Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

Salesforce Certified B2C Commerce Architect (Arch-303) Exam - Topic 1 Question 59 Discussion

During implementation, the team found that there is a notification controller exposed for an external service that marks the order as paid when notification is received. The notification URL is sent to the service together with the payment request and contains only the URL with orderlD as the parameter.What should the Architect recommend to the team in order to prevent the unauthorized usage of the controller to mark the orders as paid?
C) Add an order token in the callback URL and match the token against the one stored on the order.
A) Add a customer number in the callback URL and match the customer number against the one stored on the order.
B) Add HTTPS restriction to the controller start node.
D) Add a session attribute and validate it on the callback.

Salesforce Certified B2C Commerce Architect (Arch-303) Exam - Topic 1 Question 59 Discussion

Actual exam question for Salesforce's Salesforce Certified B2C Commerce Architect (Arch-303) exam
Question #: 59
Topic #: 1
[All Salesforce Certified B2C Commerce Architect (Arch-303) Questions]

During implementation, the team found that there is a notification controller exposed for an external service that marks the order as paid when notification is received. The notification URL is sent to the service together with the payment request and contains only the URL with orderlD as the parameter.

What should the Architect recommend to the team in order to prevent the unauthorized usage of the controller to mark the orders as paid?

Show Suggested Answer Hide Answer
Suggested Answer: C

In the given scenario, where the Email Marketing System (EMS) requires order data to send product recommendations based on stock availability, it is crucial that the most up-to-date and relevant data is used. Here's why the chosen data sources are appropriate:

Order and Customer Data from Production: Since order and customer interactions occur in real-time, exporting this data from the Production environment ensures that the most current information is used for the email marketing campaigns. This accuracy is vital for personalization and timeliness of the communications sent to customers.

Product and Inventory Data from Staging: Given that the staging environment is typically one step behind production and is used for testing before changes go live, it provides a stable dataset that reflects what is currently live without the risk of including any unvetted changes. This setup is suitable for inventory and product data, which are less susceptible to minute-by-minute changes compared to order data and can be pre-validated before use in marketing efforts.

This configuration helps ensure that the EMS has access to reliable data reflecting current stock levels and product details, which is essential for crafting accurate marketing messages based on product availability.


