Identity-and-Access-Management-Architect Exam Dumps : Salesforce Certified Platform Identity and Access Management Architect (Plat-Arch-203)

For guest checkout scenarios that later convert a shopper into a registered customer, Salesforce self-registration is the natural starting point because it gives the site a controlled way to create an external user account. The self-registration experience can be customized so that the user enters just enough order information for the site to locate the previously collected guest data and then complete the registration. SAML and social login don’t solve the core problem, which is linking an existing guest transaction to a newly created community identity. A Connected App Handler is also not the standard Experience Cloud tool for this registration pattern. The right design is to keep registration in Salesforce and tailor the page to reconcile the new user with the known order record. This is why option A is the best answer in Salesforce terms.

When partners need a single login and some do business across multiple country operations, the lowest-customization answer is often to federate access across org boundaries with SAML rather than replicate identities manually in each org. A partner can maintain a primary login context and use federation to reach the additional orgs or communities they need. Consolidating everything into one org may not be feasible if country-based orgs already exist for operational reasons, while APIs and login flows create more custom work. The architectural point is that identity should be centralized even if application data remains distributed. SAML federation is built precisely for that: one user identity can be trusted across multiple Salesforce-based service providers without forcing separate sign-in credentials per country. This is why option A is the best answer in Salesforce terms.

When a service provider needs to continue making calls back to Salesforce on behalf of the user after login, OpenID Connect is usually the more natural choice because it sits in the OAuth family and aligns well with token-based delegated access. SAML is excellent for browser-based federation, but it is not as naturally suited to modern API token usage after the interactive sign-in event. The question is not simply “which protocol is more secure.” It is about post-login application behavior. If the downstream application needs identity plus a token-friendly pattern for additional calls, that use case pushes the architect toward OIDC. In other words, the deciding factor is what the service provider must do after the initial authentication succeeds. This is why option B is the best answer in Salesforce terms.