Integration-Architect Sample Questions Answers

• Answer A is valid because creating an Auth provider in the package and setting the consumer key and consumer secret of the connected app in the central org can allow the package to authenticate with the central org using OAuth 2.0. An Auth provider is a configuration that specifies how to connect to an external service that uses a specific identity protocol. A connected app is an application that can access Salesforce resources using APIs and standard protocols. The consumer key and consumer secret are credentials that identify the connected app to Salesforce.
• Answer C is valid because creating a connected app in the central org and adding the callback URL of each org the package is installed in to redirect to after successful authentication can enable the package to obtain an access token from the central org using OAuth 2.0. The callback URL is a parameter that specifies where the user should be redirected after granting or denying permission to access Salesforce resources. The access token is a credential that can be used to invoke the custom Apex REST endpoint in the central org.
• Answer E is valid because using the Auth Provider configured and selecting the identity type as Named Principal with OAuth 2.0 as the protocol and selecting Start Authentication Flow on Save can initiate the authentication flow when installing the package. The identity type determines how the package accesses Salesforce resources on behalf of users or an application. The Named Principal identity type means that the package uses a single credential, such as a username and password or an access token, to access Salesforce resources for all users. The Start Authentication Flow on Save option means that the package will prompt the user to enter the credential when saving the Auth Provider configuration.
• Answer B is not valid because contacting Salesforce support and creating a case to temporarily enable API access for managed packages is not a necessary or recommended action. API access for managed packages is enabled by default and does not require any special permission or configuration from Salesforce support. Moreover, this action does not address the security requirement of using a specific integration account in the central org that will be authorized after installation of the package.
• Answer D is not valid because using an encrypted field to store the password that the security team enters and using password management for external orgs and setting the encryption method to TLS 1.2 is not a secure or reliable solution. An encrypted field is a custom field that encrypts sensitive data at rest and masks it on the user interface. However, this field does not prevent unauthorized access or leakage of data, as it can be decrypted by users who have the View Encrypted Data permission or by Apex code that runs in system mode. Moreover, this field does not support encryption methods such as TLS 1.2, which are used for securing data in transit, not at rest.

References: Auth Provider: Connected Apps : OAuth 2.0 Web Server Authentication Flow : Named Credentials as Callout Endpoints : API Access in Packages : Encrypted Fields : Encryption Methods Available in Salesforce

11of30

The integration architect should recommend enforcing separate security protocols and return formats at the first tier of the API-led architecture. The first tier is also known as the experience layer, which is responsible for providing a tailored interface for each system of engagement. By enforcing security and format at this layer, the integration architect can ensure that each system of engagement can access the data in a secure and consistent way, without affecting the other layers.

References: [API-led Connectivity]

• Answer D is valid because using middleware to handle the call out to the 10 different verification services is a scalable and reliable solution that can handle the complexity and variability of the integration. The middleware can orchestrate the calls to the different web services, consolidate the verification results, and handle any errors or retries. The middleware can then make a call-in to Salesforce and update the verification status to “verified” using an API or a platform event12
• Answer A is not valid because using Salesforce external service to make the call out to the 10 different verification services is not a feasible or efficient solution. Salesforce external service is a feature that allows invoking an external service from a flow and mapping its inputs and outputs to flow variables. However, this feature requires configuring an Apex action, a named credential, and an external service definition for each web service, which is not a low code solution. Moreover, this feature does not support checking the verification agencies until the result is verified, as it only invokes the external service once per flow interview3
• Answer B is not valid because creating a trigger on the trainer record to make a callout to each verification agency is not a recommended or robust solution. Triggers are Apex code that execute before or after database events, such as insert, update, or delete. However, triggers cannot make callouts directly, as they are part of a database transaction and must complete quickly. To make a callout from a trigger, an asynchronous process such as a future method or a queueable job must be used, which adds complexity and overhead to the integration. Moreover, triggers have limits on the number of callouts and asynchronous calls they can make per transaction, which may affect the scalability and reliability of the integration.
• Answer C is not valid because making an Apex callout using @future annotation to make the call out to all different agencies is not a suitable or reliable solution. The @future annotation allows marking a method for execution at a later time when system resources become available. However, this annotation has several limitations and drawbacks, such as:

1: Orchestration Pattern 2: Remote Process Invocation—Request and Reply 3: External Services : Apex Developer Guide: Triggers : Apex Developer Guide: Using Future Methods

