Salesforce Integration-Architect Salesforce Certified Platform Integration Architect (Plat-Arch-204) Exam Practice Test

The three systems from the current system landscape that can beretired with the implementation of Salesforce are Case Management System, Sales Activity System, and Email Marketing System. These systems can be replaced by Salesforce Service Cloud, Sales Cloud, and Marketing Cloud respectively, which provide similar orbetter capabilities for managing cases, sales activities, and email campaigns. Option A is not correct because Order Management System cannot be retired with the implementation of Salesforce. The company wants to reuse their existing enterprise capabilities for order management processes, which are likely to be complex and customized. Salesforce does not provide a native order management solution for B2C commerce scenarios. Option E is not correct because Quoting System cannot be retired with the implementation of Salesforce. The company wants to reuse their existing enterprise capabilities for quoting processes, which are likely to be complex and customized. Salesforce does not provide a native quoting solution for B2C commerce scenarios.

Answer A is valid because the Remote Process Invocation fire and forget pattern allows sending a message from Salesforceto the ERP system without waiting for a response or acknowledgement. This enables near real-time integration and reduces the latency and complexity of the integration. The Flow Builder is a low code tool that can be used to invoke an Apex actionthat makes the HTTP callout to the REST endpoint on insert of the order object12

Answer C is valid because the Change Data Capture feature allows capturing changes in Salesforce data and publishing them as eventsto a streaming channel. The middleware can subscribe to the channel and receive the events that contain the order details. The replay Id is a unique identifier for each event that can be used by the middleware to resume from the last processed event in case of failures or interruptions. This ensures reliable and consistent integration between Salesforce and the ERP system3

Answer B is not valid because the Outbound Messaging feature uses SOAP messages to send notifications to external systems based on workflow rules. This requires configuring a SOAP endpoint and a WSDL file for the ERP system, which may not be compatible with the REST endpoint requirement. Moreover, Outbound Messaging does not guarantee delivery or order of messages, which may affect the accuracy and timeliness of the integration.

Answer D is not valid because the Platform Event feature allows publishing custom events from Salesforce to external systems or vice versa using a publish/subscribe model. However, this requires creating a platform event object and defining its fields and permissions, which may notbe a low code solution. Moreover, using the record type as the platform event name may not be a valid or meaningful option, as record types are used to define different business processes or user interfaces for an object.

1:Remote Process Invocation—Fire and Forget 2: Invoke an Apex Class That Makes a Callout 3: Change Data Capture : Replay Events Using Middleware : Outbound Messaging Implementation Guide : Platform Events Developer Guide

Remote Site Settings and Named Credentials are solutions that should be implemented to minimize potential downtime for users in this situation. Remote Site Settings allow you to specify external domains that your organization can access during API calls or integrations. Named Credentials allow you to store authentication information for external services in a secure way. By using Named Credentials, you can easily update the URL of the external service without changing any code or configuration that references it. Enterprise Service Bus (ESB) and Remote Site Settings are not solutions that should be implemented in this situation because ESB is a middleware that facilitates communication between different systems, not a way to update the URL of an external service. Event Monitoring and Content Security Policies are also not solutions that should be implemented in this situation because Event Monitoring is used to track user activity and performance metrics, not to monitor external service availability. Content Security Policies are used to control what resources can be loaded on a web page, not to update the URL of an external service.

The integration consultant should consider the following authorization and authentication needs while integrating the DMS and ESB with Salesforce:

Users should be authorized to view information specific to the customer they are servicing without a need to search for customer. This means that the integration should providea seamless and contextual access to the customer billing information and generated bills from the DMS and ESB, based on the customer record or case that the user is working on in Salesforce.

Consider Enterprise security needs for access to DMS and ESB. This means that the integration should comply with the security policies and standards of the Enterprise, such as encryption, auditing, logging, monitoring, etc.

