Question 1

Northern Trail Outfitters has had an increase in requests from other business units to integrate
opportunity information with other systems from Salesforce. The developers have started writing
asynchronous @future callouts directly into the target systems. The CIO is concerned about the
viability of this approach scaling for future growth and has requested a solution recommendation.
What should be done to mitigate the concerns that the CIO has?

Accepted Answer

D

Explanation: The CIO's primary concern is the scalability and long-term viability of the current point-to-point integration architecture. Direct @future callouts create tight coupling between Salesforce and each target system. As the number of systems grows, this approach leads to a brittle, unmanageable "spaghetti architecture." Implementing an Enterprise Service Bus (ESB) or a similar middleware layer introduces a hub-and-spoke model. This fundamentally decouples the systems. Salesforce communicates with a single endpoint (the ESB), which then handles the complex tasks of routing, message transformation (mediation), and orchestration to the various target systems. This architectural pattern is designed specifically to enhance scalability, simplify maintenance, and provide centralized governance, directly mitigating the CIO's strategic concerns.

Question 2

Salesforce users need to read data from an external system via HTTPS request.
Which two security methods should an integration architect leverage within Salesforce to secure
the integration?
Choose 2 answers

Accepted Answer

B, D

Explanation: For securing an outbound HTTPS request from Salesforce, Named Credentials and Two-way SSL are the most direct and appropriate security methods. A Named Credential is the standard Salesforce feature for managing outbound callouts. It abstracts the endpoint URL and handles the authentication protocol (e.g., Basic Auth, OAuth 2.0), preventing sensitive credentials from being hardcoded in Apex code. Salesforce manages the authentication, simplifying the process and enhancing security. Two-way SSL (also known as mutual TLS or mTLS) provides transport-level security. In this method, both the client (Salesforce) and the server (the external system) authenticate each other by presenting and validating digital certificates. This ensures that Salesforce is communicating with the legitimate server and the server is receiving requests from the correct Salesforce org.

Question 3

The director of customer service at Northern Trail Outfitters (NTO) wants to capture and trend
specific business events that occur in Salesforce in real time. The metrics will be accessed in an ad-
hoc manner using an external analytics system. The events that are of interest are:
A customer has initiated a product exchange via a Case A customer service rep clicks on the
"Authorize Exchange Product" menu item on the Case A customer has initiated a subscription
cancellation via a Case A customer service rep clicks on the "Initiate Refund" menu item on the Case
Which two solutions will meet these business requirements?
Choose 2 answers

Accepted Answer

C, D

Explanation: This scenario requires a real-time, scalable, and decoupled integration to send business event data to an external analytics system. Platform Events are the ideal Salesforce feature for this, creating a durable event stream that external subscribers can consume in real-time. Option C correctly addresses the events initiated by a customer creating a Case (e.g., for an exchange or cancellation). An Apex trigger on the Case object is the standard mechanism to react to record creation and can publish a Platform Event to the event bus. Option D correctly addresses the events initiated by a service representative clicking a specific UI element. The most direct way to capture this user interaction is via the custom Apex controller backing the UI element (e.g., a Lightning Web Component), which can then publish the corresponding Platform Event.

Question 4

Northern Trail Outfitters (NTO) has recently changed their Corporate Security Guidelines. The
guidelines require that all cloud applications pass through a secure firewall before accessing on-
premise resources. NTO is evaluating middleware solutions to integrate cloud applications with on-
premise resources and services.
What are two considerations an Integration Architect should evaluate before choosing a middleware
solution?
Choose 2 answers

Accepted Answer

A, B

Explanation: The core requirement is to establish a secure, firewalled integration between cloud applications and on-premise resources. An API Gateway (A) serves as a dedicated, secure entry point for all incoming requests, allowing for centralized policy enforcement, security screening, and traffic management. To comply with the guideline that all traffic must pass through a secure firewall, the standard architectural pattern is to place this public-facing gateway component within a Demilitarized Zone (DMZ) or perimeter network (B). This isolates the integration layer from the internal trusted network, ensuring all traffic is inspected by firewalls before reaching sensitive on-premise systems.

Question 5

An Integration Architect has designed a mobile application for Salesforce users to get data while on
the road using a custom UI. The application is secured with oAuth and is currently functioning well.
There is a new requirement where the mobile application needs to obtain the GPS coordinates and
store it on a custom geolocation field.
The geolocation field is secured with Field Level Security, so users can view the value without
changing it.
What should be done to meet the requirement?

Accepted Answer

D

Explanation: The core requirement is to update a field that the user cannot edit due to Field Level Security (FLS). Standard API calls, such as the standard REST API (Option C) or SOAP API (Option A), execute in the context of the authenticated user and respect all their permissions, including FLS. Therefore, any attempt to update the read-only geolocation field using these standard APIs would fail. The correct solution is to create a custom Apex REST service (Option D). By default, Apex code runs in system mode, which bypasses object and field-level security. This allows the Apex method to update the field programmatically, even though the user does not have the direct permission to do so, thus satisfying the requirement.