• Option A is correct because external gateway products in use can affect the performance and security of outbound integrations from Salesforce to on-premise servers. External gateway products are software or hardware devices that act as intermediaries between Salesforce and the on-premise servers, such as firewalls, proxies, load balancers, or VPNs. They can have different configurations, features, and limitations that can impact the speed, reliability, and security of the data transmission. For example, some external gateway products may require authentication, encryption, or compression of the data, which can add overhead and latency to the integration. Some external gateway products may also have bandwidth or throughput limits, which can affect the scalability and availability of the integration. Therefore, the architect should consider the external gateway products in use before recommending a solution.
• Option B is incorrect because a default gateway restriction is not a factor that can affect the performance and security of outbound integrations from Salesforce to on-premise servers. A default gateway restriction is a feature that allows administrators to restrict outbound requests from Salesforce to a specific IP address or domain name. This can help prevent unauthorized or malicious requests from Salesforce to external systems. However, this feature does not affect the performance or security of the outbound requests themselves, as it only acts as a filter for the destination of the requests.
• Option C is incorrect because considerations for using deterministic encryption are not relevant for outbound integrations from Salesforce to on-premise servers. Deterministic encryption is a type of encryption that produces the same ciphertext for the same plaintext input. This can help preserve some functionality and performance of encrypted data in Salesforce, such as filtering, sorting, and indexing. However, deterministic encryption is not applicable for outbound integrations from Salesforce to on-premise servers, as it is only supported for custom fields and not for standard fields or attachments. Moreover, deterministic encryption does not affect the security of the data transmission itself, as it only encrypts the data at rest in Salesforce.
• Option D is incorrect because Shield Platform Encryption limitations are not relevant for outbound integrations from Salesforce to on-premise servers. Shield Platform Encryption is a feature that allows administrators to encrypt sensitive data at rest in Salesforce using AES 256-bit encryption. This can help protect data from unauthorized access or theft. However, Shield Platform Encryption limitations are not relevant for outbound integrations from Salesforce to on-premise servers, as they only affect the functionality and performance of encrypted data in Salesforce, such as searching, reporting, or validation rules. Shield Platform Encryption does not affect the security of the data transmission itself, as it only encrypts the data at rest in Salesforce.

References: Salesforce Integration Patterns and Practices : Salesforce Integration Guide : Restrict Outbound Requests with a Default Gateway : Deterministic Encryption : Shield Platform Encryption Considerations : Shield Platform Encryption : Shield Platform Encryption Architecture

 Push Topic Events can define a custom payload, which is one of the factors that should be considered when choosing a Streaming API implementation. Push Topic Events are based on SOQL queries that define the data changes to be notified of. You can specify the fields to be returned in the event message by using the SELECT clause in the query. This allows you to customize the payload according to your needs2

References: Create a PushTopic

Change Data Capture is a feature that enables you to receive near-real-time changes of Salesforce records, including create, update, delete, and undelete operations. Change Data Capture retains change events in the event bus for up to three days, so you can resume data replication from the point of failure. Change Data Capture also provides a consistent and reliable way to synchronize data changes with external systems, without the need for custom triggers or code. Reference: Salesforce Integration Architecture Designer Resource Guide, page 24

The message durability considerations that an Integration Architect should make when designing a solution to meet these business requirements are:

• When subscribing to Salesforce Event bus, ReplayID is used with a value of -2 to be able to see old and new events.
• High-volume event messages are stored for 72 hours (three days).

A Salesforce Event bus is a messaging service that allows you to publish and subscribe to events in Salesforce or from external sources. ReplayID is a property of an event message that indicates its position in the event stream. By using ReplayID with a value of -2, you can replay all events stored in the retention window, which can help you see the stages of order processing in Salesforce. High-volume event messages are a type of event message that can handle large volumes of data and are optimized for performance and scalability. High-volume event messages are stored for 72 hours (three days) in the event bus, which means they can be replayed within that time frame. The other options are not correct. Using ReplayID with a value of -1 means you can only see new events that are published after your subscription. High-volume event messages are not stored for 24 hours (one day), but for 72 hours (three days).

 Both Platform Events and Outbound Message offer declarative means for asynchronous near-real time needs. They aren’t best suited for real-time integrations (A). In both Platform Events and Outbound Messages, the event messages are retried by and delivered in sequence, and only once. Salesforce ensures there is no duplicate message delivery (B). Message sequence is possible in Outbound Message but not guaranteed with Platform Events. Both offer very high reliability. Fault handling and recovery are fully handled by Salesforce ©. Number of concurrent subscribers to Platform Events is capped at 2,000. An Outbound Message configuration can pass only 100 notifications in a single message to a SOAP end point (D). Both Platform Events and Outbound Message are highly scalable. However, unlike Outbound Message, only Platform Events have Event Delivery and Event Publishing limits to be considered (E). Reference: Salesforce Integration Architecture Designer Resource Guide, page 23

The considerations that an Integration Architect should do prior to the implementation of Shield Platform Encryption are:

• Review shield platform encryption configurations.
• Encrypt all the data so that it is secure.