Users should be authenticated into DMS and ESB without having to enter username and password. This means that the integration should use a single sign-on (SSO) mechanism that allows users to access multiple systems with one login credential, such asOAuth or SAML34

The mobile device should make a REST Apex inbound call to meet the requirement. A REST Apex inbound call allows the mobile device to invoke custom Apex logic on Salesforce using a RESTful interface. The Apex logiccan then access the geolocation field using the user’s OAuth token and update it with the GPS coordinates from the mobile device. The geolocation field is secured with Field Level Security, so the user can view the value without changing it. A SOAP API inbound call or a REST API inbound call would not be able to access the custom geolocation field, as they are not supported by the standard Salesforce objects and fields. Reference: Salesforce Integration Architecture Designer Resource Guide, page 20

The integration consultant should consider the following authorization and authentication needs while integrating the DMS and ESB with Salesforce:

Users should be authorized to view information specific to the customer they are servicing without a need to search for customer. This means that the integration should provide a seamless and contextual access to the customer billing information and generated bills from the DMS and ESB, based on the customer record or case that the user is working on in Salesforce.

Consider Enterprise security needs for access to DMS and ESB. This means that the integration should comply with the security policies and standards of the Enterprise, such as encryption, auditing, logging, monitoring, etc.

Users should be authenticated into DMS and ESB without having to enter username and password. This means that the integration should use a single sign-on (SSO) mechanism that allows users to access multiple systems with one login credential, such as OAuth or SAML.

Change Data Capture is a feature that enables you to receive near-real-time changes of Salesforce records, including create, update, delete, and undelete operations. Change Data Capture retainschange events in the event bus for up to three days, so you can resume data replication from the point of failure. Change Data Capture also provides a consistent and reliable way to synchronize data changes with external systems, without the need for custom triggers or code. Reference: Salesforce Integration Architecture Designer Resource Guide, page 24

Therequirements that the integration architect should evaluate while designing the integration needs of this project are:

Assess security requirements for internal systems and decide Integration methods that support the requirements.

Evaluate the build of acustom authentication mechanism for users in each country and support for customers and partners.

Evaluate Salesforce native authentication mechanism for all users including customers and partners.

The integration architect should assess the security requirements for internal systems, such as the ERP system and other systems that will be integrated with Salesforce for Sales and Support business processes. The security requirements may include authentication protocols, encryption standards, data access policies, and compliance regulations. The integration architect should then decide on the integration methods that support these requirements, such as SOAP or REST APIs, middleware solutions, or connectors. The integration architect should also evaluate the build of a custom authentication mechanism for users in each country and support for customers and partners. A custom authentication mechanism may be necessary to integrate with the local active directory of each country and provide a seamless user experience. The integration architect should also consider how to support customers and partners who have different authentication options, such as self-registration or Google login. The integration architect should also evaluate Salesforce native authentication mechanism for all users including customers and partners. Salesforce native authentication mechanism is a built-in feature that allows users to log in to Salesforce with their username and password. Salesforce native authentication mechanism may be simpler and easier to implement than a custom or third-party solution, but it may not meet all the security requirements or user preferences. The integration architect should compare the pros and cons of each option and choose the best one for the project. Evaluating Salesforce solution for customers and for partners, using third party solution for internal users is not a valid requirement because it does not address the need to authenticate internal users with their local active directory. Considering third party Single Sign On solution supporting all user authentication including customer and partner is not a valid requirement because it does not address the need to integrate with internal systems and their security requirements.

