When recommending Platform Events, an architect must account for the metadata lifecycle and the permanence of administrative actions. Unlike standard or custom objects, which can often be recovered from the Recycle Bin for a limited time, Platform Event definitions are handled with stricter permanence. Once a Platform Event definition is deleted, it is permanently removed from the organization's metadata, and it cannot be restored. This deletion also immediately invalidates any associated triggers, subscriptions, and stored events in the bus.
Beyond metadata management, the architect must consider the Event Retention window. High-volume platform events are stored for 72 hours, allowing subscribers to use a Replay ID to recover missed messages. However, this durability is predicated on the definition existing; if the definition is deleted, the historical data in the bus becomes inaccessible. Option A refers to Real-Time Event Monitoring, which is a separate product feature used for security auditing rather than general integration. Option B describes a specific system event (AssetTokenEvent) used for IoT device authentication, which is a niche use case and not a general consideration for platform event architecture. Therefore, understanding the permanent nature of metadata deletion is a fundamental "Maintenance" and "Governance" consideration that the architect must highlight to ensure the stability of the enterprise's event-driven landscape.

To meet the requirements of minimal customization, low developer resources, and real-time visibility without data replication, the architect should utilize Salesforce Connect with External Objects and an OData connector.
Salesforce External Objects allow the OMS data to be viewed within Salesforce as if it were stored natively, but the data remains in the on-premise system. This fulfills the requirement for sales reps to see "up-to-date information" because every time they view the record, Salesforce Connect fetches the latest data via the ESB's OData endpoint. This Data Virtualization pattern is the most efficient choice for real-time history where users only need to view the data occasionally.
Options A and B involve Data Replication via ETL, which would store the order data inside Salesforce. Given the volume (15,000 orders/shift with 25 line items each = 375,000 records daily), this would rapidly consume Salesforce data storage limits and require significant custom development for the ETL logic and REST APIs. Furthermore, ETL is typically batch-oriented and would not provide the true "real-time" view requested. By using an OData connector, the architect leverages a declarative, "no-code" solution that satisfies the timeline constraints and provides immediate access to order details and line items without the cost of data storage.

In this architectural scenario, the Integration Architect must navigate two critical technical "bottlenecks": the 9-second API Gateway timeout and the 90-second backend processing time. Since the backend takes significantly longer than the gateway allows for a synchronous connection, a standard Request-Reply pattern will fail. Furthermore, having 3,000 concurrent agents perform synchronous callouts would risk hitting Salesforce's concurrent long-running request limits.
The most scalable and user-friendly solution is to implement an Asynchronous Request-Reply pattern using Platform Events and the empAPI.
When an agent clicks "Check Eligibility," Salesforce sends an initial asynchronous request to the ESB (MuleSoft). The ESB immediately acknowledges receipt with a 202 Accepted status, freeing up the Salesforce UI thread and avoiding the API Gateway's 9-second timeout. Once the backend eligibility system completes its 90-second process, MuleSoft acts as a client to Salesforce, performing a Remote Call-In to publish a specific Platform Event containing the result and the original Request ID.
On the frontend, the Lightning UI uses the empAPI (Enterprise Messaging Platform API) to subscribe to the streaming channel for that Platform Event. Because the empAPI uses CometD technology to maintain a single long-lived connection, it can efficiently push the response to the agent's screen the moment it arrives, without requiring the agent to manually refresh or click a "Check Update" button (as suggested in Option B). This provides a "real-time" feel despite the long backend latency.
Option A is non-viable because synchronous polling would exacerbate the load on the API Gateway and likely lead to governance limit issues within Salesforce. By using Platform Events and empAPI, the architect ensures the solution remains within Salesforce's execution limits while providing a seamless, automated experience for a high-volume call center environment.

The primary architectural challenge in this scenario is the massive discrepancy between the backend response time (up to 90 seconds) and the API Gateway timeout constraint (9 seconds). In any synchronous integration pattern, the connection must remain open across the entire path; if the API Gateway closes the connection at 9 seconds, a standard Salesforce "Request-Reply" callout will fail long before the 90-second eligibility check is complete.
Option A is non-viable because synchronous polling at a high scale (3,000 concurrent users) would likely hit Salesforce concurrent request limits and place an immense, unnecessary load on the API Gateway. Option B, using Continuation, is designed to handle long-running callouts (up to 120 seconds) without blocking Salesforce threads, but it still requires the external connection path to remain open. It does not bypass the 9-second timeout imposed by the customer's API Gateway.
The optimal recommendation is Option C, which implements an Asynchronous Request-Reply pattern using Platform Events and the empAPI.12 Request Phase: The Salesforce UI initiates the request. To bypass the 9-second gateway timeout, the ESB (MuleSoft) should be configured to receive the request3 and immediately return an acknowledgment (e.g.,4 HTTP 202 Accepted). This allows the initial Salesforce callout to complete successfully within the 9-second window.56 Processing Phase: MuleSoft then proceeds with the long-running (up to 90 seconds) call to the external eligibility systems.78 Callback Phase (Remote Call-In)9: Once the eligibility result is received, MuleSoft calls back into Salesforce via the REST API to publish a Platform Event containing the result.10 UI Update (empA11PI): The 3,000 sales agents' browsers, having subscribed to the event channel using the empAPI (Lightning's built-in library for streaming events), receive the notification in real-time. The UI then updates to display the "Display Response" step.
This event-driven architecture effectively "insulates" Salesforce and the API Gateway from the backend's high latency, ensures scalability for 3,000 concurrent users, and provides a seamless, real-time user experience without hitting governor limits or timeout constraints.

The scenario highlights vulnerabilities in unmanaged packages where secrets (usernames, passwords, OAuth tokens) are stored in plain text and easily accessible. The goal is to protect these secrets from exposure in callouts, especially in unpackaged or unmanaged code contexts.
Why A (Protected Custom Metadata Types and Named Credentials)?
Named Credentials is the primary Salesforce-recommended mechanism for securely storing authentication details (including passwords, tokens, and secrets) for HTTP callouts. Secrets are encrypted, not visible in debug logs, and Salesforce handles authentication without exposing them in Apex code.
However, in Named Credentials, admins with "Customize Application" permission can view/edit the secrets.
To further protect secrets (e.g., hide them completely from admins or in packaged scenarios), use Protected Custom Metadata Types (preferably in a managed package). These allow Apex code in the same namespace/package to access the secrets while hiding them from users, API queries, or subscriber orgs.
This combination addresses both standard callouts (via Named Credentials) and cases needing maximum obfuscation (via Protected Custom Metadata), directly mitigating plain-text exposure in unmanaged packages.
Why not B (Encrypted Custom Fields and Protected Custom Settings)?
Encrypted Custom Fields are suitable for sensitive data like PII (e.g., credit cards, SSNs) but explicitly not recommended for storing authentication secrets or credentials used in callouts (per Salesforce Secure Coding guidelines).
Protected Custom Settings offer similar protection to Protected Custom Metadata but are less preferred for configuration-like data (secrets are configuration). Custom Metadata is deployable as metadata, better for packaging and migrations.
Why not C (Named Credentials and Protected Custom Settings)?
While Named Credentials are ideal, pairing with Protected Custom Settings is valid but suboptimal. Salesforce documentation and Trailhead modules favor Protected Custom Metadata Types over Custom Settings for secret storage due to better deployability, caching, and metadata API support.
This aligns with Salesforce Trailhead ("Securely Store Secrets with Salesforce Features") and secure coding guidelines, emphasizing Named Credentials for callouts and Protected Custom Metadata for high-security secret storage in packages. For unmanaged code vulnerabilities, migrating to these mechanisms (ideally with packaging) prevents exposure.