Salesforce Identity-and-Access-Management-Architect Exam Dumps - Actual Questions Answers

For a connected app to appear as a tile in the Salesforce App Launcher, two things generally matter: the app must be marked visible in the App Launcher, and the connected app configuration must include the required launch details such as the start URL or equivalent launch settings. High-assurance session requirements or OIDC scopes do not by themselves control whether the tile shows up. The absence of a launch target can keep the app from being presented meaningfully to users even when the connected app exists. From an architecture and administration perspective, discovery in the launcher depends on app-visibility settings plus a valid launch configuration. Without those, users can be entitled to the app and still not see it in the launcher. This is why options B, C work together as the correct solution.

Salesforce documents token introspection as the standards-based way to ask the authorization server about the current state of an OAuth token after it has been issued. That is exactly what this scenario requires: checking whether an OpenID Connect access token is still active, expired, or revoked. The discovery document only advertises endpoints and capabilities; it does not return runtime token status for a specific token. Likewise, enabling CORS on the token endpoint affects browser access patterns, not token validation, and creating a custom scope changes authorization boundaries rather than token-state lookup. In other words, when the requirement is “retrieve token status,” token introspection is the platform feature designed for that purpose. This is why option A is the best answer in Salesforce terms.

Salesforce login flows are designed to interrupt the sign-in journey and collect information, present screens, or enforce conditions before the user reaches the destination app or site. In this case, the requirement is conditional and mandatory: users must accept updated rules and complete missing profile data before doing anything else. A login flow is stronger than a banner, task, or email campaign because it runs at authentication time and can branch based on user data. That makes it suitable for compliance-style steps such as terms acceptance, privacy notices, or profile completion. The architect can evaluate user fields, display the required screen only when needed, and block progress until the data and acknowledgment are captured. This is why option D is the best answer in Salesforce terms.