The continuation class in Apex allows you to makelong-running requests to external web services and process their responses in a callback method. This is useful for scenarios where the response time exceeds the normal Apex limits, such as 10 seconds for synchronous transactions or 120 seconds for asynchronous transactions. By using continuation, you can avoid hitting these limits and provide a better user experience1

Option D is correct because Tooling API is the Salesforce API that can be used to retrieve code coverage and test results for Apex classes and triggers. Tooling API provides REST and SOAP interfaces to access metadata about code, execute tests, and get test results12

Option A is incorrect because SOAP API is a Salesforce API that can be used to create, retrieve, update, or delete records, but not to get code coverage and test results. SOAP API uses a WSDL file to define the parameters for accessing data through the API3

Option B is incorrect because Analytics REST API is a Salesforce API that can be used to access data from reports and dashboards, but not from code coverage and test results. Analytics RESTAPI provides a programmatic way to interact with analyticsfeatures such as lenses, datasets, and dashboards4

Option C is incorrect because Metadata API is a Salesforce API that can be used to retrieve, deploy, create, update, or delete customization information, such as custom object definitions and page layouts, but not code coverage and test results. Metadata API is mainlyused for development tools or backup tools5

The best solution for this scenario is to use a custom object to store the file location URL and redirect the community user to the on-premise file store when they click on the URL.This way, the community user can access the large design files without having to download them or use any external data source. Option A is not feasible because the Request and Reply integration pattern is not suitable for large files and would cause performance issues. Option B is not correct because Salesforce Connect cannot upload files to an external object, only data. Option D is not possible because Salesforce Files has a limit of 2 GB per file, and the design files are 2.5 GB in size. References:

Salesforce Connect Developer Guide

Salesforce Files Developer Guide

The recommendations that the Salesforce integration architect should make to fulfill the requirements around caching, queuing, error handling, alerts, retries, event handling, etc. arebased on the best practices and capabilities of the middleware tools. The recommendation B is valid because middleware tools can provide true message queueing for integration scenarios that require asynchronous processing, guaranteed delivery, load balancing, etc. The recommendation D is valid because middleware tools can handle various events that may occur during the integration process, such as logging errors, sending notifications, triggering recovery actions, etc. The recommendation E is valid becausemiddleware tools can support the publish/subscribe pattern for event-driven integration, where the middleware can route messages from publishers to subscribers based on topics or filters. The recommendation A is not valid because transforming a fire-and-forget mechanism to request-reply does not improve performance, but rather increases the latency and complexity of the integration. The recommendation C is not valid because message transformation and protocol translation are tasks that are better suited for middleware tools than Salesforce, as they can handle different formats and protocols more efficiently and flexibly23

1: Integration Architecture Designer Resource Guide 2: Integration Patterns and Practices 3: Salesforce Integration Architecture Designer Certification Exam Guide

Visually monitor in the Salesforce UI using the “Bulk Data Load Jobs” in Salesforce in the setup menu, and use the getBatchInfo method in the Java application to monitor the status of the jobs from the Java application. These two methods can help the Technical Architect to monitor the nightly batch loads into Salesforce from an external system with a custom Java application using the Bulk API. The “Bulk Data Load Jobs” page in Salesforce shows the status, progress, and results of each batch load job. The getBatchInfo method in the Java application returns a BatchInfo object that contains information about a batch, such as its ID, state, number of records processed, and number of errors. References: Certification - Integration Architect - Trailhead, [Bulk API Developer Guide]

The Data Virtualization pattern allows Salesforce to access external data sources without storing the data in Salesforce. This reduces the data storage and synchronization costs and enables real-time access to the historical data. Salesforce Connect can be used to consume OData endpoints exposed by the ESB tool and display the external objects as related lists or custom components on the Case object

The recommended solution is to use a time-based workflow rule. A time-based workflow rule is a type of workflow rulethat executes actions at a specific time, such as a certain number of days before or after a record field value. By using a time-based workflow rule, you can send an email alert to the contacts of the accounts that do not qualify for a business extension for the next month, and include a meeting invite in the email. This solution can handle large volumes of data and does not require any custom code. Using batch Apex, process builder, or trigger is not a recommended solution because they are more complex andrequire custom code or configuration. Batch Apex is a way to run large-scale and long-running jobs that operate on many records. Process builder is a tool that lets you automate business processes by creating a process with criteria and actions. Trigger is a type of Apex code that executes before or after database operations, such as insert, update, delete, or undelete.

