Salesforce Certified Platform Integration Architect Plat-Arch-204 Exam Questions

Answer : A

To minimize downtime when an external endpoint changes, an Integration Architect must ensure that the URL is not 'hardcoded' within Apex code or configuration. The standard Salesforce mechanism for abstracting and managing external endpoints is Named Credentials.

Named Credentials specify the URL of a callout endpoint and its required authentication parameters in one definition. If the URL changes, an administrator simply updates the 'URL' field in the Named Credential setup. This change takes effect immediately across all Apex callouts, Flows, and External Services that reference it, without requiring a code deployment or a sandbox-to-production migration.

Along with Named Credentials, Remote Site Settings (or the more modern External Website Configurations) are required. Salesforce blocks all outbound calls to URLs that are not explicitly whitelisted.

By having both in place, the remediation process is:

Update the URL in the Named Credential.

Update (or add) the new URL in the Remote Site Settings.

This approach follows the 'Separation of Concerns' principle. Option B (ESB) could technically handle this, but it adds an extra layer of failure and complexity for a simple URL change. Option C (Content Security Policies) is used to control which resources (like scripts or images) a browser is allowed to load in the UI; it does not govern server-side Apex callouts. Therefore, the combination of Named Credentials and Remote Site whitelisting is the most efficient and standard way to provide architectural agility and minimize downtime.

Answer : A

The timing of Platform Event publishing is a critical detail for an Integration Architect, as it affects data consistency and transaction integrity. In Salesforce, the default and most common behavior for publishing Platform Events from Apex is 'Publish After Commit.'

When an architect chooses the 'Publish After Commit' setting (defined at the event level), the events are held in a buffer and are only released to the event bus after the Apex transaction completes successfully. This ensures that if the database transaction fails and rolls back, the event---which might trigger external actions---is never sent. This prevents 'ghost' events where an external system is told to process data that was never actually saved to the Salesforce database.

The question implies a standard scenario where events are being 'published' into the bus. In this state, the events have passed the transaction boundary. If the events were only 'being published from Apex' (Option C), it doesn't describe the state of the delivery or the transaction. Option B is technically incorrect for standard event publishing logic, as Salesforce explicitly separates the event bus from the database commit to maintain atomicity.

Understanding this 'After Commit' behavior is vital when designing synchronization patterns. If the architect requires the event to be sent regardless of whether the transaction succeeds (e.g., for logging a failure), they would need to configure the event as 'Publish Immediately.' However, in a standard synchronization use case where events are 'only being published,' it signifies that the source transaction has finalized, and the messages are now available for subscribers (like middleware or other Salesforce orgs) to consume.

---

Answer : A

When corporate guidelines mandate that all cloud-to-on-premise traffic must pass through a secure firewall, the architecture must support a Demilitarized Zone (DMZ) or 'Perimeter Network' strategy. The Integration Architect must evaluate whether the middleware solution includes a robust API Gateway component.

A secure API Gateway acts as the single entry point for all external requests. It is typically deployed within the DMZ to terminate incoming TLS connections from the cloud (Salesforce) and perform deep packet inspection, IP whitelisting, and authentication before proxying the request to internal on-premise resources. This provides a critical layer of insulation, ensuring that internal services---such as an ERP or legacy database---are never exposed directly to the public internet.

While OAuth enforcement (Option B) is a common requirement for authorization, it does not fulfill the specific network-level firewall requirement described. Similarly, ODBC connectivity (Option C) is a low-level internal database protocol that should generally be avoided for cross-firewall communication due to its inherent security risks. By selecting a middleware solution with integrated API Gateway capabilities, Northern Trail Outfitters can provide the security team with centralized control over encryption, rate limiting, and threat protection, thereby strictly adhering to the new Corporate Security Guidelines while enabling seamless hybrid cloud integration.

Answer : C

When an integration involves financial transactions (payment gateways) and strict audit and reliability requirements, the most robust architectural pattern is to use an Enterprise Service Bus (ESB) or middleware as the orchestration layer.

An ESB provides critical enterprise-grade capabilities that Salesforce cannot easily replicate natively:

Centralized Auditing/Logging: The ESB can capture the full payload of every payment request and response, storing them in a secure log for regulatory compliance and financial audits.

Sophisticated Error Handling: If the payment gateway returns a transient error, the ESB can manage retries or circuit-breaker patterns to prevent system failure.

Protocol Mediation: The ESB can bridge any technical gaps between the Salesforce UI and the external RESTful service.

Option A (External Services) and Option B (Apex Callouts) are point-to-point integrations. While they can facilitate a real-time response, they place the burden of logging, audit trail management, and complex error handling directly on the Salesforce platform. For a B2C enterprise, 'hard-coding' these sensitive financial processes into Apex triggers or Flows creates a maintenance challenge and lacks the transparent, enterprise-wide visibility that a middleware solution provides. By routing the payment through an ESB, the architect ensures that the CSR gets their 'real-time' confirmation while the company maintains the high level of reliability and accountability required for financial operations.

Answer : B

When designing high-volume integrations, the Salesforce Platform Integration Architect must distinguish between standard REST resources and 'Composite' resources to optimize API consumption. The Salesforce REST API provides several composite resources to group multiple operations into a single call, thereby reducing the overhead of multiple HTTP requests and helping to stay within daily API limits.

According to Salesforce documentation on Composite Resources, the sObject Tree resource (/services/data/vXX.X/composite/tree/) is specifically designed to handle multiple records in a single request. While it is primarily marketed for creating complex hierarchies (parent-child relationships), it has a unique limit that allows for up to 200 records to be processed in a single call. These records can even be unrelated records of the same type. This is a significant advantage over the standard Batch and Composite resources.

The Composite resource and the Batch resource both have a much lower limit of 25 subrequests per call. While each subrequest in a Batch call could technically be a collection operation, the question specifically asks for the resource that natively supports the '200 records' threshold preferred for bulk-style updates within the REST framework. By utilizing the sObject Tree resource, the architect can bundle 200 record updates into a single transaction, effectively reducing API consumption by a factor of 200 compared to individual REST calls. This aligns with the requirement to avoid major architectural changes (like switching to the Bulk API 2.0) while solving the immediate problem of exceeding daily governor limits. In the context of the Integration Architect exam, understanding these specific payload limits is crucial for selecting the most efficient 'Request-Reply' or 'Data Synchronization' pattern.

Answer : A

In Salesforce, you cannot perform real HTTP callouts during unit tests. To test integration logic, developers must use the HttpCalloutMock interface to simulate the API's response. To ensure that the Apex code adheres to the RAML contract, the architect should require that the test mock implementation strictly follows the RAML specifications.

By requiring the Apex REST API Clients to implement the HttpCalloutMock (or more specifically, creating a mock class that implements it), the developer creates a controlled testing environment. The mock class should be coded to return a payload that matches the RAML-defined structure (fields, data types, and status codes). When the test runs, the Apex client receives this 'contract-compliant' response. The unit test then uses assertions to verify that the Apex code correctly parses and handles this specific data structure.

Option B is technically imprecise; you don't 'call' the mock from the client, you provide the mock to the test runtime using Test.setMock(). Option C describes the general process of testing but does not address the 'design specification' needed to ensure contract adherence. By mandating a mock implementation that mirrors the RAML contract, the architect ensures that if the API contract changes in the RAML file, the unit tests will fail if the Apex code is not updated to match, thereby maintaining high integration quality and preventing runtime errors.

Answer : B

In a standard API-led connectivity model, the First Tier (Experience APIs) is responsible for tailoring data for specific systems of engagement.

The Experience APIs take the core data from the lower tiers and transform it into the specific return formats (e.g., JSON for mobile, XML for legacy web) and security protocols (e.g., OAuth for Salesforce, API Keys for web) required by each consumer. Option B correctly identifies that these transformations and security enforcements should happen at this outer layer. While an API Gateway (Option A) can provide generic security and rate limiting, it is the Experience API layer that provides the functional transformation and specific protocol requirements defined by the business needs of the engagement systems.