Examkin

Question

Difficulty: MediumProfiles and Object/Field-Level Security

Universal Containers uses a custom object named Performance_Review__c to track employee evaluations. The administrator needs to restrict access to a sensitive custom field, Overall_Rating__c, so that only three Executive Team members can view and edit it. All other users assigned to the Standard User profile must continue to create and edit Performance Review records without having any access to the Overall_Rating__c field. Which configuration should the administrator implement to satisfy this security requirement?

  1. Set Field-Level Security on Overall_Rating__c to restricted (Read and Edit unchecked) for the Standard User profile, and assign a Permission Set granting Read and Edit access to the Executive Team members.Answer
  2. B
    Clone the Standard User profile to create an Executive User profile with access to Overall_Rating__c, then reassign all other non-executive users to a new profile with the field removed from the page layout.
  3. C
    Configure Dynamic Forms component visibility rules on the Performance Review record page to hide the Overall_Rating__c field unless the viewing user belongs to the Executive Team.
  4. D
    Define a Profile Login IP Range on the Standard User profile that limits access to the Overall_Rating__c field during corporate network sessions.

Answer

Restrict Field-Level Security on the Overall_Rating__c field for the Standard User profile by unchecking Read and Edit, and create a Permission Set granting Read and Edit access on Overall_Rating__c assigned specifically to the Executive Team members.
The correct approach enforces Field-Level Security (FLS) by removing Read and Edit access from the base profile (Standard User) and using a Permission Set to grant the required access to specific individual users. This follows Salesforce security best practices by providing true data security across UI, reports, and APIs while preventing profile maintenance bloat.

Step-by-Step Solution

1
Analyze baseline profile permissions
Recognize that the Standard User profile currently grants access to the object, but the field needs to be restricted for most users.
Security in Salesforce follows the principle of least privilege at the profile level.
2
Restrict Field-Level Security (FLS) at the profile level
Deselect Read and Edit access for Overall_Rating__c on the Standard User profile.
FLS ensures the field is secure across all access vectors including UI, API, reports, and search.
3
Grant additive access using a Permission Set
Create a Permission Set with Read and Edit access to Overall_Rating__c and assign it to the three Executive Team users.
Permission sets allow targeted, additive privilege assignment without creating redundant profiles.

Key Concept

Field-Level Security (FLS) restriction on profiles combined with additive access via Permission Sets
Estimated Time:1m 30s
Rate this question

Topics

Profiles and Object/Field-Level Security

More questions from this topic