 Outbound Message is a SOAP-based notification service that sends information about changes in Salesforce to a specified endpoint. It is a type of Remote Process Invocation—Fire and Forget integration pattern, which means that Salesforce does not wait for a response from the external system. Outbound Message can be configured using workflow rules or process builder, and it can include a subset of fields of the object that triggered the message. Outbound Message requires the external system to expose a SOAP web service that conforms to the WSDL generated by Salesforce1.

SOAP API is a way to access Salesforce dataand functionality using SOAP (Simple Object Access Protocol), which is a standard XML-based protocol for exchanging structured data over the web. SOAP API can be used for both inbound and outbound integration, and it supports two types of WSDL (Web Service Description Language) files: Enterprise and Partner. Enterprise WSDL is a strongly typedWSDL file that is specific to an organization’s Salesforce configuration. It can be used when the client application knows the objects and fields it needs to accessat compile time. Partner WSDL is a loosely typed WSDL file that is generic for any organization. It can be used when the client application needs to access data dynamically at run time2.

Therefore, the correct answer is A, because Outbound Message is suitable for Fire and Forget integration from Salesforce to the legacy system, and SOAP API using Enterprise WSDL is suitable for getting response back in a strongly typed format from the legacy system to Salesforce.

The maximum calloutsin a single Apex transaction is one of the factors that should be considered when choosing Apex code to make callouts to an external system. The limit is 100 callouts per transaction, and if this limit is exceeded, a LimitException is thrown. Therefore, the integration architect should evaluate the expected volume and frequency of the callouts and design the solution accordingly2

Using request and reply is the recommended integration pattern for this use case because it allows the support agents to send a request to the core banking system and receive a response with the bank account ID in real-time. This way, the support agents can inform the customers with the newly created bank account ID without anydelay or inconsistency. Using streaming API to generate push topic is not a good solution because it is used for event-driven integration, not for web-service integration. Using outbound message is also not a good solution because it is a Salesforce-specific feature that uses SOAP web services, which may not be compatible with the core banking system. Using Salesforce platform event is also not a good solution because it is used for event-driven integration, not for web-service integration. Reference: Salesforce Integration Architecture Designer ResourceGuide, page 29-30

Named Credentials and Protected Custom Settings are two persistence mechanisms that can be used to ensure that secrets are protected from deliberate or inadvertent exposure. Named Credentials allow you to specify the URL of a callout endpoint and its required authentication parameters in one definition. Salesforce manages all the authentication for Apex callouts that specify a namedcredential as the callout endpoint, and you don’t have to add more authentication logic in your Apex code. Named Credentials can be defined to provide a secure and convenient way of settingup authenticated callouts, and they can also be usedin Lightning components, Visualforce pages, and flows1.

Protected Custom Settings are a type of custom settings that store application-specific data that is hidden from subscribers. They are only accessible by the managed package that created them, and they canbe used to store secrets such as encryption keys, passwords, or tokens. Protected Custom Settings can be accessed by Apex code, formulas, or validation rules within the same namespace as the settings2.

Encrypted Custom Fields are not a suitable mechanism for storing secrets, because they are not designed to prevent unauthorized access to sensitive data. Encrypted Custom Fields allow you to encrypt text fields using a standard encryption scheme. The encrypteddata is masked in reports, list views, and search results, but it can still be viewed by users who have the “View Encrypted Data” permission. Encrypted Custom Fields are intended to protect data from unauthorized access by users within your organization, not from external threats or malicious code3.

Protected Custom Metadata Types are another type of custom metadata types that store application-specific data that is hidden from subscribers. They are similar to Protected Custom Settings, but they have some advantages such as being deployable using change sets or Metadata API, being accessible by SOQL queries, and being able to reference other metadata types or settings. However, Protected Custom Metadata Types cannot be used to store secrets, because they do not support encryption or masking of sensitive data. Protected Custom Metadata Types are intended to store configuration datathat is specific to your managed package, not secrets that need to be secured.

