Integration-Architect Practice Exam Questions and Answers

Named Credentials and Protected Custom Settings are two persistence mechanisms that can be used to ensure that secrets are protected from deliberate or inadvertent exposure. Named Credentials allow you to specify the URL of a callout endpoint and its required authentication parameters in one definition. Salesforce manages all the authentication for Apex callouts that specify a namedcredential as the callout endpoint, and you don’t have to add more authentication logic in your Apex code. Named Credentials can be defined to provide a secure and convenient way of settingup authenticated callouts, and they can also be usedin Lightning components, Visualforce pages, and flows1.

Protected Custom Settings are a type of custom settings that store application-specific data that is hidden from subscribers. They are only accessible by the managed package that created them, and they canbe used to store secrets such as encryption keys, passwords, or tokens. Protected Custom Settings can be accessed by Apex code, formulas, or validation rules within the same namespace as the settings2.

Encrypted Custom Fields are not a suitable mechanism for storing secrets, because they are not designed to prevent unauthorized access to sensitive data. Encrypted Custom Fields allow you to encrypt text fields using a standard encryption scheme. The encrypteddata is masked in reports, list views, and search results, but it can still be viewed by users who have the “View Encrypted Data” permission. Encrypted Custom Fields are intended to protect data from unauthorized access by users within your organization, not from external threats or malicious code3.

Protected Custom Metadata Types are another type of custom metadata types that store application-specific data that is hidden from subscribers. They are similar to Protected Custom Settings, but they have some advantages such as being deployable using change sets or Metadata API, being accessible by SOQL queries, and being able to reference other metadata types or settings. However, Protected Custom Metadata Types cannot be used to store secrets, because they do not support encryption or masking of sensitive data. Protected Custom Metadata Types are intended to store configuration datathat is specific to your managed package, not secrets that need to be secured.

Therefore, the correct answer is B and D, because Named Credentials and Protected Custom Settings are the only persistence mechanisms that can be used to securely store secretsin Salesforce.

Answer A is valid because the Remote Process Invocation fire and forget pattern allows sending a message from Salesforceto the ERP system without waiting for a response or acknowledgement. This enables near real-time integration and reduces the latency and complexity of the integration. The Flow Builder is a low code tool that can be used to invoke an Apex actionthat makes the HTTP callout to the REST endpoint on insert of the order object12

Answer C is valid because the Change Data Capture feature allows capturing changes in Salesforce data and publishing them as eventsto a streaming channel. The middleware can subscribe to the channel and receive the events that contain the order details. The replay Id is a unique identifier for each event that can be used by the middleware to resume from the last processed event in case of failures or interruptions. This ensures reliable and consistent integration between Salesforce and the ERP system3

Answer B is not valid because the Outbound Messaging feature uses SOAP messages to send notifications to external systems based on workflow rules. This requires configuring a SOAP endpoint and a WSDL file for the ERP system, which may not be compatible with the REST endpoint requirement. Moreover, Outbound Messaging does not guarantee delivery or order of messages, which may affect the accuracy and timeliness of the integration.

Answer D is not valid because the Platform Event feature allows publishing custom events from Salesforce to external systems or vice versa using a publish/subscribe model. However, this requires creating a platform event object and defining its fields and permissions, which may notbe a low code solution. Moreover, using the record type as the platform event name may not be a valid or meaningful option, as record types are used to define different business processes or user interfaces for an object.

1:Remote Process Invocation—Fire and Forget 2: Invoke an Apex Class That Makes a Callout 3: Change Data Capture : Replay Events Using Middleware : Outbound Messaging Implementation Guide : Platform Events Developer Guide