The integration consultant should consider the following authorization and authentication needs while integrating the DMS and ESB with Salesforce:

• Users should be authorized to view information specific to the customer they are servicing without a need to search for customer. This means that the integration should provide a seamless and contextual access to the customer billing information and generated bills from the DMS and ESB, based on the customer record or case that the user is working on in Salesforce.
• Consider Enterprise security needs for access to DMS and ESB. This means that the integration should comply with the security policies and standards of the Enterprise, such as encryption, auditing, logging, monitoring, etc.
• Users should be authenticated into DMS and ESB without having to enter username and password. This means that the integration should use a single sign-on (SSO) mechanism that allows users to access multiple systems with one login credential, such as OAuth or SAML34

References: Authorization Through Connected Apps and OAuth 2.0, Single Sign-On for Desktop and Mobile Applications using SAML and OAuth

The integration architect should recommend using Salesforce Connect to display the financial transactions as an external object. Salesforce Connect is a feature that allows you to integrate external data sources with Salesforce and access them in real time via external objects. External objects are similar to custom objects, but they store metadata only and not data. You can use external objects to display data from the core banking system in the customer community without copying or syncing the data. You can also use standard Salesforce features, such as reports, dashboards, or global search, with external objects. Salesforce External Service is a feature that allows you to import an external schema definition and generate an Apex wrapper class that can invoke an external service. This is useful for integrating complex business processes or workflows with Salesforce, but not for displaying data in a community lightning page. Iframe is a HTML element that allows you to embed another web page within a web page. This is not a recommended solution for displaying data in a customer community, as it can pose security risks, performance issues, or user interface problems.

References: [Salesforce Connect], [Salesforce External Services], [Using Iframes in Lightning Components]

 These are three considerations that an Integration Architect should consider when recommending Platform Event as an Integration solution. Platform Events are a type of event-driven architecture that allows you to publish and subscribe to custom events in Salesforce and external systems. Platform Events have some limitations and features that an Integration Architect should be aware of, such as:

• Inability to query event messages using SOQL. Platform Events are not stored in Salesforce database, but in an event bus that retains them for 24 hours. You cannot use SOQL to query event messages, but you can use the EventLogFile object or the Event Monitoring feature to access them.
• Inability to create a Lightning record page for platform events. Platform Events are not standard or custom objects, but a special type of sObject that can be inserted into the event bus. You cannot create a Lightning record page for platform events, but you can use Apex triggers, Lightning web components, or CometD clients to subscribe to them.
• When you delete an event definition, it’s permanently removed and can’t be restored. An event definition is a metadata type that defines the schema and properties of a platform event message. You can create or modify event definitions in Salesforce Setup or using Metadata API. However, if you delete an event definition, it’s permanently removed from your org and can’t be restored. You also lose access to any event messages that use that event definition.

References: Certification - Integration Architect - Trailhead, [Platform Events Developer Guide]

Change Data Capture is a feature that enables you to receive near-real-time changes of Salesforce records, including create, update, delete, and undelete operations. Change Data Capture retains change events in the event bus for up to three days, so you can resume data replication from the point of failure. Change Data Capture also provides a consistent and reliable way to synchronize data changes with external systems, without the need for custom triggers or code. Reference: Salesforce Integration Architecture Designer Resource Guide, page 24

 Implementing an Enterprise Service Bus (ESB) for service orchestration, mediation, routing and decoupling dependencies across systems is a better solution than refactoring the existing @future methods to use Enhanced External Services. An ESB can provide a centralized platform for integrating multiple systems and applications, while reducing the complexity and maintenance of point-to-point integrations. Enhanced External Services can be used to invoke external REST services from Salesforce, but they are not suitable for complex integration scenarios that require data transformation, error handling, or asynchronous processing. Reference: Salesforce Integration Architecture Designer Resource Guide, page 14

