Salesforce Integration-Architect Salesforce Certified Integration Architect (SU24) Exam Practice Test

The authentication is achieved by handling it in the code. A Named Credential is a type of metadata that specifies the URL of a callout endpoint and its required authentication parameters. An Apex callout is a way to invoke an external web service or API from Apex code. When using a Named Credential with an Apex callout, the authentication is handled by the Apex code that invokes the callout. The Apex code can use the HttpRequest class to set the endpoint, method, headers, and body of the callout request, and use the Http class to send the request and receive the response. The Apex code can also use the NamedCredential class to access the properties of the Named Credential, such as the principal type, protocol, and credential type. Handling authentication with login flows is not a valid option because login flows are a way to customize the user login process in Salesforce, not for external web services or APIs. Connecting via Salesforce Connect or Communities is not a valid option because they are not related to Apex callouts or Named Credentials.

Named Credentials and Two way SSL are two security methods that an integration architect can leverage within Salesforce to secure the integration with an external system via HTTPS request. Named Credentials are a type of metadata that store authentication settings for accessing external services. They allow you to specify the URL of a service, the authentication protocol, and the credentials for accessing the service. Two way SSL is a type of mutual authentication that requires both the client and the server to present their certificates to each other. This ensures that both parties are who they claim to be, and that the communication is encrypted. Two way SSL can be configured in Salesforce by uploading a certificate and a private key, and associating them with a named credential. References: Certification - Integration Architect - Trailhead, [Named Credentials], [Mutual Authentication]

The considerations that an Integration Architect should do prior to the implementation of Shield Platform Encryption are:

• Review shield platform encryption configurations.
• Encrypt all the data so that it is secure.

Shield Platform Encryption is a feature that allows you to encrypt sensitive data at rest in Salesforce, such as social security numbers, without compromising critical platform functionality. Before implementing Shield Platform Encryption, you should review the shield platform encryption configurations, such as the encryption key management, the encryption policy, and the encrypted fields and files. You should also encrypt all the data that is subject to encryption, not just the data using the most current key. Encrypting all the data ensures that your data is secure and compliant with your business requirements. Encrypting the data using the most current key is not a valid consideration because Shield Platform Encryption uses a deterministic encryption scheme that does not allow you to rotate or re-encrypt your data with a new key. Using Shield Platform Encryption as a user authentication or authorization tool is not a valid consideration because Shield Platform Encryption is not designed for that purpose. Shield Platform Encryption only encrypts data at rest, not in transit or in use.

Using request and reply is the recommended integration pattern for this use case because it allows the support agents to send a request to the core banking system and receive a response with the bank account ID in real-time. This way, the support agents can inform the customers with the newly created bank account ID without any delay or inconsistency. Using streaming API to generate push topic is not a good solution because it is used for event-driven integration, not for web-service integration. Using outbound message is also not a good solution because it is a Salesforce-specific feature that uses SOAP web services, which may not be compatible with the core banking system. Using Salesforce platform event is also not a good solution because it is used for event-driven integration, not for web-service integration. Reference: Salesforce Integration Architecture Designer Resource Guide, page 29-30

SObject Collections is a REST API composite resource that allows you to create, update, or delete up to 200 records in one API call. You can specify the type of operation (create, update, or delete) for each record in the request body, and the response body will contain the status and IDs of each record. SObject Collections is suitable for bulk operations on records that are not related to each other1.

SObject Tree is another REST API composite resource that allows you to create up to 200 records in one API call. However, unlike SObject Collections, SObject Tree requires the records to be related to each other in a hierarchy. You can specify the parent and child records in a JSON tree structure, and the response body will contain the reference IDs and URLs of each record. SObject Tree is suitable for creating nested data in one request2.

Batch is a REST API composite resource that allows you to combine up to 25 requests in one API call. Each request can be a different type of operation (query, create, update, delete, etc.) on different objects. The response body will contain the status and results of each request. Batch is suitable for grouping multiple requests into one transaction3.

Composite is a REST API composite resource that allows you to execute a series of REST API requests in one API call. You can use the output of one request as the input of another request using a reference ID. The response body will contain the status and results of each request. Composite is suitable for chaining requests that depend on each other.

