1

Which key advantage does REST have over SOAP for Salesforce integrations when working with mobile or low-bandwidth clients?

AREST uses lightweight JSON payloads and requires no XML envelope, making it faster to parse on constrained devices BREST supports built-in WS-Security headers not available in SOAP CREST always enforces WSDL-based contracts, ensuring type safety DREST requires a separate session ID endpoint unlike SOAP

2

What is the primary benefit of using Named Credentials instead of Remote Site Settings for Apex callouts?

ANamed Credentials allow callouts without setting any endpoint URL BNamed Credentials store the endpoint URL and authentication credentials securely, and automatically handle OAuth token refresh without exposing secrets in code CNamed Credentials replace the need for Connected Apps entirely DNamed Credentials are required only for SOAP callouts, not REST

3

In the OAuth 2.0 Web Server Flow, which component initiates the authorization redirect to Salesforce?

AThe Salesforce authorization server directly contacts the external app BThe resource owner's browser is bypassed; the server exchanges credentials directly CThe external web server redirects the user's browser to the Salesforce authorization endpoint, and upon approval exchanges the authorization code for tokens DThe Connected App directly polls Salesforce for a token without user involvement

4

Which OAuth flow is most appropriate for server-to-server integrations where no user interaction is possible, using a certificate-based assertion?

AUsername-Password Flow BWeb Server Flow CDevice Flow DJWT Bearer Token Flow

5

Salesforce Connect with the OData 2.0 adapter creates External Objects. Which statement best describes how these objects behave differently from standard Salesforce objects?

AExternal Objects do not store data in Salesforce; each query makes a live callout to the external OData service BExternal Objects store a cached copy of external data that is refreshed nightly CExternal Objects support all Salesforce DML operations including delete DExternal Objects require a Heroku Connect license to function

6

What is the key difference between Platform Events and Change Data Capture (CDC) in Salesforce?

APlatform Events support full DML while CDC is read-only BPlatform Events are custom events published explicitly by code or flows; CDC automatically publishes change events when Salesforce records are created, updated, deleted, or undeleted CCDC events can only be consumed by external systems, not Apex triggers DPlatform Events are stored for 30 days while CDC events expire after 72 hours

7

When configuring Outbound Messaging to notify an external system of record changes, which protocol does Salesforce use to deliver the message?

AREST with JSON payload BMQ-based message queuing CSOAP-based XML message sent to an external SOAP endpoint that must acknowledge receipt DPlatform Event published to Salesforce event bus

8

Salesforce Canvas allows an external app to appear embedded in the Salesforce UI. Which mechanism does Canvas use to pass the Salesforce context and authentication to the external app?

AOAuth Web Server Flow with a redirect URI BSAML assertion embedded in the iFrame URL CA shared API key stored in Custom Settings DA signed request (HMAC-SHA256) containing a JSON context payload that is POST-ed to the external app

9

In an Enterprise Service Bus (ESB) middleware pattern, what is the primary role of the ESB in a Salesforce integration?

AThe ESB acts as a central broker that routes, transforms, and mediates messages between Salesforce and multiple backend systems, decoupling producers from consumers BThe ESB stores Salesforce records in a separate database for reporting CThe ESB replaces Named Credentials by managing endpoint URLs DThe ESB is only used for point-to-point integrations with one external system

10

When should you choose Bulk API 2.0 over the REST API for data operations in Salesforce?

AWhen you need real-time synchronous responses for each record BWhen processing large data sets (hundreds of thousands to millions of records) asynchronously, where throughput is more important than immediate per-record response CWhen making callouts from Apex triggers DWhen the external system only supports XML payloads

11

The Salesforce Composite API's "composite" resource allows up to how many subrequests per call, and what feature enables referencing results from earlier subrequests in later ones?

A50 subrequests; query parameters B10 subrequests; named variables in the URL path C25 subrequests; reference IDs that can be used in subsequent subrequest URLs and request bodies D100 subrequests; JSON path expressions

12

What is the maximum number of callouts (HTTP requests and web service calls) allowed per Apex transaction?

A10 B50 C200 D100

13

What is the default and maximum HttpRequest timeout value in Apex for a single callout?

ADefault is 10 seconds; maximum is 120 seconds (2 minutes) BDefault is 30 seconds; maximum is 300 seconds CDefault is 60 seconds; maximum is 600 seconds DDefault is 5 seconds; maximum is 60 seconds

14

What must be configured in Salesforce before Apex code can make an HTTP callout to an external endpoint that does NOT use a Named Credential?