Shield Platform Encryption is a feature that allows you to encrypt sensitive data at rest in Salesforce, such as social security numbers, without compromising critical platform functionality. Before implementing Shield Platform Encryption, you should review the shield platform encryption configurations, such as the encryption key management, the encryption policy, and the encrypted fields and files. You should also encrypt all the data that is subject to encryption, not just the data using the most current key. Encrypting all the data ensures that your data is secure and compliant with your business requirements. Encrypting the data using the most current key is not a valid consideration because Shield Platform Encryption uses a deterministic encryption scheme that does not allow you to rotate or re-encrypt your data with a new key. Using Shield Platform Encryption as a user authentication or authorization tool is not a valid consideration because Shield Platform Encryption is not designed for that purpose. Shield Platform Encryption only encrypts data at rest, not in transit or in use.

The best solution for this scenario is to use a custom object to store the file location URL and redirect the community user to the on-premise file store when they click on the URL. This way, the community user can access the large design files without having to download them or use any external data source. Option A is not feasible because the Request and Reply integration pattern is not suitable for large files and would cause performance issues. Option B is not correct because Salesforce Connect cannot upload files to an external object, only data. Option D is not possible because Salesforce Files has a limit of 2 GB per file, and the design files are 2.5 GB in size. References:

• Salesforce Connect Developer Guide
• Salesforce Files Developer Guide

 Using a third party integration tool to stage records off platform is a solution that can handle the high volume of data and avoid hitting the API limits for the REST API call to the external system. A third party integration tool can also provide features such as data transformation, error handling, and logging. Due to high volume of records, number of concurrent requests can hit the limit for the REST API call to external system is not a solution, but a problem that needs to be addressed. Due to high volume of records, the external system will need to use a BULK API Rest endpoint to connect to Salesforce is not a solution, as the requirement is to send data from Salesforce to the external system, not vice versa. Due to high volume of records, Salesforce will need to make a REST API call to external system is not a solution, as it does not address how to handle the high volume of data and avoid hitting the API limits. Reference: Salesforce Integration Architecture Designer Resource Guide, page 18-19

Visually monitor in the Salesforce UI using the “Bulk Data Load Jobs” in Salesforce in the setup menu, and use the getBatchInfo method in the Java application to monitor the status of the jobs from the Java application. These two methods can help the Technical Architect to monitor the nightly batch loads into Salesforce from an external system with a custom Java application using the Bulk API. The “Bulk Data Load Jobs” page in Salesforce shows the status, progress, and results of each batch load job. The getBatchInfo method in the Java application returns a BatchInfo object that contains information about a batch, such as its ID, state, number of records processed, and number of errors. References: Certification - Integration Architect - Trailhead, [Bulk API Developer Guide]

The recommended solution is to use a time-based workflow rule. A time-based workflow rule is a type of workflow rule that executes actions at a specific time, such as a certain number of days before or after a record field value. By using a time-based workflow rule, you can send an email alert to the contacts of the accounts that do not qualify for a business extension for the next month, and include a meeting invite in the email. This solution can handle large volumes of data and does not require any custom code. Using batch Apex, process builder, or trigger is not a recommended solution because they are more complex and require custom code or configuration. Batch Apex is a way to run large-scale and long-running jobs that operate on many records. Process builder is a tool that lets you automate business processes by creating a process with criteria and actions. Trigger is a type of Apex code that executes before or after database operations, such as insert, update, delete, or undelete.

The Batch Data Synchronization pattern is suitable for this business use case because it allows transferring large volumes of data between Salesforce and the scheduling system in batches. This can handle the surge of requests for workshop registrations without overloading the systems or affecting the performance. The batch process can run at regular intervals or on demand to synchronize the data between the systems1

1: Batch Data Synchronization Pattern

 The OAuth protocol is a standard way to authorize access to web resources. By configuring a connected app with an authorization endpoint of the API gateway, Salesforce can obtain an access token from the API gateway and use it to invoke the external API securely. This avoids the need to manage certificates or user credentials for authentication2

References: 1: Data Virtualization Pattern 2: OAuth 2.0 Web Server Authentication Flow

