Integration-Architect Salesforce Certified Integration Architect (SU24) Questions and Answers

OpenId Connect Authentication Provider and Registration Handler, and SAML SSO and just-in-time provisioning are two requirements that the Salesforce Community Cloud can support for self-registration and SSO. OpenId Connect is a protocol that allows users to authenticate with an external identity provider and access Salesforce resources. A registration handler is a class that implements the Auth.RegistrationHandler interface and defines the logic for creating or updating a user in Salesforce after authentication. SAML SSO is a protocol that allows users to log in to Salesforce with a single click, using an assertion from an identity provider that confirms the user’s identity. Just-in-time provisioning is a feature that allows Salesforce to create or update a user account based on the information in the SAML assertion. References: Certification - Integration Architect - Trailhead, [OpenID Connect Authentication Providers], [SAML Single Sign-On (SSO) Service for Salesforce]

The maximum callouts in a single Apex transaction is one of the factors that should be considered when choosing Apex code to make callouts to an external system. The limit is 100 callouts per transaction, and if this limit is exceeded, a LimitException is thrown. Therefore, the integration architect should evaluate the expected volume and frequency of the callouts and design the solution accordingly2

References: Salesforce API Limits and Usage

Middleware should coordinate request delivery and payment processing, and Payment System should process a payment request only once. This solution ensures that each payment request is delivered to the Payment System in a reliable and consistent manner, and avoids duplicate or conflicting updates to the same Payment Request record. Middleware can act as a mediator between the Data Entry Point and the Payment System, and implement logic to handle errors, retries, and acknowledgments. Payment System can use the globally unique identifier to check if a payment request has already been processed, and avoid processing it again. References: Certification - Integration Architect - Trailhead, [Integration Patterns and Practices]

Using middleware queuing and buffering is a solution that can handle errors during service outages by storing the messages in a queue until the service is available again. This way, Salesforce does not lose any data or encounter any failures when the service is down. Using @future jobld and custom scheduled apex process to retry failed service calls is not a good solution because it can consume a lot of governor limits and create a lot of duplicate records. Using Outbound Messaging to automatically retry failed service calls is also not a good solution because it has a limited number of retries and a fixed retry interval, which may not be sufficient for long service outages. Using Platform Event replayld and custom scheduled Apex process to retrieve missed events is not applicable for this scenario because Platform Events are used for event-driven integration, not for web-service integration. Reference: Salesforce Integration Architecture Designer Resource Guide, page 29-30

Using Change Data Capture (CDC) to update downstream systems accordingly when a record changes is a solution that can handle this requirement by capturing data changes in Salesforce and sending them to external systems via a publish-subscribe model. This way, the external systems can receive near real-time updates from Salesforce and synchronize their data accordingly. Designing an MDM solution that maps external ID’s to the Salesforce record ID is a solution that can handle this requirement by creating a master data hub that stores and manages the unique identifiers of each system and their relationships. This way, the MDM solution can ensure data quality, consistency, and accuracy across systems. Locally caching external ID’s at the middleware layer and designing business logic to map updates between systems is not a good solution because it can introduce performance and scalability issues, as well as increase the complexity and maintenance cost of the middleware layer. Storing unique identifiers in an External ID field in Salesforce and using this to update the proper records across systems is not enough to handle this requirement, as it does not address how to update Salesforce with record changes from external systems. Reference: Salesforce Integration Architecture Designer Resource Guide, page 27-28

 The OAuth protocol is a standard way to authorize access to web resources. By configuring a connected app with an authorization endpoint of the API gateway, Salesforce can obtain an access token from the API gateway and use it to invoke the external API securely. This avoids the need to manage certificates or user credentials for authentication2

References: 1: Data Virtualization Pattern 2: OAuth 2.0 Web Server Authentication Flow