Therefore, the correct answer is B and D, because Named Credentials and Protected Custom Settings are the only persistence mechanisms that can be used to securely store secretsin Salesforce.

Using an Enterprise Service Bus (ESB) to determine which shipping service to use, and transform requests to the necessary format is a good solution because it can provide routing, transformation, mediation, and orchestration capabilities for integrating different services. An ESB can also abstract the complexity and heterogeneity of the services from the client application, which simplifies the integration. Using Outbound Messaging to requestcosts and delivery times from Shipper delivery services with automated error retry is not a good solution because Outbound Messaging is a Salesforce-specific feature that uses SOAP web services, which may not be compatible with all shipping services. UsingAPEX REST Service to implement routing logic to the various shipping service is also not a good solution because it can introduce performance and scalability issues, as well as increase the maintenance cost and complexity of the code. Using Enterprise Service Bus user interface to collect shipper-specific form data is not a valid option because an ESB does not have a user interface component. Reference: Salesforce Integration Architecture Designer Resource Guide, page 16-17

The considerations that an Integration Architect should do prior to the implementation of Shield Platform Encryption are:

Review shield platform encryptionconfigurations.

Encrypt all the data so that it is secure.

Shield Platform Encryption is a feature that allows you to encrypt sensitive data at rest in Salesforce, such as social security numbers, without compromising critical platform functionality. Before implementing Shield Platform Encryption, you should review the shield platform encryption configurations, such as the encryption key management, the encryption policy, and the encrypted fields and files. You should also encrypt all the data that is subject to encryption, not just the data using the most current key. Encrypting all the data ensures that your data is secure and compliant with your business requirements. Encrypting the data using the most current key is not a valid consideration because Shield Platform Encryption uses a deterministic encryption scheme that does not allow you to rotate or re-encrypt your data with a new key. Using Shield Platform Encryption as a user authentication or authorization tool is not a valid consideration because Shield Platform Encryption is not designed for that purpose. Shield Platform Encryption only encrypts data at rest, not in transit or in use.

 Make a callout to the payment gateway through ESB supporting error handling and logging for audit purposes. This solution meets the requirements of integrating with an external RESTful service, ensuring real-time updates to the CSR, and supporting post payment processes. ESB stands for Enterprise Service Bus, which is a software architecture model that allows communication between different applications via a common bus. ESB can handle the callout to the payment gateway service, and provide error handling, logging, routing, transformation,and orchestration capabilities. ESB can also integrate with other systems or services that are involved in the post payment processes, such as billing, invoicing, or reporting. References: Certification - Integration Architect - Trailhead, [Enterprise Integration Patterns]

This is because SSL/TLS mutual authentication is a security featurethat allows Salesforce to verify the identity of the client that connects to its API endpoint on port 8443. To enable this feature, you need to upload a client certificate to Salesforce and assign the “Enforce SSL/TLS Mutual Authentication” user permission to the users who need to access the company portal. The other options are not sufficient for this scenario because:

A, Enable My Domain and SSL/TLS, is a prerequisite for using SSL/TLS mutual authentication, but it does not ensure that all integrations use it. My Domain allows you to customize your Salesforce domain name and SSL/TLS provides encryption for your data in transit.

C, Generate a Self-signed Certificate, is a step that you need to do on the client side to create a certificate that can be usedfor SSL/TLS mutual authentication, but it does not ensure that allintegrations use it. You also need to upload the certificate to Salesforce and assign the user permission.

D, Generate a CA-signed Certificate, is an alternative to generating a self-signedcertificate, but it also does not ensure that all integrations use SSL/TLS mutual authentication. You still need to upload the certificate to Salesforce and assign the user permission.

