When building a distributable package (likely a Managed Package) that must securely communicate back to a central "Hub" org, the architect must use a framework that supports OAuth 2.0 flows. Storing plain-text or even encrypted passwords (Option B) is a security violation and is brittle across different environments.
The architecturally sound solution is to leverage the Authentication Provider and Named Credentials framework. In the central org, a Connected App is created to act as the OAuth endpoint. In the package, an Authentication Provider is configured using the Consumer Key and Consumer Secret from that Connected App. This setup allows the administrator in the "Subscriber" org (the org where the package is installed) to initiate an OAuth flow.
When the security team "authorizes" the integration after installation, they are essentially completing the OAuth handshake. This grants the subscriber org an Access Token and a Refresh Token associated with the specific integration user in the central org. This mechanism ensures:
Credential Security: No passwords are ever stored in the code or metadata.
Centralized Control: The security team in the central org can revoke the Refresh Token at any time to kill the integration.
Scalability: The same package can be distributed to hundreds of orgs, each with its own unique, secure connection to the central Hub.
By using an Authentication Provider combined with a Named Credential, the Apex code in the package can simply call the endpoint by its developer name, and Salesforce handles the entire authentication header injection automatically, ensuring a robust and secure cross-org integration.

When dealing with a "big surge" or high-volume influx of requests, a synchronous pattern like Request and Reply (Option A) can lead to significant performance bottlenecks. In a synchronous model, each Salesforce user thread must wait for the external scheduling system to respond, which could lead to "Concurrent Request Limit" errors during peak times.
The Remote Process Invocation-Fire and Forget pattern is the architecturally sound choice for managing surges. In this pattern, Salesforce captures the registration intent and immediately hands it off to an asynchronous process or a middleware queue. Salesforce does not wait for the external system to process the room capacity logic; instead, it receives a simple acknowledgment that the message was received.23 This pattern decouples the front-end user experience from the back-end processing limits. Middleware can then "drip-feed" these registration4s into the scheduling system at a rate it can handl5e. If the scheduling system becomes overwhelmed or goes offline, the messages remain safely in the queue. Option C (Batch) is unsuitable because users expect near real-time feedback on their registration attempt, even if the final confirmation is sent a few minutes later. By utilizing Fire and Forget, NTO ensures a responsive Community Experience during the critical launch window while maintaining system stability.

When building custom mobile or web applications that aim to replicate the look and feel of Salesforce Lightning Experience, the User Interface (UI) API is the architecturally recommended choice.
The UI API is specifically designed to provide the metadata and data needed to build high-fidelity user interfaces. Unlike the standard REST API (Option B), which returns raw record data, the UI API returns both data and metadata in a single response. This includes information about page layouts, field-level security, picklist values, and localized labels. By using the UI API, the mobile app can dynamically render fields according to the user's permissions and the organization's layout configurations, ensuring that the custom app stays in sync with changes made in Salesforce Setup without requiring code updates in the mobile app.
Connect REST API (Option A) is primarily used for Chatter, Communities (Experience Cloud), and CMS content, and while it is useful for those specific social features, it does not provide the layout and record-level metadata required for a full CRM interface. The UI API is the same underlying technology that powers the Salesforce mobile app and Lightning Experience itself. Therefore, utilizing this API allows NTO's developers to build a native app that perfectly mimics the Lightning Experience while reducing the amount of custom logic needed to handle complex Salesforce UI requirements.

When integrating Salesforce with high-security enterprise systems like an Enterprise Billing System (EBS) and a Document Management System (DMS), the primary architectural concern is respecting the Enterprise security needs for access control. These systems often contain highly sensitive financial data and are governed by strict regulatory requirements (e.g., PCI-DSS or GDPR).
The integration consultant must evaluate how to extend existing enterprise identity and authorization policies to Salesforce users. This often involves a Identity Federation strategy using protocols like SAML 2.0 or OpenID Connect. Instead of maintaining separate credentials in Salesforce (which Option A suggests and is generally an "anti-pattern" for 10 million records), the consultant should consider using a central Identity Provider (IdP).
By considering enterprise security needs, the architect ensures that when a support agent clicks a link in Salesforce to view a bill, the request is authenticated against the enterprise's security gateway. This allows for Single Sign-On (SSO) while ensuring that authorization (who can see what) remains mastered in the source systems or the central IdP. Migration (Option C) is physically and technically unfeasible for systems handling 10 million customers' historical bills and real-time processing. The focused objective is to build a "window" into these systems from Salesforce while maintaining the integrity of the enterprise's existing security perimeter.

When dealing with high-volume data (1 million transactions per day) that does not need to be stored natively in Salesforce, the architect should recommend Data Virtualization via Salesforce Connect.
Salesforce Connect allows the company to display external data as External Objects. This approach provides several architectural advantages for a banking community:
No Data Storage: Transactions remain in the core banking system, avoiding the massive storage costs and complex synchronization logic required to house millions of records natively in Salesforce.
Real-Time Visibility: Because External Objects are queried on-demand via the OData protocol or a custom Apex adapter, customers see the most up-to-date transaction history every time they refresh the page.
While an Iframe (Option B) is technically possible, it is often discouraged due to security concerns (such as clickjacking) and a poor user experience, as the Iframe does not natively integrate with Salesforce UI components or reporting. Salesforce Connect provides a "seamless" look and feel, allowing External Objects to be used in related lists and Lightning components just like standard Salesforce records, while keeping the heavy data burden on the performant core banking system.