 Reducing the batch size of asynchronous BULK API and submitting the legacy system in parallel mode are two recommendations that can improve the integration performance. The BULK API is designed to handle large-scale data loads, but it can also cause latency issues if the batch size is too large or the network bandwidth is insufficient. Reducing the batch size can help to avoid timeouts and improve throughput. Submitting the legacy system in parallel mode can also speed up the integration process by allowing multiple batches to be processed concurrently, as long as there are no dependencies or conflicts between them. Reference: Salesforce Integration Architecture Designer Resource Guide, page 21

• Option D is correct because Platform Shield Encryption allows you to encrypt standard fields and use them in workflow rules. Platform Shield Encryption uses AES 256-bit encryption to protect sensitive data at rest, while preserving platform functionality12
• Option A is incorrect because Cryptography Class is a set of Apex methods for creating digests, message authentication codes, signatures, and encryption. It does not provide a way to encrypt standard fields or use them in workflow rules3
• Option B is incorrect because Data Masking is a feature that replaces sensitive data in sandboxes with dummy data. It does not encrypt data in production or allow the use of encrypted data in workflow rules45
• Option C is incorrect because Classic Encryption is a feature that encrypts custom fields with 128-bit AES encryption. It does not support standard fields or workflow rules67

References: 1: Salesforce Shield - Data Monitoring & End to End Encryption 2: How Shield Platform Encryption Works 3: Crypto Class 4: Data Masking - Anonymize Sensitive Data 5: Secure Your Sandbox Data with Salesforce Data Mask 6: What’s the Difference Between Classic Encryption and Shield Platform Encryption? 7: Salesforce Classic vs. Salesforce Shield Platform Encryption: Which One Do You Need?

The system requirement is to expose data from the on-premise applications to Salesforce for a more unified user experience in real-time. The possible actions that can fulfill this requirement are:

• Answer B is valid because developing custom APIs on the company’s network that are invokable by Salesforce can allow Salesforce to access the data from the on-premise applications in real-time. However, this action requires opening a firewall port or using a reverse proxy to allow Salesforce to communicate with the on-premise APIs securely3
• Answer C is valid because deploying MuleSoft to the on-premise network and designing externally facing APIs to expose the data can also enable Salesforce to access the data from the on-premise applications in real-time. MuleSoft is an integration platform that can connect various systems and applications using APIs and standard protocols. MuleSoft can also handle security, orchestration, transformation, and other integration aspects.
• Answer A is not valid because developing an application in Heroku that connects to the on-premise database via an ODBC string and VPC connection is not a real-time solution. Heroku is a cloud platform that can host web applications and services, but it cannot expose data from an on-premise database directly to Salesforce. To use Heroku for this purpose, an ETL tool or a middleware solution would be needed to synchronize the data between the on-premise database and Heroku, which would introduce latency and complexity to the integration.
• Answer D is not valid because running a batch job with an ETL tool from an on-premise server to move data to Salesforce is also not a real-time solution. ETL stands for extract, transform, and load, which is a process of moving data from one system to another in batches. ETL tools can be used for data migration or integration, but they cannot provide real-time access to data from on-premise applications to Salesforce. ETL tools also have limitations on data volume, frequency, and reliability.

1: Bulk API Limits 2: Bulk API Features 3: Integrating with Salesforce using Custom Web Services : MuleSoft Overview : Heroku Overview : ETL Overview

Using request and reply is the recommended integration pattern for this use case because it allows the support agents to send a request to the core banking system and receive a response with the bank account ID in real-time. This way, the support agents can inform the customers with the newly created bank account ID without any delay or inconsistency. Using streaming API to generate push topic is not a good solution because it is used for event-driven integration, not for web-service integration. Using outbound message is also not a good solution because it is a Salesforce-specific feature that uses SOAP web services, which may not be compatible with the core banking system. Using Salesforce platform event is also not a good solution because it is used for event-driven integration, not for web-service integration. Reference: Salesforce Integration Architecture Designer Resource Guide, page 29-30

Change Data Capture (CDC) is the best option to meet the requirement. CDC is a type of streaming event that notifies subscribers of changes to Salesforce records, such as creation, update, delete, and undelete operations. By subscribing to CDC events for the course registration data, the LMS can receive real-time updates and sync with Salesforce. Streaming API is another type of streaming event that notifies subscribers of changes to Salesforce records that match a SOQL query. However, Streaming API has some limitations, such as not supporting all SOQL features and not capturing delete and undelete operations. Platform Event is a type of streaming event that delivers custom notifications within the Salesforce platform or from external sources. Platform Event is not suitable for this requirement because it is not tied to Salesforce records and requires custom logic to publish and subscribe. Outbound Message is a workflow action that sends SOAP messages with field values to designated endpoints. Outbound Message is not suitable for this requirement because it does not support complex data types, such as sObjects or collections.