 Both Platform Events and Outbound Message offer declarative means for asynchronous near-real time needs. They aren’t best suited for real-time integrations (A). In both Platform Events and Outbound Messages, the event messages are retried by and delivered in sequence, and only once. Salesforce ensures there is no duplicate message delivery (B). Message sequence is possible in Outbound Message but not guaranteed with PlatformEvents. Both offer very high reliability. Fault handling and recovery are fully handled by Salesforce ©. Number of concurrent subscribers to Platform Events is capped at 2,000. An Outbound Message configuration can pass only 100 notifications in a single message to a SOAP end point (D). Both Platform Events and Outbound Message are highly scalable. However, unlike Outbound Message, only Platform Events have Event Delivery and Event Publishing limits to be considered (E). Reference: Salesforce Integration Architecture Designer Resource Guide, page 23

Answer D is valid because using middleware to handle the call out to the 10 different verification services is a scalable and reliable solution that can handle the complexity and variability of the integration. The middlewarecan orchestrate the calls to the different web services, consolidate the verification results, and handle any errors or retries. The middleware can then make a call-in to Salesforce and update the verificationstatus to “verified” using an API or a platform event12

Answer A is not valid because using Salesforce external service to make the call out to the 10 different verification services is not a feasible or efficient solution. Salesforce external service is a feature that allows invoking anexternal service from a flow and mapping its inputs and outputs to flow variables. However, this feature requires configuring an Apex action, a named credential, and an external service definition for each web service, which is not a low code solution. Moreover, this feature does not support checking the verification agencies untilthe result is verified, as it only invokes the external service once per flow interview3

Answer B is not valid because creating a trigger on the trainer record to make a callout to each verification agency is not a recommended or robust solution. Triggers are Apex code that execute before or after database events, such as insert, update, or delete. However, triggers cannot make callouts directly, as they are part of a database transaction and must complete quickly. To make a callout from a trigger, an asynchronous process such as a future method or a queueablejob must be used, which adds complexity and overhead to the integration. Moreover, triggershave limits on the number of callouts and asynchronous calls they can make per transaction, which may affect the scalability and reliability of the integration.

Answer C is not valid because making an Apex callout using @future annotation to make the call out to all different agencies is not a suitable or reliable solution. The @future annotation allows marking a method for execution at a later time when system resources become available. However, this annotation has several limitations and drawbacks, such as:

Future methods cannot return values, so they cannot update the trainer status to “verified” directly.

Future methods have limits on the number of callouts andfuture calls they can make per execution, which may affect the scalability and reliability of the integration.

Future methods run in their own thread and do not share any static variables or state with other methods, which makes it difficult to consolidatethe verification results from different agencies.

Future methods are not guaranteed to execute at a specific time or order, which may affect the timeliness and accuracy of the integration.

1: Orchestration Pattern 2: RemoteProcess Invocation—Request and Reply 3: External Services : Apex Developer Guide: Triggers : Apex Developer Guide: Using Future Methods

Using a Connected App for each external system integration is a good solution because it can provide security, auditing, and monitoring features for each integration. A Connected App is an application that can connect to Salesforce using APIs and OAuth as an authentication protocol. A Connected App can also enforce policies such as IP restrictions, login hours, and session timeout for each integration. Using a shared integration user for the three external system integrations is not a good solution because it violates the principle of least privilege, as well as makes it difficult to audit the activities of each system. Using a shared Connected App for the three external system integrationsis also not a good solution because it does not allow for granular control and visibility of each integration. Using a unique integration user for each external system integration is not enough to meet the security and auditing requirements, as it does not provide any mechanism for authentication, authorization, or encryption. Reference: Salesforce Integration Architecture Designer Resource Guide, page 20-21

The message durability considerations that an Integration Architect should make when designing a solution to meet these business requirements are:

When subscribing to Salesforce Event bus, ReplayID is used with a value of -2 to be able to see old and new events.

