When an integration initiated from the client-side (the browser) fails, the architect must first look at the browser's security policies. In Salesforce, Lightning Web Components are subject to the Lightning Component framework's Content Security Policy (CSP).
CSP is a security layer that prevents cross-site scripting (XSS) and other code injection attacks by restricting which domains the browser is allowed to communicate with. If an LWC attempts to make a fetch() call to an external REST endpoint, the browser will block the request unless that specific domain is whitelisted in CSP Trusted Sites.
Option B (Remote Site Settings) is a common distractor; these settings are strictly for server-side Apex callouts and have no effect on client-side JavaScript requests. Option A (CORS) is also a browser security mechanism, but it must be configured on the external server to allow Salesforce to access its resources. While CORS is necessary, the first thing to validate within the Salesforce environment for a failing LWC callout is the CSP Trusted Site entry. Without this whitelisting, the request will be terminated by the browser before it even leaves the client, regardless of how the external server is configured.

In Salesforce, you cannot perform real HTTP callouts during unit tests. To test integration logic, developers must use the HttpCalloutMock interface to simulate the API's response. To ensure that the Apex code adheres to the RAML contract, the architect should require that the test mock implementation strictly follows the RAML specifications.
By requiring the Apex REST API Clients to implement the HttpCalloutMock (or more specifically, creating a mock class that implements it), the developer creates a controlled testing environment. The mock class should be coded to return a payload that matches the RAML-defined structure (fields, data types, and status codes). When the test runs, the Apex client receives this "contract-compliant" response. The unit test then uses assertions to verify that the Apex code correctly parses and handles this specific data structure.
Option B is technically imprecise; you don't "call" the mock from the client, you provide the mock to the test runtime using Test.setMock(). Option C describes the general process of testing but does not address the "design specification" needed to ensure contract adherence. By mandating a mock implementation that mirrors the RAML contract, the architect ensures that if the API contract changes in the RAML file, the unit tests will fail if the Apex code is not updated to match, thereby maintaining high integration quality and preventing runtime errors.

Implementing Shield Platform Encryption is a significant architectural change that requires careful planning before activation. The architect's first priority must be to Review Shield Platform Encryption configurations and understand the platform's functional limitations.
Encryption at rest affects how data interacts with other platform features. For example, encrypting a field can impact the ability to use that field in SOQL WHERE clauses, report filters, list views, or as a unique/external ID. Before encrypting Social Security Numbers, the architect must audit all existing integrations, Apex code, and reports that reference that field to ensure they will still function correctly.
Option A is incorrect because unnecessarily encrypting all data can negatively impact system performance and break standard functionality. Encryption should be applied selectively to sensitive fields based on a clear data classification policy. Option B is factually wrong; Shield is a data protection tool, not an authentication or authorization mechanism like OAuth or SSO. By reviewing the configurations first, the architect can identify potential "blockers"-such as a field being used in a formula or a criteria-based sharing rule-and address them before the encryption keys are generated and applied.

For a requirement focused on synchronizing record updates from Salesforce to an external system in an event-driven and asynchronous manner, Change Data Capture (CDC) is the architecturally preferred solution over custom Platform Events.
CDC is designed specifically for data replication and synchronization. It automatically publishes change events for Salesforce records (Create, Update, Delete, and Undelete) to the event bus. Unlike Platform Events, which require manual publishing via Apex triggers or Flows, CDC is a low-code feature that requires only a simple activation for the Contact object in Setup. The external homegrown application can then act as a CometD subscriber, listening to the specialized /data/ContactChangeEvent channel to receive near real-time updates without the need for constant polling. Furthermore, CDC provides ordered, replayable events and an extended 72-hour retention window, ensuring that the homegrown application can recover missed updates using a Replay ID if it momentarily loses connection. This native broadcasting capability ensures data integrity across systems while breaking the tight coupling between Salesforce and the legacy application.