Examkin

Question

Difficulty: HardUser Management and Provisioning

An administrator at an enterprise firm needs to provision access for a newly hired Internal Auditor. The auditor requires baseline Read access to Accounts and Contacts, identical to 40 executive users currently assigned to the standard 'Executive User' profile. In addition, the auditor requires Read access to a custom 'Audit Logs' object. The security team also specifies that the auditor must be strictly restricted from logging into Salesforce outside the corporate office IP address range, whereas executive users assigned to the existing baseline profile must retain the ability to log in from any location. Which administrative solution fulfills these provisioning and security requirements while adhering to Salesforce best practices?

  1. Clone the 'Executive User' profile to create an 'Internal Auditor' profile, specify the corporate IP range under Login IP Ranges on the new profile, and assign a Permission Set to the auditor that grants Read access to the Audit Logs object.Answer
  2. B
    Configure the corporate IP range under Login IP Ranges directly on the shared 'Executive User' profile, and assign a Permission Set to the auditor that grants Read access to the Audit Logs object.
  3. C
    Add the corporate IP range to Network Access under Security Controls, and modify the shared 'Executive User' profile to grant Read access to the Audit Logs object.
  4. D
    Freeze the auditor's account when they leave the corporate office, and create a custom profile with direct Read access to the Audit Logs object and Network Access restrictions.

Answer

Clone the baseline profile to create a dedicated profile where profile-level Login IP Ranges can be applied specifically to the auditor, and grant access to the custom object via a Permission Set.
The correct solution creates a distinct profile for the auditor so that Profile Login IP Ranges can strictly restrict logins to the corporate office IP range without affecting other users. It then uses a Permission Set to additively grant Read access to the Audit Logs object, adhering to Salesforce security best practices.

Step-by-Step Solution

1
Analyze security boundaries for profile vs permission set assignment.
Login IP Ranges are defined at the Profile level, not via Permission Sets. Because executive users must retain unrestricted location access while the auditor must be restricted, the auditor requires a separate profile.
Profile settings apply to all users assigned to that profile; modifying a shared profile's Login IP Ranges affects all existing users.
2
Determine object permission provisioning method.
Keep the cloned profile minimal and grant custom object ('Audit Logs') Read permissions using a Permission Set.
Salesforce security best practices mandate using Permission Sets for additive object and field permissions.
3
Evaluate network security mechanisms.
Use Profile Login IP Ranges to deny logins outside the corporate IP subnet.
Organization-wide Network Access entries only whitelist IP addresses to prevent activation challenges, whereas Profile Login IP Ranges strictly restrict access outside the specified ranges.

Key Concept

Profile IP Restrictions and Additive Permission Provisioning
Estimated Time:2m 0s
Rate this question

Topics

User Management and Provisioning

More questions from this topic