High-volume event messages are stored for 72 hours (three days).

A Salesforce Event bus is a messaging service that allows you to publish and subscribe to events inSalesforce or from external sources. ReplayID is a property of an event message that indicates its position in the event stream. By using ReplayID with a value of -2, you can replay all events stored in the retention window, which can help you see the stages of order processing in Salesforce. High-volume event messages are a type of event message that can handle large volumes of data and are optimized for performance and scalability. High-volume event messages are stored for 72 hours (three days) in the event bus, which means they can be replayed within that time frame. The other options are not correct. Using ReplayID with a value of -1 means you can only see new events that are published after your subscription. High-volume event messages are not stored for 24 hours (one day), but for 72 hours (three days).

Option A is correct because using ESB (Mule) with cache/state management can help to handle the long-running requests from Salesforce and return a request ID or a response if available from the external systems. This way, Salesforce does not have to wait for the externalsystems to respond and can avoid the API gateway timeout1

Option C is correct because using Continuation callouts can make the eligibility check request from Salesforce from Lightning UI at page load without blocking the UI thread. Continuation callouts are asynchronous and can handle long-running requestsup to 60 seconds23

Option E is correct because implementing a ‘Check Update’ button that passes a requestID received from ESB can allow the user to manually check the status of the eligibility check request. This can be useful when theresponse is not available within the Continuation timeout limit or when the user wants to refresh the data4

Option B is incorrect because recommending synchronous Apex callouts from Lightning UI to External Systems via Mule and implementing polling on APIgateway timeout can cause performance issues and user frustration. Synchronous Apex callouts block the UI thread and can only handle requests up to 120 seconds. Polling on API gateway timeout can increasethe network traffic and consume the callout limits25

Option D is incorrect because creating a Platform Event in Salesforce via Remote-Call-In and using the empAPI in the lightning UI to serve 3,000 concurrent users can introduce complexity and scalability issues. Platform Events are meant for event-driven architecture and not for request-response scenarios. Remote-Call-In requires an additional license and configuration. empAPI has a limit of 1,000 concurrent subscribers per channel678

 The OAuth protocol is a standard way to authorizeaccess to web resources. By configuring a connected app with an authorization endpoint of the API gateway, Salesforce can obtain an access token from the API gateway and use it to invoke the external API securely. This avoids the need to manage certificates oruser credentials for authentication2

The first thing an integration architect should validate if a callout from a Lightning Web Component to an external endpoint is failing is the endpoint domain has been added to Cross-Origin Resource Sharing (CORS). CORS is a mechanism that allows web browsers to make requests to servers on different origins, such as different domains, protocols, orports. CORS requires the server to send back a special header that indicates whether the browser is allowed to access the resource or not. If the endpoint domain is not added to the CORS whitelist in Salesforce, the browser will block the callout and throwan error. Option B is not correct because Content Security Policies (CSP) are used to control what resources can be loaded on a Visualforce or Lightning page, such as scripts, stylesheets, images, etc. CSP does not affect the callout from a Lightning WebComponent to an external endpoint. Option C is not correct because outbound firewall rules are used to restrict the network traffic from Salesforce to external systems. Firewall rules are configured at the network level, not at the Salesforce level. OptionD is not correct because Remote Site Settings are used to specify the domains that are allowed for callouts from Apex code, not from Lightning Web Components. References:

Working with CORS and CSP to Call APIs from LWC

[Cross-Origin Resource Sharing (CORS)]

The system constraint questions that should be considered when designing an integration to send orders from Salesforce to a fulfillment system are related to the performance, reliability, and scalability of the integration. The latency and idempotency of the integration are important factors that affect these aspects. Therefore, the questions A and D are relevant for the integration design. The question B is related to the business logic of the order validation, which is not a system constraint question. The question C is related to the implementation details of the Outbound Messaging interface, which is not a system constraint question either