Examkin

Question

Difficulty: MediumRole Hierarchy and Sharing Rules

Meridian Global Logistics utilizes a custom object named Supplier_Contract__c with an Organization-Wide Default (OWD) set to Private. To prevent executive roles from automatically gaining access to sensitive operational records, the System Administrator deselects the 'Grant Access Using Hierarchies' option on Supplier_Contract__c. However, Regional Directors still require Read/Write access to Supplier_Contract__c records owned by Procurement Specialists who occupy roles below them. Which configuration should the administrator implement to meet this requirement?

  1. A
    Create a permission set with 'View All' and 'Modify All' object permissions for Supplier_Contract__c and assign it to the Regional Directors.
  2. Create an owner-based sharing rule that shares Supplier_Contract__c records owned by the Procurement Specialist role with the Regional Director role.Answer
  3. C
    Re-enable 'Grant Access Using Hierarchies' on Supplier_Contract__c because sharing rules cannot grant access when hierarchy sharing is turned off.
  4. D
    Update the Regional Director profile to grant Read and Edit object permissions on the Supplier_Contract__c object.

Answer

Create an owner-based sharing rule that shares Supplier_Contract__c records owned by the Procurement Specialist role with the Regional Director role.
Creating an owner-based sharing rule specifically grants Read/Write access for records owned by the Procurement Specialist role to users in the Regional Director role. This satisfies the business requirement without re-enabling automatic hierarchy access or over-granting organization-wide record permissions through permission sets.

Step-by-Step Solution

1
Evaluate the current Organization-Wide Default (OWD) and hierarchy access settings.
The OWD is set to Private and 'Grant Access Using Hierarchies' is disabled on the custom object Supplier_Contract__c, meaning role hierarchy access propagation is turned off.
Disabling hierarchy access prevents roles higher up in the hierarchy from automatically inheriting record access from subordinate roles.
2
Identify the proper security mechanism to selectively open up record access.
An owner-based sharing rule can target records owned by users in the Procurement Specialist role and grant Read/Write access to the Regional Director role.
Sharing rules operate independently of the 'Grant Access Using Hierarchies' setting on custom objects, allowing targeted access without exposing records to top-level executives.

Key Concept

Disabling 'Grant Access Using Hierarchies' on custom objects stops automatic access rollout up the role hierarchy, but sharing rules can still explicitly share records between specific roles or groups.
Estimated Time:1m 30s
Rate this question

Topics

Role Hierarchy and Sharing Rules

More questions from this topic