Therefore, the correct answer is A, because SObject Collections is the only REST API composite resource that allows bulk updates on records that are not related to each other.

References: 1: SObject Collections | REST API Developer Guide | Salesforce Developers 2: SObject Tree | REST API Developer Guide | Salesforce Developers 3: Batch | REST API Developer Guide | Salesforce Developers : [Composite | REST API Developer Guide | Salesforce Developers]

Streaming API is the best option for sending real-time notifications of changes to Salesforce data. Streaming API uses a publish-subscribe model to push relevant data to subscribers without polling. Streaming API supports PushTopic events, which are based on SOQL queries that define the data changes to listen for. The affiliate company can subscribe to a PushTopic event on the NTO Salesforce org and receive notifications whenever the data that matches the query changes. This way, the affiliate company can be informed of any updates to the opportunities in the NTO Salesforce instance.

 Idempotent design means that the same request can be repeated multiple times without changing the outcome. This is useful for avoiding duplicate orders in case of network failures or timeouts. By implementing idempotent design, the sales representatives can retry the order(s) in question without creating duplicates in the manufacturing system. Outbound messaging is not a reliable solution because it does not guarantee delivery or acknowledgement of messages. Scheduled apex is not a real-time solution and may not catch all the duplicate or missing orders

This is because Bulk API is a RESTful API that is optimized for loading or deleting large sets of data asynchronously. By processing jobs in parallel mode, you can take advantage of the multiple resources available on the Salesforce platform and speed up the data load. The other options are not suitable for this scenario because:

• B, Contact Salesforce support to schedule performance load, is not a valid option as Salesforce does not offer such a service. You are responsible for optimizing your own data load performance.
• C, Use Bulk API to process jobs in serial mode, is a slower option than parallel mode as it processes one batch at a time. This is only recommended when you have dependencies between records or when you want to preserve the order of records.
• D, Use Bulk API to process jobs in high performance mode, is not a valid option as there is no such mode in Bulk API. You can only choose between parallel and serial modes.

References:

• Introduction to Bulk API 2.0 and Bulk API
• Use Bulk API 2.0 Unit

 The best solutions for minimizing potential downtime for users in this situation are to use named credentials and an enterprise ESB. Named credentials allow you to store the URL and authentication parameters of an external service in one definition, and then use it in Apex callouts or declarative integrations. If the URL of the external service changes, you only need to update the named credential once, and all the integrations that use it will be updated automatically. An enterprise ESB is a middleware layer that acts as a broker between different systems and services. It can provide routing, transformation, orchestration, and monitoring capabilities for integrations. If the URL of an external service changes, you only need to update the ESB configuration once, and all the integrations that use it will be updated automatically. Option B is not correct because remote site settings only allow you to specify the domains that are allowed for callouts from your org. They do not store any authentication parameters or provide any routing or transformation capabilities. Option C is not correct because content security policies are used to control what resources can be loaded on a Visualforce or Lightning page. They do not store any authentication parameters or provide any routing or transformation capabilities. References:

• Named Credentials
• Streamline and Secure: Mastering Named Credentials in Salesforce

The integration consultant should consider the following authorization and authentication needs while integrating the DMS and ESB with Salesforce:

• Users should be authorized to view information specific to the customer they are servicing without a need to search for customer. This means that the integration should provide a seamless and contextual access to the customer billing information and generated bills from the DMS and ESB, based on the customer record or case that the user is working on in Salesforce.
• Consider Enterprise security needs for access to DMS and ESB. This means that the integration should comply with the security policies and standards of the Enterprise, such as encryption, auditing, logging, monitoring, etc.
• Users should be authenticated into DMS and ESB without having to enter username and password. This means that the integration should use a single sign-on (SSO) mechanism that allows users to access multiple systems with one login credential, such as OAuth or SAML.

