Interview Questions

Dynamic Forms allow you to place individual fields and sections from a page layout directly on a Lightning Record Page (App Builder) — as components rather than a monolithic layout. Benefits: (1) Field-level visibility rules; (2) Different fields visible per profile/record type without multiple page layouts; (3) More flexible page design. Available for custom objects and some standard objects.

Remote Site Setting: Whitelists an external URL/endpoint so Salesforce allows callouts to it. Simple — just the URL, no authentication details. Required when using hardcoded URLs in Apex callouts. Named Credential: A more advanced alternative — stores both the endpoint URL AND authentication details (username/password, OAuth tokens, certificates). In Apex, use 'callout:MyNamedCredential' instead of the full URL. Advantages over RSS: (1) Authentication is handled by Salesforce — no credentials in code; (2) Credentials can be rotated without code changes; (3) Supports OAuth, Basic Auth, JWT, etc.

A Connected App defines a trusted external application that can integrate with Salesforce via OAuth 2.0. It provides Consumer Key and Consumer Secret used for OAuth authentication flows. Required for: inbound integrations (external systems calling Salesforce APIs), SSO, and mobile apps.

REST: Uses HTTP methods (GET, POST, PUT, PATCH, DELETE). Returns JSON or XML. Lightweight, stateless, faster. Better for mobile and web APIs. Salesforce's modern APIs (REST API, Apex REST) use this. SOAP: XML-based, uses WSDL for contract. More rigid, heavier, but has built-in error handling and WS-Security. Used for legacy enterprise integrations. Salesforce SOAP API requires WSDL download.

Web Server Flow (Authorization Code): User logs in via browser, gets auth code, exchanged for access token. Used for web apps. User-Agent Flow (Implicit): Token returned directly to browser. Less secure — no client secret. Username-Password Flow: Credentials sent directly. Simple but less secure — no user interaction. JWT Bearer Flow: Uses a certificate-signed JWT instead of password. No user interaction — used for server-to-server. Client Credentials Flow: Uses client ID/secret. For server-to-server without user context. Refresh Token Flow: Uses refresh token to get new access token without re-authentication.

HttpRequest req = new HttpRequest(); req.setEndpoint('callout:MyNamedCredential/api/accounts'); req.setMethod('GET'); req.setHeader('Content-Type', 'application/json'); Http http = new Http(); HttpResponse res = http.send(req); if(res.getStatusCode() == 200) { Map<String, Object> body = (Map<String, Object>) JSON.deserializeUntyped(res.getBody()); }

Cannot do callouts directly in triggers (uncommitted DML causes 'uncommitted work pending' error). Solution: Use @future(callout=true) — call the future method from the trigger, passing Ids. The future method then makes the callout in a separate async transaction.

(1) Create an Apex REST Service using @RestResource annotation. (2) Create a Connected App in Salesforce. (3) External system authenticates via OAuth (gets access token). (4) Calls the Apex REST endpoint. @RestResource(urlMapping='/accounts/*') global class AccountRestService { @HttpGet global static Account getAccount() { Id accId = RestContext.request.requestURI.substringAfterLast('/'); return [SELECT Id, Name, BillingCity FROM Account WHERE Id = :accId]; } } Why global? Apex REST service classes must be global to be accessible externally.

Salesforce's Bulk API is optimised for loading or extracting large data volumes (millions of records). It processes records asynchronously in batches. Two modes: Serial (one batch at a time) and Parallel (multiple batches simultaneously — risk of row lock errors). Data Loader uses Bulk API. Bulk API 2.0 is the modern version with simpler job management.

Authentication: Verifying identity — 'Who are you?' (login with username/password, certificates, OAuth). Authorization: Determining access rights — 'What can you do?' (profile permissions, sharing rules, scopes in OAuth).

Platform Events are Salesforce's enterprise messaging feature. Publishers send event messages; subscribers receive them asynchronously. Used for: real-time integrations, decoupled architectures, cross-org communication. Differences from CDC: Platform Events are custom-defined; CDC (Change Data Capture) automatically publishes events when standard/custom object records change.