Examkin

Question

Difficulty: EasyProfiles and Object/Field-Level Security

An administrator needs to restrict access to a sensitive custom field, Credit_Limit__c, on the Account object so that standard users cannot view or edit it across reports, list views, or the API. Additionally, one specific compliance auditor who holds a standard user profile requires Read-only access to this field.

Which TWO actions should the administrator take to meet these security requirements? (Choose 2 answers)

  1. Modify Field-Level Security (FLS) to remove Read and Edit access on Credit_Limit__c for the standard user profile.Answer
  2. Create a Permission Set that grants Read access to Credit_Limit__c and assign it to the compliance auditor.Answer
  3. C
    Use Dynamic Forms component visibility rules to hide Credit_Limit__c from the Lightning record page for unauthorized users.
  4. D
    Create a new custom profile with Read access to Credit_Limit__c and assign it to the compliance auditor.

Answer

The administrator should modify Field-Level Security on the standard profile to restrict access broadly, and assign a Permission Set granting Read access specifically to the compliance auditor.
The correct solution uses Field-Level Security (FLS) to remove access to the sensitive field on the baseline profile and leverages a Permission Set to grant Read access strictly to the single user needing exception access. FLS guarantees complete security across UI, reports, and API, while Permission Sets allow granular access expansion without multiplying custom profiles.

Step-by-Step Solution

1
Remove field access on the baseline profile using Field-Level Security (FLS).
All users assigned to the standard profile lose Read and Edit access to Credit_Limit__c across all interfaces and API.
FLS enforces field security globally across reports, APIs, list views, and page layouts.
2
Create a new Permission Set and check Read permission for Credit_Limit__c under Object Settings.
A reusable permission container with additive field access is created.
Permission Sets extend user access without altering baseline profile assignments.
3
Assign the created Permission Set directly to the compliance auditor user.
The compliance auditor gains Read access to Credit_Limit__c while maintaining their standard user profile.
Using Permission Sets for individual exceptions follows Salesforce security best practices.

Key Concept

Profiles establish baseline restrictive access (including FLS), while Permission Sets provide additive permissions for specific users.
Rate this question

Topics

Profiles and Object/Field-Level Security

More questions from this topic