Examkin

Question

Difficulty: HardProfiles and Object/Field-Level Security

A Salesforce Administrator at Meridian Global Logistics is configuring administrative access controls across various custom objects and user groups. Match each security requirement to the most appropriate Salesforce security feature.

  • Restrict users assigned to a specific role from logging into Salesforce outside of official business hours (8:00 AM to 6:00 PM EST).Profile Login Hours settings
  • Completely hide the custom field Vendor_Tax_ID__c on Account records across all UI pages, reports, global search, and API integrations for non-Finance users.Field-Level Security (FLS) settings
  • Grant temporary edit access for the Contract_Status__c field to a single Operations Lead without modifying their assigned profile or affecting peers on the same profile.Permission Set assignment
  • Prevent an entire department from creating, reading, editing, or deleting any custom Audit_Log__c records regardless of record ownership.Profile Object Permissions (CRUD settings)

Answer

Matching pairings: 1) Restricting login times by role matches Profile Login Hours settings; 2) Hiding sensitive field data across UI, reports, and API matches Field-Level Security (FLS) settings; 3) Granting selective temporary field edit access to one user matches Permission Set assignment; 4) Preventing record creation/reading/editing/deletion for an entire object matches Profile Object Permissions (CRUD settings).
Each security mechanism is correctly paired according to its architectural purpose in Salesforce core administration: Profile Login Hours control login time restrictions; Field-Level Security enforces data access restriction at the field level globally across UI and API; Permission Sets allow flexible, additive permission assignment to individual users without profile alteration; and Profile Object Permissions control baseline CRUD capabilities for records of an object.

Step-by-Step Solution

1
Analyze access control requirements based on scope (user-specific vs profile-wide) and target (system access, object, field).
Identified four distinct security boundaries: authentication timing, field data visibility, individual user permission extension, and object baseline capabilities.
Salesforce security uses a layered security model where Profiles establish baseline object CRUD rights and login restrictions, FLS secures individual fields globally, and Permission Sets provide additive grants to individual users.
2
Map login time window restrictions to Profile Login Hours.
Profile Login Hours control when users assigned to that profile can authenticate.
Setting Login Hours on a profile denies login attempts made outside the designated timeframe.
3
Map comprehensive field privacy requirements across UI, reports, and API to Field-Level Security.
Field-Level Security (FLS) suppresses field access across all access channels.
Unlike page layouts, FLS enforces security at the data layer, ensuring fields cannot be queried or exposed in reports, list views, or APIs.
4
Map single-user permission additions without profile modifications to Permission Sets.
Permission Sets grant permissions to individual users without profile proliferation.
Permission Sets follow the principle of least privilege by extending access incrementally to specific users.
5
Map object-wide access restriction (preventing Create, Read, Edit, Delete) to Profile Object Permissions.
Profile Object Permissions control baseline CRUD settings for the target object.
Removing Read access on the profile prevents users from accessing any records of that object, overriding sharing rules.

Key Concept

Salesforce security architecture relies on Profiles for baseline system access (Login Hours) and Object CRUD permissions, Field-Level Security for universal field privacy, and Permission Sets for additive, individual user permissions.
Rate this question

Topics

Profiles and Object/Field-Level Security

More questions from this topic