Salesforce Comm-Dev-101 - Salesforce Certified B2C Commerce Developer

CSRF validation must occurwhen the state-changing request is submitted, before protected business logic executes. In SFRA this is implemented as middleware in the controller ' s POST route, using the appropriate CSRF middleware—validateRequestfor standard submissions orvalidateAjaxRequestfor AJAX-based requests.

Salesforce ' s SFRA Forms documentation specifically states that CSRF protection is supplied as middleware and demonstrates CSRF checks as middleware steps. The underlyingdw.web.CSRFProtection.validateRequest()API verifies that the request contains the system-generated token and that the token has not expired.

Generating the token in the template only establishes the client-side value; it does not provide security unless the receiving POST endpoint validates it. Placing validation only in the form-display route would validate the wrong request. Performing validation in a persistence model is also too late because request security should be enforced before mutation logic is invoked.

Study Guide reference:Application Development — CSRF protection, SFRA middleware, POST routes,validateRequest,validateAjaxRequest, and secure form processing.

===============

WARNis the appropriate logging severity when an operation completed but produced an unexpected condition that may warrant investigation. It communicates that the application has encountered an abnormal or potentially consequential situation without falsely classifying the request as a complete processing failure.

Salesforce ' s B2C Commerce logging guidance identifies warning logs as appropriate for custom jobs, payment integrations, imports, and application code conditions that can affect users. WARN output is also normally available in operational logging, making it more appropriate than DEBUG for a potentially significant production condition.

DEBUGis intended for detailed development-oriented diagnostics and is not available as persistent debug file logging on production in the same manner.ERRORshould generally be reserved for an operation that actually failed, an exception, or another state requiring error-level treatment.

For Service Framework integrations, logs should contain useful but sanitized diagnostic context. Salesforce strongly recommends filtering requests and responses so credentials, payment data, tokens, and personal information are not exposed.

Study Guide reference:Application Development — Logger severity, WARN messages, Service Framework diagnostics, secure service logging, and troubleshooting external integrations.

===============

B2C Commerce ' sLoggermethods support parameterized message formatting. Placeholders such as{0}and{1}are placed in the message string, and the corresponding values are supplied as subsequent arguments to the logging method. Option A therefore correctly logs the product ID and product name.

The Salesforce Script API documentation forLoggerspecifies message formatting based on indexed placeholders and arguments, allowing calls such asLogger.warn(message, args...). This avoids manual concatenation and makes structured log messages easier to read and maintain.

Option B places JavaScript template-literal-style expressions inside an ordinary single-quoted string. Because the value is not enclosed with backticks and the B2C logger does not interpret${...}expressions inside a normal string, those expressions would not be evaluated as intended. Option C is also incorrect:.context()is not a post-processing method used to substitute{0}and{1}after callingwarn().

Parameterized logging is preferable for operational diagnostics because the fixed message pattern remains consistent while dynamic values are inserted at runtime.

Study Guide reference:Application Development —dw.system.Logger, custom logging, message formatting, diagnostic instrumentation, and troubleshooting.

===============

ThePipeline Profileris the appropriate performance-analysis tool because it reports execution statistics for storefront controllers and their underlying scripts, including hit counts, total processing time, andaverage response/run time.

Salesforce ' s performance troubleshooting documentation specifically recommends Pipeline Profiler for measuring deployed storefront-code performance and identifying expensive pipelines or controllers. The profiler presents high-level response-time information and allows the developer to drill down into individual scripts contributing to the controller ' s execution time.

This makes it appropriate for diagnosing reports that a product-details route has become slow. After identifying the expensive controller, the developer can inspect its script-level execution data to determine whether custom models, service calls, product logic, templates, or other components are contributing excessive processing time.

Request logs are useful for examining the sequence and context of individual requests but are not the principal tool for aggregating controller average processing times. The URL Request Analyzer is likewise not the intended answer for this performance metric.

Study Guide reference:Application Development — Pipeline Profiler, controller performance, average execution time, script profiling, and storefront performance troubleshooting.

===============

In SFRA ' s MVC-style architecture, a controller owns the HTTP request/response workflow. Consequently, generating aJSON HTTP responseis an appropriate controller responsibility. The SFRA response API exposesres.json(data)specifically for this purpose and Salesforce notes that it is useful for AJAX service endpoints called by client-side code.

The other two choices describe responsibilities that belong more appropriately to the model/ViewModel layer. Salesforce explains that SFRA models obtain data from B2C Commerce Script API objects and convert those objects intopure serializable JavaScript objectssuitable for views. Models also encapsulate storefront-oriented business logic. Controllers request or coordinate the required data and pass it through the model layer rather than becoming the primary object-transformation layer themselves.

This separation improves testability and maintainability. Controllers stay focused on routing, request validation, response selection, redirects, rendering, and JSON output, while models isolate the transformation of Commerce platform objects into view-friendly structures.

Study Guide reference:Application Development — SFRA MVC architecture, controllers, ViewModels,res.json(), Script API objects, and separation of concerns.

===============

Creating attribute definitions on a Custom Object Type is not always sufficient to make those attributes available in the Business Manager editing interface. The attributes must be assigned to anAttribute Group, which controls how they are organized and presented to Business Manager users.

Salesforce ' s business-object configuration guidance explains that custom object types can be given custom attributes through their attribute definitions and that attributes can be organized into groups for administrative presentation.

Therefore, if the object type itself appears but its fields do not appear when creating or editing an instance, the developer should verify the Attribute Grouping configuration and add the required attributes to a group.

Changing the underlying data type does not address whether the fields are presented to the administrator. Option C mixes two separate custom-object concepts: storage scope determines whether object instances are site-specific or organization-wide, while replication determines whether they move between instances. Neither setting controls whether an attribute appears on the Business Manager edit form.

Study Guide reference:Data Management Using Business Manager Usage — Custom Object Types, attribute definitions, attribute groups, Business Manager presentation, storage scope, and replication.

===============

ThePerpetualflag exists specifically to indicate that a product represented by a B2C Commerce inventory record should be considered continually in stock rather than constrained by an allocation quantity. This makes it the appropriate setting for a digitally issued gift voucher whose supply is effectively unlimited.

Salesforce ' s inventory documentation definesPerpetualas the flag indicating that the product isalways in stock. TheProductInventoryRecordScript API likewise states that theperpetualproperty determines whether a product is perpetually in stock.

Setting an artificially large allocation is inferior because that number is still finite and can create misleading inventory data. Option C is also inappropriate:stockLevelis a calculated value based on allocation and turnover rather than a Business Manager control that should be forced to an arbitrary maximum.

When the perpetual flag is active under standard B2C Commerce inventory management, availability logic treats the product as available irrespective of normal decrementing stock calculations.

Study Guide reference:Data Management Using Business Manager Usage — inventory records, perpetual inventory, product availability, allocation, and Business Manager inventory configuration.

===============

SFRA is designed around cartridge-based extension rather than direct modification of the base storefront code. When a developer needs to add another step to an existing registration workflow, the route should beextendedfrom a custom cartridge so that the standard implementation remains intact.

Salesforce ' s SFRA customization guidance describesmodule.superModule,server.extend,server.append,server.prepend, and route replacement as the supported mechanisms for customizing functionality from another cartridge. The exact technique depends on whether the additional operation must execute before, after, or instead of existing behavior.

Option A implies modifying the original controller directly, which is undesirable because upgrades or cartridge replacement can overwrite the changes. Option B copies base code, creating duplication and making later maintenance significantly harder.

Extending the route preserves the original implementation and keeps merchant-specific logic isolated in the custom cartridge. For a simple additional step that should execute after the existing route,server.append()is often appropriate; for access behavior or a fundamentally changed workflow, Salesforce recommends the corresponding supported extension/replacement pattern.

Study Guide reference:Application Development — SFRA controller extension, custom cartridges,module.superModule, route customization, and upgrade-safe development.

===============

B2C Commerce localizesform structure through locale-specific folders, not by appending the locale to the form-definition filename. For a U.S. English form, the developer createsforms/en_US/and places anaddress.xmlform definition inside it.

Salesforce ' s SFRA Forms documentation explicitly states that when a form ' s structure differs by locale—for example, state fields in one country and province fields in another—the cartridge should contain separate locale directories beneathforms, with each directory containing a form definition of thesame name. If a locale-specific definition is absent, the default form definition is used.

en_USfollows the Salesforce locale naming convention using language and country codes. Option B incorrectly changes the filename toaddress_en_US.xmlinstead of creating the required locale directory. Option C omits the language component and therefore does not use a valid locale ID for this purpose.

The copied U.S. file can then be modified independently to contain the state abbreviation options.

Study Guide reference:Application Development — localized forms,forms/en_US, XML form definitions, address localization, and locale-specific storefront behavior.

===============