Examkin

Question

Difficulty: Very hardPermission Sets and Permission Set Groups

A wealth management firm uses a Permission Set Group titled 'Financial Advisory Team' to grant broad object permissions, including Read, Create, Edit, and Delete on Portfolio records, as well as the 'Export Reports' system permission. A team of external audit contractors needs the access provided by the 'Financial Advisory Team' Permission Set Group, but regulatory policies strictly prohibit contractors from exporting reports. The administrator must ensure full-time advisors retain export capabilities while preventing contractors from exporting, without creating redundant profiles or manually creating separate standalone permission sets for each object. Which administrative action fulfills these security requirements?

  1. A
    Add a Muting Permission Set to the 'Financial Advisory Team' Permission Set Group that explicitly mutes the 'Export Reports' permission, then assign this Permission Set Group to the contractors.
  2. Clone the 'Financial Advisory Team' Permission Set Group, add a Muting Permission Set to the new group that mutes the 'Export Reports' permission, and assign the new group to the contractors.Answer
  3. C
    Clone the baseline profile assigned to contractors, disable the 'Export Reports' system permission on the cloned profile, and assign the updated profile to the contractor users.
  4. D
    Create a new Permission Set with the 'Export Reports' permission set to disabled, and assign it directly to the contractors alongside the original Permission Set Group.

Answer

Clone the 'Financial Advisory Team' Permission Set Group, add a Muting Permission Set to the new group that mutes the 'Export Reports' permission, and assign the new group to the contractors.
Cloning the existing Permission Set Group enables administrators to reuse all bundled permission sets while attaching a Muting Permission Set specific to the contractor group. This mutes the 'Export Reports' permission exclusively for contractors while allowing full-time staff to retain export capabilities through the unmuted group.

Step-by-Step Solution

1
Analyze access requirements for full-time advisors versus external contractors.
Full-time advisors require full access including 'Export Reports', whereas contractors require identical object access but must have 'Export Reports' disabled.
Permissions granted in Salesforce permission sets are additive by default, meaning an assigned permission set cannot selectively remove a permission granted elsewhere without using a Muting Permission Set in a Permission Set Group.
2
Evaluate the mechanism of Muting Permission Sets.
Muting Permission Sets function exclusively within Permission Set Groups to disable specific object, field, or system permissions for users assigned to that specific group.
Applying a Muting Permission Set to the existing group would impact full-time advisors. Therefore, creating a separate Permission Set Group by cloning allows isolated muting for contractors.
3
Configure the cloned group with the muting permission.
The cloned group contains all underlying permission sets, and the added Muting Permission Set turns off 'Export Reports' specifically for members of the cloned group.
This maintains centralized management of the baseline permission sets while enforcing restricted access for contractors without altering profiles or creating redundant permission sets.

Key Concept

Permission Set Groups and Muting Permission Sets
Estimated Time:2m 0s
Rate this question

Topics

Permission Sets and Permission Set Groups

More questions from this topic