Northern Trail Outfitters (NTO) has recently changed its Corporate Security Guidelines requiring all cloud applications...

When corporate guidelines mandate a firewall-protected entry point for cloud traffic, the middleware architecture must include a component capable of residing in a Demilitarized Zone (DMZ) or perimeter network. The architect must evaluate the solution's API Gateway capabilities.

A secure API Gateway acts as the intermediary that terminates external (cloud) TLS connections and inspects incoming traffic before proxying it to internal systems. It allows the security team to implement:

IP Whitelisting: Ensuring only Salesforce's IP ranges can access the gateway.

Mutual Authentication: Using certificates to verify that the request is genuinely coming from the Salesforce org.

Rate Limiting: Protecting on-premise resources from being overwhelmed by cloud requests.

Option A (OAuth) is an authorization framework and does not satisfy the network-level firewall requirement on its own. Option B (ODBC) is an internal database protocol that should generally never be exposed to a cloud-facing firewall due to security risks. By prioritizing a solution with a hardened API Gateway, the architect ensures that NTO meets its new security mandates while providing a scalable and secure bridge for Salesforce to access back-office services.