by Svetlana at Feb 12, 2025, 02:02 PM

Limited Time Offer

25%

Off

Get Premium Salesforce Certified B2C Commerce Architect (Arch-303) Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Denny
9 months ago
Customer number in the URL? Seems risky to me.
upvoted 0 times
...
Torie
10 months ago
Wait, can you really just mark orders as paid like that?
upvoted 0 times
...
Tijuana
10 months ago
Not sure if a session attribute is the best way to go.
upvoted 0 times
...
Vicky
10 months ago
I think HTTPS restriction is a must too.
upvoted 0 times
...
Amber
10 months ago
Adding an order token sounds solid!
upvoted 0 times
...
Myra
10 months ago
I recall that using session attributes might not be ideal for this scenario since it could complicate stateless interactions. I wonder if the order token is the better choice.
upvoted 0 times
...
Victor
11 months ago
I’m a bit confused about whether HTTPS restrictions alone would be enough to prevent unauthorized access. It seems like there should be more validation.
upvoted 0 times
...
Helaine
11 months ago
I think we practiced a similar question where we had to secure a payment notification. I feel like adding an order token could be a strong option here.
upvoted 0 times
...
Jennie
11 months ago
I remember discussing the importance of securing callback URLs in our last class, but I'm not sure if adding a customer number is the best approach.
upvoted 0 times
...
Charlene
11 months ago
Okay, I think I've got it. The customer number or order token in the callback URL is the way to go. That way, we can validate the request and ensure it's coming from a legitimate source. Nice problem!
upvoted 0 times
...
Veronika
11 months ago
This is a tricky one. I'm leaning towards the order token option, as it seems like the most robust solution to prevent unauthorized access. But I'll need to think it through a bit more to be sure.
upvoted 0 times
...
Michel
11 months ago
Ah, I see what the problem is here. The key is to verify the identity of the caller to the notification controller. Adding a session attribute and validating it on the callback seems like a solid approach to me.
upvoted 0 times
...
Janella
11 months ago
Hmm, I'm a bit unsure about this one. The question mentions that the notification URL only contains the orderID, so adding a customer number or token might be tricky. Maybe the HTTPS restriction would be the easiest solution?
upvoted 0 times
...
Hoa
11 months ago
This looks like a security issue with the notification controller. I think adding a customer number or an order token in the callback URL and matching it against the stored value would be a good way to prevent unauthorized usage.
upvoted 0 times
...
Julieta
1 year ago
I'm with Scot on this one. HTTPS is so 2010. Let's just use a good old-fashioned secret handshake to authenticate the orders. Option C is the way to go!
upvoted 0 times
Lynelle
1 year ago
User 3: I'm with Scot on this one. Let's use a secret handshake to authenticate the orders. Option C is the way to go!
upvoted 0 times
...
Helene
1 year ago
User 2: I disagree, we should add an order token in the callback URL and match it against the one stored on the order.
upvoted 0 times
...
Eleni
1 year ago
User 1: I think we should add a customer number in the callback URL to prevent unauthorized usage.
upvoted 0 times
...
...
Scot
1 year ago
Haha, option B with the HTTPS restriction? Might as well just send the orders to the service via carrier pigeon to keep them safe!
upvoted 0 times
Willard
1 year ago
User 3: Yeah, I agree. Option B might not be enough to prevent unauthorized usage.
upvoted 0 times
...
Glen
1 year ago
User 2: Glen is right. Option C would definitely add an extra layer of security.
upvoted 0 times
...
Emile
1 year ago
User 1: Option C sounds like a better idea. Adding an order token for validation.
upvoted 0 times
...
...
Kent
1 year ago
Wow, option D with the session attribute? That's overkill for a simple notification callback. Keep it simple with option C, folks!
upvoted 0 times
Tamekia
1 year ago
Let's go with option C for now and see how it works.
upvoted 0 times
...
My
1 year ago
True, but option D might be too complex for this scenario.
upvoted 0 times
...
Shawnta
1 year ago
But wouldn't adding a customer number in the callback URL provide an extra layer of security?
upvoted 0 times
...
Vannessa
1 year ago
I agree, option C seems like the most straightforward solution.
upvoted 0 times
...
...
Cheryl
1 year ago
I'm not a fan of option A. Tying the customer number to the order seems like an unnecessary complication. Option C is the clear winner here.
upvoted 0 times
Veronika
1 year ago
I think option A could work too, but I see your point about it being complicated. Option C does seem more straightforward.
upvoted 0 times
...
Leana
1 year ago
I agree, option C is the best choice. Adding an order token for validation makes more sense.
upvoted 0 times
...
...
Olene
1 year ago
I think option A is also a good choice. Adding a customer number in the callback URL and matching it against the one stored on the order can also help prevent unauthorized usage. It's important to have multiple layers of security measures in place.
upvoted 0 times
...
Donette
1 year ago
I agree with Odette. Adding an order token in the callback URL is a good idea to prevent unauthorized usage of the controller. It's important to have that extra validation step.
upvoted 0 times
...
Odette
1 year ago
I think the Architect should recommend adding an order token in the callback URL and match the token against the one stored on the order. This way, it adds an extra layer of security.
upvoted 0 times
...
Deandrea
1 year ago
Option C sounds like the way to go. Adding an order token to the callback URL and verifying it against the stored token is a simple yet effective way to prevent unauthorized access.
upvoted 0 times
Twanna
1 year ago
User 4: Adding that extra layer of security is crucial in preventing unauthorized access.
upvoted 0 times
...
Margurite
1 year ago
User 3: It's important to verify the token against the stored one.
upvoted 0 times
...
Delpha
1 year ago
User 2: I agree, adding an order token is a good security measure.
upvoted 0 times
...
Chandra
1 year ago
User 1: Option C sounds like the way to go.
upvoted 0 times
...
...

Save Cancel