SF-PD2 Testing, Debugging, and Deployment Practice Question
A developer needs to give a CI service account the ability to run the Apex test suite in a production org without interactive login, and the pipeline must not store a user's personal password. Which authentication approach should the developer configure?
⚠ Common exam trap
The trap here is assuming an encrypted password variable or a personal access token is acceptable for CI, when passwordless certificate-based authentication is the supported secure path.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Authenticate the CI job with a connected app using the JWT bearer flow and authorize the integration user in advance.
The JWT bearer flow with a connected app and a pre-authorized integration user provides headless, passwordless authentication for CI, since the pipeline signs a JWT with a certificate instead of storing user credentials. This satisfies the requirement to run Apex tests in production without interactive login or a personal password.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Authenticate the CI job with a connected app using the JWT bearer flow and authorize the integration user in advance.
Why this is correct
The JWT bearer flow lets a CI service authenticate as a pre-authorized integration user using a signed certificate, with no interactive login and no stored user password. The user must be authorized once in the org, after which the pipeline can request access tokens unattended. This is the standard, secure approach for headless pipeline authentication to run Apex tests in production.
- ✗
Store the integration user's username and password in an encrypted pipeline variable and authenticate with sf org login web.
Why it's wrong here
The web login flow opens an interactive browser session, which is unsuitable for a headless CI job. Storing a user password, even encrypted, violates the requirement not to keep a personal password and breaks when the user's password or MFA policy changes. This approach is both operationally fragile and contrary to the stated security constraint.
- ✗
Use the SOAP login call with the integration user's credentials and a security token appended to the password.
Why it's wrong here
SOAP login still requires the user's password and security token, which the pipeline must store, directly violating the no-password requirement. It is also increasingly discouraged for automation because it depends on interactive-user credentials rather than a scoped connected app and certificate. This does not meet the headless, passwordless goal for running the production test suite.
- ✗
Generate a personal access token in the org's setup and pass it to the CLI with the sf org login access-token command.
Why it's wrong here
Salesforce does not issue a standalone personal access token for CLI login in the way some platforms do, and there is no sf org login access-token command that accepts one. Authentication is performed through OAuth flows or a JWT grant with a connected app. This approach rests on a mechanism that does not exist for Salesforce orgs.
About these practice questions
Courseiva writes every SF-PD2 question from scratch — 226 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Salesforce exam blueprint
This SF-PD2 practice question is part of Courseiva's free Salesforce certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SF-PD2 exam.