This is because SSL/TLS mutual authentication is a security feature that allows Salesforce to verify the identity of the client that connects to its API endpoint on port 8443. To enable this feature, you need to upload a client certificate to Salesforce and assign the “Enforce SSL/TLS Mutual Authentication” user permission to the users who need to access the company portal. The other options are not sufficient for this scenario because:

• A, Enable My Domain and SSL/TLS, is a prerequisite for using SSL/TLS mutual authentication, but it does not ensure that all integrations use it. My Domain allows you to customize your Salesforce domain name and SSL/TLS provides encryption for your data in transit.
• C, Generate a Self-signed Certificate, is a step that you need to do on the client side to create a certificate that can be used for SSL/TLS mutual authentication, but it does not ensure that all integrations use it. You also need to upload the certificate to Salesforce and assign the user permission.
• D, Generate a CA-signed Certificate, is an alternative to generating a self-signed certificate, but it also does not ensure that all integrations use SSL/TLS mutual authentication. You still need to upload the certificate to Salesforce and assign the user permission.

References:

• Certificates in Mutual Authentication
• Configure Your API Client to Use Mutual Authentication
• Salesforce Mutual Authentication Setup

Using a Connected App for each external system integration is a good solution because it can provide security, auditing, and monitoring features for each integration. A Connected App is an application that can connect to Salesforce using APIs and OAuth as an authentication protocol. A Connected App can also enforce policies such as IP restrictions, login hours, and session timeout for each integration. Using a shared integration user for the three external system integrations is not a good solution because it violates the principle of least privilege, as well as makes it difficult to audit the activities of each system. Using a shared Connected App for the three external system integrations is also not a good solution because it does not allow for granular control and visibility of each integration. Using a unique integration user for each external system integration is not enough to meet the security and auditing requirements, as it does not provide any mechanism for authentication, authorization, or encryption. Reference: Salesforce Integration Architecture Designer Resource Guide, page 20-21

The three systems from the current system landscape that can be retired with the implementation of Salesforce are Case Management System, Sales Activity System, and Email Marketing System. These systems can be replaced by Salesforce Service Cloud, Sales Cloud, and Marketing Cloud respectively, which provide similar or better capabilities for managing cases, sales activities, and email campaigns. Option A is not correct because Order Management System cannot be retired with the implementation of Salesforce. The company wants to reuse their existing enterprise capabilities for order management processes, which are likely to be complex and customized. Salesforce does not provide a native order management solution for B2C commerce scenarios. Option E is not correct because Quoting System cannot be retired with the implementation of Salesforce. The company wants to reuse their existing enterprise capabilities for quoting processes, which are likely to be complex and customized. Salesforce does not provide a native quoting solution for B2C commerce scenarios.

 Make a callout to the payment gateway through ESB supporting error handling and logging for audit purposes. This solution meets the requirements of integrating with an external RESTful service, ensuring real-time updates to the CSR, and supporting post payment processes. ESB stands for Enterprise Service Bus, which is a software architecture model that allows communication between different applications via a common bus. ESB can handle the callout to the payment gateway service, and provide error handling, logging, routing, transformation, and orchestration capabilities. ESB can also integrate with other systems or services that are involved in the post payment processes, such as billing, invoicing, or reporting. References: Certification - Integration Architect - Trailhead, [Enterprise Integration Patterns]

A Connected App is a framework that enables an external application to integrate with Salesforce using APIs and standard protocols, such as OAuth. By configuring a Connected App in Salesforce, the integration can authenticate the middleware and grant access to the Salesforce data and services. This is a secure and flexible solution that does not require configuring Remote Site Settings, API Gateway, or Firewall and reverse proxy2

