Salesforce Comm-Dev-101 Exam Questions

SFRA's response object provides thesetViewData()method specifically for adding data to the view-data object that will be available during rendering. Therefore, option A follows the supported controller pattern: callres.setViewData()with the additional object, render the template, and then invokenext()to continue the middleware chain.

Salesforce's SFRA documentation explains thatsetViewData(data)adds or merges data into the response's view-data object. This behavior is particularly important for an appended route because earlier middleware may already have established view data.setViewData()allows the appended function to add its contribution without replacing the response object's internal handling.

Directly assigningres.viewData, as shown in option B, bypasses the supported response API and is not the documented SFRA mechanism. Option C is also invalid because route appending expects a middleware function; data cannot be supplied by chaining an object through.append()after rendering.

This pattern is central to cartridge extensibility because multiple middleware functions can progressively enrich a response while preserving previously established data and route behavior.

Study Guide reference:Application Development --- SFRA controllers, response objects, middleware chains,setViewData(), and template rendering.

===============

CSRF validation must occurwhen the state-changing request is submitted, before protected business logic executes. In SFRA this is implemented as middleware in the controller's POST route, using the appropriate CSRF middleware---validateRequestfor standard submissions orvalidateAjaxRequestfor AJAX-based requests.

Salesforce's SFRA Forms documentation specifically states that CSRF protection is supplied as middleware and demonstrates CSRF checks as middleware steps. The underlyingdw.web.CSRFProtection.validateRequest()API verifies that the request contains the system-generated token and that the token has not expired.

Generating the token in the template only establishes the client-side value; it does not provide security unless the receiving POST endpoint validates it. Placing validation only in the form-display route would validate the wrong request. Performing validation in a persistence model is also too late because request security should be enforced before mutation logic is invoked.

Study Guide reference:Application Development --- CSRF protection, SFRA middleware, POST routes,validateRequest,validateAjaxRequest, and secure form processing.

===============

A storefront category intended to appear in navigation normally needs appropriate online configuration andavailable products assigned to it. Salesforce's category-management guidance specifically notes that to show a category in storefront menu navigation, available products must be assigned to the category and the relevant menu-navigation configuration must be enabled.

This makes option A the relevant cause among the supplied choices. A newly created category that contains no available merchandise can fail to appear where expected in the storefront navigation structure.

Option C is incorrect because sorting determines ordering, not whether a category exists or is eligible to appear. Option B is too broad in the context of the scenario. An offline storefront catalog would affect storefront catalog availability generally, rather than explaining why this newly created category alone cannot be seen.

Product/category visibility in B2C Commerce depends on several related configuration elements: product assignments, category online state, catalog-to-site assignment, navigation settings, and updated search indexes where applicable. Salesforce also confirms that products must be assigned to categories and the catalog assigned to the site for storefront visibility.

Study Guide reference:Data Management Using Business Manager Usage --- catalogs, categories, product assignments, storefront navigation, and product availability.

===============

The cartridge's root-levelpackage.jsonuses the'hooks'property to point to the hook registration file. In the standard SFRA cartridge structure, the hook-registration file resides under:

cartridge/scripts/hooks.json

Therefore, the correct relative path is:

{'hooks':'./cartridge/scripts/hooks.json'}

Salesforce's SFRA hook documentation confirms thatpackage.jsonuses thehookskeyword to identify the hook file and that the referenced hook file then maps extension-point names to script implementations.

Option B omits thecartridgeportion of the normal directory structure, so it points to the wrong location. Option C uses JavaScript-object syntax rather than valid JSON because thehooksproperty name is unquoted. Apackage.jsonfile must contain valid JSON.

Thehooks.jsonfile contains entries with the extension-pointnameand correspondingscriptmodule. Once the cartridge is deployed and active on the appropriate cartridge path, registered hooks can participate in storefront or platform extension points.

Study Guide reference:Application Development --- hook registration,package.json,hooks.json, cartridge structure, CommonJS hook modules, and extension points.

===============

Server-side script variables do not persist between independent request executions. B2C Commerce therefore provides theSessionobject as the appropriate request-session mechanism for maintaining shopper-specific state across calls.

Salesforce specifically identifies the Session API as providing access to thecurrent customer, whether that customer isauthenticated, session custom attributes, andcustom privacy attributes. These capabilities map directly to every requirement in the question.

A client-side cookie is inappropriate for reproducing server-maintained authentication and customer state. It would also expose application-controlled values to client modification and duplicate information already securely managed by the Commerce session. An SFRA controller does not automatically preserve its own JavaScript variables across requests; each request executes within a separate script context.

Session data should nevertheless remain lightweight. Long-lived or business-critical information that must survive beyond the shopper's browser session belongs in persistent business objects rather than session attributes. Privacy attributes have specific lifecycle semantics and are particularly appropriate for tracking consent and related shopper preferences during the active session.

Study Guide reference:Application Development --- Session API, shopper state, authentication state, privacy attributes, server-side JavaScript execution lifecycle, and scalable state management.

===============