AA Connected App with the endpoint URL BA Remote Site Setting entry for the external endpoint URL CA Custom Metadata Type record with the URL DA CSP Trusted Site entry in Setup

15

MuleSoft Anypoint Platform is classified as which type of integration middleware?

APoint-to-point integration adapter BSalesforce-native workflow tool CIntegration Platform as a Service (iPaaS) and API-led connectivity platform supporting hub-and-spoke and ESB patterns DMessage queue broker similar to Apache Kafka only

16

When Salesforce acts as a SAML Identity Provider (IdP), what does it provide to service providers during SSO?

AAn OAuth access token for the service provider to use BA username and password combination for the external app CA Salesforce session ID for the external app DA digitally signed SAML assertion containing user identity attributes that the service provider trusts to authenticate the user

17

Salesforce Shield Event Monitoring provides which integration-relevant capability?

ADetailed event log files capturing API usage, login events, report exports, and page views that can be consumed by external SIEM systems via the REST API or Platform Events BReal-time encryption of all API callout payloads CAutomated blocking of suspicious API calls DA firewall between Salesforce and external systems

18

Heroku Connect synchronizes data between Salesforce and a Heroku Postgres database. What are the two sync modes available?

ABatch mode and streaming mode BPolling (periodic) and event-driven (using Streaming API / CDC) modes CManual and automatic modes DRead-only and write-only modes

19

Why should Queueable Apex be preferred over @future methods when making callouts that require chaining or passing complex objects?

A@future methods run faster than Queueable jobs B@future methods support passing SObject lists while Queueable does not CQueueable supports passing non-primitive types (SObjects, collections), chaining jobs, and obtaining a job ID for monitoring, which @future methods do not support DQueueable jobs run synchronously while @future runs asynchronously

20

What is an idempotent API design, and why is it important in Salesforce integrations?

AAn idempotent API processes requests faster on repeated calls by caching responses BAn idempotent API requires a unique session token per request to prevent replay attacks CAn idempotent API validates all input fields before processing DAn idempotent API produces the same result whether called once or multiple times with the same input, which prevents duplicate records when network retries occur

21

In REST API versioning for Salesforce, what is the recommended approach to maintain backward compatibility for consumers when introducing breaking changes?

AIncrement the API version number in the URL (e.g., /v1/ to /v2/) and maintain older versions until consumers migrate BUse query parameters to indicate the version (e.g., ?version=2) COverwrite the existing endpoint with the new behavior immediately DUse HTTP headers exclusively for versioning with no URL changes

22

What happens when a Salesforce API rate limit (concurrent or daily) is exceeded by an external integration?

ASalesforce queues excess requests and processes them when capacity frees up BSalesforce returns an HTTP 503 (REQUEST_LIMIT_EXCEEDED) error, and the integration must implement retry logic with exponential backoff CThe user's Connected App is permanently revoked DSalesforce automatically throttles requests to 1 per second without error

23

In JWT Bearer Token OAuth flow, what is the typical expiry of the access token returned by Salesforce?

A24 hours B30 minutes CThe token expires based on the session settings in the Connected App (default is about 2 hours); a new JWT assertion must be submitted to obtain a new token as no refresh token is issued DThe token never expires and can be stored permanently

24

How does OAuth token refresh work when a Connected App uses the Web Server Flow with offline_access scope?

AThe user must log in again every time the access token expires BThe Connected App stores the access token in a cookie for automatic renewal CSalesforce sends a new access token to the Connected App via webhook when the old one expires DThe app exchanges the long-lived refresh token for a new access token by posting to the Salesforce token endpoint without requiring user re-authorization

25

Salesforce Files Connect allows users to access files from external repositories. Which two external repositories are natively supported?

AMicrosoft SharePoint and Google Drive BDropbox and Box CAWS S3 and Azure Blob Storage DOneDrive and Heroku Filesystem

26

What is the Composite Batch API resource used for, and how does it differ from the Composite resource?

AComposite Batch executes subrequests sequentially with dependencies; Composite executes them in parallel BComposite Batch executes up to 25 independent subrequests in a single round trip without supporting cross-request references; Composite supports up to 25 subrequests with reference IDs linking them CComposite Batch is for bulk data; Composite is for single record operations DComposite Batch requires OAuth; Composite uses session ID only

27

Which Salesforce Streaming API channel type delivers notifications for record changes that match a SOQL query filter?

APlatform Events channel BGeneric Streaming channel CPushTopic channel, where the PushTopic record contains a SOQL query defining which record changes trigger a notification DChange Data Capture channel with SOQL filter

28

What is the Salesforce Composite Graph API used for?