References: 1: BatchApexErrorEvent 2: Connected Apps

The integration architect should consider the impact of deleted records on system functionality, the ability to delete personal data in every system, and the ability to provide a 360-degree view of the customer. These are important requirements for ensuring that the company can comply with the privacy and data protection regulations, as well as deliver a customer-centric service. Option A is not correct because manual steps and procedures are not desirable for deleting personal data on demand. The integration architect should aim for an automated and reliable solution that minimizes human intervention and errors. Option D is not correct because restoring deleted records when needed may violate the privacy and data protection regulations, as well as the customer’s consent. The integration architect should ensure that the deletion of personal data is permanent and irreversible.

• Option C is correct because Salesforce should be the system of record for their customers and prospects, as it is the CRM solution that the sales and service associates use to view and log their interactions with them. Salesforce can also integrate with the Marketing and ERP solutions to display relevant information from those systems, such as campaign history, invoices, and orders12
• Option A is incorrect because ERP is not a suitable system of record for customers and prospects, as it is mainly focused on invoicing and order fulfillment. ERP may not have all the data that the sales and service associates need to interact with them, such as contact details, preferences, activities, and opportunities. ERP may also have different data models and definitions than Salesforce and Marketing, which can cause data quality and consistency issues3
• Option B is incorrect because Marketing is not a suitable system of record for customers and prospects, as it is mainly focused on email campaigns. Marketing may not have all the data that the sales and service associates need to interact with them, such as account information, service cases, contracts, and quotes. Marketing may also have different data models and definitions than Salesforce and ERP, which can cause data quality and consistency issues.
• Option D is incorrect because creating a new custom database for customers and prospects is not a feasible or efficient solution, as it would require additional development, maintenance, and integration costs. It would also create another layer of complexity and potential data duplication in the system landscape. Salesforce already provides a robust and flexible platform for managing customer and prospect data, which can be easily customized and integrated with other systems.

References: 1: Salesforce CRM - The Definitive Guide 2: Salesforce Integration Cloud - Connect Any App, Data, or Device 3: What Is ERP? | Oracle : Salesforce vs ERP: What’s the Difference? : Marketing Cloud - Digital Marketing Platform : Salesforce vs Marketing Cloud: What’s the Difference? : Salesforce Platform - Build Apps Fast : Why You Shouldn’t Build Your Own CRM System

Create a special user solely for the integration purposes. This is the first thing that the Architect should do when building a solution that allows a service to access Salesforce through the API. Creating a special user for the integration purposes can help to ensure security, accountability, and traceability of the API calls. The special user should have a unique username, password, security token, and profile that grants only the necessary permissions and access for the integration. The special user should also be assigned to an API-only user license type that prevents logging in to the Salesforce UI. References: Certification - Integration Architect - Trailhead, [User Licenses], [API User Permission]

• Option A is correct because Salesforce B2C Commerce to Service Cloud Connector is an integration solution that allows service agents to see order history from a B2C Commerce system. Salesforce B2C Commerce to Service Cloud Connector is a pre-built package that integrates Salesforce B2C Commerce and Service Cloud using REST APIs and Platform Events. It enables service agents to view, edit, cancel, and refund orders from B2C Commerce within the Service Cloud console. It also supports features such as customer verification, order search, order details, and order history.
• Option B is incorrect because a REST API offered by Commerce Platform is not an integration solution that allows service agents to see order history from a B2C Commerce system. A REST API offered by Commerce Platform is a set of web services that expose the functionality and data of the Commerce Platform to external applications. It can be used to create, update, delete, or query resources such as products, catalogs, customers, or orders. However, a REST API offered by Commerce Platform is not a complete integration solution, as it requires additional development, configuration, and maintenance to connect with Service Cloud and display the order history in the Service Cloud console.
• Option C is incorrect because Mulesoft Anypoint Platform is not an integration solution that allows service agents to see order history from a B2C Commerce system. Mulesoft Anypoint Platform is a platform that enables developers to build, manage, and monitor integrations and APIs across various systems and applications. It can be used to connect Salesforce B2C Commerce and Service Cloud using various connectors, protocols, and transformations. However, Mulesoft Anypoint Platform is not a pre-built integration solution, as it requires additional development, configuration, and maintenance to connect with Service Cloud and display the order history in the Service Cloud console.
• Option D is incorrect because a REST API offered by Salesforce Platform is not an integration solution that allows service agents to see order history from a B2C Commerce system. A REST API offered by Salesforce Platform is a set of web services that expose the functionality and data of the Salesforce Platform to external applications. It can be used to create, update, delete, or query resources such as objects, records, metadata, or Apex classes. However, a REST API offered by Salesforce Platform is not a complete integration solution, as it requires additional development, configuration, and maintenance to connect with B2C Commerce and display the order history in the Service Cloud console.