 The best solutions for minimizing potential downtime for users in this situation are to use named credentials and an enterprise ESB. Named credentials allow you to store the URL and authentication parameters of an external service in one definition, and then use it in Apex callouts or declarative integrations. If the URL of the external service changes, you only need to update the named credential once, and all the integrations that use it will be updated automatically. An enterprise ESB is a middleware layer that acts as a broker between different systems and services. It can provide routing, transformation, orchestration, and monitoring capabilities for integrations. If the URL of an external service changes, you only need to update the ESB configuration once, and all the integrations that use it will be updated automatically. Option B is not correct because remote site settings only allow you to specify the domains that are allowed for callouts from your org. They do not store any authentication parameters or provide any routing or transformation capabilities. Option C is not correct because content security policies are used to control what resources can be loaded on a Visualforce or Lightning page. They do not store any authentication parameters or provide any routing or transformation capabilities. References:

• Named Credentials
• Streamline and Secure: Mastering Named Credentials in Salesforce

The end-to-end response time from the user’s perspective is the time elapsed between the user’s request and the user’s receipt of the final response. In the diagram, this corresponds to the sum of A and H, which are the durations of the synchronous calls from the user interface to the cloud-based application and back. The other durations (B to G) are either internal to the cloud-based application or asynchronous calls that do not affect the user’s perception of response time. Therefore, the correct answer is D, because it represents the sum of A and H.

The considerations that an Integration Architect should do prior to the implementation of Shield Platform Encryption are:

• Review shield platform encryption configurations.
• Encrypt all the data so that it is secure.

Shield Platform Encryption is a feature that allows you to encrypt sensitive data at rest in Salesforce, such as social security numbers, without compromising critical platform functionality. Before implementing Shield Platform Encryption, you should review the shield platform encryption configurations, such as the encryption key management, the encryption policy, and the encrypted fields and files. You should also encrypt all the data that is subject to encryption, not just the data using the most current key. Encrypting all the data ensures that your data is secure and compliant with your business requirements. Encrypting the data using the most current key is not a valid consideration because Shield Platform Encryption uses a deterministic encryption scheme that does not allow you to rotate or re-encrypt your data with a new key. Using Shield Platform Encryption as a user authentication or authorization tool is not a valid consideration because Shield Platform Encryption is not designed for that purpose. Shield Platform Encryption only encrypts data at rest, not in transit or in use.

 The BatchApexErrorEvent object allows handling errors that occur during Batch Apex execution. By subscribing to this event, the integration can retry the invoice generation for the failed records or perform other recovery actions. This is a resilient and scalable solution that does not require custom code in the Batch Apex job itself or in the middleware1

Streaming API is the best option for sending real-time notifications of changes to Salesforce data. Streaming API uses a publish-subscribe model to push relevant data to subscribers without polling. Streaming API supports PushTopic events, which are based on SOQL queries that define the data changes to listen for. The affiliate company can subscribe to a PushTopic event on the NTO Salesforce org and receive notifications whenever the data that matches the query changes. This way, the affiliate company can be informed of any updates to the opportunities in the NTO Salesforce instance.

The first thing an integration architect should validate if a callout from a Lightning Web Component to an external endpoint is failing is the endpoint domain has been added to Cross-Origin Resource Sharing (CORS). CORS is a mechanism that allows web browsers to make requests to servers on different origins, such as different domains, protocols, or ports. CORS requires the server to send back a special header that indicates whether the browser is allowed to access the resource or not. If the endpoint domain is not added to the CORS whitelist in Salesforce, the browser will block the callout and throw an error. Option B is not correct because Content Security Policies (CSP) are used to control what resources can be loaded on a Visualforce or Lightning page, such as scripts, stylesheets, images, etc. CSP does not affect the callout from a Lightning Web Component to an external endpoint. Option C is not correct because outbound firewall rules are used to restrict the network traffic from Salesforce to external systems. Firewall rules are configured at the network level, not at the Salesforce level. Option D is not correct because Remote Site Settings are used to specify the domains that are allowed for callouts from Apex code, not from Lightning Web Components. References:

• Working with CORS and CSP to Call APIs from LWC
• [Cross-Origin Resource Sharing (CORS)]

The system constraint questions that should be considered when designing an integration to send orders from Salesforce to a fulfillment system are related to the performance, reliability, and scalability of the integration. The latency and idempotency of the integration are important factors that affect these aspects. Therefore, the questions A and D are relevant for the integration design. The question B is related to the business logic of the order validation, which is not a system constraint question. The question C is related to the implementation details of the Outbound Messaging interface, which is not a system constraint question either

Change Data Capture Event is the best option to meet this requirement. Change Data Capture Event is a type of streaming event that notifies subscribers of changes to Salesforce records, such as creation, update, delete, and undelete operations1. By subscribing to Change Data Capture Event for the Case object, the dashboard component can receive real-time updates on the number of closed Cases. Push Topic Event is another type of streaming event that notifies subscribers of changes to Salesforce records that match a SOQL query2. However, Push Topic Event has some limitations, such as not supporting all SOQL features and not capturing delete and undelete operations3. Platform Event is a type of streaming event that delivers custom notifications within the Salesforce platform or from external sources4. Platform Event is not suitable for this requirement because it is not tied to Salesforce records and requires custom logic to publish and subscribe. Generic Event is a type of streaming event that sends custom JSON notifications to subscribers without a predefined schema5. Generic Event is not suitable for this requirement because it is not tied to Salesforce records and requires custom logic to publish and subscribe.

 Both Platform Events and Outbound Message offer declarative means for asynchronous near-real time needs. They aren’t best suited for real-time integrations (A). In both Platform Events and Outbound Messages, the event messages are retried by and delivered in sequence, and only once. Salesforce ensures there is no duplicate message delivery (B). Message sequence is possible in Outbound Message but not guaranteed with Platform Events. Both offer very high reliability. Fault handling and recovery are fully handled by Salesforce ©. Number of concurrent subscribers to Platform Events is capped at 2,000. An Outbound Message configuration can pass only 100 notifications in a single message to a SOAP end point (D). Both Platform Events and Outbound Message are highly scalable. However, unlike Outbound Message, only Platform Events have Event Delivery and Event Publishing limits to be considered (E). Reference: Salesforce Integration Architecture Designer Resource Guide, page 23

OpenId Connect Authentication Provider and Registration Handler, and SAML SSO and just-in-time provisioning are two requirements that the Salesforce Community Cloud can support for self-registration and SSO. OpenId Connect is a protocol that allows users to authenticate with an external identity provider and access Salesforce resources. A registration handler is a class that implements the Auth.RegistrationHandler interface and defines the logic for creating or updating a user in Salesforce after authentication. SAML SSO is a protocol that allows users to log in to Salesforce with a single click, using an assertion from an identity provider that confirms the user’s identity. Just-in-time provisioning is a feature that allows Salesforce to create or update a user account based on the information in the SAML assertion. References: Certification - Integration Architect - Trailhead, [OpenID Connect Authentication Providers], [SAML Single Sign-On (SSO) Service for Salesforce]

The integration architect should consider Change Data Capture Events and High Volume Platform Events for using the Streaming API with minimal data loss. Change Data Capture Events capture changes to Salesforce records and deliver them as events to subscribers. High Volume Platform Events are custom events that can be published and consumed at a large scale. Both types of events support reliable event delivery, which means that events are stored for 72 hours and can be replayed by subscribers in case of connection loss or failure. This ensures that data loss is minimized, even when the client re-connects every couple of days12

References: Change Data Capture Developer Guide, Platform Events Developer Guide

The error “Max CPU time exceeded” occurs when a batch of records takes more than 10 minutes to process in the Bulk API. Using a smaller batch size can reduce the processing time and avoid this error. However, there are some trade-offs to consider when using a smaller batch size, such as:

• Answer A is valid because a smaller batch size may cause record-locking errors if multiple batches try to update the same records or records that are related by a lookup or master-detail relationship. This can result in concurrency issues and data inconsistency1
• Answer B is valid because a smaller batch size may increase the time required to execute bulk jobs, as more batches need to be created and processed sequentially. This can affect the performance and efficiency of the integration1
• Answer C is not valid because a smaller batch size may not exceed the concurrent API request limits, as the Bulk API does not count against the concurrent request limit. The Bulk API has its own limit on the number of batches that can be queued or in progress, which is 5,000 per rolling 24-hour period2
• Answer D is not valid because a smaller batch size can trigger “Too many concurrent batches” error only if the number of batches exceeds the limit of 5,000 per rolling 24-hour period. This error is not related to the parallel mode of the Bulk API, which allows up to 10 batches to be processed simultaneously

• Option A is correct because using ESB (Mule) with cache/state management can help to handle the long-running requests from Salesforce and return a request ID or a response if available from the external systems. This way, Salesforce does not have to wait for the external systems to respond and can avoid the API gateway timeout1
• Option C is correct because using Continuation callouts can make the eligibility check request from Salesforce from Lightning UI at page load without blocking the UI thread. Continuation callouts are asynchronous and can handle long-running requests up to 60 seconds23
• Option E is correct because implementing a ‘Check Update’ button that passes a request ID received from ESB can allow the user to manually check the status of the eligibility check request. This can be useful when the response is not available within the Continuation timeout limit or when the user wants to refresh the data4
• Option B is incorrect because recommending synchronous Apex callouts from Lightning UI to External Systems via Mule and implementing polling on API gateway timeout can cause performance issues and user frustration. Synchronous Apex callouts block the UI thread and can only handle requests up to 120 seconds. Polling on API gateway timeout can increase the network traffic and consume the callout limits25
• Option D is incorrect because creating a Platform Event in Salesforce via Remote-Call-In and using the empAPI in the lightning UI to serve 3,000 concurrent users can introduce complexity and scalability issues. Platform Events are meant for event-driven architecture and not for request-response scenarios. Remote-Call-In requires an additional license and configuration. empAPI has a limit of 1,000 concurrent subscribers per channel678

References: 1: MuleSoft Documentation 2: Salesforce Documentation 4: Salesforce Trailhead 3: Salesforce Developers Blog 5: Salesforce Documentation 6: Salesforce Documentation 7: Salesforce Documentation 8: Salesforce Documentation

 Using a third party integration tool to stage records off platform is a solution that can handle the high volume of data and avoid hitting the API limits for the REST API call to the external system. A third party integration tool can also provide features such as data transformation, error handling, and logging. Due to high volume of records, number of concurrent requests can hit the limit for the REST API call to external system is not a solution, but a problem that needs to be addressed. Due to high volume of records, the external system will need to use a BULK API Rest endpoint to connect to Salesforce is not a solution, as the requirement is to send data from Salesforce to the external system, not vice versa. Due to high volume of records, Salesforce will need to make a REST API call to external system is not a solution, as it does not address how to handle the high volume of data and avoid hitting the API limits. Reference: Salesforce Integration Architecture Designer Resource Guide, page 18-19

Named Credentials and Protected Custom Settings are two persistence mechanisms that can be used to ensure that secrets are protected from deliberate or inadvertent exposure. Named Credentials allow you to specify the URL of a callout endpoint and its required authentication parameters in one definition. Salesforce manages all the authentication for Apex callouts that specify a named credential as the callout endpoint, and you don’t have to add more authentication logic in your Apex code. Named Credentials can be defined to provide a secure and convenient way of setting up authenticated callouts, and they can also be used in Lightning components, Visualforce pages, and flows1.

Protected Custom Settings are a type of custom settings that store application-specific data that is hidden from subscribers. They are only accessible by the managed package that created them, and they can be used to store secrets such as encryption keys, passwords, or tokens. Protected Custom Settings can be accessed by Apex code, formulas, or validation rules within the same namespace as the settings2.

