SF-PD2 Process Automation, Logic, and Integration — 15 Questions

Question 1

An enterprise Salesforce org utilizes Platform Events to decouple order processing services. A developer needs to ensure that when a custom Platform Event is published, subscriber processing failures do not cause the publishing transaction to roll back, and subscribers can resume processing from the exact point of failure after a system outage. Which configuration and implementation approach should the developer choose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the Platform Event publishing behavior to publish after successfully committing the database transaction, and use an Apex trigger with asynchronous processing for subscribers.. Platform events inherently decouple publishers from subscribers, ensuring publishing transactions never roll back due to subscriber errors. Utilizing CometD clients with replay IDs allows subscribers to retrieve missed events after disconnects. Understanding event durability and transaction boundaries is crucial for designing reliable event-driven architectures.

Answer

Publish the event using Database.insert(event, true) within a trigger that synchronously calls subscriber Apex classes in a chained loop.

Answer

Implement a custom REST service where subscribers poll Salesforce every 5 seconds, storing the last processed timestamp in a custom object.

Answer

Publish the event with immediate publishing behavior so subscribers execute within the exact same database transaction as the publisher.

Question 2

Refer to the exhibit. A developer wrote a trigger handler to evaluate child orders when an order's status changes. During stress testing with bulk updates across accounts with numerous child orders, the developer notices intermittent CPU time limit exceptions. What is the root architectural flaw in this Apex code?

Accepted Answer

The subquery fetching child orders within the parent Account query creates excessive heap usage and nested iteration overhead when processing accounts with large child volumes.. Querying child records inside a parent query within a trigger handler introduces potential nested loop structures and heavy memory consumption, especially when accounts have large child orders. This violates bulk design patterns and leads to CPU timeout issues. Developers must isolate queries and aggregate data efficiently to maintain scalable enterprise code.

Answer

The trigger handler executes queries inside a tight loop iterating over the newOrders collection without batching.

Answer

The Map construction for the Account query uses Id keys instead of String keys, which causes severe hashing collisions in large bulk transactions.

Answer

The before update context automatically invokes triggers twice in Salesforce enterprise environments, doubling the CPU time consumed.

Question 3

An integration architect is designing a bidirectional data synchronization mechanism between Salesforce and an external Enterprise Resource Planning (ERP) system. The solution requires real-time outbound notifications when Account records are modified, ensuring secure transmission and handling potential endpoint unavailability. Which TWO architectural components or patterns should be incorporated? Choose 2 answers.

Accepted Answer

Implement Named Credentials to securely store and manage authentication endpoints, tokens, and authorization parameters for all outbound HTTP callouts.. Outbound Message rules or Apex callouts via Queueable combined with Named Credentials provide secure, decoupled outbound communication. Named Credentials securely manage endpoint authentication tokens without hardcoding secrets, while asynchronous processing ensures system resilience during outages. These patterns ensure enterprise-grade security and reliability.

Answer

Use synchronous trigger-based HTTP callouts directly inside the Account before update trigger to guarantee immediate delivery.

Answer

Hardcode the external ERP endpoint URL and API bearer tokens directly into Custom Labels to allow rapid administrative updates.

Answer

Rely on standard Salesforce Workflow outbound messages without TLS encryption to maximize throughput and processing speed.

Question 4

A developer is writing a bulkified trigger handler for the Account object that performs complex calculations and updates related Contact records. To maintain optimal performance and adhere to Salesforce best practices, which TWO strategies must the developer implement? Choose 2 answers.

Accepted Answer

Collect all Account IDs into a Set, query related Contact records in a single SOQL statement, and map them appropriately before processing.. Bulkifying triggers and maintaining strict separation of concerns are foundational for scalable Salesforce development. By querying related records into maps and looping through collection instances rather than querying inside loops, the code avoids governor limit exceptions and executes efficiently under large data volumes.

Answer

Query related Contact records inside the Account trigger loop using a SOQL query for each individual Account record.

Answer

Delegate all business logic directly into helper methods within the trigger body to ensure centralized execution flow.

Answer

Hardcode record type IDs directly inside the trigger logic to ensure fast filtering of specific account categories.

Question 5

A platform developer is designing a custom logging framework that records diagnostic information whenever unhandled exceptions occur in trigger handlers. To ensure that log records are successfully committed to the database even when the main transaction rolls back due to an exception, which feature must be utilized?

Accepted Answer

Publish a Platform Event within the catch block configured with immediate publishing behavior to capture logs independently.. Platform events published with the 'Publish After Recovery' or 'Publish Immediately' behavior, or using separate autonomous transactions via custom REST callouts, can persist data independently. However, inside Apex, Platform Events configured with 'Publish After Commit' publish only when the transaction succeeds, whereas standard DML rolls back. Utilizing asynchronous processing or independent logging frameworks is essential.

