Apex Financial Services requires a security restriction for a sensitive custom field, Bank_Account_Number__c, on the Account object. Currently, all 25 advisors in the Wealth Management division are assigned the custom "Wealth Advisor" profile, which grants Read and Edit access to this field. Following an audit update, only 3 senior advisors require access to view and edit Bank_Account_Number__c, while the remaining 22 advisors must not have access to the field via the user interface or API. Which two steps should the Salesforce Administrator perform to meet this requirement? (Choose 2 answers)
- Remove Read and Edit access for Bank_Account_Number__c in Field-Level Security on the Wealth Advisor profile.Answer
- Create a Permission Set that grants Read and Edit access to Bank_Account_Number__c and assign it to the 3 senior advisors.Answer
- CClone the Wealth Advisor profile to create a Senior Wealth Advisor profile with field access enabled, and assign the new profile to the 3 senior advisors.
- DUse Dynamic Forms component visibility rules on the Account record page to hide Bank_Account_Number__c from non-senior advisors.
Answer
The administrator should remove Read and Edit access for the field on the base Wealth Advisor profile, and then create and assign a Permission Set granting Read and Edit access to the 3 senior advisors.
Field-Level Security (FLS) on the user profile establishes the baseline permission. By clearing Read and Edit access on the profile, access is revoked for all 25 users. Then, creating a Permission Set with Read and Edit access and assigning it to the 3 senior advisors follows Salesforce best practices by using additive permission sets for user-specific exceptions.
Step-by-Step Solution
Key Concept
Profiles establish baseline access, while Permission Sets selectively grant additional access.