UUS Practice Tests⌕ Search
IT Certifications · Plat-Arch-203

Salesforce Identity Access Exam Practice Test

Salesforce identity and access work connects sign-in, federated authentication, session controls, and authorization to records and fields. This practice page addresses decisions such as validating signed identity messages, granting record access without ownership changes, and controlling what authenticated users can view or modify.

Exam overview

Exam providerSalesforce
Exam codePlat-Arch-203
CategoryIT Certifications

About the Salesforce Identity Access Exam

Identity design separates authentication—verifying who a user is—from authorization—determining what that user may do in Salesforce. Relevant tasks include selecting an external directory or identity provider for sign-in, understanding OAuth token use for integrations, and configuring certificates to validate signed authentication messages. Access decisions also involve profile and permission settings, field-level visibility and editability, record-sharing mechanisms, and temporary delegation of record access. Session and login controls, including profile-based trusted IP ranges and login hours, help administrators apply access conditions without confusing them with organization-wide session timeout settings. When evaluating a configuration, trace the full path from identity verification through user assignment and session policy to object, field, and record permissions; this helps locate whether a failure occurs during authentication or after the user has signed in.

Sample Practice Questions

Review a selection from this exam's published US Practice Tests practice bank.

Question 1

A team wants to check a user's Salesforce access before granting that user access to a particular record. Which standard mechanism can grant record access to selected users without changing the record owner?

  1. AA sharing rule
  2. BA login IP range
  3. CA session setting
  4. DAn authentication provider
Show answerCorrect answer: A

Sharing rules can extend record access to groups of users based on ownership or criteria. They do not grant object permissions, so users also need suitable object-level access.

Question 2

An administrator needs an integration to continue accessing Salesforce after the user’s initial authorization without repeatedly asking the user to sign in. Which OAuth token is intended to obtain new access tokens when permitted?

  1. ARefresh token
  2. BSession label
  3. CSAML audience value
  4. DVerification code
Show answerCorrect answer: A

A refresh token can be used by an OAuth client to request a new access token after the current access token expires, subject to the authorization and policies in place. It is not itself a user password or a SAML field.

Question 3

A Salesforce administrator wants a user to see sensitive fields on a record but not change them. Which access control most directly governs whether that user can view a particular field?

  1. AField-level security
  2. BLogin hours
  3. COAuth refresh token
  4. DRole hierarchy
Show answerCorrect answer: A

Field-level security determines whether users can view or edit specific fields, independently of whether they can access the record itself. Login hours govern sign-in timing, and tokens support authorization flows.

Question 4

An administrator needs to let users sign in to Salesforce using credentials from an external directory, and Salesforce should verify those credentials through that directory. Which authentication approach fits this requirement?

  1. ADelegated authentication
  2. BSalesforce password policies
  3. CRecord-triggered automation
  4. DField history tracking
Show answerCorrect answer: A

Delegated authentication lets Salesforce pass a username and password to an external service for authentication. Salesforce still manages the user account and access to Salesforce resources.

Question 5

A Salesforce identity configuration uses an identity provider certificate to verify signed authentication messages. What should Salesforce do with the signature during validation?

  1. AVerify it using the configured public certificate
  2. BDecrypt it using the user’s Salesforce password
  3. CCompare it to the user’s profile name
  4. DTreat the signature as a record-sharing rule
Show answerCorrect answer: A

A signed message is validated with the public key corresponding to the signer’s certificate. Successful verification helps establish that the message has not been altered and was signed by the expected party.

Question 6

A Salesforce administrator needs to assign users different login hours based on their role, without changing the organization-wide session timeout. Which setting is the most direct fit?

  1. ALogin hours on the user’s profile
  2. BA connected app OAuth scope
  3. CA sharing rule
  4. DA named credential
Show answerCorrect answer: A

Profile login hours determine when users assigned to that profile can log in. Session timeout governs session duration, while OAuth scopes, sharing rules, and named credentials address other concerns.

Question 7

A company wants employees to use a central identity provider for authentication while keeping Salesforce responsible for deciding which Salesforce records each user can access. Which approach best fits this goal?

  1. AUse single sign-on for authentication and Salesforce permissions and sharing for authorization
  2. BUse single sign-on to grant every employee access to every record
  3. CStore the identity provider’s password in a Salesforce formula field
  4. DDisable Salesforce authorization checks after login
Show answerCorrect answer: A

Single sign-on delegates or streamlines authentication, while Salesforce authorization mechanisms—such as profiles, permission sets, and sharing—continue to control in-org access. Successful authentication does not automatically grant unrestricted data access.

How to use this practice test

The free US Practice Tests practice bank contains 50 published questions; each session presents up to 20 random questions. Use a session to work through identity and access scenarios, then review the displayed results to identify concepts that need another pass, such as OAuth tokens, field permissions, or record sharing.

Preparation tips

  • For each sign-in scenario, distinguish credential verification by an external directory from Salesforce authorization after authentication.
  • Compare OAuth access and refresh token roles, and identify when an integration can request a new access token without prompting the user to sign in again.
  • Practice separating object permissions, field-level security, and record-level sharing when deciding what a user can see or change.
  • Map session controls such as login hours and profile trusted IP ranges to their specific purpose; do not substitute them for session timeout settings.
  • Trace signed identity messages through certificate-based signature validation, and check how authentication configurations are assigned to users.
Official sourceOfficial exam page ↗