Answer

Execute a standard database insert statement inside the catch block of the primary transaction handler.

Answer

Invoke a synchronous webservice callout to an external logging server from within the catch block.

Answer

Utilize a custom metadata type deployment via Metadata API within the catch block to store error logs.

Question 6

Refer to the exhibit. A developer wrote a future method to process orders and make external callouts. During testing with a large data set, the developer notices intermittent failures and performance degradation. What is the primary architectural flaw in this implementation?

Accepted Answer

Executing HTTP callouts inside a for-loop risks exceeding the maximum limit of 100 callouts per transaction and causes serial latency.. Making HTTP callouts inside a for-loop violates Salesforce best practices and quickly hits governor limits such as maximum callouts per transaction (100) and cumulative CPU time limits. Callouts must be batched or handled asynchronously via Queueable Apex if multiple distinct calls are required.

Answer

The future method parameter accepts a Set of IDs instead of primitive data types, causing a compilation error.

Answer

The DML statement is placed outside the loop, causing record updates to fail due to uncommitted transaction scopes.

Answer

The @future annotation cannot accept parameters when combined with the callout=true attribute.

Question 7

An architect is designing an integration where an external system must update a custom object in Salesforce. The external system is restricted to standard REST APIs and cannot handle OAuth refresh tokens. Which authentication approach should the architect recommend to ensure both security and operational reliability?

Accepted Answer

Implement a Named Credential configured with the OAuth 2.0 Client Credentials flow.. The Named Credential with an Auth Provider using the Client Credentials Flow is the recommended approach. This flow is specifically designed for server-to-server communication where there is no user context. By using Named Credentials, the architect offloads the authentication management, including token refreshing and endpoint maintenance, to the platform itself, ensuring a secure and decoupled integration that minimizes hardcoded configuration and credential exposure risks.

Answer

Use a public-facing unauthenticated REST endpoint with a custom validation token.

Answer

Store the client secret in a custom setting and append it to every API request header.

Answer

Hardcode the username and password into the external system's integration configuration.

Question 8

Refer to the exhibit. An integration is failing when updating records because the process triggers a cascade of updates that hits the platform's recursion limit. Which strategy should the developer implement to safely handle this scenario while ensuring all required updates are applied?

Accepted Answer

Use a static boolean flag in a helper class to prevent re-entrant trigger execution.. The 'Maximum stack depth' error indicates infinite recursion, likely caused by a trigger updating a record that causes the same trigger to fire again. The standard solution is to use a static boolean variable or a specialized collection in an Apex class to track whether a trigger has already executed within the current context, preventing the trigger from processing the same records repeatedly in a single transaction.

Answer

Wrap the update logic in a try-catch block to ignore the error when it occurs.

Answer

Convert the trigger to an asynchronous @future method to offload the execution.

Answer

Increase the heap size limit by processing records in smaller batches.

Question 9

An organization is migrating legacy data and needs to ensure that validation rules are respected while improving performance during bulk inserts. Which THREE strategies are effective for balancing data integrity and system throughput?

Accepted Answer

Utilize the Bulk API 2.0 to process records in large batches to reduce total API calls.. Efficient data migration involves minimizing the overhead per record while strictly adhering to validation rules. By using high-performance APIs like Bulk API 2.0, minimizing trigger and flow logic, and utilizing efficient data structures, developers can move large sets of data into the system. These strategies ensure that all platform validations remain in effect while maximizing the concurrency and throughput capacity offered by the Salesforce platform infrastructure.

Answer

Disable all validation rules temporarily to allow for faster data insertion.

Answer

Use a single trigger to perform all data validation logic instead of using Validation Rules.

Question 10

A developer needs to dynamically query objects and fields based on user input for a custom reporting tool. Which Apex feature allows the developer to construct and execute these queries safely while preventing SOQL injection?

Accepted Answer

Employ Database.query() with bind variables to sanitize input parameters.. Dynamic SOQL is the correct feature for executing queries constructed at runtime. To prevent SOQL injection, developers must use bind variables, specifically the String.escapeSingleQuotes() method or utilize the Database.queryWithBinds method, which allows the platform to safely handle variable input as literal values rather than executable code, effectively neutralizing the risk of malicious user input manipulating the query structure.

Answer

Use the String.format method to inject user input directly into the query string.

Answer

Utilize a custom Apex class that regex-strips all special characters from input.

Answer

Perform the query using the standard SOQL syntax and pass the criteria as a list.

Question 11

An integration developer is tasked with syncing data between two Salesforce orgs. Which THREE considerations are critical to ensure data consistency and system reliability?

