Salesforce Plat-Arch-203 問題集

質問 1：
An Identity architect works for a multinational, multi-brand organization. As they work with the organization to understand their Customer Identity and Access Management requirements, the identity architect learns that the brand experience is different for each of the customer's sub-brands and each of these branded experiences must be carried through the login experience depending on which sub-brand the user is logging into.
Which solution should the architect recommend to support scalability and reduce maintenance costs, if the organization has more than 150 sub-brands?
A. Create a separate Salesforce org for each sub-brand so that each sub-brand has complete control over the user experience.
B. Assign each sub-brand a unique Experience ID and use the Experience ID to dynamically brand the login experience.
C. Create a community subdomain for each sub-brand and customize the look and feel of the Login page for each community subdomain to match the brand.
D. Use Audiences to customize the login experience for each sub-brand and pass an audience ID to the community during the OAuth and Security Assertion Markup Language (SAML) flows.
正解：B

質問 2：
A manufacturer wants to provide registration for an Internet of Things (IoT) device with limited display input or capabilities.
Which Salesforce OAuth authorization flow should be used?
A. OAuth 2.0 User-Agent Flow
B. OAuth 2.0 Asset Token Flow
C. OAuth 2.0 Device Flow
D. OAuth 2.0 JWT Bearer How
正解：C

質問 3：
What are three capabilities of Delegated Authentication? Choose 3 answers
A. It can be assigned by Profiles.
B. It can connect to SOAP services.
C. It can connect to REST services.
D. It can be assigned by Permission Sets.
E. It can be assigned by Custom Permissions.
正解：B,C,D

質問 4：
An Identity and Access Management (IAM) Architect is recommending Identity Connect to integrate Microsoft Active Directory (AD) with Salesforce for user provisioning, deprovisioning and single sign-on (SSO).
Which feature of Identity Connect is applicable for this scenano?
A. Identity Connect can be deployed as a managed package on salesforce org, leveraging High Availability of Salesforce Platform out-of-the-box.
B. When Identity Connect is in place, if a user is deprovisioned in an on-premise AD, the user's Salesforce session Is revoked Immediately.
C. If the number of provisioned users exceeds Salesforce licence allowances, identity Connect will start disabling the existing
D. When configured, Identity Connect acts as an identity provider to both Active Directory and Salesforce, thus providing SSO as a default feature.
正解：B

質問 5：
Universal Containers (UC) has implemented SAML-based SSO solution for use with their multi-org Salesforce implementation, utilizing one of the the orgs as the Identity Provider. One user is reporting that they can log in to the Identity Provider org but get a generic SAML error message when accessing the other orgs. Which two considerations should the architect review to troubleshoot the issue? Choose 2 answers
A. The Federation ID must is case sensitive
B. The Federation ID must be populated on the user record.
C. The Federation ID must be in the form of an email address.
D. The Federation ID must be a valid Salesforce Username
正解：A,B

質問 6：
A third-party app provider would like to have users provisioned via a service endpoint before users access their app from Salesforce.
What should an identity architect recommend to configure the requirement with limited changes to the third-party app?
A. Create Canvas app in Salesforce for third-party app to provision users.
B. Use Salesforce identity with Security Assertion Markup Language (SAML) for provisioning users.
C. Use a connected app with user provisioning flow.
D. Redirect users to the third-party app for registration.
正解：C

質問 7：
The security team at Universal Containers (UC) has identified exporting reports as a high-risk action and would like to require users to be logged into Salesforce with their Active Directory (AD) credentials when doing so. For all other users of Salesforce, users should be allowed to use AD Credentials or Salesforce credentials. What solution should be recommended to prevent exporting reports except when logged in using AD credentials while maintaining the ability to view reports when logged in with Salesforce credentials?
A. Use SAML Federated Authentication and Custom SAML JIT Provisioning to dynamically and or remove a permission set that grants the Export Reports Permission.
B. Use SAML federated Authentication with a Login Flow to dynamically add or remove a Permission Set that grants the Export Reports Permission.
C. Use SAML federated Authentication, treat SAML Sessions as High Assurance, and raise the session level required for exporting reports.
D. Use SAML Federated Authentication and block access to reports when accessed through a Standard Assurance session.
正解：C

質問 8：
Which two roles of the systems are involved in an environment where salesforce users are enabled to access Google Apps from within salesforce through App launcher and connected App set up? Choose 2 answers
A. Google is the identity provider
B. Google is the service provider
C. Salesforce is the service provider
D. Salesforce is the identity provider
正解：C

質問 9：
A leading fitness tracker company is getting ready to launch a customer community. The company wants its customers to login to the community and connect their fitness device to their profile. Customers should be able to obtain exercise details and fitness recommendation in the community.
Which should be used to satisfy this requirement?
A. OAuth Device Flow
B. Login Flows
C. Single Sign-On Settings
D. Named Credentials
正解：A