Encrypted Custom Fields are not a suitable mechanism for storing secrets, because they are not designed to prevent unauthorized access to sensitive data. Encrypted Custom Fields allow you to encrypt text fields using a standard encryption scheme. The encrypted data is masked in reports, list views, and search results, but it can still be viewed by users who have the “View Encrypted Data” permission. Encrypted Custom Fields are intended to protect data from unauthorized access by users within your organization, not from external threats or malicious code3.

Protected Custom Metadata Types are another type of custom metadata types that store application-specific data that is hidden from subscribers. They are similar to Protected Custom Settings, but they have some advantages such as being deployable using change sets or Metadata API, being accessible by SOQL queries, and being able to reference other metadata types or settings. However, Protected Custom Metadata Types cannot be used to store secrets, because they do not support encryption or masking of sensitive data. Protected Custom Metadata Types are intended to store configuration data that is specific to your managed package, not secrets that need to be secured.

Therefore, the correct answer is B and D, because Named Credentials and Protected Custom Settings are the only persistence mechanisms that can be used to securely store secrets in Salesforce.

References: 1: Named Credentials | Apex Developer Guide | Salesforce Developers 2: Custom Settings | Apex Developer Guide | Salesforce Developers 3: Encrypted Fields | Salesforce Help : [Protected Custom Metadata Types | ISVforce Guide | Salesforce Developers]

Create a special user solely for the integration purposes. This is the first thing that the Architect should do when building a solution that allows a service to access Salesforce through the API. Creating a special user for the integration purposes can help to ensure security, accountability, and traceability of the API calls. The special user should have a unique username, password, security token, and profile that grants only the necessary permissions and access for the integration. The special user should also be assigned to an API-only user license type that prevents logging in to the Salesforce UI. References: Certification - Integration Architect - Trailhead, [User Licenses], [API User Permission]

 Configuring Identity Type, Certificate, and CSRF Protection for OData connection are three configurations that an Integration Architect should recommend to secure requests coming from Salesforce. Identity Type is used to specify the authentication method for the OData connection, such as Basic Authentication, OAuth 2.0, or Named Principal. Certificate is used to enable SSL/TLS encryption for the OData connection, which protects the data in transit from eavesdropping or tampering. CSRF Protection is used to prevent cross-site request forgery attacks, which exploit the trust between the user and Salesforce by sending malicious requests from another website. Configuring Special Compatibility for OData connection is not a configuration that is related to security, but rather to compatibility issues with different versions or implementations of OData. Configuring CSRF Protection on External Data Source is not a configuration that can be done in Salesforce, but rather on the external data source itself. Reference: Salesforce Connect: Custom Adapters Developer Guide, page 9-10

Platform Events are a type of event-driven architecture that allows you to publish and subscribe to events in Salesforce and external systems. To subscribe to an event, the integration user in Salesforce needs read access to the event entity, which defines the schema and properties of the event message. To publish an event, the integration user in Salesforce needs create permission on the event entity, which is a special type of sObject that can be inserted into the platform event queue. Error handling must be performed by the remote service because the event is effectively handed off to the remote system for further processing. Salesforce does not guarantee the delivery or acknowledgment of the event by the external system. The external system should implement its own logic to handle errors, such as retrying failed events, logging errors, or sending notifications. References: Certification - Integration Architect - Trailhead, [Platform Events Developer Guide]

Visually monitor in the Salesforce UI using the “Bulk Data Load Jobs” in Salesforce in the setup menu, and use the getBatchInfo method in the Java application to monitor the status of the jobs from the Java application. These two methods can help the Technical Architect to monitor the nightly batch loads into Salesforce from an external system with a custom Java application using the Bulk API. The “Bulk Data Load Jobs” page in Salesforce shows the status, progress, and results of each batch load job. The getBatchInfo method in the Java application returns a BatchInfo object that contains information about a batch, such as its ID, state, number of records processed, and number of errors. References: Certification - Integration Architect - Trailhead, [Bulk API Developer Guide]