AVisualizing Salesforce record relationships in a graph database BRunning SOSL text searches across multiple objects CExecuting a sequence of SOQL queries in parallel DCreating a set of composite requests that represent a graph of related records, where all operations succeed or fail atomically as a unit

29

In error handling for integrations, what is the recommended pattern when an Apex callout receives a non-2xx HTTP response?

ACheck the response status code, log the error details, throw a custom exception or add to an error log object, and implement retry logic using Queueable or Platform Events for transient failures BSwallow the exception silently to prevent transaction rollback CImmediately retry the callout 10 times in a loop within the same transaction DReturn null to the calling code and let the UI handle the error

30

When Salesforce acts as the SAML Service Provider (SP) in an SSO configuration, what does it receive from the Identity Provider to authenticate a user?

AAn OAuth access token from the IdP's token endpoint BA SAML Response containing a signed XML assertion with user identity claims that Salesforce validates against the IdP's certificate CA Kerberos ticket from the Active Directory server DA username and hashed password via POST

31

In a point-to-point integration architecture with 10 systems all integrated with each other, how many integration connections are required, and what is the main drawback?

A10 connections; single point of failure if one system goes down B20 connections; difficult to add new systems C45 connections (n*(n-1)/2); the architecture becomes extremely complex and brittle as each system is tightly coupled to many others D100 connections; too expensive to license

32

Which Salesforce feature enables Einstein Analytics (CRM Analytics) datasets to be populated from external data via an API?

AThe CRM Analytics Streaming API BSalesforce Connect with OData adapter pointing to CRM Analytics CBulk API 2.0 with a special analytics flag DThe Analytics External Data API, which allows uploading CSV or JSON data to create or replace CRM Analytics datasets

33

What is the Salesforce MuleSoft Anypoint MQ product used for in an integration architecture?

AA fully managed, cloud-native message queuing service that decouples producers and consumers, enabling asynchronous messaging within MuleSoft integrations BA real-time analytics dashboard for monitoring Mule flows CA Salesforce Platform Event bus replacement for external systems DA tool to migrate Salesforce metadata between orgs

34

What is the OData 4.0 advantage over OData 2.0 when using Salesforce Connect External Objects?

AOData 4.0 supports only JSON while OData 2.0 supports both XML and JSON BOData 4.0 supports more query capabilities, better performance through server-side filtering, and is the current standard with broader ecosystem support COData 4.0 allows write operations while OData 2.0 is read-only DOData 4.0 stores data in Salesforce while OData 2.0 does live queries only

35

In the OAuth 2.0 Username-Password Flow, what is a significant security concern that makes it unsuitable for most production integrations?

AIt does not support scopes, giving the app full access BIt requires two-factor authentication which slows integrations CThe app receives the user's actual username and password, which creates a security risk since credentials must be stored in the external system and there is no user consent dialog DIt only works with Salesforce Classic, not Lightning Experience

36

When using the Salesforce REST API to integrate with an external system, which HTTP status code indicates that a resource was successfully created?

A200 OK B204 No Content C202 Accepted D201 Created

37

A connected app's Consumer Key and Consumer Secret should be treated like which type of credential?

AHighly sensitive credentials equivalent to passwords — they must never be embedded in client-side code or public repositories, and should be rotated regularly BPublic identifiers that can be safely stored in source control CRead-only tokens that cannot be used to impersonate users DTemporary tokens that expire after each API call

38

What is the hub-and-spoke integration topology, and what is its main advantage over point-to-point?

AEach system connects directly to every other system; it has no single point of failure BAll systems connect to a central hub (e.g., ESB or iPaaS); each system only needs one integration to the hub, drastically reducing connections and centralizing transformation and routing logic CThe hub stores all data and systems query it via REST; this eliminates real-time integration needs DThe spoke systems handle all transformations; the hub only routes messages

39

Which Salesforce feature would you use to expose a custom Apex class as a SOAP web service to external systems?

A@RestResource annotation with @HttpPost B@InvocableMethod annotation Cglobal keyword on the class with webservice keyword on methods, generating a WSDL at the Apex SOAP service endpoint D@AuraEnabled annotation with soapMethod=true parameter

40

What does the Salesforce Bulk API 2.0 improve over Bulk API 1.0 in terms of developer experience?

