The problem of duplicate order records is caused by the integration not being able to identify the existing order record in Salesforce and creating a new one instead. To prevent this, the integration needs to use a unique identifier that can match the order record in both systems. The order number in the OMS can serve as such an identifier, if it is guaranteed to be unique and not reused. Therefore, the following actions can prevent the duplicate order records from being created in Salesforce:
* Option A: Ensure that the order number in the OMS is unique. This will ensure that there is no ambiguity or confusion when matching the order records in both systems.
* Option B: Use the order number from the OMS as an external ID. An external ID is a custom field that can be used to store a unique identifier from an external system. By using the order number from the OMS as an external ID, the integration can use the upsert operation to either insert a new order record or update an existing one based on the external ID value.
References:
* Trailhead: Data Modeling (1)
* Trailhead: Data Integration (2)
* Apex Developer Guide: Upserting Records (3)

When saving records using a custom controller in a Visualforce page, validation rule violations can occur. To display these validation error messages to the user, the developer should use the <apex:messages> component.
Option A: Include <apex:messages> on the Visualforce page.
Correct Approach.
The <apex:messages> component displays all messages that were generated for all components on the page, including validation rule violations.
When a DML operation is performed, any validation errors are automatically added to the ApexPages message collection.
Including <apex:messages> in the page ensures that these messages are displayed to the user.
Example:
<apex:page controller="CustomAccountController">
<apex:form>
<apex:messages />
<!-- Form fields for Account -->
<apex:commandButton action="{!saveAccount}" value="Save" />
</apex:form>
</apex:page>
While a try/catch block can catch exceptions, it is not required for displaying validation errors.
Validation rule violations are added to the message collection automatically.
Using try/catch may suppress the standard error handling.
Option C: Add custom controller attributes to display the message.
Inefficient Approach.
Manually adding controller attributes and logic to handle error messages adds unnecessary complexity.
The standard <apex:messages> component handles this automatically.
Option D: Perform the DML using the Database.upsert() method.
Not Sufficient Alone.
Using Database.upsert() allows for finer control over DML operations and error handling.
However, unless the errors are added to the message collection, they will not be displayed.
The developer would still need to handle displaying the errors.
Conclusion:
By including the <apex:messages> component on the Visualforce page, validation rule violations and other error messages are displayed to the user automatically.
Therefore, Option A is the correct answer.
Reference:
apex
https://developer.salesforce.com/docs/atlas.en-us.pages.meta/pages/pages_compref_messages.htm Displaying Errors Option B: Use a try/catch with a custom exception class.
Not Necessary.

The developer should use the lightning-input-field component to support the security requirements. This component respects the field-level security and sharing settings of the Salesforce org, and displays the appropriate data to different types of users. The other components do not have this feature, and may expose sensitive data to unauthorized users. References: Lightning Web Components Developer Guide), Secure Coding Guide)