Option 3 is correct because internal emails generally contain operational info not meant for public but also not critically sensitive. Option 1 overstates the sensitivity. Option 2 is risky and not compliant with standard practices. Option 4 confuses protection level with classification.

Option 2 is correct because 403 implies access was denied, typically due to missing credentials or wrong permissions. Data types and volume lead to different errors. UI settings don‘t influence API access.

Option 2 is correct because deduplication using External IDs is crucial during upsert operations. Bandwidth, dashboards, and authentication do not influence record uniqueness.

Option 2 is correct because firewalls enforce network boundaries, preventing unauthorized traffic. The other options deal with internal configuration, not connectivity.

Option 2 is correct because if updates don’t go through the API, automation like Flows may not fire. Deactivation would cause all flows to fail, not selectively. Reports and tabs don’t influence automation.

Option 1 is correct because the error suggests throttling, which can be mitigated through limits and retries. Permissions and UI settings don’t impact request volumes.

Option 2 is correct because real-time integration depends on event-driven architectures, and lack of event publishing causes lag. The other choices are UI or metadata and irrelevant.

Option 2 is correct because API debug logs capture call failures, payloads, and response codes critical for troubleshooting. Login or dashboard files do not reveal integration behavior.

Option 1 is correct because credit card numbers are considered highly sensitive and confidential due to regulatory and compliance requirements such as PCI DSS. Option 2 is incorrect because such data should never be publicly exposed. Option 3 is close, but “secure” is not a classification label—it‘s a control measure. Option 4, internal, refers to organizational info not intended for external use, but still not as sensitive as credit card data.

Option 3 is correct because product catalogs intended for public consumption are typically classified as public data. Option 1 is incorrect because there’s no sensitivity around the data. Option 2, internal, would restrict access unnecessarily. Option 4, secure, applies to data that needs encryption and access control—not product listings.

Option 2 is correct because medical records are legally protected under laws such as HIPAA and must be treated as confidential data. Option 1 is incorrect because “secure” refers to how the data is protected, not its classification. Option 3 is invalid as such data should never be public. Option 4 is too lenient and insufficient for compliance purposes.

Option 1 is correct because confidential agreements often contain legal and financial terms that require protection via encryption. Option 2 and 3 contain general access data that doesn’t require such levels of protection. Option 4 is clearly public-facing and not sensitive.

Option 3 is correct because salary data contains private financial information that must be treated as confidential. Option 1 is incorrect because salary information should never be exposed publicly. Option 2, while internal, does not fully reflect the required confidentiality. Option 4 is irrelevant.

Option 1 is correct because press releases are intended for external and public distribution. Option 2 implies access only within an organization, which is overly restrictive. Option 3 and 4 are meant for sensitive data and don’t apply to public communications.

Option 4 is correct because unpublished financial data can affect market behavior and must be restricted and confidential. Option 1 is wrong because the data hasn’t been released. Option 2 underestimates the sensitivity. Option 3 describes how it should be handled, not its classification.

Option 2 is correct because sync depends on schedules or events; if missing, records go out of sync. Themes and layouts don’t affect data flows. Reports are read-only and don‘t cause sync issues.

Option 3 is correct because customer names already exposed in public-facing testimonials are public by nature. Option 1 or 2 would unnecessarily restrict access. Option 4 focuses on protection rather than classification and is too restrictive.

Option 3 is correct because the data is meant only for internal personnel but doesn‘t necessarily contain sensitive details. Option 1 is invalid as the data is not for external use. Option 2 implies it‘s legally or financially sensitive. Option 4 is overly cautious.

Option 1 is correct because functional requirements describe what the system must do — in this case, real-time updates. Option 2 and 3 are non-functional as they define how the system performs. Option 4 is about data governance, not system functionality.

Option 3 is correct because response time is about performance, a classic non-functional attribute. Options 1, 2, and 4 describe actual features and behavior of the system, so they are functional.

Option 1 is correct because data consistency ensures that changes in one system are accurately reflected in another. Option 2 relates to security, not consistency. Option 3 is usability-related. Option 4 is a security setting.

Option 3 is correct because encryption relates to how data is protected, making it a non-functional requirement. Option 1 is incorrect as it does not describe business functionality. Option 2 refers to speed, which is unrelated. Option 4 is incorrect because it doesn’t define behavior or logic rules.