References: Salesforce B2C Commerce to Service Cloud Connector : Salesforce B2C Commerce to Service Cloud Connector Implementation Guide : Commerce API Explorer : MuleSoft | Integration Platform for Connecting SaaS and Enterprise Applications : REST API Developer Guide

The HttpCalloutMock interface allows testing HTTP callouts by returning a predefined response in a test context. By implementing HttpCalloutMock to return responses per RAML specification, the Apex REST API Clients unit tests can confirm that the API requests and responses match the expected format and values. Calling the Apex REST API Clients in a test context to get the mock response is also necessary to verify the adherence to the RAML specs. Calling the HttpCalloutMock implementation from the Apex REST API Clients or requiring the Apex REST API Clients to implement the HttpCalloutMock are not valid options because the HttpCalloutMock interface is implemented by a separate class that is passed as a parameter to the Test.setMock method2

References: 1: Idempotent REST APIs 2: Testing HTTP Callouts by Implementing the HttpCalloutMock Interface

An API gateway is a component that acts as a single point of entry for all cloud applications to access on-premise resources and services. It can provide security, routing, transformation, and other features to facilitate integration. An API gateway component should be deployable behind a DMZ or perimeter network, which is a subnetwork that separates the internal network from the external network and provides an additional layer of security. The middleware solution should also be capable of establishing a secure API gateway between cloud applications and on-premise resources, which may involve using protocols such as HTTPS, SSL/TLS, or VPN. The OAuth security protocol is not a requirement for choosing a middleware solution, as it is a standard for authorizing access to resources on behalf of a user. The middleware solution’s ability to interface directly with databases via an ODBC connection string is also not a requirement, as it is a specific feature that may or may not be needed depending on the integration scenario. Reference: Salesforce Integration Architecture Designer Resource Guide, page 14-15

 Idempotent design means that the same request can be repeated multiple times without changing the outcome. This is useful for avoiding duplicate orders in case of network failures or timeouts. By implementing idempotent design, the sales representatives can retry the order(s) in question without creating duplicates in the manufacturing system. Outbound messaging is not a reliable solution because it does not guarantee delivery or acknowledgement of messages. Scheduled apex is not a real-time solution and may not catch all the duplicate or missing orders

Data Visualization is the type of integration that allows users to view real-time data from an external system without storing it in Salesforce. This can be achieved by using Lightning Web Components, Visualforce pages, or Canvas apps that display data from the external system using APIs or web services. Data Synchronization, Process Orchestration, and Batch Processing are types of integration that involve moving data between systems, which is not required by the business requirement. Reference: Salesforce Integration Architecture Designer Resource Guide, page 9

This is because Bulk API is a RESTful API that is optimized for loading or deleting large sets of data asynchronously. By processing jobs in parallel mode, you can take advantage of the multiple resources available on the Salesforce platform and speed up the data load. The other options are not suitable for this scenario because:

• B, Contact Salesforce support to schedule performance load, is not a valid option as Salesforce does not offer such a service. You are responsible for optimizing your own data load performance.
• C, Use Bulk API to process jobs in serial mode, is a slower option than parallel mode as it processes one batch at a time. This is only recommended when you have dependencies between records or when you want to preserve the order of records.
• D, Use Bulk API to process jobs in high performance mode, is not a valid option as there is no such mode in Bulk API. You can only choose between parallel and serial modes.