Question 6

A company needs to integrate a legacy on premise application that can only support SOAP API. After
the Integration Architect has evaluated the requirements and volume, they determined that the Fire
and Forget integration pattern will be most appropriate for sending data from Salesforce to the
external application and getting response back in a strongly typed format.
Which integration capabilities should be used to integrate the two systems?

Accepted Answer

A

Explanation: The scenario requires a "Fire and Forget" integration from Salesforce to a legacy system's SOAP API. Salesforce's Outbound Message is a declarative, native feature designed specifically for this purpose. It sends a SOAP notification to a designated endpoint asynchronously without waiting for a response, perfectly matching the fire-and-forget pattern. For the return communication from the legacy system to Salesforce, the requirement is for a "strongly typed format." The Enterprise WSDL is strongly typed, meaning it is bound to the specific configuration of the Salesforce org, including its custom objects and fields. This provides a strict contract for the external system, fulfilling the requirement.

Question 7

An enterprise architect has requested the Salesforce Integration architect to review the following (see diagram & description) and provide recommendations after carefully considering all constraints of the enterprise systems and Salesforce platform limits. • About 3,000 phone sales agents use a Salesforce Lightning UI concurrently to check eligibility of a customer for a qualifying offer. • There are multiple eligibility systems that provides this service and are hosted externally. However, their current response times could take up to 90 seconds to process and return (there are discussions to reduce the response times in future, but no commitments are made). • These eligibility systems can be accessed through APIs orchestrated via ESB (MuleSoft). • All requests from Salesforce will have to traverse through customer's API Gateway layer and the API Gateway imposes a constraint of timing out requests after 9 seconds. Which three recommendations should be made? Choose 3 answers

Accepted Answer

A, C, E

Explanation: The scenario involves a long-running callout (up to 90 seconds) initiated from a Lightning UI that must pass through a gateway with a short timeout (9 seconds). This requires an asynchronous integration pattern. 1. (A) The ESB (MuleSoft) must immediately acknowledge the request and return a correlation or requestID. This decouples Salesforce from the long-running backend process, satisfying the 9-second gateway timeout. Mule then manages the state of the long-running transaction. 2. (C) On the Salesforce side, a Continuation is the ideal mechanism to make a long-running callout from a Lightning component. It frees up the Apex thread, preventing it from being blocked and hitting governor limits, which is crucial with 3,000 concurrent users. 3. (E) To retrieve the result, a client-side polling mechanism is the most viable option. After receiving the requestID, a "Check Update" button allows the user to poll for the result. The alternative, using Platform Events (Option D), is not feasible as the 3,000 concurrent users would exceed the platform's limit of 2,000 concurrent CometD subscribers.

Question 8

An Integration Architect has built a Salesforce application that integrates multiple systems and keeps them synchronized via Platform Events. What is taking place if events are only being published?

Accepted Answer

B

Explanation: In Salesforce, when Platform Events are published from within an Apex transaction using the EventBus.publish() method, the events are not sent immediately. Instead, they are queued. The actual publication to the event bus occurs only after the entire Apex transaction has been successfully committed to the database. This transactional behavior is a critical feature that ensures data consistency, as it prevents events from being published if the originating transaction fails and is rolled back. The events are discarded along with the other rolled-back changes.

Question 9

Service Agents at Northern Trail Outfitters uses Salesforce to manage cases and B2C Commerce for
ordering.
Which integration solution should an architect recommend in order for the service agents to see
order history from a B2C Commerce system?

Accepted Answer

A

Explanation: The most precise and recommended solution is the Salesforce B2C Commerce to Service Cloud Connector. This is a pre-built, managed solution specifically designed to integrate these two platforms. It synchronizes customer and order data from B2C Commerce directly into Service Cloud, providing service agents with a 360-degree view of the customer, including their order history, without requiring extensive custom development. This connector is the most direct and efficient way to meet the specified requirement.

Question 10

A large enterprise customer operating in a high regulated industry is planning to implement
Salesforce for customer facing associates in both Sales and Service, and back office staff. The business
processes that Salesforce supports are critical to the business.
Salesforce will be integrated to multiple back office systems to provide a single interface for
associates. Reliability and monitoring of these integrations is required as associates support
customers.
Which integration solution should the architect consider when planning the implementation?

Accepted Answer

D

Explanation: For a large enterprise with business-critical processes and multiple back-office systems, a middleware platform (such as an Enterprise Service Bus or an Integration Platform as a Service) is the standard architectural solution. Middleware is specifically designed to manage complex integrations by providing a centralized hub for orchestration, transformation, and routing. Crucially, these platforms offer robust, out-of-the-box capabilities for reliability (e.g., guaranteed delivery, retry logic), centralized monitoring, logging, and real-time alerting. This directly addresses the customer's requirements for a reliable, manageable, and observable integration landscape in a regulated environment.

Question 11

A company is planning on sending orders from Salesforce to a fulfillment system. The integration
architect has been asked to plan for the integration.
Which two questions should the integration architect consider?
Choose 2 answers
A Can the fulfillment system create new addresses within the Order Create service?

