Examkin

Question

Difficulty: Very hardOrganization-Wide Defaults (OWD)

An administrator at Zenith Financial is establishing access controls for a newly created custom object, Strategic_Account_Plan__c, which contains sensitive client growth strategies. Executive leadership mandates the following security criteria:

1. Default access must restrict all users from viewing or editing records created by others across different branches of the organization.
2. Managers and executives positioned above the record owner in the role hierarchy must automatically inherit full access to view and update their subordinates' account plan records.
3. Non-owner peers within the same department or role level must be denied visibility to these records by default.

Which Organization-Wide Default (OWD) configuration and sharing setting for Strategic_Account_Plan__c fulfills these requirements while maintaining standard record access inheritance?

  1. Set Default Internal Access to Private and keep Grant Access Using Hierarchies selected.Answer
  2. B
    Set Default Internal Access to Private and deselect Grant Access Using Hierarchies.
  3. C
    Set Default Internal Access to Public Read-Only and use Permission Sets to restrict Read access for peer roles.
  4. D
    Set Default Internal Access to Public Read/Write and assign a restrictive custom Profile that removes Object Read permissions.

Answer

Set Default Internal Access to Private and keep Grant Access Using Hierarchies selected.
Setting the Organization-Wide Default (OWD) to Private restricts record visibility solely to the record owner by default. Keeping 'Grant Access Using Hierarchies' selected ensures that users positioned above the owner in the role hierarchy automatically inherit access to those records. This satisfies both strict peer privacy and executive access requirements.

Step-by-Step Solution

1
Determine the baseline Organization-Wide Default (OWD) requirement.
Since non-owners must be restricted from viewing peer records by default, the most restrictive baseline OWD setting of Private is required.
OWD sets the baseline level of access for the most restricted user in the organization.
2
Evaluate role hierarchy access requirements for the custom object.
Keep 'Grant Access Using Hierarchies' enabled (selected).
For custom objects, Grant Access Using Hierarchies is checked by default. Keeping it selected ensures record access automatically propagates up the role hierarchy to higher management roles.
3
Validate against alternative permission models.
Reject profile or permission set restriction strategies.
Salesforce security follows an additive model; profiles and permission sets grant object-level access and permissions but can never restrict record-level access granted by OWD.

Key Concept

Organization-Wide Defaults (OWD) and Role Hierarchy Inheritance for Custom Objects
Rate this question

Topics

Organization-Wide Defaults (OWD)

More questions from this topic