References:

• Introduction to Bulk API 2.0 and Bulk API
• Use Bulk API 2.0 Unit

Remote Site Settings and Named Credentials are solutions that should be implemented to minimize potential downtime for users in this situation. Remote Site Settings allow you to specify external domains that your organization can access during API calls or integrations. Named Credentials allow you to store authentication information for external services in a secure way. By using Named Credentials, you can easily update the URL of the external service without changing any code or configuration that references it. Enterprise Service Bus (ESB) and Remote Site Settings are not solutions that should be implemented in this situation because ESB is a middleware that facilitates communication between different systems, not a way to update the URL of an external service. Event Monitoring and Content Security Policies are also not solutions that should be implemented in this situation because Event Monitoring is used to track user activity and performance metrics, not to monitor external service availability. Content Security Policies are used to control what resources can be loaded on a web page, not to update the URL of an external service.

Using Salesforce custom object, custom REST API and ETL is a better solution than using Salesforce standard object, REST API and ETL. A custom object can store the order information and provide more flexibility and control over the data model, validation rules, triggers, etc. A custom REST API can be used to create orders in real time from Salesforce, using the ESB as a proxy to communicate with the legacy system. An ETL tool can be used to sync the order history and status from the legacy system to Salesforce, using the last modified date as a filter. This way, sales reps can see the order history and the most up-to-date information on current order status, and managers can run reports on order volumes and fulfillment timelines. A standard object, such as Order, may not meet all the business requirements and may require more customization than a custom object. A standard REST API may not provide enough security and error handling for creating orders in real time. Reference: Salesforce Integration Architecture Designer Resource Guide, page 18

The integration architect should consider whether the fulfillment system can make a callback into Salesforce and whether it can implement a contract-first Outbound Messaging interface. A callback is a way for the fulfillment system to send a response or an acknowledgment back to Salesforce after receiving an order1. This can help ensure data consistency and reliability between the two systems. A contract-first Outbound Messaging interface is an approach where the integration is designed based on a predefined XML schema that defines the structure and content of the messages2. This can help ensure interoperability and compatibility between the two systems. The other two questions are not relevant for the integration architect to consider. The fulfillment system does not need to create new addresses within the Order Create service, as this is a function of Salesforce3. The product catalog data does not need to be identical at all times in both systems, as long as there is a mapping or synchronization mechanism to handle any discrepancies

 Outbound Message is a SOAP-based notification service that sends information about changes in Salesforce to a specified endpoint. It is a type of Remote Process Invocation—Fire and Forget integration pattern, which means that Salesforce does not wait for a response from the external system. Outbound Message can be configured using workflow rules or process builder, and it can include a subset of fields of the object that triggered the message. Outbound Message requires the external system to expose a SOAP web service that conforms to the WSDL generated by Salesforce1.

SOAP API is a way to access Salesforce data and functionality using SOAP (Simple Object Access Protocol), which is a standard XML-based protocol for exchanging structured data over the web. SOAP API can be used for both inbound and outbound integration, and it supports two types of WSDL (Web Service Description Language) files: Enterprise and Partner. Enterprise WSDL is a strongly typed WSDL file that is specific to an organization’s Salesforce configuration. It can be used when the client application knows the objects and fields it needs to access at compile time. Partner WSDL is a loosely typed WSDL file that is generic for any organization. It can be used when the client application needs to access data dynamically at run time2.

Therefore, the correct answer is A, because Outbound Message is suitable for Fire and Forget integration from Salesforce to the legacy system, and SOAP API using Enterprise WSDL is suitable for getting response back in a strongly typed format from the legacy system to Salesforce.

References: 1: Remote Process Invocation—Fire and Forget | Integration Patterns and Practices | Salesforce Developers 2: SOAP API Developer Guide | SOAP API Basics | Salesforce Developers