Salesforce ARC-101 Exam Prep
Certified Integration Architect (Page 2 )

• Large initial load (2M Accounts, 5.5M Contacts, 4.3M Opportunities, 45k Products): use Bulk API for high-volume, asynchronous data loads (preferred over SOAP/REST for big batches).
• Notify external systems of new/updated Accounts/Contacts: use Streaming API to publish events in real time to external systems.
• Expose custom business logic to 5 external apps securely: use Apex REST API to create secure REST endpoints (easily protected with OAuth/Named Credentials).
• Schedule nightly dataflows/recipes/data syncs: use Analytics REST API to manage Einstein Analytics dataflows/Recipes and scheduling.

• A and B lack the Streaming API for real-time notifications.
• D uses Apex SOAP API instead of REST; REST is generally preferred for new integrations and easier to secure and manage.

• Platform Event (C) — This is the best choice. Platform Events are designed for pub/sub, real-time updates inside Salesforce. A Lightning component can subscribe to the event (e.g., via the empApi) and refresh the count as soon as a Case is closed.

• Push Topic (A) — Primarily for external systems to subscribe to Salesforce data changes. It’s not the ideal pattern for updating an internal Salesforce UI component.

• Change Data Capture (B) — Used to notify external systems about data changes. It can feed external dashboards, but it isn’t the most straightforward way to drive an in-Salesforce UI in real time.

• Generic Event (D) — Not a standard or recommended pattern for this use case.

• ?? ?? ?? ??
• ?? NFS ?? SMB ?? ??
• ?? ???? ???
• ?? IP ??? ???? ?? ???
• ??? ?? ???? ?????

• B: ????? NFS ? Snowball Edge? ?? ?? ? AWS? ?? ? S3
• D: ????? NFS ? ????/Direct Connect ? File Gateway ? S3

• Attack simulator — Used to run phishing and other attack simulations for user awareness training.
• Hunting — Used to proactively query security data and investigate potential threats.
• Incidents — Used to investigate and manage related alerts and active security events.

• Denial-of-service: Prevents users from accessing a service; it does not normally redirect them.
• Social engineering: Manipulates people into taking an action, such as clicking a malicious link, but does not directly alter DNS resolution.
• ARP spoofing: Associates the attacker’s MAC address with another device’s IP address on a local network. It can intercept traffic, but the described website redirection is most specifically DNS poisoning.

• Employees can work from any location, including remote sites and offices worldwide.
• Login can be relatively seamless after the device is registered.
• It does not require distributing additional physical authentication equipment.

• Geotagging: Identifies location, but location alone is not a strong authentication method and may prevent legitimate remote access.
• Smart cards: Provide strong authentication but require card readers and physical cards, increasing equipment and management requirements.
• Time-based logins: Typically involve one-time codes that users must enter, making the experience less seamless and potentially requiring a token or authenticator app.

• B — Incorporate contextual output encoding/escaping: Encode untrusted data based on its context—HTML, attribute, JavaScript, or URL—so the browser treats it as data rather than executable code.
• D — Run untrusted HTML input through an HTML sanitization engine: Sanitization removes or neutralizes dangerous elements and attributes, such as script-related content, while preserving safe HTML where needed.

• A: Enabling client-side scripts does not prevent XSS. Script restrictions may reduce risk in some environments, but “enable” is not a general XSS control.
• C: Cookie inspection is unrelated to preventing injected scripts.
• E: The SameSite cookie attribute primarily helps mitigate CSRF, not XSS. It should not generally be described as an XSS prevention measure.

• A — VARIANT "null" values are not the same as SQL NULL values: True

• B — Frequent, single-row DMLs: False

• C — Validate data before loading into the target table: True

• D — Use staging tables to manage MERGE statements: True

• IDS attack signatures: Primarily detects suspicious network activity; it is not the best control for scanning uploaded documents.
• Load balancer: Distributes traffic and can improve availability, but does not inspect files for malware.
• WAF: Helps block web attacks such as command injection and SQL injection, but it is not primarily a malware-scanning solution.

• Driver node: Coordinates Spark jobs and runs in the compute environment.
• Worker node: Executes tasks and processes data.
• Databricks Filesystem (DBFS): Provides storage access for data used by compute resources.

• A: Concerns task scheduling and avoiding missed runs, not directly sizing the warehouse.
• B: The amount of data in a stream alone does not reliably determine compute needs; the SQL processing is what matters.
• D: A multi-cluster warehouse addresses concurrency, not the compute size needed for one task execution.

• IaaS: você gerencia a VM e o sistema operacional.
• PaaS: o Azure gerencia a infraestrutura; você se concentra no aplicativo.

