Once SAML SSO is already configured, enabling Just-in-Time provisioning in Salesforce is done on the SAML Single Sign-On setting itself. The architect turns on JIT user provisioning, selects the provisioning type, and supplies the SAML JIT handler if custom logic is needed. That is the expected configuration path because JIT is part of the federation handshake, not a sharing model or permission-set feature. Creating a random Apex class without wiring it into the SAML setting would not enable JIT on its own. The architectural distinction is that JIT rides inside the SAML login process. Therefore it must be enabled and configured where Salesforce processes the incoming assertion. This is why option A is the best answer in Salesforce terms.

If the organization already has a SAML setup and wants to obtain OAuth access to Salesforce APIs based on that existing federation trust, the correct bridge is the OAuth 2.0 SAML Bearer Assertion Flow. This flow allows a client to present a SAML assertion and exchange it for an OAuth access token. That is different from standard user-agent or JWT flows, and it is more specific than simply saying “SAML assertion” without naming the OAuth flow. The exam point is that SAML is being reused to obtain API authorization, not merely to log a person into the user interface. Salesforce documents this pattern specifically for environments that already depend on SAML and want to extend that trust into API access. This is why option B is the best answer in Salesforce terms.

The Identity Only license is designed for users who need Salesforce Identity services without broad CRM object access. Salesforce documentation positions it for scenarios where employees or other internal users need to authenticate with Salesforce credentials and access connected applications, but they do not require the full set of standard Salesforce business objects. That makes it a good fit for benefits portals, employee hubs, or third-party workforce apps that rely on Salesforce for identity rather than for CRM usage. External Identity is aimed at external audiences such as customers or partners, while Identity Connect is synchronization software rather than an end-user license. The licensing decision follows the user population and the scope of application access more than the authentication protocol itself. This is why option C is the best answer in Salesforce terms.

In the OAuth 2.0 web server flow, the main concepts are scopes, an access token, and a client secret. This is the authorization-code pattern for confidential web applications, so the server-side client can safely hold the client secret and exchange the authorization code for an access token. Verification URLs and generic “authentication tokens” are not the defining exam concepts here. Salesforce documentation emphasizes that the web server flow is appropriate when the application can securely store secrets and needs to access APIs on behalf of the user. That is why the flow combines requested scopes, a confidential client, and a token issued after the secure code exchange. Those are the concepts that matter most when reasoning about this flow. This is why options C, D, E work together as the correct solution.

The OAuth 2.0 Asset Token Flow is Salesforce’s purpose-built answer for connected devices and IoT-style integrations. It is designed for assets that need to act on behalf of a physical device or asset record rather than a human user. That makes it the correct fit for sensors, GPS trackers, or smart devices that must securely post telemetry or create service actions in Salesforce. User-agent, web-server, or username-password flows are built around user identity or generic application access, not around a registered device/asset relationship. The architectural advantage of the asset token model is that it ties the authorization context back to the asset, which is exactly what you want when the platform must know which device generated the event or maintenance alert. This is why option D is the best answer in Salesforce terms.

Salesforce Activations gives administrators visibility into the devices that users have activated for certain trusted access experiences and the ability to revoke those device activations when necessary. That aligns directly with compliance requirements to track devices used for login and to invalidate a device if it should no longer be trusted. Login History shows session data but not the same activation-management control plane. A custom object plus login flow would create a partial record, but it would not provide the built-in revocation semantics the requirement asks for. The important distinction is between observing a login event and managing device trust. Activations addresses device trust management, which is why it is the better fit here. This is why option D is the best answer in Salesforce terms.

Login Discovery is the Salesforce feature built for identifier-first sign-in experiences that start with an email address or phone number and then route the user into the next authentication step. It is especially relevant for passwordless designs because the user can enter an email address or mobile number and then receive a verification code through the configured handler and verification service. That matches the stated requirement much more closely than social sign-on or a generic external IdP recommendation. The key platform point is that Login Discovery separates “who are you?” from “how do we authenticate you?” and allows Salesforce to branch appropriately. For citizen or customer portals, it is the standard entry point for phone-or-email-based identification before code verification. This is why option B is the best answer in Salesforce terms.