References: [Authorization Through Connected Apps and OAuth 2.0], [Single Sign-On for Desktop and Mobile Applications using SAML and OAuth]

Trigger invokes Queueable Apex method, with custom error handling process. Queueable Apex allows you to run asynchronous jobs that can make callouts to external web services. You can use custom error handling logic to handle any failures and retry the callouts if necessary. You can also use Database.Stateful interface to maintain state across transactions and ensure that each order is sent exactly once. This solution meets the requirements of sending order and line items directly to an existing finance application web service when an order is fulfilled, and ensuring that each order reaches the finance application exactly once for accurate invoicing. References: Certification - Integration Architect - Trailhead, [Queueable Apex], [Making a Web Service Callout from a Queueable Apex Job]

The Connect REST API is designed to access Chatter feeds and social data such as users, groups, followers, and files. By using this API, the integration can query the Chatter posts that include the #thanksNTO hashtag and post them to Twitter using another API. The REST API, Streaming API, and Apex REST are not specific to Chatter and do not provide the same level of functionality and ease of use as the Connect REST API2

References: 1: Fire and Forget Pattern 2: Connect REST API

Named Credentials and Protected Custom Settings are two persistence mechanisms that can be used to ensure that secrets are protected from deliberate or inadvertent exposure. Named Credentials allow you to specify the URL of a callout endpoint and its required authentication parameters in one definition. Salesforce manages all the authentication for Apex callouts that specify a named credential as the callout endpoint, and you don’t have to add more authentication logic in your Apex code. Named Credentials can be defined to provide a secure and convenient way of setting up authenticated callouts, and they can also be used in Lightning components, Visualforce pages, and flows1.

Protected Custom Settings are a type of custom settings that store application-specific data that is hidden from subscribers. They are only accessible by the managed package that created them, and they can be used to store secrets such as encryption keys, passwords, or tokens. Protected Custom Settings can be accessed by Apex code, formulas, or validation rules within the same namespace as the settings2.

Encrypted Custom Fields are not a suitable mechanism for storing secrets, because they are not designed to prevent unauthorized access to sensitive data. Encrypted Custom Fields allow you to encrypt text fields using a standard encryption scheme. The encrypted data is masked in reports, list views, and search results, but it can still be viewed by users who have the “View Encrypted Data” permission. Encrypted Custom Fields are intended to protect data from unauthorized access by users within your organization, not from external threats or malicious code3.

Protected Custom Metadata Types are another type of custom metadata types that store application-specific data that is hidden from subscribers. They are similar to Protected Custom Settings, but they have some advantages such as being deployable using change sets or Metadata API, being accessible by SOQL queries, and being able to reference other metadata types or settings. However, Protected Custom Metadata Types cannot be used to store secrets, because they do not support encryption or masking of sensitive data. Protected Custom Metadata Types are intended to store configuration data that is specific to your managed package, not secrets that need to be secured.

Therefore, the correct answer is B and D, because Named Credentials and Protected Custom Settings are the only persistence mechanisms that can be used to securely store secrets in Salesforce.

References: 1: Named Credentials | Apex Developer Guide | Salesforce Developers 2: Custom Settings | Apex Developer Guide | Salesforce Developers 3: Encrypted Fields | Salesforce Help : [Protected Custom Metadata Types | ISVforce Guide | Salesforce Developers]

 Integrating Salesforce with Data Warehouse, Order Management and Email Management System is the best option considering Salesforce capabilities. Salesforce can be used as the primary case management system, replacing the existing one. Salesforce can also integrate with the Data Warehouse to provide analytics and reporting on case data. Salesforce can integrate with the Order Management System to access order information related to cases. Salesforce can integrate with the Email Management System to send and receive emails from customers and agents. Reference: Salesforce Integration Architecture Designer Resource Guide, page 16

 Reducing the batch size of asynchronous BULK API and submitting the legacy system in parallel mode are two recommendations that can improve the integration performance. The BULK API is designed to handle large-scale data loads, but it can also cause latency issues if the batch size is too large or the network bandwidth is insufficient. Reducing the batch size can help to avoid timeouts and improve throughput. Submitting the legacy system in parallel mode can also speed up the integration process by allowing multiple batches to be processed concurrently, as long as there are no dependencies or conflicts between them. Reference: Salesforce Integration Architecture Designer Resource Guide, page 21