• The application stores data on Amazon EBS volumes, so the encryption should be applied directly to those volumes.
• EBS encryption uses AWS-managed cryptographic operations and is designed to provide encryption at rest with minimal performance impact.
• The volumes are created during initial deployment, so they can be configured as encrypted when provisioned.

• B: Moving data to an encrypted S3 bucket changes the storage design and does not encrypt the EBS data the application uses.
• C: A custom encryption algorithm adds application overhead and is unnecessary.
• D: Ephemeral disks are temporary storage and can lose data when instances stop or terminate. Encrypting only the AMI’s root volume does not protect data stored elsewhere.

• WPA3: Secures wireless traffic but does not normally verify whether someone has paid.
• PSK: A shared Wi-Fi password gives access to anyone who knows it; it cannot easily validate individual receipts.
• IEEE 802.1X: Provides user/device authentication, commonly through an authentication server, but is excessive and not designed specifically for a simple receipt-based guest-access workflow.

• terraform apply
• terraform destroy

• The JSON files contain one billion items, so this is a big-data workload.
• PySpark uses Apache Spark’s distributed, parallel processing, allowing the data to be processed across multiple compute nodes.
• It can read and transform data directly from OneLake, helping minimize unnecessary data movement or duplication.
• A Fabric notebook can also support exploration and visualization, as well as Spark-based analytics and anomaly-detection workflows.

• Pandas is primarily in-memory and generally suited to smaller datasets. One billion records would be impractical on a typical single machine.
• A Power BI report with core visuals is appropriate for visualization and sharing, but it is not the best tool for large-scale transformation, parallel processing, or anomaly detection. It would normally consume prepared data rather than perform the entire workload.

• Prevention costs – costs incurred to stop defects occurring, such as staff training, quality planning and supplier evaluation.
• Appraisal costs – costs of checking whether products meet standards, such as inspection, testing and quality audits.
• Internal failure costs – costs of defects found before delivery to customers, such as scrap, rework and retesting.
• External failure costs – costs of defects found after delivery, such as warranty claims, returns, complaints and product recalls.

1. Clear principles and boundaries — Employees have freedom, but decisions must remain within clear organizational values, policies and limits.
2. High degree of freedom — Managers are trusted to make decisions rather than seeking continual approval from senior management.
3. Frontline customer responsibility — Customer-facing managers should be empowered to manage customer relationships and respond quickly to needs.
4. Transparent and ethical information — Information should be openly available and used honestly, supporting trust and informed decision-making.

• Help the team identify the root causes of delays.
• Empower the team to improve its workflow and practices.
• Facilitate removal of impediments.
• Avoid directing the team toward a solution without its involvement.
• Protect quality and sustainable delivery rather than simply accelerating everything.

• A: An impediment log may help, but merely recording problems does not empower the team to solve them.
• B: Directing the team to solutions conflicts with self-management.
• C: Adding impediments to the product backlog may incorrectly treat internal obstacles as product features and delays their resolution.

• Namespace: The namespace associated with the code where the checkpoint was set.
• Time: When the checkpoint was captured or executed.

• Exception: Exceptions are viewed through debug logs or execution results, not as the primary Checkpoints tab information.
• Debug Statement: System.debug() output belongs in the Logs tab. A checkpoint captures program state, such as variables and their values, at a specific point in execution.

• Accept: Acknowledging the risk and choosing not to take additional action.
• Transfer: Shifting the risk or financial consequences to another party, such as an insurer.
• Mitigate: Reducing the likelihood or impact through controls, such as patching or access restrictions.
• Avoid: Eliminating the activity that creates the risk.

• Sales revenue is affected because internal sales are recorded at the transfer price.
• Operating profit is affected because revenue changes while costs may remain unchanged.
• Return on investment (ROI) is affected because ROI depends on operating profit and the division’s investment.
• Cost of components purchased is not affected by the transfer price. These are costs incurred when buying components from external suppliers, not the internal price charged for the division’s output.

• /27 (255.255.255.224)

• /26 (255.255.255.192)

• /25: Creates only 2 subnets, not 3
• /28: Provides only 14 usable hosts per subnet

• Share files with the wrong people
• Use public links unnecessarily
• Fail to classify sensitive data
• Upload data to unauthorized services
• Misunderstand company sharing policies

• A — Step-up authentication: Helps protect administrator accounts, but does not directly address improper file sharing by users.
• C — Password complexity: Helps reduce password attacks, not accidental data disclosure.
• D — Mobile device management: Secures managed mobile devices, but does not directly control file-sharing behavior across the organization.