Option 4 is correct because rolling back transactions defines actual behavior of the system, a functional aspect. Option 1 is a security control. Option 2 is availability-related, and option 3 is about protection, both of which are non-functional.

Option 2 is correct because throughput relates to performance, making it a non-functional requirement. Option 1 and 3 describe behavior, and Option 4, while helpful, is more of a monitoring or auditing feature than a pure non-functional spec.

Option 3 is correct because compliance falls under non-functional needs, defining standards or laws the system must adhere to. Option 1 is about labeling data. Option 2 implies functionality. Option 4 is too broad to be precise.

Option 2 is correct because this is a performance requirement under SLA definitions, hence non-functional. Option 1 would require specifying behavior. Option 3 and 4 are unrelated to timing or service expectations.

Option 1 is correct because it defines a core task the system must perform — logging orders. Option 2 is about format, not function. Option 3 and 4 are security and reliability measures, not functional behaviors.

Option 1 is correct because successful CRM adoption relies on timely insights into customer behavior and touchpoints, which require integrated, real-time data across systems. Option 2 limits visibility to outdated data, which affects decision-making. Option 3 undermines adoption and usability. Option 4 is error-prone and inefficient, introducing bottlenecks and data mismatches.

Option 1 is correct because sales users benefit from automation that reduces friction, such as leads being automatically pushed from marketing systems to CRM. Option 2 introduces delays and requires extra effort from users. Option 3 reduces accessibility and usability. Option 4 impacts data trust, leading to low adoption.

Option 1 is correct because deduplication at the point of integration prevents the accumulation of redundant or conflicting records, which directly supports CRM data quality. Option 2 is UI-related and cosmetic. Option 3 is reactive and not preventative. Option 4 increases the chance of human error and inconsistency.

Option 1 is correct because real-time integration depends on systems that can notify or push events. The other options are about UI or storage, which don’t trigger live updates.

The EMR’s enforced SOAP 1.1 with mutual TLS and a 2 MB limit is an immediate, non-negotiable limitation that constrains how requests are formed, how security is handled, and how payloads are chunked. Standards and boundaries are often dictated by systems that cannot change quickly, so integration must adapt to them now. This constraint directly impacts serialization (XML), security setup (client certs), and potential need for message splitting or compression. Option 2 describes middleware flexibility, which is helpful but not constraining; it does not force a design path. Option 3 is a preference, not a boundary; standards can be adapted or mapped by transformation layers. Option 4 is a future plan and does not influence current compliance needs. Prioritizing hard external constraints prevents build-time surprises. Recognizing payload ceilings early avoids runtime failures and retries. Finally, security handshakes like mTLS require certificate lifecycle planning that must be reflected in the design immediately.

The best fit is to avoid direct inbound calls to Salesforce and instead leverage a pattern that respects outbound-only from Salesforce while using the DMZ proxy and allowed egress to middleware. A near real-time approach is achieved by event publishing from core banking to a secure gateway, then middleware consumes and pushes via an allowed path (or Salesforce subscribes via outbound connections). Option 2 proposes direct inbound to Salesforce REST APIs from the banking host, which violates outbound-only and likely fails the allowlist/proxy boundary. Option 3 requires opening bidirectional rules, breaching the established security posture. Option 4 asks for a VPN to the banking network, which is usually disallowed from multi-tenant SaaS to core banking and contradicts the outbound-only constraint. The selected pattern decouples producers and consumers and adheres to inspection and allowlist controls. It leverages DMZ components to maintain enterprise security standards. Event/middleware buffering also helps with resilience and back-pressure. Near real-time delivery is preserved without violating boundaries.

Establishing a common contract for identifiers, naming, and versioning is a standards step that can be applied without replacing protocols immediately. It respects existing SFTP and REST patterns while creating consistency that lowers mapping errors and future migration cost. Option 2 replaces SFTP with queues, which is high-risk given the vendor cannot change this quarter. Option 3 similarly forces a vendor change and ignores contractual or technical constraints. Option 4 degrades capability by eliminating real-time checks, harming customer experience and violating non-functional needs. A canonical contract aligns schema semantics across flows, enabling reliable transformations. It also supports observability because fields are predictable and traceable. Versioning avoids breaking changes when either side evolves. This incremental standardization is a low-risk, high-value first step. It creates a path for later protocol convergence.

