Integration23% of the exam
Securing shopper and business user access
Which controls secure Business Manager users, API clients, storefront shoppers, service-org users and Marketing Cloud Engagement data across a B2C solution, and what each control does and doesn't protect against.
Given a B2C use case, recommend features and approaches that ensure security for both customers and internal business users while complying with regional and local legal requirements.
~7 min read · 17 practice questions
What the exam expects
- Secure Business Manager users and API clients: IP lists, Unified Authentication, session and password settings, site- and locale-scoped roles.
- Protect shoppers and the storefront: password-protected sites, customer lockout, eCDN firewall and WAF, SLAS client type, payment data retention.
- Secure the service org for B2C service: record-view audit evidence, Experience Cloud sharing sets and the MFA requirement.
- Protect sensitive data in Engagement and outbound Commerce calls: PGP file decryption, Tokenized Sending and keystore certificates.
Key terms:
- Business Manager: the B2C Commerce administration application for merchants and administrators.
- Unified Authentication: Business Manager login with Account Manager credentials, where Account Manager runs password and login policy.
- SLAS: Shopper Login and API Access Service, which issues shopper tokens; a private client keeps its secret on a server.
- Sharing set: an Experience Cloud setting that gives site users access to records tied to their own account or contact.
- Tokenized Sending: an Engagement feature that stores tokens instead of sensitive contact data and resolves them at send time.
Key facts
Allowlist without the block option
- Detail
- Other addresses can still log in
Business Manager idle logout
- Detail
- 15 minutes, can't be changed
Password policy under Unified Authentication
- Detail
- Set in Account Manager
Static content after enabling protection
- Detail
- Valid until it expires unless the cache is invalidated
Payment instruments
- Detail
- Masked after retention, default 12 months
SLAS client with a BFF
- Detail
- Private client, secret on the server
Sharing sets per profile
- Detail
- One; applies across all the user's sites
MFA scope
- Detail
- Internal UI users in production and sandboxes; not API logins or external users
Private CA for outbound TLS
- Detail
- Import as TrustedCertificateEntry
Sources for this section (9)
- IP Settingshelp.salesforce.com (opens in a new tab)
- Login Settingshelp.salesforce.com (opens in a new tab)
- User Authenticationhelp.salesforce.com (opens in a new tab)
- Password Protectionhelp.salesforce.com (opens in a new tab)
- Secure Storagehelp.salesforce.com (opens in a new tab)
- SLAS Best Practicesdeveloper.salesforce.com (opens in a new tab)
- Sharing Setshelp.salesforce.com (opens in a new tab)
- MFA Requirementshelp.salesforce.com (opens in a new tab)
- Keys and Certificateshelp.salesforce.com (opens in a new tab)
- When does Business Manager send the first warning before deactivating an unused local account?
- Why keep the old key after re-encrypting data at rest with a new one?
- What load must a Tokenized Sending resolver handle?
- When does Enforce Password History start remembering Business Manager passwords?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the B2C Solution Architect pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 20 lessons of the B2C Solution Architect guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Practice exams purchase adds inline bank questions and topic practice (17 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Choose guide-only, practice-only, or save $4 with both