In a Synchronous Request-Reply pattern, the user's experience is directly tied to the performance of the external service. For a mission-critical "Available-to-Promise" (ATP) service during checkout, the most vital scalability consideration is the typical and worst-case historical response times of the target system.
Salesforce imposes strict Governor Limits on synchronous callouts to protect platform health. Specifically, if an ATP callout takes longer than 120 seconds, the transaction will time out. More importantly, Salesforce limits the number of long-running requests (those lasting longer than 5 seconds). If multiple users are checking out simultaneously and the external inventory system begins to respond slowly (worst-case), those requests can quickly occupy all available slots in the concurrent request queue, leading to "Concurrent Request Limit Exceeded" errors for all users in the org.
By analyzing historical response times, the architect can determine if the service is reliable enough for a synchronous callout. If the worst-case response time frequently exceeds 5 seconds, the architect should consider a more resilient pattern, such as the Continuation pattern or an asynchronous approach, to prevent blocking the UI thread and hitting platform limits. Options A and C are irrelevant to synchronous checkout performance; query cursors relate to database state, and batch jobs are asynchronous background processes that do not impact real-time user checkout latency.

When dealing with high-volume data (1 million transactions per day) that does not need to be stored natively in Salesforce, the architect should recommend Data Virtualization via Salesforce Connect.
Salesforce Connect allows the company to display external data as External Objects. This approach provides several architectural advantages for a banking community:
No Data Storage: Transactions remain in the core banking system, avoiding the massive storage costs and complex synchronization logic required to house millions of records natively in Salesforce.
Real-Time Visibility: Because External Objects are queried on-demand via the OData protocol or a custom Apex adapter, customers see the most up-to-date transaction history every time they refresh the page.
While an Iframe (Option B) is technically possible, it is often discouraged due to security concerns (such as clickjacking) and a poor user experience, as the Iframe does not natively integrate with Salesforce UI components or reporting. Salesforce Connect provides a "seamless" look and feel, allowing External Objects to be used in related lists and Lightning components just like standard Salesforce records, while keeping the heavy data burden on the performant core banking system.

In a robust event-driven architecture, "durability" is the ability of a system to retain events so that a subscriber can retrieve them even after being offline. For an architect needing to minimize data loss over "every couple of days," the selection must focus on event types that support a high retention window.
Salesforce provides two modern event types specifically designed for high-scale, durable messaging:
Change Data Capture (CDC): This automatically broadcasts changes to Salesforce records (Create, Update, Delete, Undelete). CDC events are highly durable and are retained in the event bus for 72 hours (3 days).
High-Volume Platform Events: These are custom events defined by the architect. Like CDC, High-Volume Platform Events also provide a 72-hour retention window.
Earlier versions of the Streaming API, such as PushTopic Events and Generic Events (Option C and parts of A), typically offered a 24-hour retention window, which would not satisfy the requirement of a client re-connecting "every couple of days" (potentially 48-72 hours later).
By utilizing CDC and High-Volume Platform Events, the architect can leverage the Replay ID. When the client re-connects, it can send the Replay ID of the last event it successfully processed. Salesforce then "replays" all events that occurred during the client's downtime from that specific point, up to the 72-hour limit. This mechanism ensures zero data loss for planned or unplanned outages lasting up to three days, making it the most resilient choice for the specified requirements.

Standard synchronous Apex callouts have a timeout limit, and more importantly, Salesforce limits the number of long-running requests (those lasting longer than 5 seconds) that can execute concurrently. If a payment gateway consistently takes 30 seconds, a few simultaneous users could easily exhaust the org's concurrent request limit, causing the entire system to stop responding.
The Continuation pattern (Option C) is designed specifically for this "long-wait" scenario. It allows the Apex request to be suspended while waiting for the external service to respond, freeing up the Salesforce worker thread to handle other users. Once the gateway responds, the suspended process resumes and returns the result to the student's browser. This provides the "real-time" experience required for the student to retry immediately without the risk of bringing down the entire community due to thread exhaustion.

When integrating Salesforce with high-security enterprise systems like an Enterprise Billing System (EBS) and a Document Management System (DMS), the primary architectural concern is respecting the Enterprise security needs for access control. These systems often contain highly sensitive financial data and are governed by strict regulatory requirements (e.g., PCI-DSS or GDPR).
The integration consultant must evaluate how to extend existing enterprise identity and authorization policies to Salesforce users. This often involves a Identity Federation strategy using protocols like SAML 2.0 or OpenID Connect. Instead of maintaining separate credentials in Salesforce (which Option A suggests and is generally an "anti-pattern" for 10 million records), the consultant should consider using a central Identity Provider (IdP).
By considering enterprise security needs, the architect ensures that when a support agent clicks a link in Salesforce to view a bill, the request is authenticated against the enterprise's security gateway. This allows for Single Sign-On (SSO) while ensuring that authorization (who can see what) remains mastered in the source systems or the central IdP. Migration (Option C) is physically and technically unfeasible for systems handling 10 million customers' historical bills and real-time processing. The focused objective is to build a "window" into these systems from Salesforce while maintaining the integrity of the enterprise's existing security perimeter.