A mediation layer (API gateway or middleware) policy set allows normalization of authentication, rate limits, and error formats without touching each backend immediately. This approach enforces standards at a boundary where change is manageable and reversible. It provides consistent client experience while honoring backend limitations. Option 2 implies rewriting all adapters, which is disruptive and risky for live systems. Option 3 is an abrupt directive that may cause outages and noncompliance; deprecation must be phased with compensating controls. Option 4 is a platform consolidation strategy, not an immediate enforcement mechanism for standards. Policy-as-code at the gateway enables progressive hardening and observability. It also supports exception handling where legacy constraints apply. Over time, the gateway can deprecate weak methods safely. This incremental control aligns governance with operational realities and minimizes business disruption.

Moving to short-lived access tokens with PKCE and tightening refresh token rotation meets the security standards while staying within OAuth 2.0 best practices for mobile. It directly addresses long-lived credential risk and aligns with FIPS/TLS mandates. PKCE strengthens public clients without secrets, and frequent refresh rotation reduces token theft impact. Option 2 leaves the core violation (90-day refresh) in place; fingerprinting is not a substitute for proper token lifetime controls. Option 3 misapplies SAML in a mobile API context and complicates flows without solving token lifetime constraints. Option 4 ignores the mandate; exceptions undermine governance and risk acceptance. The chosen option is technically feasible and compatible with current protocols. It preserves user experience via silent refresh while staying compliant. It also simplifies future audits by matching policy to implementation.

A façade pattern preserves the legacy SOAP contract with WS-Security while allowing upstream consumers to use standardized OAuth REST. This defines a boundary where translation, security headers, and timestamp handling are centralized. It minimizes change to the legacy, which meets the business constraint. Option 2 forces migration, which is risky and likely out of scope for “evaluate current landscape.” Option 3 couples Salesforce to SOAP and WS-Security details, increasing complexity and governance overhead. Option 4 weakens security by bypassing WS-Security requirements and is unlikely to pass audit. The façade also provides a place for schema mapping and error normalization. It supports gradual modernization without breaking existing clients. Observability and retries can be handled consistently at this boundary. This approach is a standard solution for protocol mismatch in heterogeneous estates.

An enterprise event taxonomy defines what each event represents, how it is identified, and the delivery guarantees (at-least-once, exactly-once via idempotency keys). Clarifying semantics reduces accidental duplication and aligns diverse mechanisms. This does not require ripping out existing protocols; it standardizes how they are used. Option 2 forces a single mechanism but may not be feasible for external systems and ignores legitimate use cases for webhooks. Option 3 treats symptoms rather than causes; faster consumers still mis-handle duplicates. Option 4 removes async benefits and adds coupling, harming resilience and scale. Idempotency keys let handlers safely de-dup across CDC, events, and webhooks. Taxonomy and standards provide a shared language for producers and consumers. This is essential for governance and monitoring. It also simplifies replay strategies and error handling consistently.

Adding regional mediation nodes creates enforcement points within legal boundaries, ensuring data residency while maintaining a federated integration pattern. These nodes can filter, tokenize, or anonymize fields before forwarding, satisfying local restrictions. Option 2 depends on legal mechanisms but does not technically enforce residency, risking non-compliance. Option 3 violates residency by mirroring first, even if masking occurs later; the breach happens on ingress. Option 4 degrades business operations and introduces data quality risks. Regional nodes respect existing platforms and minimize disruption while embedding compliance controls. They also help with audit trails and regional SLAs. This approach scales as new regions are added. It preserves a common governance layer with localized policies.

A shared client standard that defines exponential backoff, retry policies, consistent pagination, and appropriate use of Composite/Batch APIs directly addresses the operational limitations. It makes consumption predictable and fair, reducing spikes and errors. Option 2 treats the symptom by asking for more limits but does not fix poor client behavior; limits are finite. Option 3 over-caches and risks staleness, violating data freshness needs and potentially causing logic errors. Option 4 restricts business capability by forbidding daytime reads, which is not realistic for interactive workloads. Client patterns are a controllable lever that improve resilience under constraints. Standard pagination avoids duplicate or missing records. Backoff and jitter reduce thundering herds. Composite endpoints minimize round trips within limits. Documenting and enforcing these standards institutionalizes good behavior.

Option 2 is correct because inconsistent data reflects synchronization failures or missing transformation logic. The other options are positive or irrelevant and don‘t signal an integration issue.

