Master the Salesforce Certified Integration Architect (WI24) Integration-Architect Exam with Confidence!

Outbound Messaging and Platform Events are both suitable solutions for capturing and sending business events from Salesforce to an external system in real time. Outbound Messaging allows you to specify workflow rules that send SOAP messages with field values to designated endpoints1. Platform Events are secure and scalable messages that contain data and can be published and subscribed to using various APIs2. A trigger or a custom Apex controller can be used to publish platform events from Salesforce34. A callout is not a suitable solution because it is a synchronous request that may fail or timeout, and it also consumes API limits. A contract-first Outbound Messaging interface is not a valid option because Outbound Messaging uses a predefined WSDL that cannot be customized

SObject Collections is a REST API composite resource that allows you to create, update, or delete up to 200 records in one API call. You can specify the type of operation (create, update, or delete) for eachrecord in the request body, and the response body will contain the status and IDs of each record. SObject Collections is suitable for bulk operations on records that are not related to each other1.

SObject Tree is another REST API composite resource that allows you to create up to 200 records in one API call. However, unlike SObject Collections, SObject Tree requires the records to be related to each other in a hierarchy. You can specifythe parent and child records in a JSON tree structure, and the response body will contain the reference IDs and URLs of each record. SObject Tree is suitable forcreating nested data in one request2.

Batch is a REST API composite resource that allows you to combine up to 25 requests in one API call. Each request can be adifferent type of operation (query, create, update, delete, etc.) on different objects. The response body will contain the status and results of each request. Batch is suitable for grouping multiple requests into one transaction3.

Composite is a REST API composite resource that allowsyou to execute a series of REST API requests in one API call. You can use the output of one request as the input of another request using a reference ID. The response body will contain the status and results of each request. Composite is suitable for chaining requests that depend on each other.

Therefore, the correct answer is A, because SObject Collections is the only REST API composite resource that allows bulk updates on records that are not related to each other.

References: 1: SObject Collections | REST API Developer Guide | Salesforce Developers 2: SObject Tree | REST API Developer Guide | Salesforce Developers 3: Batch | REST API Developer Guide | Salesforce Developers : [Composite | REST API Developer Guide | Salesforce Developers]

QUESTIONNO: 23

A company's security assessment noted vulnerabilities on the un managed packages in their Salesforce orgs, notably secrets that are easily accessible and in plain text, such as usernames, passwords, and OAuth tokens used in callouts from Salesforce.

Which two persistence mechanisms should an integration architect require to be used to ensure that secrets are protected from deliberate or inadvertent exposure?

Choose 2 answers

A. Encrypted Custom Fields

B. Named Credentials

C. Protected CustomMetadata Types

D. Protected Custom Settings

Answer: B, D

Named Credentials and Protected Custom Settings are two persistence mechanisms that can be used to ensure that secrets are protected from deliberate or inadvertent exposure. Named Credentials allowyou to specify the URL of a callout endpoint and its required authentication parameters in one definition. Salesforce manages all the authentication for Apex callouts that specify a named credential as the callout endpoint, and you don’t have to add more authentication logic in your Apex code. Named Credentials can be defined to provide a secure and convenient way of settingup authenticated callouts, and they can also be used in Lightning components, Visualforce pages, and flows1.

Protected Custom Settings are a type of custom settings that store application-specific data that is hidden from subscribers. They are only accessible by the managed package that created them, and they canbe used to store secrets such as encryption keys, passwords,or tokens. Protected Custom Settings can be accessed by Apex code, formulas, or validation rules within the same namespace as the settings2.

Encrypted Custom Fields are not a suitable mechanism for storing secrets, because they are not designed to prevent unauthorized access to sensitive data. Encrypted Custom Fields allow you to encrypt text fields using a standard encryption scheme. The encrypted data is masked in reports, list views, and search results, but it can still be viewed by users who have the “View Encrypted Data” permission. Encrypted Custom Fields are intended to protect data from unauthorized access by users within your organization, not from external threats or malicious code3.

Protected Custom Metadata Types are another type of custom metadata types that store application-specific data that is hidden from subscribers. They are similar to Protected Custom Settings, but they have some advantages such as being deployable using change sets or Metadata API, being accessible by SOQL queries, and being able to reference other metadata types or settings. However, Protected Custom Metadata Types cannot be used to store secrets, because they do not support encryption or masking of sensitive data. Protected Custom Metadata Types are intended to store configuration data that is specific to your managed package, not secrets that need to be secured.

Therefore, the correct answer is B and D, because Named Credentials and Protected Custom Settings are the only persistence mechanisms that can be used to securely store secrets in Salesforce.