Accepted Answer

B, C

Explanation: When planning an integration, the architect must first understand the capabilities of the external system to select the most appropriate integration pattern. Callback Capability (B): Asking if the fulfillment system can make a callback is critical for designing an asynchronous integration. For an order fulfillment process, Salesforce needs to know the final status (e.g., shipped, canceled). A callback allows the fulfillment system to update Salesforce asynchronously, which is a robust and scalable pattern for long-running processes. Outbound Messaging Support (C): Outbound Messaging is a standard, declarative Salesforce integration feature that sends a SOAP message to a designated endpoint. Asking if the fulfillment system can implement an interface based on the Salesforce-generated WSDL (a contract-first approach for the endpoint) directly assesses its compatibility with a reliable, asynchronous, fire-and-forget pattern.

Question 12

Universal Containers (UC) is a large printing company that sells advertisement banners. The company
works with third-party agents on banner initial design concepts. The design files are stored in an on-
premise file store that can be accessed by UC internal users and the third party agencies. UC would
like to collaborate with the 3rd part agencies on the design files and allow them to be able to view
the design files in the community.
The conceptual design files size is 2.5 GB.
Which solution should an integration architect recommend?

Accepted Answer

B

Explanation: The core challenge is providing access to very large (2.5 GB) files stored on-premise for viewing within a Salesforce Community. The most appropriate Salesforce technology for this is Files Connect. Files Connect allows users to browse, search, and share files from external repositories (including on-premise systems via a custom adapter) directly within the Salesforce UI. This approach keeps the file in its original location, bypassing Salesforce's 2 GB file size limit, while providing an integrated viewing experience inside the community. Although the wording in option B is imprecise (e.g., "upload to an external object"), it correctly identifies the governing technology (Salesforce Connect, which includes Files Connect) and the concept of using an External Data Source to federate access to external data/files.

Question 13

A company's security assessment noted vulnerabilities on the un managed packages in their
Salesforce orgs, notably secrets that are easily accessible and in plain text, such as usernames,
passwords, and OAuth tokens used in callouts from Salesforce.
Which two persistence mechanisms should an integration architect require to be used to ensure that
secrets are protected from deliberate or inadvertent exposure?
Choose 2 answers

Accepted Answer

A, B

Explanation: Named Credentials are Salesforce’s prescribed mechanism for outbound callouts because the endpoint URL, user name, password, OAuth token, and refresh token are stored in a secure, non-exportable secret store that is never exposed in Apex or the UI. If a secret must be kept inside the org rather than supplied at run time, an Encrypted Custom Field protects it by encrypting the value at rest; only users with the “View Encrypted Data” permission can see the clear text, and the value is masked in reports, list views, and the API for all other users. Protected Custom Metadata Types and Protected Custom Settings either cannot be used in an unmanaged package or do not provide encryption, so they do not meet the stated requirement.

Question 14

A large consumer goods manufacturer operating in multiple countries is planning to implement
Salesforce for their Sales and Support operations globally. They have the following security
requirements:
1. Internal users from each country have to be authenticated with their local active directory.
2. Customers can create their own login or use Google login.
3. Partners have to be authenticated through a central system which is to be determined.
4. Internal users will have access to the central ERP with their credentials maintained in the ERP.
5. Additional internal systems will be integrated with Salesforce for Sales and Support business
processes.
Which three requirements should the integration architect evaluate while designing the integration
needs of this project?
Choose 3 answers

Accepted Answer

B, D, E

Explanation: The integration architect must evaluate various architectural patterns to address the complex, multi-faceted identity and integration requirements. 1. (B) The requirement for integrating additional internal systems (#5) necessitates a thorough security assessment. The architect must evaluate and decide on secure integration methods, such as appropriate OAuth 2.0 flows, for system-to-system communication, which is a distinct concern from user authentication. 2. (D) A common and robust pattern for handling diverse authentication needs (internal AD, partners, social logins) is to use a centralized third-party Identity Provider (IdP) like Okta or Azure AD. Evaluating this architectural pattern is a critical task for the architect to simplify management and centralize security policy. 3. (E) The architect must also evaluate using the Salesforce platform's native identity capabilities (Salesforce Identity). Salesforce can act as an IdP, support social sign-on for customers, provide native logins, and act as a service provider for internal users, making it a viable pattern to assess against the requirements.

Question 15

Northern Trail Outfitters (NTO) uses Salesforce to track leads, opportunities and order details that
convert leads to customers. However, Orders are managed by an external (remote) system. Sales
representatives want to view and update real-time order information in Salesforce. NTO wants the
data to only persist in the external system.
Which type of Integration should an architect recommend to meet this business requirement?

Accepted Answer

A

Explanation: The core requirements are to view and update external data in real-time without storing a copy in Salesforce. The Data Visualization pattern (also known as Data Virtualization) directly addresses this. This pattern allows Salesforce to present data from an external system within the user interface as if it were native data. Technologies like Salesforce Connect use External Objects to achieve this, querying the remote system on-demand for display and pushing updates back in real-time, ensuring the external system remains the single source of truth.

Free Salesforce ARC-101 Actual Exam Questions