Question

Difficulty: HardOrganization-Wide Defaults (OWD)

Universal Containers tracks sensitive internal HR compliance reviews using a custom object named Internal_Investigation__c. Management requires that records must be hidden from all employees by default. Additionally, because these reviews are highly confidential, higher-level managers in the role hierarchy must NOT automatically receive access to records created by their direct reports. Which TWO security settings must an administrator configure to fulfill these requirements? (Select TWO)

  1. Set the Organization-Wide Default (OWD) internal access for Internal_Investigation__c to Private.Answer
  2. Deselect the Grant Access Using Hierarchies option for the Internal_Investigation__c object in Sharing Settings.Answer
  3. C
    Assign a Permission Set with restricted object access to managers to block visibility of subordinate records.
  4. D
    Keep Grant Access Using Hierarchies enabled because hierarchy access propagation is mandatory and cannot be disabled for custom objects.

Answer

To meet the confidentiality requirements, the administrator must set the Organization-Wide Default (OWD) internal access for Internal_Investigation__c to Private, and deselect the Grant Access Using Hierarchies option for the custom object in Sharing Settings.
The correct configuration requires setting the Organization-Wide Default baseline for Internal_Investigation__c to Private to prevent unauthorized access by default, and deselecting Grant Access Using Hierarchies on the custom object settings to ensure managers above record owners in the role hierarchy do not automatically inherit access.

Step-by-Step Solution

1
Establish baseline security restriction
Set Organization-Wide Default (OWD) internal access for Internal_Investigation__c to Private
OWD defines the baseline access for users who do not own the record. Setting it to Private ensures non-owners have no visibility by default.
2
Disable implicit role hierarchy access propagation
Deselect 'Grant Access Using Hierarchies' in Sharing Settings for Internal_Investigation__c
Custom objects enable hierarchy access by default. Unchecking this setting prevents managers higher in the role hierarchy from automatically viewing records owned by their direct reports.

Key Concept

Organization-Wide Defaults (OWD) and Hierarchy Access Control for Custom Objects
Estimated Time:2m 0s
Rate this question