Examkin

Question

Difficulty: MediumProfiles and Object/Field-Level Security

Summit Global Solutions uses a custom currency field named Executive_Bonus__c on the Opportunity object. Currently, 20 sales managers and 100 sales representatives share the standard 'Sales User' profile. Business requirements dictate that only the 20 sales managers should be able to view and edit Executive_Bonus__c, while sales representatives must not have access to this field in reports, record pages, or API integrations. Which configuration strategy should the Salesforce Administrator implement to fulfill this requirement?

  1. Remove Read and Edit permissions for Executive_Bonus__c on the Sales User profile, create a Permission Set that grants Read and Edit access to Executive_Bonus__c, and assign the Permission Set to the 20 sales managers.Answer
  2. B
    Clone the Sales User profile to create a Sales Manager profile, grant Read and Edit access to Executive_Bonus__c on the new profile, and assign the 20 sales managers to the cloned profile.
  3. C
    Remove the Executive_Bonus__c field from the Opportunity page layout assigned to sales representatives and set up Dynamic Forms component visibility rules to hide the field.
  4. D
    Restrict access to Executive_Bonus__c by configuring Organization-Wide Defaults (OWD) for Opportunities to Private and adding Network Access IP ranges for sales managers.

Answer

Remove Read and Edit permissions for the field on the base profile, create a Permission Set granting Read and Edit access to the field, and assign it to the users who require access.
The correct solution enforces a secure baseline by removing Field-Level Security (FLS) read/edit rights on the common profile, then uses a Permission Set to grant access additively to the sales managers. FLS restricts field visibility universally across reports, APIs, and record detail pages.

Step-by-Step Solution

1
Analyze the baseline access requirement
Since the majority of users (100 sales reps) should not access Executive_Bonus__c, the baseline Field-Level Security (FLS) on the shared profile must restrict both Read and Edit access.
Field-Level Security is the primary control for securing field visibility across all interfaces including UI, reports, and APIs.
2
Determine the optimal authorization method for the subset of users
Create a Permission Set specifically granting Read and Edit access to Executive_Bonus__c and assign it to the 20 sales managers.
Salesforce security architecture relies on profiles for restrictive baselines and permission sets for additive access, avoiding redundant profile maintenance.

Key Concept

Field-Level Security and Permission Sets
Rate this question

Topics

Profiles and Object/Field-Level Security

More questions from this topic