A Connected App is a framework that enables an external application to integrate with Salesforce using APIs and standard protocols, such as OAuth. By configuring a Connected App in Salesforce, the integration can authenticate the middleware and grant access to the Salesforce data and services. This is a secure and flexible solution that does not require configuring Remote Site Settings, API Gateway, or Firewall and reverse proxy2

References: 1: BatchApexErrorEvent 2: Connected Apps

The message durability considerations that an Integration Architect should make when designing a solution to meet these business requirements are:

• When subscribing to Salesforce Event bus, ReplayID is used with a value of -2 to be able to see old and new events.
• High-volume event messages are stored for 72 hours (three days).

A Salesforce Event bus is a messaging service that allows you to publish and subscribe to events in Salesforce or from external sources. ReplayID is a property of an event message that indicates its position in the event stream. By using ReplayID with a value of -2, you can replay all events stored in the retention window, which can help you see the stages of order processing in Salesforce. High-volume event messages are a type of event message that can handle large volumes of data and are optimized for performance and scalability. High-volume event messages are stored for 72 hours (three days) in the event bus, which means they can be replayed within that time frame. The other options are not correct. Using ReplayID with a value of -1 means you can only see new events that are published after your subscription. High-volume event messages are not stored for 24 hours (one day), but for 72 hours (three days).

OpenId Connect Authentication Provider and Registration Handler, and SAML SSO and just-in-time provisioning are two requirements that the Salesforce Community Cloud can support for self-registration and SSO. OpenId Connect is a protocol that allows users to authenticate with an external identity provider and access Salesforce resources. A registration handler is a class that implements the Auth.RegistrationHandler interface and defines the logic for creating or updating a user in Salesforce after authentication. SAML SSO is a protocol that allows users to log in to Salesforce with a single click, using an assertion from an identity provider that confirms the user’s identity. Just-in-time provisioning is a feature that allows Salesforce to create or update a user account based on the information in the SAML assertion. References: Certification - Integration Architect - Trailhead, [OpenID Connect Authentication Providers], [SAML Single Sign-On (SSO) Service for Salesforce]

 The integration architect should require bulk load for Einstein Analytics and callouts to RESTful services for the Community Cloud portal and Einstein Analytics. Bulk load is a capability that allows loading large volumes of data into Einstein Analytics from external sources, such as the Patient Prescriptions System. This can be done securely by using encryption in transit and at rest, and by masking or removing any identifiable patient information from the data. Callouts to RESTful services are a capability that allows making requests to external web services from Salesforce, such as the Patient Prescriptions System. This can be done securely by using identity tokens or certificates for authentication and authorization, and by using encryption in transit and at rest12

References: How to Load Data into Einstein Analytics, Strengthen Your Data’s Security with Shield Platform Encryption

• Answer A is valid because creating an Auth provider in the package and setting the consumer key and consumer secret of the connected app in the central org can allow the package to authenticate with the central org using OAuth 2.0. An Auth provider is a configuration that specifies how to connect to an external service that uses a specific identity protocol. A connected app is an application that can access Salesforce resources using APIs and standard protocols. The consumer key and consumer secret are credentials that identify the connected app to Salesforce.
• Answer C is valid because creating a connected app in the central org and adding the callback URL of each org the package is installed in to redirect to after successful authentication can enable the package to obtain an access token from the central org using OAuth 2.0. The callback URL is a parameter that specifies where the user should be redirected after granting or denying permission to access Salesforce resources. The access token is a credential that can be used to invoke the custom Apex REST endpoint in the central org.
• Answer E is valid because using the Auth Provider configured and selecting the identity type as Named Principal with OAuth 2.0 as the protocol and selecting Start Authentication Flow on Save can initiate the authentication flow when installing the package. The identity type determines how the package accesses Salesforce resources on behalf of users or an application. The Named Principal identity type means that the package uses a single credential, such as a username and password or an access token, to access Salesforce resources for all users. The Start Authentication Flow on Save option means that the package will prompt the user to enter the credential when saving the Auth Provider configuration.
• Answer B is not valid because contacting Salesforce support and creating a case to temporarily enable API access for managed packages is not a necessary or recommended action. API access for managed packages is enabled by default and does not require any special permission or configuration from Salesforce support. Moreover, this action does not address the security requirement of using a specific integration account in the central org that will be authorized after installation of the package.
• Answer D is not valid because using an encrypted field to store the password that the security team enters and using password management for external orgs and setting the encryption method to TLS 1.2 is not a secure or reliable solution. An encrypted field is a custom field that encrypts sensitive data at rest and masks it on the user interface. However, this field does not prevent unauthorized access or leakage of data, as it can be decrypted by users who have the View Encrypted Data permission or by Apex code that runs in system mode. Moreover, this field does not support encryption methods such as TLS 1.2, which are used for securing data in transit, not at rest.