• User-generated content: precisa ser coletado, filtrado, anonimizado e rotulado.
• Moderation logs: podem conter dados inconsistentes, informações pessoais e decisões que precisam ser revisadas.
• Content moderation guidelines: são regras ou orientações, não dados diretamente utilizáveis para medir o comportamento do modelo.

• Type 1 hypervisor: Runs directly on the physical hardware (“bare metal”).
• Type 2 hypervisor: Runs inside the host OS as an application.

• Bare-metal installation: Type 1
• Local management only: Not a defining characteristic
• Specific hardware requirements: Not the key distinction

• File policy in Microsoft Defender for Cloud Apps: Can detect activity involving files, but it is not designed specifically to investigate risk from departing or deleted users.
• Access review policy in Microsoft Entra: Reviews whether users should retain access to resources; it does not detect historical document downloads.
• Alert policy in Microsoft Defender for Office 365: Primarily handles alerts for email and collaboration threats, not insider-risk investigations involving departed users.

• Red team: Simulates attackers and tests exploitability.
• Blue team: Defends, monitors, detects, and responds to attacks.
• Purple team: Combines red- and blue-team activities to improve cooperation and defenses.
• White team: Manages and oversees the rules, scope, and authorization of the exercise.

• CHAP: Uses a challenge-response exchange, so the password is not directly transmitted.
• IPsec: Provides authentication, integrity, and encryption for IP communications.
• EAP: An authentication framework that supports stronger methods, such as certificates or token-based authentication.

• The load balancer provides the listener’s frontend IP address.
• The active SQL Server node must also respond to that same listener IP.
• Enabling Floating IP allows the listener IP to be preserved and handled correctly by the active replica.
• Without it, SQL connections may be sent to a node that cannot correctly claim the listener address.

• A health probe for the SQL Server port
• A load-balancing rule using the listener port
• Floating IP enabled on that rule

• Marketing users: Dynamic Forms can show all fields.
• Support users: Field visibility rules can display only the Support preference fields on the record page.
• Reporting: Both profiles can still report on all fields because Dynamic Forms controls page visibility, not the underlying field access.

• A — Two record types and page layouts: Page layouts can control field placement and editability, but they are less flexible for conditional field visibility and would not be the best fit here.
• C — Muting permission set: Permission-set muting is used with permission-set groups; it does not conditionally hide fields on a page.
• D — Field-Level Security: FLS would remove field visibility at the security level. If fields are hidden by FLS, users generally cannot report on or access those fields, conflicting with the requirement that both users report on all data.

• Matching hashes: The software likely has not changed.
• Different hashes: The software was modified or corrupted.

• Encryption: Protects confidentiality by making data unreadable; it does not primarily detect changes.
• Baselines: Define an approved system or configuration state, but they are not the specific integrity mechanism here.
• Tokenization: Replaces sensitive data with substitute values.

• Reporting relationships
• Organizational structures
• Leadership styles
• Team maturity
• Individual and group behavior
• Communication and motivation

• Acquire Project Team: Focuses on obtaining the people needed for the project.
• Develop Project Team: Focuses on improving team skills, relationships, and performance.
• Manage Project Team: Focuses on tracking performance, resolving issues, and managing changes within the team.

• Injection
• Broken access control
• Authentication failures
• Security misconfiguration
• Cross-site scripting

• STIX: A standardized language and format for exchanging threat intelligence.
• OVAL: Used to describe and assess system vulnerabilities and configuration issues.
• Threat intelligence feed: Provides current indicators and intelligence about threats, but not necessarily a structured overview of common application exploitation methods.
• CVE: A catalog of individually identified, publicly disclosed vulnerabilities.

• The table is large.
• Queries frequently filter or join on particular columns.
• The table’s natural data order does not support good micro-partition pruning.
• Clustering improves performance enough to justify its maintenance cost.

• Record changes — a flow can start when a record is updated or otherwise changes.
• Schedules — a flow can run at a specified date/time or on a schedule.
• Record inserts — a flow can start when a new record is created.

• Subflows are reusable flow components called by another flow; they are not normally trigger types.
• Record views do not generally initiate a Flow Designer flow.

• The requirement is an assessment of the Azure environment’s design, which requires a support plan offering proactive architectural guidance.
• Premier support would provide this capability, but it is a high-cost option.
• Since the requirement says to minimize expenses, Premier is not the best recommendation.
• A lower-cost plan with the required advisory/design-review capability—historically Professional Direct in Azure’s support-plan model—would be more appropriate.

• A local network gateway represents an on-premises network—its address space and VPN device information—for an Azure Site-to-Site VPN connection.
• It does not control which connection types are allowed between Azure web servers and database servers.
• It is also unnecessary when both server groups are in the same Azure virtual network.

