Examkin

Question

Difficulty: Very hardProfiles and Object/Field-Level Security

An enterprise organization requires that a subset of users within the Support department gain access to a sensitive custom field, Salary_Grade__c, on the User object for auditing purposes. All Support representatives currently share the standard Support User profile, which restricts visibility to Salary_Grade__c via Field-Level Security (FLS). The administrator must grant access to this field exclusively to these designated auditors without impacting other Support representatives or creating unnecessary profile maintenance overhead. Which configuration approach should the administrator implement?

  1. Create a Permission Set with Read access enabled for the Salary_Grade__c field in Field-Level Security and assign it to the specific Support auditors.Answer
  2. B
    Clone the Support User profile to create an Auditor profile, enable Read access for Salary_Grade__c on the new profile, and reassign the audit users to this profile.
  3. C
    Add the Salary_Grade__c field to the Lightning Record Page using Dynamic Forms and set Component Visibility filters to show the field only to designated auditors.
  4. D
    Add the audit team's IP address range to the Login IP Ranges on the Support User profile to automatically bypass Field-Level Security restrictions for those users.

Answer

Create a Permission Set with Read access enabled for the Salary_Grade__c field in Field-Level Security and assign it to the specific Support auditors.
Assigning a permission set containing field-level security read access is the Salesforce standard best practice for granting additive permissions to a subset of users sharing a profile without increasing profile management overhead.

Step-by-Step Solution

1
Analyze base security and access requirements
All Support representatives share a single profile, but only a subset needs access to Salary_Grade__c.
Modifying the existing profile would incorrectly grant access to all Support representatives.
2
Evaluate additive access mechanics in Salesforce security model
Profiles define the baseline access, while Permission Sets grant additive access to targeted users.
Using Permission Sets avoids creating redundant profiles and maintains clean security governance.
3
Configure Field-Level Security via Permission Set
Field-Level Security settings inside the Permission Set control true data access across all interfaces (UI, API, reports).
UI controls like Dynamic Forms only hide UI components but do not provide true data security.

Key Concept

Profiles define baseline permissions; Permission Sets provide additive permissions such as Field-Level Security without profile duplication.
Rate this question

Topics

Profiles and Object/Field-Level Security

More questions from this topic