Examkin

Question

Difficulty: HardPermission Sets and Permission Set Groups

A healthcare technology company configures security access for two customer support tier teams: Tier 1 Representatives and Tier 2 Escalation Specialists. Both teams rely on a core master Permission Set named "Customer Support Base" which grants read, create, and edit access to Cases and full access to patient custom fields. However, compliance regulations dictate that Tier 1 Representatives must NOT be able to delete Case records or view the "Social Security Number" custom field, whereas Tier 2 Escalation Specialists require these elevated capabilities. The administrator wants to avoid creating redundant permission sets that require duplicate maintenance whenever common permissions change. Which administrative configuration should the administrator implement to meet these security requirements?

  1. A
    Clone the "Customer Support Base" Permission Set to build a secondary Permission Set named "Tier 1 Support Base" with Case deletion and field access disabled, assigning each Permission Set to its corresponding team.
  2. Build a Permission Set Group for Tier 1 Representatives that includes the "Customer Support Base" Permission Set and a Muting Permission Set that disables Case deletion and field-level access for "Social Security Number", while assigning "Customer Support Base" to Tier 2 Escalation Specialists.Answer
  3. C
    Create custom profiles for Tier 1 Representatives and Tier 2 Escalation Specialists, managing Object Permissions and Field-Level Security directly on each profile rather than utilizing permission sets.
  4. D
    Configure Dynamic Forms component visibility rules on the Case Lightning record page to hide the "Social Security Number" field and the Delete button from Tier 1 Representatives.

Answer

Create a Permission Set Group for Tier 1 Representatives containing the core "Customer Support Base" Permission Set along with a Muting Permission Set that disables Case deletion and access to the "Social Security Number" field, while assigning the unmuted core Permission Set to Tier 2 Escalation Specialists.
The correct approach uses a Permission Set Group combined with a Muting Permission Set. By adding the master "Customer Support Base" Permission Set into a Permission Set Group for Tier 1 Representatives and attaching a Muting Permission Set, the administrator can explicitly disable Case deletion and field access to "Social Security Number" for Tier 1 users. Meanwhile, Tier 2 Escalation Specialists can receive the unmuted base Permission Set. This maintains a single source of truth for baseline support permissions without creating redundant permission sets.

Step-by-Step Solution

1
Analyze the permission requirements for both user groups
Identified that both teams share baseline permissions, but Tier 1 Representatives require a subset of permissions (Case deletion and Sensitive Field view) to be turned off.
Reusing a single baseline permission set avoids duplicate maintenance when common permissions change in the future.
2
Evaluate Salesforce Permission Set Group features and Muting capabilities
Muting Permission Sets within a Permission Set Group can explicitly revoke specific Object, Field, or User permissions that are enabled by included Permission Sets.
Muting allows granular restriction within a bundled group while preserving the underlying master Permission Set intact.
3
Select the optimal configuration to maintain scalable security architecture
Bundle the base Permission Set into a Permission Set Group for Tier 1 Representatives with a Muting Permission Set applied, while assigning the base Permission Set (or an unmuted group) to Tier 2 Specialists.
This solution adheres to Salesforce security best practices by enabling component reuse and minimizing administrative overhead.

Key Concept

Muting Permission Sets in Permission Set Groups
Rate this question

Topics

Permission Sets and Permission Set Groups

More questions from this topic