New Year Sale 2026! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions

Salesforce Certified B2C Commerce Architect (Arch-303) Exam - Topic 1 Question 59 Discussion

Actual exam question for Salesforce's Salesforce Certified B2C Commerce Architect (Arch-303) exam
Question #: 59
Topic #: 1
[All Salesforce Certified B2C Commerce Architect (Arch-303) Questions]

During implementation, the team found that there is a notification controller exposed for an external service that marks the order as paid when notification is received. The notification URL is sent to the service together with the payment request and contains only the URL with orderlD as the parameter.

What should the Architect recommend to the team in order to prevent the unauthorized usage of the controller to mark the orders as paid?

Show Suggested Answer Hide Answer
Suggested Answer: C

In the given scenario, where the Email Marketing System (EMS) requires order data to send product recommendations based on stock availability, it is crucial that the most up-to-date and relevant data is used. Here's why the chosen data sources are appropriate:

Order and Customer Data from Production: Since order and customer interactions occur in real-time, exporting this data from the Production environment ensures that the most current information is used for the email marketing campaigns. This accuracy is vital for personalization and timeliness of the communications sent to customers.

Product and Inventory Data from Staging: Given that the staging environment is typically one step behind production and is used for testing before changes go live, it provides a stable dataset that reflects what is currently live without the risk of including any unvetted changes. This setup is suitable for inventory and product data, which are less susceptible to minute-by-minute changes compared to order data and can be pre-validated before use in marketing efforts.

This configuration helps ensure that the EMS has access to reliable data reflecting current stock levels and product details, which is essential for crafting accurate marketing messages based on product availability.


Contribute your Thoughts:

0/2000 characters
Denny
3 months ago
Customer number in the URL? Seems risky to me.
upvoted 0 times
...
Torie
3 months ago
Wait, can you really just mark orders as paid like that?
upvoted 0 times
...
Tijuana
3 months ago
Not sure if a session attribute is the best way to go.
upvoted 0 times
...
Vicky
4 months ago
I think HTTPS restriction is a must too.
upvoted 0 times
...
Amber
4 months ago
Adding an order token sounds solid!
upvoted 0 times
...
Myra
4 months ago
I recall that using session attributes might not be ideal for this scenario since it could complicate stateless interactions. I wonder if the order token is the better choice.
upvoted 0 times
...
Victor
4 months ago
I’m a bit confused about whether HTTPS restrictions alone would be enough to prevent unauthorized access. It seems like there should be more validation.
upvoted 0 times
...
Helaine
4 months ago
I think we practiced a similar question where we had to secure a payment notification. I feel like adding an order token could be a strong option here.
upvoted 0 times
...
Jennie
5 months ago
I remember discussing the importance of securing callback URLs in our last class, but I'm not sure if adding a customer number is the best approach.
upvoted 0 times
...
Charlene
5 months ago
Okay, I think I've got it. The customer number or order token in the callback URL is the way to go. That way, we can validate the request and ensure it's coming from a legitimate source. Nice problem!
upvoted 0 times
...
Veronika
5 months ago
This is a tricky one. I'm leaning towards the order token option, as it seems like the most robust solution to prevent unauthorized access. But I'll need to think it through a bit more to be sure.
upvoted 0 times
...
Michel
5 months ago
Ah, I see what the problem is here. The key is to verify the identity of the caller to the notification controller. Adding a session attribute and validating it on the callback seems like a solid approach to me.
upvoted 0 times
...
Janella
5 months ago
Hmm, I'm a bit unsure about this one. The question mentions that the notification URL only contains the orderID, so adding a customer number or token might be tricky. Maybe the HTTPS restriction would be the easiest solution?
upvoted 0 times
...
Hoa
5 months ago
This looks like a security issue with the notification controller. I think adding a customer number or an order token in the callback URL and matching it against the stored value would be a good way to prevent unauthorized usage.
upvoted 0 times
...
Julieta
10 months ago
I'm with Scot on this one. HTTPS is so 2010. Let's just use a good old-fashioned secret handshake to authenticate the orders. Option C is the way to go!
upvoted 0 times
Lynelle
8 months ago
User 3: I'm with Scot on this one. Let's use a secret handshake to authenticate the orders. Option C is the way to go!
upvoted 0 times
...
Helene
8 months ago
User 2: I disagree, we should add an order token in the callback URL and match it against the one stored on the order.
upvoted 0 times
...
Eleni
9 months ago
User 1: I think we should add a customer number in the callback URL to prevent unauthorized usage.
upvoted 0 times
...
...
Scot
10 months ago
Haha, option B with the HTTPS restriction? Might as well just send the orders to the service via carrier pigeon to keep them safe!
upvoted 0 times
Willard
9 months ago
User 3: Yeah, I agree. Option B might not be enough to prevent unauthorized usage.
upvoted 0 times
...
Glen
10 months ago
User 2: Glen is right. Option C would definitely add an extra layer of security.
upvoted 0 times
...
Emile
10 months ago
User 1: Option C sounds like a better idea. Adding an order token for validation.
upvoted 0 times
...
...
Kent
10 months ago
Wow, option D with the session attribute? That's overkill for a simple notification callback. Keep it simple with option C, folks!
upvoted 0 times
Tamekia
8 months ago
Let's go with option C for now and see how it works.
upvoted 0 times
...
My
9 months ago
True, but option D might be too complex for this scenario.
upvoted 0 times
...
Shawnta
10 months ago
But wouldn't adding a customer number in the callback URL provide an extra layer of security?
upvoted 0 times
...
Vannessa
10 months ago
I agree, option C seems like the most straightforward solution.
upvoted 0 times
...
...
Cheryl
10 months ago
I'm not a fan of option A. Tying the customer number to the order seems like an unnecessary complication. Option C is the clear winner here.
upvoted 0 times
Veronika
10 months ago
I think option A could work too, but I see your point about it being complicated. Option C does seem more straightforward.
upvoted 0 times
...
Leana
10 months ago
I agree, option C is the best choice. Adding an order token for validation makes more sense.
upvoted 0 times
...
...
Olene
10 months ago
I think option A is also a good choice. Adding a customer number in the callback URL and matching it against the one stored on the order can also help prevent unauthorized usage. It's important to have multiple layers of security measures in place.
upvoted 0 times
...
Donette
11 months ago
I agree with Odette. Adding an order token in the callback URL is a good idea to prevent unauthorized usage of the controller. It's important to have that extra validation step.
upvoted 0 times
...
Odette
11 months ago
I think the Architect should recommend adding an order token in the callback URL and match the token against the one stored on the order. This way, it adds an extra layer of security.
upvoted 0 times
...
Deandrea
11 months ago
Option C sounds like the way to go. Adding an order token to the callback URL and verifying it against the stored token is a simple yet effective way to prevent unauthorized access.
upvoted 0 times
Twanna
10 months ago
User 4: Adding that extra layer of security is crucial in preventing unauthorized access.
upvoted 0 times
...
Margurite
10 months ago
User 3: It's important to verify the token against the stored one.
upvoted 0 times
...
Delpha
10 months ago
User 2: I agree, adding an order token is a good security measure.
upvoted 0 times
...
Chandra
10 months ago
User 1: Option C sounds like the way to go.
upvoted 0 times
...
...

Save Cancel