References: Auth Provider: Connected Apps : OAuth 2.0 Web Server Authentication Flow : Named Credentials as Callout Endpoints : API Access in Packages : Encrypted Fields : Encryption Methods Available in Salesforce

11of30

The integration architect should consider whether the fulfillment system can make a callback into Salesforce and whether it can implement a contract-first Outbound Messaging interface. A callback is a way for the fulfillment system to send a response or an acknowledgment back to Salesforce after receiving an order1. This can help ensure data consistency and reliability between the two systems. A contract-first Outbound Messaging interface is an approach where the integration is designed based on a predefined XML schema that defines the structure and content of the messages2. This can help ensure interoperability and compatibility between the two systems. The other two questions are not relevant for the integration architect to consider. The fulfillment system does not need to create new addresses within the Order Create service, as this is a function of Salesforce3. The product catalog data does not need to be identical at all times in both systems, as long as there is a mapping or synchronization mechanism to handle any discrepancies

The typical and worst-case historical response times, and how many concurrent service calls are being placed are two considerations that an integration architect should make when building a scalable integration solution for synchronous callouts to “available to promise” services. These two factors can affect the performance, reliability, and availability of the integration solution, as well as the user experience of the customer checkout process. The integration architect should design the solution to handle high volumes of service calls, optimize the response times, handle errors and timeouts, and avoid hitting governor limits or service quotas. References: Certification - Integration Architect - Trailhead, [Callout Limits and Limitations], [Integration Patterns and Practices]

The correct answer is C, Request-Reply: Enhanced External Services invokes a REST API. This is because Enhanced External Services allows you to register an external web service that has an OpenAPI 2.0 specification and use it as an invocable action in a Lightning flow. This way, you can check the preferences from the external service in real-time and get the response in Boolean and string values. The other options are not suitable for this scenario because:

• A, Fire and Forget: Process-driven platform events publishes events on Salesforce Event Bus, is a pattern that is used for asynchronous integration, where the sender does not expect a response from the receiver. This is not suitable for checking preferences in real-time.
• B, Remote Call-In: Salesforce REST API with REST Composite Resources, is a pattern that is used for integrating external applications with Salesforce by calling the Salesforce REST API. This is not suitable for invoking an external service from a Lightning flow.
• D, Data Virtualization: Salesforce Connect map data external REST data in external objects, is a pattern that is used for accessing external data without copying or synchronizing it to Salesforce. This is not suitable for checking preferences in real-time or using them in a Lightning flow.

References:

• Enhanced External Services
• Get Started with External Services
• Registering external services in salesforce

The Data Virtualization pattern allows Salesforce to access external data sources without storing the data in Salesforce. This reduces the data storage and synchronization costs and enables real-time access to the historical data. Salesforce Connect can be used to consume OData endpoints exposed by the ESB tool and display the external objects as related lists or custom components on the Case object

 Invoking middleware service to retrieve valid shipping methods is a solution that can allow the sales representatives to select between valid services for the customer’s country. The middleware service can act as a single point of entry for all shipping services and provide routing and transformation capabilities. Using middleware to abstract the call to the specific shipping services is a solution that can allow the sales representatives to request shipping estimates from the selected service. The middleware can hide the complexity and heterogeneity of the shipping services and provide mediation and orchestration capabilities. Using Platform Events to construct and publish shipper-specific events is not a solution, as Platform Events are used for event-driven integration, not for web-service integration. Storing shipping services in a picklist that is dependent on a country picklist is not a solution, as it does not address how to request shipping estimates from the shipping services. Reference: Salesforce Integration Architecture Designer Resource Guide, page 16-17

