Examkin

Question

Difficulty: MediumLightning App Builder Pages (App, Home, Record Pages)

A Salesforce administrator configures a conditional component visibility filter on an Account Lightning Record Page to display a custom financial metrics component only when a user's Profile Name equals 'Finance Executive'. Shortly after deployment, the security team notices that integration users without the 'Finance Executive' profile can still retrieve the underlying metric field values using the REST API. What explains why the integration users can access this data?

  1. Component visibility filters in Lightning App Builder only govern UI rendering and do not restrict data access or API permissions enforced by Field-Level Security.Answer
  2. B
    Component visibility filters only enforce field security when the record page is assigned as the Org Default rather than activated by App or Profile.
  3. C
    The administrator omitted the picklist value assignments for the metric record type when activating the custom Lightning Record Page.
  4. D
    Component visibility rules apply exclusively to custom objects, so standard object field access defaults to Org-Wide Defaults for API requests.

Answer

Component visibility filters in Lightning App Builder only govern UI rendering and do not restrict data access or API permissions enforced by Field-Level Security.
Lightning App Builder component visibility filters control strictly whether a component is rendered on the graphical user interface. They do not act as data security boundaries. To prevent users or API integrations from querying or reading field data, administrators must restrict access using Field-Level Security (FLS), Object Permissions, or Sharing Settings.

Step-by-Step Solution

1
Analyze the scope of Lightning App Builder component visibility rules.
Visibility rules evaluate runtime attributes (such as user profile or record fields) to hide or show components on the desktop or mobile screen.
Component visibility operates purely as a front-end presentation layer setting.
2
Evaluate how Salesforce enforces backend data security for API access.
Field-Level Security (FLS), object permissions, and sharing rules determine whether a user or integration service can query or update field values.
APIs bypass Lightning page layouts entirely and rely on backend security policies.
3
Determine the cause of the data exposure.
The integration user was granted read access to the financial metric fields via Field-Level Security, allowing API queries to succeed regardless of UI layout filters.
Hiding a field or component visually does not revoke FLS read permissions.

Key Concept

Lightning Component Visibility vs. Field-Level Security
Rate this question

Topics

Lightning App Builder Pages (App, Home, Record Pages)

More questions from this topic