Free Plat-Arch-203 sample questions

Correct answer: Increase the 'Assertion Validity Duration' setting in the Salesforce Single Sign-On configuration.

Correct answer: OAuth 2.0 JWT Bearer Flow

The JWT Bearer Flow is designed for server-to-server integration. It uses a certificate to sign the JWT request, eliminating the need to transmit a password or client secret over the wire during the handshake, fulfilling the security requirement. The Web Server flow requires user interaction, and the Username-Password flow transmits credentials.

Correct answer: Create AD Groups corresponding to the departments, map these AD Groups to Salesforce Permission Sets in Identity Connect, and then group them in Salesforce.

Identity Connect maps AD Groups to Salesforce Permissions Sets, Public Groups, or Roles. It does not map directly to Permission Set Groups. The correct approach is to map the AD Groups to the specific Permission Sets that make up the required access. While the question asks about Permission Set Groups, Identity Connect's direct mapping capability targets Permission Sets. (Note: In newer versions, direct mapping to Permission Set Groups may be supported via advanced configuration or indirect mapping, but the standard architectural pattern is mapping AD Groups to Permission Sets).

Correct answers: If a user has a Standard session and accesses a resource requiring High Assurance, they are prompted to verify their identity (MFA) to elevate the session.; Multi-Factor Authentication (MFA) is the only method that can grant a High Assurance session in a default configuration.

This describes session elevation. If a policy requires High Assurance and the current session is Standard, Salesforce prompts for a second factor.

By default, Multi-Factor Authentication is defined as High Assurance. While you can move other methods there, MFA is the primary mechanism.

Correct answer: The 'Community Url' followed by /services/auth/sso/{OrgId}/{AuthProviderDeveloperName}

To initiate a specific Auth Provider flow directly (bypassing the Salesforce login selection screen), the client should direct the user to the specific SSO initialization URL for that Auth Provider: `https://[domain].my.site.com/services/auth/sso/[OrgID]/[AuthProviderName]`.

Correct answer: False

False. If the user already has a valid High Assurance session in Salesforce (e.g., they logged in with MFA earlier), Salesforce will not force them to re-authenticate for the Connected App unless the session has expired or the policy is explicitly set to 'Raise the session level to High Assurance' and the current session is only Standard.