• Answer D is valid because using middleware to handle the call out to the 10 different verification services is a scalable and reliable solution that can handle the complexity and variability of the integration. The middleware can orchestrate the calls to the different web services, consolidate the verification results, and handle any errors or retries. The middleware can then make a call-in to Salesforce and update the verification status to “verified” using an API or a platform event12
• Answer A is not valid because using Salesforce external service to make the call out to the 10 different verification services is not a feasible or efficient solution. Salesforce external service is a feature that allows invoking an external service from a flow and mapping its inputs and outputs to flow variables. However, this feature requires configuring an Apex action, a named credential, and an external service definition for each web service, which is not a low code solution. Moreover, this feature does not support checking the verification agencies until the result is verified, as it only invokes the external service once per flow interview3
• Answer B is not valid because creating a trigger on the trainer record to make a callout to each verification agency is not a recommended or robust solution. Triggers are Apex code that execute before or after database events, such as insert, update, or delete. However, triggers cannot make callouts directly, as they are part of a database transaction and must complete quickly. To make a callout from a trigger, an asynchronous process such as a future method or a queueable job must be used, which adds complexity and overhead to the integration. Moreover, triggers have limits on the number of callouts and asynchronous calls they can make per transaction, which may affect the scalability and reliability of the integration.
• Answer C is not valid because making an Apex callout using @future annotation to make the call out to all different agencies is not a suitable or reliable solution. The @future annotation allows marking a method for execution at a later time when system resources become available. However, this annotation has several limitations and drawbacks, such as:

1: Orchestration Pattern 2: Remote Process Invocation—Request and Reply 3: External Services : Apex Developer Guide: Triggers : Apex Developer Guide: Using Future Methods

Using Salesforce custom object, custom REST API and ETL is a better solution than using Salesforce standard object, REST API and ETL. A custom object can store the order information and provide more flexibility and control over the data model, validation rules, triggers, etc. A custom REST API can be used to create orders in real time from Salesforce, using the ESB as a proxy to communicate with the legacy system. An ETL tool can be used to sync the order history and status from the legacy system to Salesforce, using the last modified date as a filter. This way, sales reps can see the order history and the most up-to-date information on current order status, and managers can run reports on order volumes and fulfillment timelines. A standard object, such as Order, may not meet all the business requirements and may require more customization than a custom object. A standard REST API may not provide enough security and error handling for creating orders in real time. Reference: Salesforce Integration Architecture Designer Resource Guide, page 18

This is because SSL/TLS mutual authentication is a security feature that allows Salesforce to verify the identity of the client that connects to its API endpoint on port 8443. To enable this feature, you need to upload a client certificate to Salesforce and assign the “Enforce SSL/TLS Mutual Authentication” user permission to the users who need to access the company portal. The other options are not sufficient for this scenario because:

• A, Enable My Domain and SSL/TLS, is a prerequisite for using SSL/TLS mutual authentication, but it does not ensure that all integrations use it. My Domain allows you to customize your Salesforce domain name and SSL/TLS provides encryption for your data in transit.
• C, Generate a Self-signed Certificate, is a step that you need to do on the client side to create a certificate that can be used for SSL/TLS mutual authentication, but it does not ensure that all integrations use it. You also need to upload the certificate to Salesforce and assign the user permission.
• D, Generate a CA-signed Certificate, is an alternative to generating a self-signed certificate, but it also does not ensure that all integrations use SSL/TLS mutual authentication. You still need to upload the certificate to Salesforce and assign the user permission.

