Salesforce Certified B2C Commerce Architect (Arch-303) Exam - Topic 1 Question 59 Discussion

Actual exam question for Salesforce's Salesforce Certified B2C Commerce Architect (Arch-303) exam

Question #: 59
Topic #: 1

[All Salesforce Certified B2C Commerce Architect (Arch-303) Questions]

During implementation, the team found that there is a notification controller exposed for an external service that marks the order as paid when notification is received. The notification URL is sent to the service together with the payment request and contains only the URL with orderlD as the parameter.

What should the Architect recommend to the team in order to prevent the unauthorized usage of the controller to mark the orders as paid?

AAdd a customer number in the callback URL and match the customer number against the one stored on the order.

BAdd HTTPS restriction to the controller start node.

CAdd an order token in the callback URL and match the token against the one stored on the order.

DAdd a session attribute and validate it on the callback.

Show Suggested Answer

Suggested Answer: C

In the given scenario, where the Email Marketing System (EMS) requires order data to send product recommendations based on stock availability, it is crucial that the most up-to-date and relevant data is used. Here's why the chosen data sources are appropriate:

Order and Customer Data from Production: Since order and customer interactions occur in real-time, exporting this data from the Production environment ensures that the most current information is used for the email marketing campaigns. This accuracy is vital for personalization and timeliness of the communications sent to customers.

Product and Inventory Data from Staging: Given that the staging environment is typically one step behind production and is used for testing before changes go live, it provides a stable dataset that reflects what is currently live without the risk of including any unvetted changes. This setup is suitable for inventory and product data, which are less susceptible to minute-by-minute changes compared to order data and can be pre-validated before use in marketing efforts.

This configuration helps ensure that the EMS has access to reliable data reflecting current stock levels and product details, which is essential for crafting accurate marketing messages based on product availability.

by Svetlana at Feb 12, 2025, 02:02 PM

Limited Time Offer

25%

Off

Get Premium Salesforce Certified B2C Commerce Architect (Arch-303) Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Denny

3 months ago

Customer number in the URL? Seems risky to me.

upvoted 0 times

...

Torie

3 months ago

Wait, can you really just mark orders as paid like that?

upvoted 0 times

...

Tijuana

3 months ago

Not sure if a session attribute is the best way to go.

upvoted 0 times

...

Vicky

4 months ago

I think HTTPS restriction is a must too.

upvoted 0 times

...

Amber

4 months ago

Adding an order token sounds solid!

upvoted 0 times

...

Myra

4 months ago

I recall that using session attributes might not be ideal for this scenario since it could complicate stateless interactions. I wonder if the order token is the better choice.

upvoted 0 times

...

Victor

4 months ago

I’m a bit confused about whether HTTPS restrictions alone would be enough to prevent unauthorized access. It seems like there should be more validation.

upvoted 0 times

...

Helaine

4 months ago

I think we practiced a similar question where we had to secure a payment notification. I feel like adding an order token could be a strong option here.

upvoted 0 times

...

Jennie

5 months ago

I remember discussing the importance of securing callback URLs in our last class, but I'm not sure if adding a customer number is the best approach.

upvoted 0 times

...

Charlene

5 months ago

Okay, I think I've got it. The customer number or order token in the callback URL is the way to go. That way, we can validate the request and ensure it's coming from a legitimate source. Nice problem!

upvoted 0 times

...

Veronika

5 months ago

This is a tricky one. I'm leaning towards the order token option, as it seems like the most robust solution to prevent unauthorized access. But I'll need to think it through a bit more to be sure.

upvoted 0 times

...

Michel

5 months ago

Ah, I see what the problem is here. The key is to verify the identity of the caller to the notification controller. Adding a session attribute and validating it on the callback seems like a solid approach to me.

upvoted 0 times

...

Janella

5 months ago

Hmm, I'm a bit unsure about this one. The question mentions that the notification URL only contains the orderID, so adding a customer number or token might be tricky. Maybe the HTTPS restriction would be the easiest solution?

upvoted 0 times

...

Hoa

5 months ago

This looks like a security issue with the notification controller. I think adding a customer number or an order token in the callback URL and matching it against the stored value would be a good way to prevent unauthorized usage.

upvoted 0 times

...

Julieta

10 months ago

I'm with Scot on this one. HTTPS is so 2010. Let's just use a good old-fashioned secret handshake to authenticate the orders. Option C is the way to go!

upvoted 0 times

Lynelle

8 months ago

User 3: I'm with Scot on this one. Let's use a secret handshake to authenticate the orders. Option C is the way to go!

upvoted 0 times

...

Helene

8 months ago

User 2: I disagree, we should add an order token in the callback URL and match it against the one stored on the order.

upvoted 0 times

...

Eleni

9 months ago

User 1: I think we should add a customer number in the callback URL to prevent unauthorized usage.

upvoted 0 times

...

Scot

10 months ago

Haha, option B with the HTTPS restriction? Might as well just send the orders to the service via carrier pigeon to keep them safe!

upvoted 0 times

Willard

9 months ago

User 3: Yeah, I agree. Option B might not be enough to prevent unauthorized usage.

upvoted 0 times

...

Glen

10 months ago

User 2: Glen is right. Option C would definitely add an extra layer of security.

upvoted 0 times

...

Emile

10 months ago

User 1: Option C sounds like a better idea. Adding an order token for validation.

upvoted 0 times

...

Kent

10 months ago

Wow, option D with the session attribute? That's overkill for a simple notification callback. Keep it simple with option C, folks!

upvoted 0 times

Tamekia

8 months ago

Let's go with option C for now and see how it works.

upvoted 0 times

...

My

9 months ago

True, but option D might be too complex for this scenario.

upvoted 0 times

...

Shawnta

10 months ago

But wouldn't adding a customer number in the callback URL provide an extra layer of security?

upvoted 0 times

...

Vannessa

10 months ago

I agree, option C seems like the most straightforward solution.

upvoted 0 times

...

Cheryl

10 months ago

I'm not a fan of option A. Tying the customer number to the order seems like an unnecessary complication. Option C is the clear winner here.

upvoted 0 times

Veronika

10 months ago

I think option A could work too, but I see your point about it being complicated. Option C does seem more straightforward.

upvoted 0 times

...

Leana

10 months ago

I agree, option C is the best choice. Adding an order token for validation makes more sense.

upvoted 0 times

...

Olene

10 months ago

I think option A is also a good choice. Adding a customer number in the callback URL and matching it against the one stored on the order can also help prevent unauthorized usage. It's important to have multiple layers of security measures in place.

upvoted 0 times

...

Donette

11 months ago

I agree with Odette. Adding an order token in the callback URL is a good idea to prevent unauthorized usage of the controller. It's important to have that extra validation step.

upvoted 0 times

...

Odette

11 months ago

I think the Architect should recommend adding an order token in the callback URL and match the token against the one stored on the order. This way, it adds an extra layer of security.

upvoted 0 times

...

Deandrea

11 months ago

Option C sounds like the way to go. Adding an order token to the callback URL and verifying it against the stored token is a simple yet effective way to prevent unauthorized access.

upvoted 0 times