Free Salesforce Certified Platform Identity and Access Management Architect Exam Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Salesforce Certified Platform Identity and Access Management Architect Exam practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1What distinguishes delegated authentication from federated single sign-on in the user login experience?

   1. A. Delegated authentication reuses credentials but requires a login to each application.
   2. B. Delegated authentication establishes one session that automatically signs in to every application.
   3. C. Federated single sign-on requires a separate password for each service provider.
   4. D. Federated single sign-on validates every application password against an LDAP server.

   Answer: A

   Explanation: Salesforce states, "However, with delegated authentication, users must log in to each app separately." Reusing credentials does not provide the seamless cross-application login experience of federation.

   Reference: Single Sign-On — SSO Content — Delegated Authentication

2. 2Employees authenticate with a corporate identity provider and then access Salesforce using that identity. What role does Salesforce perform in this relationship?

   1. A. The authoritative password store for the corporate identity provider
   2. B. The identity provider that authenticates the corporate directory
   3. C. The registration authority that issues the corporate certificates
   4. D. The service provider that trusts the external authentication

   Answer: D

   Explanation: Salesforce defines the service provider as "The system that trusts the identity provider for authentication". In this relationship the external provider authenticates employees and Salesforce consumes that authentication.

   Reference: Single Sign-On — Single Sign-On — identity provider and service provider roles

3. 3An external web application can protect a client secret on its server and needs Salesforce API access after interactive user authorization. Which flow implements the authorization-code grant for this use case?

   1. A. OAuth 2.0 device flow
   2. B. OAuth 2.0 JWT bearer flow
   3. C. OAuth 2.0 web server flow
   4. D. OAuth 2.0 client credentials flow

   Answer: C

   Explanation: Salesforce states that the web server flow "implements the OAuth 2.0 authorization code grant type." It requires the hosting server to protect the client identity and secret. JWT and client credentials serve unattended patterns; device flow addresses limited-input devices.

   Reference: OAuth Authorization Flows — OAuth 2.0 Web Server Flow for Web App Integration

4. 4A non-privileged user needs an allowed MFA method that can generate a verification code while the registered authenticator device is offline. Which method fits?

   1. A. Salesforce Authenticator push approval
   2. B. An emailed identity verification code
   3. C. A registered TOTP authenticator code
   4. D. An SMS identity verification code

   Answer: C

   Explanation: Salesforce documents "TOTP codes that work if connectivity isn't available." Locally generated TOTP codes meet the offline requirement. Push approval and delivered email or SMS codes depend on receiving a request or message; they are not offline code generation.

   Reference: MFA Verification Methods for Direct Salesforce Login — Verification methods comparison — authenticator app user experience

5. 5An enterprise must host Identity Connect as part of its AD integration. Which deployment form does Salesforce document?

   1. A. A managed Lightning component running in each user's browser
   2. B. An Apex trigger running entirely inside the Salesforce org
   3. C. A service running on a Windows or Linux platform
   4. D. A mobile application installed on every employee's phone

   Answer: C

   Explanation: Salesforce states, "Identity Connect runs as a service on either Windows or Linux platforms." It is server-side integration software, not an Apex trigger, browser component, or per-phone client.

   Reference: Identity Connect — Identity Connect — supported service platforms

6. 6A team configures branding from an Experience Cloud site's Login & Registration page. What is the documented scope of this branding?

   1. A. Only content pages displayed after users enter the site
   2. B. Only welcome emails delivered when a new user registers
   3. C. Only the login form, excluding verification and password pages
   4. D. Login, sign-up, verification, and password-management pages

   Answer: D

   Explanation: Trailhead states, "From the Login & Registration page, you can brand all pages related to the login experience." The next sentence includes sign-up, login, verification and password-reset pages, so the setting is broader than the login form alone and does not refer only to content pages or welcome emails.

   Reference: Set Up Mobile-First Login and Sign-Up — Brand the Site

7. 7Which description captures the principal user-facing purpose of single sign-on?

   1. A. Assigning the same record ownership across multiple applications
   2. B. Accessing multiple applications with one login and one set of credentials
   3. C. Synchronizing every application's user permissions into a single profile
   4. D. Replacing application authorization with a shared password policy

   Answer: B

   Explanation: The guide defines SSO as "an authentication method that enables users to access multiple applications with one login and one set of credentials." This concerns authentication continuity, not shared record ownership or identical permissions.

   Reference: Salesforce Security Guide — p. 9, Single Sign-On

8. 8A company enables SSO into Salesforce but leaves users' direct Salesforce login ability unchanged. What should the architect expect?

   1. A. Direct Salesforce login is automatically disabled for all SSO users.
   2. B. Both direct Salesforce login and identity-provider login remain possible.
   3. C. Direct Salesforce login is retained automatically only for administrators.
   4. D. Direct Salesforce login becomes possible only during an IdP outage.

   Answer: B

   Explanation: Salesforce states, "By default, when you set up single sign-on, users can log in from the SSO provider or from Salesforce." No automatic admin-only exception or outage detection is implied. Separate configuration is needed to require exclusive SSO.

   Reference: Single Sign-On — SSO Content — Require Users to Log In with Single Sign-On (SSO)

9. 9A previously approved server integration must obtain Salesforce access without interactive login on every exchange. It will authenticate using a certificate-signed JWT rather than a shared client secret. Which flow fits?

   1. A. OAuth 2.0 JWT bearer flow
   2. B. OAuth 2.0 web server flow
   3. C. OAuth 2.0 username-password flow
   4. D. OAuth 2.0 client credentials flow

   Answer: A

   Explanation: Salesforce states, "This flow uses a certificate to sign the JWT request and doesn’t require explicit user interaction." JWT bearer fits the preapproved certificate-based integration. Web server flow uses interactive authorization code, username-password flow uses user credentials, and client credentials uses the consumer key and secret rather than a signed JWT.

   Reference: OAuth Authorization Flows — OAuth 2.0 JWT Bearer Flow for Server-to-Server Integration

10. 10Employees cannot bring phones into a service center. They need a physical public-key MFA method using supported desktop browsers. Which method fits?

    1. A. A registered USB security key
    2. B. Salesforce Authenticator push approval
    3. C. A desktop TOTP authenticator app
    4. D. A browser-extension TOTP authenticator

    Answer: A

    Explanation: Salesforce describes security keys as "Physical devices that use public-key cryptography." A supported USB key is the requested physical public-key method. Push approval uses an authenticator app; desktop and browser TOTP apps generate codes rather than using a physical public-key device.

    Reference: MFA Verification Methods for Direct Salesforce Login — Verification methods comparison — Security Keys; Security Keys for MFA