References: 1: Named Credentials | Apex Developer Guide | Salesforce Developers 2: CustomSettings | Apex Developer Guide | Salesforce Developers 3: Encrypted Fields | Salesforce Help :[Protected Custom Metadata Types | ISVforce Guide | Salesforce Developers]

An API gateway is a component that acts as a single point of entry for all cloud applications to access on-premise resources and services. It can provide security, routing, transformation, and other features to facilitate integration. An API gateway component should be deployable behind a DMZ or perimeter network, whichis a subnetwork that separates the internal network from the external network and provides an additional layer of security. The middleware solution should also be capable of establishing a secure API gateway between cloud applications and on-premise resources, which may involve using protocols such as HTTPS, SSL/TLS, or VPN. The OAuth security protocol is not a requirement for choosing a middleware solution, as it is a standard for authorizing access to resources on behalf of a user. The middleware solution’s ability to interface directly with databases via an ODBC connection string is also not a requirement, as it is a specific feature that may or may not be needed depending on the integration scenario. Reference: Salesforce Integration Architecture Designer Resource Guide, page 14-15

The best solution for this scenario is to use a custom object to store the file location URL and redirect the community user tothe on-premise file store when they click on the URL. This way, the community user can access the large design files without having to download them or use any external data source. Option A is not feasible because the Request and Reply integration patternis not suitable for large files and would cause performance issues. Option B is not correct because Salesforce Connect cannot upload files to an external object, only data. Option D is not possible because Salesforce Files has a limit of 2 GB per file, and the design files are 2.5 GB in size. References:

• Salesforce Connect Developer Guide
• Salesforce Files Developer Guide

The system requirement is to expose data from the on-premise applications to Salesforce for a more unified user experience in real-time. The possible actions that can fulfill this requirement are:

• Answer B isvalid because developing custom APIs on the company’s network that are invokable by Salesforce can allow Salesforce to access the data from the on-premise applications in real-time. However, this action requires opening a firewall port or using a reverse proxy to allow Salesforce to communicate with the on-premise APIs securely3
• Answer C is valid because deploying MuleSoft to the on-premise network and designing externally facing APIs to expose the data can also enable Salesforce to access the data from the on-premise applications in real-time. MuleSoft is an integration platform that can connect various systems and applications using APIs and standard protocols. MuleSoft can also handle security, orchestration, transformation, and other integration aspects.
• Answer A is not valid because developing an application in Heroku that connects to the on-premise database via an ODBC string and VPC connection is not a real-time solution. Heroku is a cloud platform that can host web applications and services, but it cannot expose data from an on-premise database directly to Salesforce.To use Heroku for this purpose, an ETL tool or a middleware solution would be needed to synchronize the data between the on-premise database and Heroku, which would introduce latency and complexity to the integration.
• Answer D is not valid because runninga batch job with an ETL tool from an on-premise server to move data to Salesforce is also not a real-time solution. ETL stands for extract, transform, and load, which is a process of moving data from one system to another in batches. ETL toolscan be usedfor data migration or integration, but they cannot provide real-time access to data from on-premise applications to Salesforce. ETL tools also have limitations on data volume, frequency, and reliability.

1: Bulk API Limits 2: Bulk API Features 3: Integrating with Salesforce using Custom Web Services : MuleSoft Overview : Heroku Overview : ETL Overview

• Option C is correct because Salesforce should be the system of record for their customers and prospects, as it is the CRM solution that the sales and service associates use to view and log their interactions with them. Salesforce can also integrate with the Marketing and ERP solutions to display relevant information from those systems, such as campaign history, invoices, and orders12
• Option A is incorrect because ERP is not a suitable system of record for customers and prospects, as it is mainly focused on invoicing andorder fulfillment. ERP may not have all the data that the sales and service associates need to interact with them, such as contact details, preferences, activities, and opportunities. ERP may also have different data models and definitions than Salesforce and Marketing, which can cause data quality and consistency issues3
• Option B is incorrect because Marketing is not a suitable system of record for customers and prospects, as it is mainly focused on email campaigns. Marketing may not have all the data that the sales and service associates need to interact with them, such as account information, service cases, contracts, and quotes. Marketing may also have different data models and definitions than Salesforce and ERP, which can cause data quality and consistency issues.
• Option D is incorrect because creating a new custom database for customers and prospects is not a feasible or efficient solution, as it would require additional development, maintenance, and integration costs. It would also create another layer of complexity and potential data duplication in the system landscape. Salesforce already provides a robust and flexible platform for managing customer and prospect data, which can be easily customized and integrated with other systems.

References: 1: Salesforce CRM - The Definitive Guide 2: Salesforce Integration Cloud - Connect Any App, Data, or Device 3:What Is ERP? | Oracle : Salesforce vs ERP: What’s the Difference? : Marketing Cloud - Digital Marketing Platform : Salesforce vs Marketing Cloud: What’s the Difference? : Salesforce Platform - Build Apps Fast : Why You Shouldn’t Build Your Own CRM System

 The BatchApexErrorEvent object allows handling errors that occur during Batch Apex execution. By subscribing to this event,the integration can retry the invoice generation for the failed records or perform other recovery actions. This is a resilient and scalable solution that does not require custom code in the Batch Apex job itself or in the middleware1

 Configuring Identity Type, Certificate, and CSRF Protection for OData connection are three configurations that an Integration Architect should recommend to secure requests coming from Salesforce. Identity Type is used to specify the authentication method for the OData connection, such as Basic Authentication, OAuth 2.0, or Named Principal. Certificate is used to enable SSL/TLS encryption for the OData connection, which protects the data in transit from eavesdropping or tampering. CSRF Protection is used to prevent cross-site request forgery attacks, which exploit the trust between the user and Salesforce by sending malicious requests from another website. Configuring Special Compatibility for OData connection is not a configuration that is related to security, but rather to compatibility issues with different versions or implementations of OData. Configuring CSRF Protection on External Data Source is not a configuration that can be done in Salesforce, but rather on the external data sourceitself. Reference: Salesforce Connect: Custom Adapters Developer Guide, page 9-10