Salesforce Certified Platform Integration Architect Plat-Arch-204 Exam Questions

Answer : C

Implementing Shield Platform Encryption is a significant architectural change that requires careful planning before activation. The architect's first priority must be to Review Shield Platform Encryption configurations and understand the platform's functional limitations.

Encryption at rest affects how data interacts with other platform features. For example, encrypting a field can impact the ability to use that field in SOQL WHERE clauses, report filters, list views, or as a unique/external ID. Before encrypting Social Security Numbers, the architect must audit all existing integrations, Apex code, and reports that reference that field to ensure they will still function correctly.

Option A is incorrect because unnecessarily encrypting all data can negatively impact system performance and break standard functionality. Encryption should be applied selectively to sensitive fields based on a clear data classification policy. Option B is factually wrong; Shield is a data protection tool, not an authentication or authorization mechanism like OAuth or SSO. By reviewing the configurations first, the architect can identify potential 'blockers'---such as a field being used in a formula or a criteria-based sharing rule---and address them before the encryption keys are generated and applied.

Answer : A

To satisfy a requirement for near real-time updates to an ERP system while adher9ing to a low-code constraint, the architect must leverage Salesforce's modern declara10tive automation tools. The goal is to initiate an outbound signal that the existing middleware can then orchestrate and deliver to the ERP's REST endpoint.

The Remote Process Invocation---Fire and Forget pattern is perfectly suited for this scenario. In this pattern, Salesforce sends a message to an external system and does not wait for a functional response. This is ideal for 'capturing' transactions in an ERP where the primary goal is record synchronization rather than a real-time calculation return. By using Flow Builder, the team can implement a record-triggered flow on the Order object. This flow can be configured to execute 'Actions' that send data to the middleware via External Services or standard HTTP Callouts (Beta/GA features in modern Flow), which requires zero Apex coding.

Option B, Outbound Messaging, is a legacy declarative tool that is highly reliable but has a significant limitation: it natively sends messages in SOAP format. Since the requirement specifically specifies a REST endpoint, using Outbound Messaging would require additional transformation logic in the middleware, making it a less direct architectural fit than a modern Flow-based REST call. Option C, Change Data Capture (CDC), is a highly scalable, event-driven mechanism, but it is typically considered more complex to implement and maintain. It requires the middleware to manage 'Replay IDs' and subscribe to a streaming channel, which often requires more specialized development effort on the middleware side compared to a simple HTTP POST from a Flow. For a team with limited development resources, Flow Builder provides the most accessible and maintainable path to achieving near real-time integration.

Answer : B

For a distributable package to securely access a central 'Hub' org, the architecture must support the OAuth 2.0 Web Server Flow. This flow is designed for applications (like the package installed in a 'Spoke' org) that can securely store a Client Secret and need to act on behalf of a specific user.

The Connected App in the central org acts as the 'Identity and Access' gatekeeper. A critical component of the Connected App configuration is the Callback URL (Redirect URI). When a user in the 'Subscriber' org clicks 'Authorize,' Salesforce redirects them to the central org to log in. After successful authentication, the central org needs to know where to send the 'Authorization Code' back to.

In a multi-org packaging scenario, each subscriber org will have a unique instance URL (e.g., na15.salesforce.com). The architect must ensure that the Connected App's callback URLs are correctly configured to handle these redirects.

Option C (Encrypted Passwords) is a major security risk and is considered an 'anti-pattern' in modern integration. Option A is unnecessary, as API access is a standard feature. By using the Connected App with correct Callback URLs, the architect allows the security team in the central org to oversee exactly which 'Spoke' orgs have authorized access. They can use the 'Connected Apps OAuth Usage' page to monitor, rotate secrets, or revoke access for individual orgs, providing the granular security control required for an enterprise-grade distributed Salesforce architecture.

Answer : A

When dealing with high-volume data (1 million transactions per day) that does not need to be stored natively in Salesforce, the architect should recommend Data Virtualization via Salesforce Connect.