Using Change Data Capture (CDC) to update downstream systems accordingly when a record changes is a solution that can handle this requirement by capturing data changes in Salesforce and sending them to external systems via a publish-subscribe model. This way, the external systems can receive near real-time updates from Salesforce and synchronize their data accordingly. Designing an MDM solution that maps external ID’s to the Salesforce record ID is a solution that can handle this requirement by creating a master data hub that stores and manages the unique identifiers of each system and their relationships. This way, the MDM solution can ensure data quality, consistency, and accuracy across systems. Locally caching external ID’s at the middleware layer and designing business logic to map updates between systems is not a good solution because it can introduce performance and scalability issues, as well as increase the complexity and maintenance cost of the middleware layer. Storing unique identifiers in an External ID field in Salesforce and using this to update the proper records across systems is not enough to handle this requirement, as it does not address how to update Salesforce with record changes from external systems. Reference: Salesforce Integration Architecture Designer Resource Guide, page 27-28

 The BatchApexErrorEvent object allows handling errors that occur during Batch Apex execution. By subscribing to this event, the integration can retry the invoice generation for the failed records or perform other recovery actions. This is a resilient and scalable solution that does not require custom code in the Batch Apex job itself or in the middleware1

The best use case for leveraging the existing SAML integration to connect Salesforce with other internal systems is to make Apex SOAP outbound integrations to external web services more secure. SAML can be used to authenticate the Salesforce org as the service provider and obtain a session ID from the external system as the identity provider. This session ID can then be used to make SOAP calls to the external web service without exposing any credentials in the Apex code. Option A is not correct because formula fields with HYPERLINK() do not support SAML authentication. Option C is not correct because Apex REST outbound integrations require OAuth or basic authentication, not SAML. Option D is not correct because API inbound integrations from an external Java client require OAuth or basic authentication, not SAML. References:

• Named Credentials as Callout Endpoints
• SAML SSO with Salesforce as the Service Provider

The integration consultant should consider the following authorization and authentication needs while integrating the DMS and ESB with Salesforce:

• Users should be authorized to view information specific to the customer they are servicing without a need to search for customer. This means that the integration should provide a seamless and contextual access to the customer billing information and generated bills from the DMS and ESB, based on the customer record or case that the user is working on in Salesforce.
• Consider Enterprise security needs for access to DMS and ESB. This means that the integration should comply with the security policies and standards of the Enterprise, such as encryption, auditing, logging, monitoring, etc.
• Users should be authenticated into DMS and ESB without having to enter username and password. This means that the integration should use a single sign-on (SSO) mechanism that allows users to access multiple systems with one login credential, such as OAuth or SAML.

References: [Authorization Through Connected Apps and OAuth 2.0], [Single Sign-On for Desktop and Mobile Applications using SAML and OAuth]

Create a special user solely for the integration purposes. This is the first thing that the Architect should do when building a solution that allows a service to access Salesforce through the API. Creating a special user for the integration purposes can help to ensure security, accountability, and traceability of the API calls. The special user should have a unique username, password, security token, and profile that grants only the necessary permissions and access for the integration. The special user should also be assigned to an API-only user license type that prevents logging in to the Salesforce UI. References: Certification - Integration Architect - Trailhead, [User Licenses], [API User Permission]

OpenId Connect Authentication Provider and Registration Handler, and SAML SSO and just-in-time provisioning are two requirements that the Salesforce Community Cloud can support for self-registration and SSO. OpenId Connect is a protocol that allows users to authenticate with an external identity provider and access Salesforce resources. A registration handler is a class that implements the Auth.RegistrationHandler interface and defines the logic for creating or updating a user in Salesforce after authentication. SAML SSO is a protocol that allows users to log in to Salesforce with a single click, using an assertion from an identity provider that confirms the user’s identity. Just-in-time provisioning is a feature that allows Salesforce to create or update a user account based on the information in the SAML assertion. References: Certification - Integration Architect - Trailhead, [OpenID Connect Authentication Providers], [SAML Single Sign-On (SSO) Service for Salesforce]

The end-to-end response time from the user’s perspective is the time elapsed between the user’s request and the user’s receipt of the final response. In the diagram, this corresponds to the sum of A and H, which are the durations of the synchronous calls from the user interface to the cloud-based application and back. The other durations (B to G) are either internal to the cloud-based application or asynchronous calls that do not affect the user’s perception of response time. Therefore, the correct answer is D, because it represents the sum of A and H.

The authentication is achieved by handling it in the code. A Named Credential is a type of metadata that specifies the URL of a callout endpoint and its required authentication parameters. An Apex callout is a way to invoke an external web service or API from Apex code. When using a Named Credential with an Apex callout, the authentication is handled by the Apex code that invokes the callout. The Apex code can use the HttpRequest class to set the endpoint, method, headers, and body of the callout request, and use the Http class to send the request and receive the response. The Apex code can also use the NamedCredential class to access the properties of the Named Credential, such as the principal type, protocol, and credential type. Handling authentication with login flows is not a valid option because login flows are a way to customize the user login process in Salesforce, not for external web services or APIs. Connecting via Salesforce Connect or Communities is not a valid option because they are not related to Apex callouts or Named Credentials.

