Examkin

Question

Difficulty: Very hardUser Management and Provisioning

An administrator at a financial enterprise needs to urgently restrict access for a departing System Administrator. However, an audit reveals that the departing user is configured as the Default Workflow User, is designated as the running user for several critical Scheduled Apex jobs, and is referenced in active automated processes. The executive leadership requires immediate revocation of login capabilities while ensuring zero downtime or failure of existing automated enterprise background jobs. Which resolution path should the administrator execute to satisfy these requirements?

  1. Freeze the user account immediately to block system login while allowing scheduled background processes to run, reassign all background automation dependencies to a generic system user, and then deactivate the user account.Answer
  2. B
    Deactivate the user account immediately, because Salesforce automatically transfers active scheduled jobs and Default Workflow User assignments to the primary System Administrator.
  3. C
    Create a custom profile with all administrative permissions unchecked, assign this profile to the user, and unassign all permission sets to prevent login access.
  4. D
    Add a restrictive IP address range under Organization-Wide Network Access to immediately disable login access for the departing administrator without modifying account status.

Answer

The correct course of action is to freeze the user account immediately to block system login while allowing scheduled background processes to run, reassign all background automation dependencies to a generic system user, and then deactivate the user account.
Freezing a user account is specifically designed for scenarios where an administrator must instantly prevent a user from logging into Salesforce, but immediate account deactivation is blocked due to active background process dependencies (such as being the Default Workflow User or running user for Scheduled Apex). Freezing revokes authentication privileges immediately without disrupting running automated jobs. Once the process references are safely remapped to another user account, full user deactivation can be performed to free up the user license.

Step-by-Step Solution

1
Identify the immediate security constraint versus operational dependency.
Login access must be revoked instantly, but deactivating a user tied to background processes (Default Workflow User, Scheduled Apex) will cause errors or fail validation.
Deactivation prevents a user from being logged in, but Salesforce blocks deactivation if the user is a Default Workflow User or will cause scheduled background Apex to fail.
2
Apply user freezing as the immediate mitigation.
The user account status changes to Frozen, preventing any web, mobile, or API login attempts while leaving automated process execution unblocked.
Freezing stops user authentication without altering record ownership or removing the user from system processing contexts.
3
Reassign system administration dependencies and finalize offboarding.
Update the Default Workflow User setting under Process Automation Settings, re-queue or transfer Apex jobs to an active dedicated integration user, and deactivate the original user account.
Safely clears the user from active administrative roles, allowing permanent deactivation and license release.

Key Concept

User Freezing vs User Deactivation in Salesforce Administration
Rate this question

Topics

User Management and Provisioning

More questions from this topic