ABulk API 2.0 supports XML payloads that Bulk API 1.0 did not BBulk API 2.0 processes records synchronously for faster feedback CBulk API 2.0 allows 1 million records per batch vs 10,000 in Bulk API 1.0 DBulk API 2.0 simplifies the workflow by removing the need to create and close batches manually — you upload a CSV, Salesforce handles batching internally, and results are retrieved as a single file

41

A Salesforce Platform Event has a ReplayId field. What does this field enable for external subscribers?

ASubscribers can specify a ReplayId to replay events from a specific point in the event log (up to 72 hours retention), ensuring at-least-once delivery even after downtime BReplayId is used to deduplicate events automatically on the subscriber side CReplayId must be manually incremented by the publisher for each event DReplayId controls the priority order in which events are delivered to subscribers

42

When integrating Salesforce with an ERP using a request-reply synchronous pattern, which Apex mechanism should be used to make the callout and wait for the response?

A@future(callout=true) method to run asynchronously BHttpRequest and HttpResponse classes in a synchronous Apex method, which blocks until the response is received or the timeout is reached CContinuation class for non-blocking callout DQueueable Apex to defer the callout to a separate transaction

43

A Remote Site Setting is required when an Apex class makes an HTTP callout. What happens if the endpoint changes to use a sub-domain not covered by the existing Remote Site Setting?

ASalesforce automatically creates a new Remote Site Setting for the sub-domain BThe callout succeeds because wildcard Remote Site Settings cover all sub-domains CThe callout throws a "Unauthorized endpoint" exception and a new Remote Site Setting or Named Credential must be added for the new sub-domain DThe callout falls back to using the parent domain automatically

44

What is the Salesforce EventBus (Pub/Sub API) and how does it differ from the older CometD-based Streaming API?

AEventBus is only available in Experience Cloud; CometD works everywhere BEventBus uses SOAP; CometD uses REST CEventBus supports batch events only; CometD handles real-time only DThe Pub/Sub API uses gRPC for high-throughput, low-latency streaming and supports binary Avro-encoded events, making it more efficient than the CometD-based Streaming API for high-volume enterprise integrations

45

In a Connected App configured for OAuth, what is the purpose of the "Callback URL" (redirect_uri)?

AIt is the URL to which Salesforce redirects the user's browser after authorization, passing back the authorization code that the server-side app exchanges for an access token BIt is a webhook URL that Salesforce calls whenever the access token is refreshed CIt specifies where Salesforce sends error notifications when the Connected App fails DIt is the URL Salesforce polls to verify the external app is still running

46

What is the maximum size of a single HTTP request body for a Salesforce REST API callout made FROM Apex?

A1 MB B12 MB for synchronous and 36 MB for asynchronous Apex callout request/response combined C5 MB flat limit for all callouts D100 MB using chunked transfer encoding

47

Which integration pattern is most appropriate when Salesforce needs to receive and process thousands of incoming events from IoT devices without blocking device transmissions?

ASynchronous REST callout from each device to the Salesforce REST API BSOAP-based request-reply from each device CDevices publish events to a message queue (e.g., MuleSoft MQ, Kafka); a middleware layer batches and pushes data to Salesforce via Bulk API or Platform Events asynchronously DEach device uses SOQL to update records directly via the Salesforce REST API

48

Which Salesforce object stores the audit trail of outbound message delivery attempts and acknowledgements?

AEventLogFile BOutboundMessageLog__c COutboundMessage__e Platform Event DOutboundMessage delivery status is visible in the Outbound Messaging monitoring page in Setup, which shows queue and retry status; the WorkflowActionHistory or Debug Logs are used for detailed tracing

49

What is the recommended approach for handling large file transfers (e.g., 500 MB) between Salesforce and an external system?

AStore large files in Salesforce Files (ContentVersion) and provide the external system a pre-authenticated download URL via the REST API /sobjects/ContentVersion/{id}/VersionData endpoint; or use an external storage service like AWS S3 with a reference stored in Salesforce BUse Apex SOAP callouts with chunked encoding to stream 500 MB directly CUse the Composite API to split the file into 25 MB chunks per subrequest DEmail the file to an Email-to-Case address and retrieve from the attachment via SOAP

50

Which Salesforce product provides a managed, low-code way to build API-led integrations between Salesforce and external systems without writing Mule flows from scratch?

ASalesforce Flow with External Services BMuleSoft Composer for Salesforce — a no-code integration tool that uses pre-built connectors to integrate Salesforce with external systems like Slack, Google, NetSuite, and Workday CSalesforce Connect with a Custom Apex Adapter DHeroku Connect with Postgres replication

Integration Architect Mock Test