Option 2 is correct because lack of access due to firewall or VPN rules is a classic system boundary problem. UI, app installs, or reports are end-user issues, not architectural boundaries.

Option 2 is correct because failed logins often stem from incompatible authentication standards. Dashboards, code coverage, and email issues don’t relate to auth flows.

Option 2 is correct because handling both APIs requires careful management of limits and formats. The other options are unrelated to the technical constraints of mixed protocol integration.

Option 2 is correct because FTP-based issues often relate to transfer size limits or unstable sessions. Layouts, filters, and record rules are not part of file transport logic.

The correct answer is a canonical integration inventory because the task explicitly asks to identify the current system landscape and determine standards, limitations, boundaries, and protocols, which requires a structured catalog of what exists today. An inventory captures each endpoint’s protocol (REST, SOAP, SFTP), authentication (OAuth, mTLS), volumes, SLAs, schedules, and ownership, enabling a precise view of constraints before any design decisions. Starting with as-is facts prevents premature solutioning and avoids confirmation bias. It also makes gaps and duplicates visible across teams. Additionally, this inventory aligns stakeholders on terminology and scope. Option 2 is future-state; it assumes decisions have been made and obscures current constraints. Option 3 is an execution artifact and presupposes that analysis is complete; it is too granular and time-boxed for landscape discovery. Option 4 is a financial artifact and does not capture technical standards or boundaries. None of the incorrect options provide the breadth of metadata needed to reason about standards and limitations. The inventory becomes the foundation for later design reviews and risk analysis. It also supports governance by feeding into integration lifecycle management.

Option 2 is correct because a 429 error specifically signals rate limiting, which is a key performance constraint. Other options suggest unrelated issues.

Option 2 is correct because poor synchronization or missing data mapping causes discrepancies across systems. Branding or visuals do not affect data integrity.

Option 2 is correct because API logs provide insight into failures, latency, and usage — all critical for diagnosing integration health. The other choices focus on unrelated UI or metadata updates.

Option 1 is correct because understanding which authentication protocols (like OAuth, SAML) are supported is foundational to planning secure access. Option 2 is about UI and not related to authentication. Option 3 focuses on analytics, which doesn‘t help with identity verification. Option 4 addresses scale, not security design.

Option 2 is correct because the Username-password OAuth flow provides short-term tokens and avoids the need for persistent credential storage on the device. Option 1 requires longer-lived sessions. Option 3 is typically used for server-to-server without user involvement. Option 4 is insecure for mobile contexts.

Option 1 is correct because the JWT Bearer Flow is designed for server-to-server integrations where no user is present. Option 2 requires browser interaction. Option 3 involves manual steps and is unsuitable for background systems. Option 4 is a security anti-pattern and highly discouraged.

Option 2 is correct because permission sets allow granular control of object-level access based on needs. Option 1 violates least-privilege principles. Option 3 is too broad and not tailored to the use case. Option 4 addresses network security, not access rights.

Option 3 is correct because External Account Hierarchies enforce data access based on the user’s account. Role hierarchies expand access upward. Login Flows manage UI flow, not record visibility. Community profiles help assign base access but lack dynamic scoping.

Option 2 is correct because SAML enables federated identity and supports SSO through a central identity provider. Option 1 uses credentials directly and bypasses the IDP. Option 3 is a UI choice, not a protocol. Option 4 is unrelated to authentication.

Option 2 is correct because Named Credentials handle endpoint and authentication details, simplifying secure external API calls. Option 1 and 3 are unrelated to integration. Option 4 adds unnecessary complexity and duplicates native features.

Option 2 is correct because separate users with scoped access ensure better auditability and minimize breach risk. Shared or guest users violate security best practices. Admin reuse creates an over-permissioned attack surface.

Option 2 is correct because OAuth scopes clearly define what a client app can access, reducing exposure. Option 1 is done through HTTPS. Option 3 is UI-level, not API-level. Option 4 is unrelated to token-based access.

Option 3 is correct because failing to authenticate leads to HTTP 401, preventing access. Option 1 is false; unauthenticated calls are blocked. Option 2 is a data issue, not auth-related. Option 4 is not relevant unless login succeeds.

Option 2 is correct because the system‘s rejection is due to exceeding payload limits, which is a common constraint in APIs. Storage limits affect saved data, not in-transit data. Schema mismatches would throw validation errors. Permission issues relate to access, not size.