Salesforce Connect allows the company to display external data as External Objects. This approach provides several architectural advantages for a banking community:

No Data Storage: Transactions remain in the core banking system, avoiding the massive storage costs and complex synchronization logic required to house millions of records natively in Salesforce.

Real-Time Visibility: Because External Objects are queried on-demand via the OData protocol or a custom Apex adapter, customers see the most up-to-date transaction history every time they refresh the page.

While an Iframe (Option B) is technically possible, it is often discouraged due to security concerns (such as clickjacking) and a poor user experience, as the Iframe does not natively integrate with Salesforce UI components or reporting. Salesforce Connect provides a 'seamless' look and feel, allowing External Objects to be used in related lists and Lightning components just like standard Salesforce records, while keeping the heavy data burden on the performant core banking system.

Answer : A

When integrating with a legacy SOAP-only application using a Fire and Forget pattern, Salesforce Outbound Messaging is the native, declarative choice.

Outbound Messaging is a platform feature that sends a SOAP message to a designated endpoint when specific criteria are met. It is inherently asynchronous and provides built-in reliability; if the legacy system is offline, Salesforce will automatically retry the delivery for up to 24 hours. This perfectly fits the 'Fire and Forget' requirement.

For the strongly-typed response back (Remote Call-In), the Enterprise WSDL is the correct recommendation.1415

Enterprise WSDL: This is a strongly-typed WSDL generated specifically for one org's metadata. It includes specific references to16 custom objects and fields, ensu17ring that the legacy system can communicate with Salesforce using a rigid, predictable data structure.

Partner WSDL (Option C): This is a loosely-typed WSDL designed for developers building tools that must work across many different orgs; it is not ideal for an internal, strongly-typed legacy integration.

While Platform Events (Option B) are a modern alternative, they typically use REST or Streaming APIs, making them a less natural fit for an application that 'can only support SOAP'. By combining Outbound Messaging and the Enterprise WSDL, the architect provides a robust, SOAP-native solution that satisfies the business's technical constraints and reliability requirements.

Answer : C

When building a distributable package (likely a Managed Package) that must securely communicate back to a central 'Hub' org, the architect must use a framework that supports OAuth 2.0 flows. Storing plain-text or even encrypted passwords (Option B) is a security violation and is brittle across different environments.

The architecturally sound solution is to leverage the Authentication Provider and Named Credentials framework. In the central org, a Connected App is created to act as the OAuth endpoint. In the package, an Authentication Provider is configured using the Consumer Key and Consumer Secret from that Connected App. This setup allows the administrator in the 'Subscriber' org (the org where the package is installed) to initiate an OAuth flow.

When the security team 'authorizes' the integration after installation, they are essentially completing the OAuth handshake. This grants the subscriber org an Access Token and a Refresh Token associated with the specific integration user in the central org. This mechanism ensures:

Credential Security: No passwords are ever stored in the code or metadata.

Centralized Control: The security team in the central org can revoke the Refresh Token at any time to kill the integration.

Scalability: The same package can be distributed to hundreds of orgs, each with its own unique, secure connection to the central Hub.

By using an Authentication Provider combined with a Named Credential, the Apex code in the package can simply call the endpoint by its developer name, and Salesforce handles the entire authentication header injection automatically, ensuring a robust and secure cross-org integration.

Answer : A

To achieve a 'Customer 360' view where sales and service associates have the context needed for daily interactions, Salesforce is the logical System of Record (SoR) for customer and prospect engagement.

While the ERP remains the master for financial transactions (invoices) and the Marketing tool masters campaign analytics, Salesforce should house the core 'Golden Record' of the customer. This is achieved by integrating relevant data from the ERP (order status, invoice history) and Marketing (lead source, email engagement) into Salesforce. This strategy (Option A) empowers associates to log interactions and view history in one place, fulfilling the primary goal of the CRM implementation while avoiding the complexity of a new custom database (Option B) or trying to force prospect-level engagement data into a rigid ERP (Option C).