Question 1

Universal containers (UC) uses a legacy Employee portal for their employees to collaborate and post theirideas. UC decides to use salesforce ideas for voting and better tracking purposes. To avoid provisioning userson Salesforce, UC decides to push ideas posted on the Employee portal to salesforce through API. UC decidesto use an API user using Oauth Username - password flow for the connection. How can the connection tosalesforce be restricted only to the employee portal server?

Options :

A : Add the Employee portals IP address to the Trusted IP range for the connected App

B : Use a digital certificate signed by the employee portal Server.

C : Add the employee portals IP address to the login IP range on the user profile.

D : Use a dedicated profile for the user the Employee portal uses.

Answer: A

Question 2

Universal containers wants to build a custom mobile app connecting to salesforce using Oauth, and would liketo restrict the types of resources mobile users can access. What Oauth feature of Salesforce should be used toachieve the goal?

Options :

A : Access Tokens

B : Mobile pins

C : Refresh Tokens

D : Scopes

Answer: D

Question 3

Users logging into Salesforce are frequently prompted to verify their identity.The identity architect is required to provide recommendations so that frequency of prompt verification can bereduced.What should the identity architect recommend to meet the requirement?

Options :

A : Implement 2FA authentication for the Salesforce org.

B : Set trusted IP ranges for the organization.

C : Implement an single sign-on for Salesforce using an external identity provider.

D : Implement multi-factor authentication for the Salesforce org.

Answer: B

Question 4

A service provider (SP) supports both Security Assertion Markup Language (SAML) and OpenID Connect(OIDC).When integrating this SP with Salesforce, which use case is the determining factor when choosing OIDC orSAML?

Options :

A : OIDC is more secure than SAML and therefore is the obvious choice.

B : The SP needs to perform API calls back to Salesforce on behalf of the user after the user logs in to the service provider.

C : If the user has a session on Salesforce, you do not want them to be prompted for a username and password when they login to the SP.

D : They are equivalent protocols and there is no real reason to choose one over the other.

Answer: B

Question 5

Containers (UC) has implemented SAML-based single Sign-on for their Salesforce application and is planning to provide access to Salesforce on mobile devices using the Salesforce1 mobile app. UC wants to ensure that Single Sign-on is used for accessing the Salesforce1 mobile App. Which two recommendations should the Architect make? Choose 2 Answers

Options :

A : Configure the Embedded Web Browser to use My Domain URL.

B : Configure the Salesforce1 App to use the MY Domain URL.

C : Use the existing SAML-SSO flow along with User Agent Flow.

D : Use the existing SAML SSO flow along with Web Server Flow.

Answer: B,C

Free Plat-Arch-203 Mock Exam – Practice Online Confidently

Buying Options: