Explanation
Leverage Change Data Capture to track changes to the Contact object and write a CometD subscriber on the homegrown application. This solution meets the requirements of keeping Salesforce and the homegrown application synchronized for consistency, using event-driven and asynchronous integration. Change Data Capture is a feature that allows you to receive near real-time notifications of changes to Salesforce records, such as inserts, updates, deletes, and undeletes. You can use Change Data Capture to track changes to the Contact object, and publish them as events to an event bus. CometD is a protocol that allows you to subscribe to events from the event bus using a streaming API. You can write a CometD subscriber on the homegrown application, and use it to receive the events and update the customer data accordingly.
References: Certification - Integration Architect - Trailhead, [Change Data Capture Developer Guide],
[Streaming API Developer Guide]

Explanation
Trigger invokes Queueable Apex method, with custom error handling process. Queueable Apex allows you to run asynchronous jobs that can make callouts to external web services. You can use custom error handling logic to handle any failures and retry the callouts if necessary. You can also use Database.Stateful interface to maintain state across transactions and ensure that each order is sent exactly once. This solution meets the requirements of sending order and line items directly to an existing finance application web service when an order is fulfilled, and ensuring that each order reaches the finance application exactly once for accurate invoicing. References: Certification - Integration Architect - Trailhead, [Queueable Apex], [Making a Web Service Callout from a Queueable Apex Job]

Explanation
Creating Salesforce Cases using the Salesforce REST, SOAP or Bulk API is a solution that can allow the logging service to create case records in Salesforce based on the exceptions received from the middleware platform. This way, the logging service can use the standard APIs to interact with Salesforce and leverage the features and functionality of the case object. Creating Salesforce Cases conditionally using automatic Case creation rules is a solution that can allow the logging service to create case records in Salesforce based on predefined criteria and actions. This way, the logging service can reduce the number of API calls and avoid creating unnecessary or duplicate cases. Receiving Application Events through Change Data Capture (CDC) is not a solution that is related to this requirement, as CDC is used for capturing data changes in Salesforce and sending them to external systems, not for receiving data from external systems. Subscribing to the Application Exceptions using the Salesforce Streaming API is also not a solution that is related to this requirement, as Streaming API is used for subscribing to events or notifications from Salesforce, not for sending data to Salesforce. Reference: Salesforce Integration Architecture Designer Resource Guide, page 25-26

Explanation
Named Credentials and Protected Custom Settings are two persistence mechanisms that can be used to ensure that secrets are protected from deliberate or inadvertent exposure. Named Credentials allow you to specify the URL of a callout endpoint and its required authentication parameters in one definition. Salesforce manages all the authentication for Apex callouts that specify a named credential as the callout endpoint, and you don't have to add more authentication logic in your Apex code. Named Credentials can be defined to provide a secure and convenient way of setting up authenticated callouts, and they can also be used in Lightning components, Visualforce pages, and flows1.
Protected Custom Settings are a type of custom settings that store application-specific data that is hidden from subscribers. They are only accessible by the managed package that created them, and they can be used to store secrets such as encryption keys, passwords, or tokens. Protected Custom Settings can be accessed by Apex code, formulas, or validation rules within the same namespace as the settings2.
Encrypted Custom Fields are not a suitable mechanism for storing secrets, because they are not designed to prevent unauthorized access to sensitive data. Encrypted Custom Fields allow you to encrypt text fields using a standard encryption scheme. The encrypted data is masked in reports, list views, and search results, but it can still be viewed by users who have the "View Encrypted Data" permission. Encrypted Custom Fields are intended to protect data from unauthorized access by users within your organization, not from external threats or malicious code3.
Protected Custom Metadata Types are another type of custom metadata types that store application-specific data that is hidden from subscribers. They are similar to Protected Custom Settings, but they have some advantages such as being deployable using change sets or Metadata API, being accessible by SOQL queries, and being able to reference other metadata types or settings. However, Protected Custom Metadata Types cannot be used to store secrets, because they do not support encryption or masking of sensitive data. Protected Custom Metadata Types are intended to store configuration data that is specific to your managed package, not secrets that need to be secured.
Therefore, the correct answer is B and D, because Named Credentials and Protected Custom Settings are the only persistence mechanisms that can be used to securely store secrets in Salesforce.
References: 1: Named Credentials | Apex Developer Guide | Salesforce Developers 2: Custom Settings | Apex Developer Guide | Salesforce Developers 3: Encrypted Fields | Salesforce Help : [Protected Custom Metadata Types | ISVforce Guide | Salesforce Developers]