Explanation
The best use case for leveraging the existing SAML integration to connect Salesforce with other internal systems is to make Apex SOAP outbound integrations to external web services more secure. SAML can be used to authenticate the Salesforce org as the service provider and obtain a session ID from the external system as the identity provider. This session ID can then be used to make SOAP calls to the external web service without exposing any credentials in the Apex code. Option A is not correct because formula fields with HYPERLINK() do not support SAML authentication. Option C is not correct because Apex REST outbound integrations require OAuth or basic authentication, not SAML. Option D is not correct because API inbound integrations from an external Java client require OAuth or basic authentication, not SAML. References:
Named Credentials as Callout Endpoints
SAML SSO with Salesforce as the Service Provider

Explanation
This is because SSL/TLS mutual authentication is a security feature that allows Salesforce to verify the identity of the client that connects to its API endpoint on port 8443. To enable this feature, you need to upload a client certificate to Salesforce and assign the "Enforce SSL/TLS Mutual Authentication" user permission to the users who need to access the company portal. The other options are not sufficient for this scenario because:
A, Enable My Domain and SSL/TLS, is a prerequisite for using SSL/TLS mutual authentication, but it does not ensure that all integrations use it. My Domain allows you to customize your Salesforce domain name and SSL/TLS provides encryption for your data in transit.
C, Generate a Self-signed Certificate, is a step that you need to do on the client side to create a certificate that can be used for SSL/TLS mutual authentication, but it does not ensure that all integrations use it. You also need to upload the certificate to Salesforce and assign the user permission.
D, Generate a CA-signed Certificate, is an alternative to generating a self-signed certificate, but it also does not ensure that all integrations use SSL/TLS mutual authentication. You still need to upload the certificate to Salesforce and assign the user permission.
References:
Certificates in Mutual Authentication
Configure Your API Client to Use Mutual Authentication
Salesforce Mutual Authentication Setup

https://www.workfront.com/blog/systems-of-record

Explanation
Invoking middleware service to retrieve valid shipping methods is a solution that can allow the sales representatives to select between valid services for the customer's country. The middleware service can act as a single point of entry for all shipping services and provide routing and transformation capabilities. Using middleware to abstract the call to the specific shipping services is a solution that can allow the sales representatives to request shipping estimates from the selected service. The middleware can hide the complexity and heterogeneity of the shipping services and provide mediation and orchestration capabilities.
Using Platform Events to construct and publish shipper-specific events is not a solution, as Platform Events are used for event-driven integration, not for web-service integration. Storing shipping services in a picklist that is dependent on a country picklist is not a solution, as it does not address how to request shipping estimates from the shipping services. Reference: Salesforce Integration Architecture Designer Resource Guide, page 16-17