Middleware should coordinate request delivery and payment processing, and Payment System should process a payment request only once. This solution ensures that each payment request is delivered to the Payment System in a reliable and consistent manner, and avoids duplicate or conflicting updates to the same Payment Request record. Middleware can act as a mediator between the Data Entry Point and the Payment System, and implement logic to handle errors, retries, and acknowledgments. Payment System can use the globally unique identifier to check if a payment request has already been processed, and avoid processing it again. References: Certification - Integration Architect - Trailhead, [Integration Patterns and Practices]

Handle verification process error in the Verification Webservice API in case there is a connection issue to the Webservice or if it responds with an error. This solution ensures that the agent can see an error message when the credit verification process failed, and take appropriate actions. The Verification Webservice API can implement error handling logic to catch any exceptions or errors that occur during the callout to the external agencies, and return a meaningful error message to the agent. The agent can then retry the verification process, or escalate the issue to a supervisor. References: Certification - Integration Architect - Trailhead, [Apex Web Services and Callouts]

Use Salesforce Connect if the database supports Open Data Protocol (OData). Salesforce Connect allows you to integrate external data sources with Salesforce without copying the data into Salesforce. OData is a standard protocol for accessing data from different sources. Use Salesforce Connect if the database supports Open Database Connectivity (ODBC) is incorrect because ODBC is not supported by Salesforce Connect. Use Heroku Connect if the data is hosted in Heroku is incorrect because Heroku Connect is used to synchronize data between Salesforce and a Heroku Postgres database, not an on-premises system.

• Option B is correct because platform events are published after the Apex transaction completes. Platform events are asynchronous messages that are published and consumed by different processes or systems. When an Apex transaction publishes a platform event, the event is not sent immediately, but rather added to a temporary queue. The event is only published and delivered to the subscribers after the Apex transaction commits successfully. This ensures that the event data is consistent with the database state and that the event is not lost in case of a rollback.
• Option A is incorrect because platform events are not published immediately before the Apex transaction completes. As explained above, platform events are published after the Apex transaction commits successfully. Publishing events before the transaction completes can cause data inconsistency and event loss issues.
• Option C is incorrect because platform events can have a trigger in Apex, but this is not related to the question of when events are published. A platform event trigger is a special type of Apex trigger that executes when a platform event message is received by Salesforce. A platform event trigger can perform logic based on the event data, such as updating records, sending notifications, or calling external services. A platform event trigger does not affect the publishing of events, but rather the consumption of events.
• Option D is incorrect because platform events can be published from Apex, but this does not answer the question of when events are published. Platform events can be published from various sources, such as Apex code, Process Builder, Flows, or API calls. Publishing events from Apex requires creating an instance of a platform event object and using the EventBus.publish method to add it to the temporary queue. The actual publishing of events happens after the Apex transaction completes, regardless of the source of the events.

References: Publish and Subscribe with Platform Events: Publish Platform Events : Subscribe to Platform Events : Write a Platform Event Trigger : Create and Publish Platform Events in Apex : EventBus Class

The integration consultant should evaluate current and future data and system usage and then identify potential integration requirements to Salesforce. This approach can help to understand the business needs, data flows, data quality, data volume, data frequency, and data security of the proposed CRM system. Based on this analysis, the integration consultant can design and implement the best integration solution for each system, such as Marketing, ERP, or Outlook.

References: [Salesforce Integration Architecture Designer Resource Guide]

The integration consultant should consider the following authorization and authentication needs while integrating the DMS and ESB with Salesforce:

• Users should be authorized to view information specific to the customer they are servicing without a need to search for customer. This means that the integration should provide a seamless and contextual access to the customer billing information and generated bills from the DMS and ESB, based on the customer record or case that the user is working on in Salesforce.
• Consider Enterprise security needs for access to DMS and ESB. This means that the integration should comply with the security policies and standards of the Enterprise, such as encryption, auditing, logging, monitoring, etc.
• Users should be authenticated into DMS and ESB without having to enter username and password. This means that the integration should use a single sign-on (SSO) mechanism that allows users to access multiple systems with one login credential, such as OAuth or SAML34

References: Authorization Through Connected Apps and OAuth 2.0, Single Sign-On for Desktop and Mobile Applications using SAML and OAuth