Examkin

Question

Difficulty: HardPermission Sets and Permission Set Groups

An organization uses a custom Billing application where access is managed using a Permission Set Group named 'Billing Operations Group'. This group includes three permission sets: Invoicing Access, Payment Processing, and Credit Adjustments. A compliance audit requires that a subgroup of internal auditors assigned to this group must retain all viewing and editing capabilities provided by the group, but must be explicitly restricted from deleting Credit Adjustment records. All other billing users must continue to have delete access. How should the system administrator meet this requirement while maintaining a scalable access architecture?

  1. A
    Clone the standard billing profile, disable the Delete permission on the Credit Adjustment object, and reassign the internal auditors to the new custom profile.
  2. Create a new Permission Set Group for the internal auditors containing the three permission sets, and add a Muting Permission Set to the group that disables Delete access on the Credit Adjustment object.Answer
  3. C
    Modify the existing Credit Adjustments permission set to remove Delete access, and create a new standalone permission set granting Delete access to non-auditor billing users.
  4. D
    Set the Organization-Wide Defaults for the Credit Adjustment object to Private and use sharing rules to restrict delete privileges for internal auditors.

Answer

Create a new Permission Set Group specifically for internal auditors that bundles the original permission sets along with a Muting Permission Set that revokes Delete permission on the Credit Adjustment object.
Permission Set Groups consolidate permissions into single assignments. When a subset of users assigned to a group requires a restriction (such as revoking Delete access), the recommended solution is to include a Muting Permission Set within a dedicated Permission Set Group. This mutes specified permissions without affecting the underlying reusable Permission Sets.

Step-by-Step Solution

1
Analyze access requirements
Internal auditors require the exact permissions of the existing Permission Set Group minus the Delete capability on a specific custom object.
Additive permission modeling using Permission Set Groups allows re-using underlying permission sets while muting unwanted permissions.
2
Evaluate Muting Permission Set capabilities
A Muting Permission Set can be added to a Permission Set Group to mute specific Object, Field, or User permissions.
This avoids modifying the source permission sets that are shared across other groups or users.
3
Select the optimal architecture
Constructing an Auditor Permission Set Group with the three base permission sets plus a Muting Permission Set fulfills the audit restriction while maintaining a streamlined admin model.
This approach preserves reusable components without resorting to profile redundancy or record sharing mechanisms.

Key Concept

Permission Set Groups and Muting Permission Sets
Rate this question

Topics

Permission Sets and Permission Set Groups

More questions from this topic