Evaluate Business Needs11% of the exam
Growth, residency and compliance factors
How expected growth (acquisitions, tenfold volume) and regulation (data residency, GDPR transfers, GDPR and CCPA consent, HIPAA, PCI DSS) change which integration solution fits, from a hub or event bus instead of point-to-point links to Shield, Field Audit Trail, tokenization and consent-aware Data 360 activation.
Given a use case, identify the business growth and regulatory factors that can impact choice of integration solutions.
~8 min read · 8 practice questions ·
What the exam expects
- Choose an integration architecture that absorbs growth such as acquisitions (hub, ESB or event bus) instead of more point-to-point links.
- Evaluate growth against API allocations, platform event add-ons and large data volumes before picking an option.
- Advise on data residency: when the existing org cannot meet a localization mandate, and when GDPR needs a transfer mechanism rather than EU hosting.
- Capture consent requirements per jurisdiction (GDPR opt-in, CCPA opt-out of sale or sharing) and propagate withdrawals across systems.
- Name the integration controls for HIPAA (Shield Platform Encryption, Field Audit Trail) and PCI DSS (tokenization instead of storing card numbers).
- Key terms: mandatory localization (law requiring data to stay in-country); transfer mechanism (adequacy decision, SCCs or BCRs for cross-border flows); SCCs (Standard Contractual Clauses); tokenization (replacing a card number with a payment gateway token); consent-aware activation (Data 360 excluding records whose consent flags forbid sharing).
Key facts
New systems join the bus
- Detail
- A new subscriber needs no custom point-to-point integration
Migrating off point-to-point
- Detail
- Incremental: most business-critical applications first
High-volume events
- Detail
- Add-on required for high-volume platform event and CDC use cases
Limits headroom
- Detail
- Reliability guidance uses a 70% operational ceiling for governor limits
Org residency
- Detail
- Fixed at provisioning; regions exist only where Salesforce operates one
No in-country region
- Detail
- Residency overlay or separate org for the mandated data
GDPR transfers
- Detail
- Adequate protection, not EU deployment; adequacy, SCCs or BCRs; consent last
Consent models
- Detail
- GDPR/LGPD opt-in, purpose-specific; CCPA/CPRA opt-out of sale or sharing
Data 360 activation
- Detail
- Consent flags evaluated before activation; each activation logged with lineage
HIPAA
- Detail
- Shield on all PHI fields plus Field Audit Trail with retention policies
PCI DSS
- Detail
- Do not store full PAN; tokenize via the payment gateway
Classic Encryption scope
- Detail
- Custom text fields only, 175 characters
Sources for this section (6)
- Event-Driven Architecturesarchitect.salesforce.com (opens in a new tab)
- Data Integration with Salesforcearchitect.salesforce.com (opens in a new tab)
- Well-Architected Frameworkarchitect.salesforce.com (opens in a new tab)
- Trustarchitect.salesforce.com (opens in a new tab)
- Data 360 Security Architecturearchitect.salesforce.com (opens in a new tab)
- Classic Encryption for Custom Fieldshelp.salesforce.com (opens in a new tab)
- Why can't an EU company's legal team insist the middleware must run in the EU under GDPR?
- When does the existing org fail to meet a residency requirement?
- Which two controls does Salesforce's guidance require for PHI fields?
- What growth factors should be weighed for a tenfold order increase?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Integration Architect pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 25 lessons of the Integration Architect guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (8 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams