When creating an authentication provider in Salesforce, architects can configure operational settings that shape the user experience and downstream provisioning behavior. A custom error URL is supported so failed sign-ins can be routed to a branded or informative destination. A custom registration handler is also supported, giving the org control over how incoming identities are mapped to Salesforce users and related records. By contrast, options like a "default login user" or a generic default certificate setting do not describe the primary provider-creation controls in the same way. The important architecture concept is that an authentication provider defines both the trust with the external source and the user-lifecycle handling logic inside Salesforce. This is why options B, D work together as the correct solution.