The mobile device should make a REST Apex inbound call to meet the requirement. A REST Apex inbound call allows the mobile device to invoke custom Apex logic on Salesforce using a RESTful interface. The Apex logic can then access the geolocation field using the user’s OAuth token and update it with the GPS coordinates from the mobile device. The geolocation field is secured with Field Level Security, so the user can view the value without changing it. A SOAP API inbound call or a REST API inbound call would not be able to access the custom geolocation field, as they are not supported by the standard Salesforce objects and fields. Reference: Salesforce Integration Architecture Designer Resource Guide, page 20

The three systems from the current system landscape that can be retired with the implementation of Salesforce are Case Management System, Sales Activity System, and Email Marketing System. These systems can be replaced by Salesforce Service Cloud, Sales Cloud, and Marketing Cloud respectively, which provide similar or better capabilities for managing cases, sales activities, and email campaigns. Option A is not correct because Order Management System cannot be retired with the implementation of Salesforce. The company wants to reuse their existing enterprise capabilities for order management processes, which are likely to be complex and customized. Salesforce does not provide a native order management solution for B2C commerce scenarios. Option E is not correct because Quoting System cannot be retired with the implementation of Salesforce. The company wants to reuse their existing enterprise capabilities for quoting processes, which are likely to be complex and customized. Salesforce does not provide a native quoting solution for B2C commerce scenarios.

• Option A is correct because Salesforce B2C Commerce to Service Cloud Connector is an integration solution that allows service agents to see order history from a B2C Commerce system. Salesforce B2C Commerce to Service Cloud Connector is a pre-built package that integrates Salesforce B2C Commerce and Service Cloud using REST APIs and Platform Events. It enables service agents to view, edit, cancel, and refund orders from B2C Commerce within the Service Cloud console. It also supports features such as customer verification, order search, order details, and order history.
• Option B is incorrect because a REST API offered by Commerce Platform is not an integration solution that allows service agents to see order history from a B2C Commerce system. A REST API offered by Commerce Platform is a set of web services that expose the functionality and data of the Commerce Platform to external applications. It can be used to create, update, delete, or query resources such as products, catalogs, customers, or orders. However, a REST API offered by Commerce Platform is not a complete integration solution, as it requires additional development, configuration, and maintenance to connect with Service Cloud and display the order history in the Service Cloud console.
• Option C is incorrect because Mulesoft Anypoint Platform is not an integration solution that allows service agents to see order history from a B2C Commerce system. Mulesoft Anypoint Platform is a platform that enables developers to build, manage, and monitor integrations and APIs across various systems and applications. It can be used to connect Salesforce B2C Commerce and Service Cloud using various connectors, protocols, and transformations. However, Mulesoft Anypoint Platform is not a pre-built integration solution, as it requires additional development, configuration, and maintenance to connect with Service Cloud and display the order history in the Service Cloud console.
• Option D is incorrect because a REST API offered by Salesforce Platform is not an integration solution that allows service agents to see order history from a B2C Commerce system. A REST API offered by Salesforce Platform is a set of web services that expose the functionality and data of the Salesforce Platform to external applications. It can be used to create, update, delete, or query resources such as objects, records, metadata, or Apex classes. However, a REST API offered by Salesforce Platform is not a complete integration solution, as it requires additional development, configuration, and maintenance to connect with B2C Commerce and display the order history in the Service Cloud console.

References: Salesforce B2C Commerce to Service Cloud Connector : Salesforce B2C Commerce to Service Cloud Connector Implementation Guide : Commerce API Explorer : MuleSoft | Integration Platform for Connecting SaaS and Enterprise Applications : REST API Developer Guide

 The OAuth protocol is a standard way to authorize access to web resources. By configuring a connected app with an authorization endpoint of the API gateway, Salesforce can obtain an access token from the API gateway and use it to invoke the external API securely. This avoids the need to manage certificates or user credentials for authentication2

References: 1: Data Virtualization Pattern 2: OAuth 2.0 Web Server Authentication Flow