Free Plat-Arch-203 sample questions

Correct answer: OAuth 2.0 JWT Bearer Flow

The JWT Bearer Flow is designed for server-to-server integration. It uses a certificate to sign the JWT request, eliminating the need to transmit a password or client secret over the wire during the handshake, fulfilling the security requirement. The Web Server flow requires user interaction, and the Username-Password flow transmits credentials.

Correct answer: Create AD Groups corresponding to the departments, map these AD Groups to Salesforce Permission Sets in Identity Connect, and then group them in Salesforce.

Identity Connect maps AD Groups to Salesforce Permissions Sets, Public Groups, or Roles. It does not map directly to Permission Set Groups. The correct approach is to map the AD Groups to the specific Permission Sets that make up the required access. While the question asks about Permission Set Groups, Identity Connect's direct mapping capability targets Permission Sets. (Note: In newer versions, direct mapping to Permission Set Groups may be supported via advanced configuration or indirect mapping, but the standard architectural pattern is mapping AD Groups to Permission Sets).

Correct answers: Multi-Factor Authentication (MFA) is the only method that can grant a High Assurance session in a default configuration.; If a user has a Standard session and accesses a resource requiring High Assurance, they are prompted to verify their identity (MFA) to elevate the session.

By default, Multi-Factor Authentication is defined as High Assurance. While you can move other methods there, MFA is the primary mechanism.

This describes session elevation. If a policy requires High Assurance and the current session is Standard, Salesforce prompts for a second factor.

Correct answer: The 'Community Url' followed by /services/auth/sso/{OrgId}/{AuthProviderDeveloperName}

To initiate a specific Auth Provider flow directly (bypassing the Salesforce login selection screen), the client should direct the user to the specific SSO initialization URL for that Auth Provider: `https://[domain].my.site.com/services/auth/sso/[OrgID]/[AuthProviderName]`.

Correct answer: False

False. If the user already has a valid High Assurance session in Salesforce (e.g., they logged in with MFA earlier), Salesforce will not force them to re-authenticate for the Connected App unless the session has expired or the policy is explicitly set to 'Raise the session level to High Assurance' and the current session is only Standard.

Correct answer: Implement a Configurable Self-Reg Page (LWC) that calls an Apex Controller to perform the callout to the legacy database.

Standard self-registration cannot perform real-time external callouts for validation before creation. A custom Lightning Web Component (Configurable Self-Reg) invoking an Apex controller allows the architect to call the external API, validate the MRN/DOB, and then programmatically create the user only if validation succeeds.