• Box 1: No — The rule requires user.department to equal Engineering. Engineer does not match, so User1 is not in AU1. Admin1 cannot reset User1’s password.
• Box 2: No — Admin1’s role is scoped to AU1 and cannot manage users outside that AU.
• Box 3: Yes — Admin2 is a Global Administrator and can reset User3’s password.

• Security groups
• Dynamic security groups
• Cloud-only or synchronized security groups

• Microsoft 365 groups
• Distribution groups
• Mail-enabled distribution groups

• Reduce the training data: Usually makes overfitting worse.
• Add hyperparameters: Hyperparameters already control training; simply adding them does not solve the problem. Proper tuning could help, but that is not what the option states.
• Increase training time: More training can worsen overfitting if the model is already memorizing the training data.

• A. IDS attack signatures: An IDS mainly detects suspicious network traffic. It is not the best control for scanning uploaded documents.
• C. Load balancer: Distributes traffic among servers and can improve availability, but does not specifically detect malware.
• D. WAF: Protects web applications from attacks such as SQL injection and command injection. It may inspect web requests, but malware scanning of PDF files is not its primary function.

• A — Tables
• B — Named file formats
• C — Schemas
• E — Databases

Why these are correct

• Tables: Can be cloned using CREATE TABLE ... CLONE. The clone initially uses zero-copy cloning, so storage is shared until changes are made.
• Named file formats: Can be cloned as database objects, preserving the file-format definition.
• Schemas: A schema and its eligible objects can be cloned.
• Databases: A database and its eligible schemas and objects can be cloned.

Why the others are incorrect

• Shares: A share is an account-level data-sharing object, not a normal cloneable database object.
• Users: Users are security principals and cannot be cloned with CLONE.

apex 
for (Account updatedAccount : Trigger.new) { 
    AccountTriggerHelper.notinyxternalSystem(updatedAccount.Id); 
}

• Too many callouts: The callout occurs asynchronously in the future method, and each future transaction can perform its permitted callouts.
• Too many SOQL queries: The SOQL query is inside the future execution, not repeatedly in the trigger transaction.
• Callout from triggers not supported: Direct callouts from triggers are prohibited, but the trigger delegates the callout to asynchronous Apex, which is the correct pattern.

• One physical NIC is active and carries traffic.
• Another NIC remains on standby.
• If the active uplink fails, traffic switches to the backup uplink.
• This provides redundancy without requiring special switch-side link aggregation configuration.

• Balance-SLB: Distributes traffic based on source load balancing; not the default.
• Balance-TCP: Uses dynamic TCP traffic balancing and generally requires appropriate network-switch configuration.
• No Uplink Bond: Incorrect because vs0 is normally configured with redundant uplinks.

• Create procurement-manager-role only in the shared services accounts, where procurement managers operate.
• Attach AWSPrivateMarketplaceAdminFullAccess to that role.
• Procurement managers assume the role when they need to administer Private Marketplace.
• Apply a root-level SCP that explicitly denies Private Marketplace administration to everyone except that role. The SCP acts as a maximum-permission boundary across member accounts.
• Add another SCP denying creation of a role with the same name. Otherwise, another administrator might create a similarly named role and bypass the intended exception.

• Creating the role in every account increases administration and creates more opportunities for misuse.
• A permissions boundary on developer roles does not prevent other administrators from managing Private Marketplace.
• Applying the SCP only to shared services accounts would not protect the rest of the organization.

• 24 cores: Available in the Business Critical provisioned-compute configurations.
• Approximately 124 GB memory: Matches the memory capacity of the relevant Business Critical hardware configuration.
• More than 50,000 IOPS: Business Critical uses local SSD storage and provides the high I/O performance required here.
• 500 GB storage: Well within the tier’s supported capacity.

• Premium: The DTU-based Premium tier does not provide the required combination of compute, memory, and I/O characteristics.
• Hyperscale: Hyperscale is primarily intended for very large databases and independent storage scaling. It is not the best match for these specific high-memory and high-IOPS requirements.

1. CALCULATE
2. AND
3. FILTER

DAX 
Transaction Category = 
CALCULATE( 
    MAX('Transaction Size'[Size]), 
    FILTER( 
        'Transaction Size', 
        AND( 
            Sales[Sales Amount] >= 'Transaction Size'[Minimum], 
            Sales[Sales Amount] <= 'Transaction Size'[Maximum] 
        ) 
    ) 
)

• FILTER examines the rows in the Transaction Size table.
• AND ensures the sales amount falls between the category’s minimum and maximum values.
• CALCULATE evaluates the result in the modified filter context and returns the matching category.