Examkin

Question

Difficulty: HardProfiles and Object/Field-Level Security

Apex Health tracks clinical research studies using a custom object named Trial_Participant__c. All Clinical Research Associates (CRAs) are assigned the standard 'CRA User' profile. Due to updated privacy guidelines, access to the sensitive custom field Patient_Identity_Hash__c on Trial_Participant__c must be hidden from most CRAs. However, two lead compliance auditors who share the 'CRA User' profile require Read and Edit access to this field. Additionally, security policy mandates that these two compliance auditors must be strictly prohibited from logging into Salesforce if they are outside the corporate network IP address range.

Which two configuration steps should the Salesforce Administrator perform to meet these requirements? (Choose 2 answers)

  1. Deselect Read and Edit access for Patient_Identity_Hash__c in Field-Level Security on the CRA User profile, and assign a Permission Set granting Read and Edit access on the field to the two compliance auditors.Answer
  2. Create a dedicated profile for the two compliance auditors and specify the corporate network IP range under Login IP Ranges on that profile to deny login access outside the network.Answer
  3. C
    Configure component visibility rules on the Trial_Participant__c Lightning Record Page using Dynamic Forms to hide Patient_Identity_Hash__c from general CRA users.
  4. D
    Add the corporate network IP address range to Network Access under Setup Security Controls to prevent compliance auditors from logging in outside the corporate network.

Answer

The administrator should set Field-Level Security on the CRA User profile to hide the field and grant access to the compliance auditors via a Permission Set, while configuring Login IP Ranges on a profile assigned to the auditors to restrict login access outside the corporate network.
To grant additive access to a subset of users, Field-Level Security should be hidden at the profile baseline and granted additively using a Permission Set. To restrict login locations, Login IP Ranges must be specified on a Profile assigned to those users, as profile IP ranges enforce hard login restrictions.

Step-by-Step Solution

1
Evaluate field accessibility requirements for the broader user group versus the specific subset of users.
Identify that the base CRA User profile should have Field-Level Security for Patient_Identity_Hash__c set to restricted (hidden), adhering to the principle of least privilege.
Profiles establish baseline permissions for groups of users, while permission sets grant additive permissions to specific individuals without creating extra profiles.
2
Determine how to grant field access to the two compliance auditors.
Create a Permission Set with Read and Edit access on Patient_Identity_Hash__c and assign it to the two compliance auditors.
Permission sets are the recommended mechanism in Salesforce for granting selective additive field and object access.
3
Analyze login restriction requirements for the compliance auditors.
Configure Login IP Ranges on a dedicated profile assigned to the auditors to block logins outside corporate network IP boundaries.
Profile-level Login IP Ranges strictly enforce IP restriction by preventing authentication outside the specified ranges, whereas org-level Network Access settings only control multi-factor/identity verification challenges.

Key Concept

Combining Profile Field-Level Security with Permission Sets for additive field access, and using Profile Login IP Ranges for strict login restrictions.
Rate this question

Topics

Profiles and Object/Field-Level Security

More questions from this topic