References:

• Certificates in Mutual Authentication
• Configure Your API Client to Use Mutual Authentication
• Salesforce Mutual Authentication Setup

 Using a third party integration tool to stage records off platform is a solution that can handle the high volume of data and avoid hitting the API limits for the REST API call to the external system. A third party integration tool can also provide features such as data transformation, error handling, and logging. Due to high volume of records, number of concurrent requests can hit the limit for the REST API call to external system is not a solution, but a problem that needs to be addressed. Due to high volume of records, the external system will need to use a BULK API Rest endpoint to connect to Salesforce is not a solution, as the requirement is to send data from Salesforce to the external system, not vice versa. Due to high volume of records, Salesforce will need to make a REST API call to external system is not a solution, as it does not address how to handle the high volume of data and avoid hitting the API limits. Reference: Salesforce Integration Architecture Designer Resource Guide, page 18-19

• Option D is correct because Tooling API is the Salesforce API that can be used to retrieve code coverage and test results for Apex classes and triggers. Tooling API provides REST and SOAP interfaces to access metadata about code, execute tests, and get test results12
• Option A is incorrect because SOAP API is a Salesforce API that can be used to create, retrieve, update, or delete records, but not to get code coverage and test results. SOAP API uses a WSDL file to define the parameters for accessing data through the API3
• Option B is incorrect because Analytics REST API is a Salesforce API that can be used to access data from reports and dashboards, but not from code coverage and test results. Analytics REST API provides a programmatic way to interact with analytics features such as lenses, datasets, and dashboards4
• Option C is incorrect because Metadata API is a Salesforce API that can be used to retrieve, deploy, create, update, or delete customization information, such as custom object definitions and page layouts, but not code coverage and test results. Metadata API is mainly used for development tools or backup tools5

References: 1: Introducing Tooling API 2: Tooling API Examples 3: SOAP API Developer Guide 4: Analytics REST API Developer Guide 5: Metadata API Developer Guide

• Option A is correct because external gateway products in use can affect the performance and security of outbound integrations from Salesforce to on-premise servers. External gateway products are software or hardware devices that act as intermediaries between Salesforce and the on-premise servers, such as firewalls, proxies, load balancers, or VPNs. They can have different configurations, features, and limitations that can impact the speed, reliability, and security of the data transmission. For example, some external gateway products may require authentication, encryption, or compression of the data, which can add overhead and latency to the integration. Some external gateway products may also have bandwidth or throughput limits, which can affect the scalability and availability of the integration. Therefore, the architect should consider the external gateway products in use before recommending a solution.
• Option B is incorrect because a default gateway restriction is not a factor that can affect the performance and security of outbound integrations from Salesforce to on-premise servers. A default gateway restriction is a feature that allows administrators to restrict outbound requests from Salesforce to a specific IP address or domain name. This can help prevent unauthorized or malicious requests from Salesforce to external systems. However, this feature does not affect the performance or security of the outbound requests themselves, as it only acts as a filter for the destination of the requests.
• Option C is incorrect because considerations for using deterministic encryption are not relevant for outbound integrations from Salesforce to on-premise servers. Deterministic encryption is a type of encryption that produces the same ciphertext for the same plaintext input. This can help preserve some functionality and performance of encrypted data in Salesforce, such as filtering, sorting, and indexing. However, deterministic encryption is not applicable for outbound integrations from Salesforce to on-premise servers, as it is only supported for custom fields and not for standard fields or attachments. Moreover, deterministic encryption does not affect the security of the data transmission itself, as it only encrypts the data at rest in Salesforce.
• Option D is incorrect because Shield Platform Encryption limitations are not relevant for outbound integrations from Salesforce to on-premise servers. Shield Platform Encryption is a feature that allows administrators to encrypt sensitive data at rest in Salesforce using AES 256-bit encryption. This can help protect data from unauthorized access or theft. However, Shield Platform Encryption limitations are not relevant for outbound integrations from Salesforce to on-premise servers, as they only affect the functionality and performance of encrypted data in Salesforce, such as searching, reporting, or validation rules. Shield Platform Encryption does not affect the security of the data transmission itself, as it only encrypts the data at rest in Salesforce.

References: Salesforce Integration Patterns and Practices : Salesforce Integration Guide : Restrict Outbound Requests with a Default Gateway : Deterministic Encryption : Shield Platform Encryption Considerations : Shield Platform Encryption : Shield Platform Encryption Architecture