Accepted Answer

Use an External ID field for record matching to prevent data duplication during syncs.. Syncing between orgs requires careful planning to maintain data integrity. Using External IDs for upserting ensures that records are matched correctly rather than duplicated. Handling potential conflicts requires robust error logging and retry mechanisms. Additionally, selecting the right integration pattern, such as asynchronous event-driven updates, ensures that the integration is resilient, scalable, and does not negatively impact the performance of either production org.

Answer

Always use the record ID from the source org as the primary key in the target org.

Answer

Process all updates synchronously to ensure the target org is updated immediately.

Question 12

A developer needs to ensure that an Apex class runs with the permissions of the user who invokes it, rather than system-wide permissions. Which keyword should be added to the class definition?

Accepted Answer

public with sharing class MyClass {}. The 'with sharing' keyword is the standard mechanism to enforce the sharing rules and record-level security of the current user. By using 'with sharing', the developer ensures the Apex code respects the user's access levels, which is a critical security requirement for preventing data leakage and maintaining the integrity of org-wide security policies when executing custom business logic.

Answer

public without sharing class MyClass {}

Answer

public inherited sharing class MyClass {}

Answer

public class MyClass {}

Question 13

A developer is building an Apex REST service exposed at /services/apexrest/orders/. The service must accept a JSON payload and reject requests whose body cannot be deserialized into the OrderRequest wrapper class, returning HTTP 400 without leaking internal exception details. Which implementation satisfies this requirement?

Accepted Answer

Wrap the deserialization call in try/catch for JSONException and System.JSONException, and in the catch block set RestContext.response.statusCode to 400 and assign a generic message to RestContext.response.responseBody.. Catching System.JSONException around the deserialization call and explicitly writing a 400 status plus a generic body gives deterministic control over both the status code and the response content. The other approaches either target the wrong framework, produce a 500, or assume the platform maps return values or exceptions to 400 automatically, none of which happens.

Answer

Declare the method to throw a custom OrderException and rely on the Apex REST framework to translate any uncaught exception into an HTTP 400 with the exception message as the body.

Answer

Annotate the method with @AuraEnabled and let the platform convert deserialization errors into an automatic 400 response with a platform-generated error body.

Answer

Use RestRequest.requestBody.toString() and check for a null value; if null, return a String literal 'Bad Request' from the method so the framework maps it to HTTP 400.

Question 14

A developer needs an Apex callout to an external inventory service to be retried automatically up to three times when the service returns HTTP 503, with short waits between attempts, and the final failure must be logged. Which approach correctly implements this within a single Apex transaction?

Accepted Answer

Use a for loop with a counter, make the Http callout inside a try/catch, inspect the HttpResponse status code for 503, and on failure call a small delay via a custom retry utility that reissues the request up to three times before writing a log record.. Because callouts must complete within the transaction that initiates them, retries for a single logical operation belong in a bounded loop that reissues the request and inspects each response. Handling the final failure inside the same method lets the code write the log record predictably, whereas chaining jobs or assuming platform retries breaks either the transaction scope or the retry count.

Answer

Enqueue a Queueable job for each attempt, chaining a new job when a 503 is received, until three jobs have run, then write the log from the last job.

Answer

Rely on the platform's automatic callout retry, which resends any request that receives a 5xx response up to five times before surfacing the failure to Apex.

Answer

Set the HttpRequest timeout to 300000 milliseconds and rely on the extended timeout to absorb transient 503 responses so the call eventually succeeds on its own.

Question 15

A developer is building an Apex class that must be callable from a Lightning web component and also from an external system via REST. The class performs DML on a custom object and must enforce the running user's field-level security and object permissions. The developer annotates the class with `with sharing` and declares the method as `public static`. During testing, an external integration user with limited permissions receives a `System.DmlException` for insufficient access, but the developer expected the operation to succeed because the integration user has create permission on the object. What is the most likely cause?

Accepted Answer

Apex does not enforce object permissions or field-level security by default; the developer must explicitly enforce CRUD/FLS using `Schema.sObjectType` or `Security.stripInaccessible` before performing DML.. The class uses `with sharing` to enforce record-level sharing, but Apex does not automatically enforce object permissions or field-level security. The integration user lacks create permission on the custom object or field-level access, causing a DML exception. To enforce CRUD/FLS, the developer must explicitly check permissions using `Schema.sObjectType` methods or `Security.stripInaccessible` before DML. This ensures the running user's permissions are respected.

Answer

The method is declared as `public static` but should be `global static` to be accessible from an external REST context, and the access modifier mismatch causes the permission error.

Answer

The `with sharing` keyword enforces record-level sharing but does not enforce object-level permissions or field-level security, so the DML fails due to CRUD/FLS restrictions.

Answer

The `with sharing` keyword should be replaced with `without sharing` to allow the integration user to bypass permission checks and complete the DML operation.