Examkin

Question

Difficulty: HardProfiles and Object/Field-Level Security

Helios Energy Solutions maintains a sensitive custom field, Audit_Status__c, on the Account object. Currently, twelve employees share the standard Sales User profile, but only two of these users serve as compliance auditors who require Read and Edit access to Audit_Status__c. The remaining ten sales representatives must be restricted from accessing this field across all interfaces, including reports, list views, and API integrations. Which administrative action represents the optimal configuration to meet these requirements following Salesforce security best practices?

  1. Restrict Field-Level Security (FLS) on Audit_Status__c for the Sales User profile, create a Permission Set granting Read and Edit access to the field, and assign it to the two compliance auditors.Answer
  2. B
    Clone the Sales User profile to create a new profile named Compliance Sales User, grant Read and Edit access to Audit_Status__c on the cloned profile, and reassign the two compliance auditors.
  3. C
    Keep Field-Level Security visible for the Sales User profile, but configure Dynamic Forms component visibility rules on the Account record page to hide Audit_Status__c from non-auditors.
  4. D
    Add the IP addresses of the compliance auditors to Organization-Wide Network Access login IP ranges so that field access to Audit_Status__c is unlocked automatically upon login.

Answer

Restrict Field-Level Security on the custom field for the base profile, then create and assign a Permission Set to grant Read and Edit access specifically to the compliance auditors.
The optimal solution is to restrict Field-Level Security (FLS) on the custom field at the profile level so that sales reps cannot access the field via any channel. Then, a Permission Set granting Read and Edit permissions on the field should be assigned to the two compliance auditors. This follows Salesforce best practices by keeping profiles clean and using permission sets for additive access.

Step-by-Step Solution

1
Evaluate the baseline security configuration requirement for the general user population.
Since ten out of twelve users on the Sales User profile must not see or edit Audit_Status__c anywhere in Salesforce, the field must be hidden at the Profile level using Field-Level Security (FLS).
Field-Level Security enforced at the profile level restricts visibility across all entry points, including reports, list views, search results, and API queries.
2
Determine the optimal mechanism to grant elevated access to the sub-group of two compliance auditors.
Create a Permission Set with Read and Edit access enabled for Audit_Status__c and assign it directly to the two compliance auditors.
Salesforce security architecture relies on Profiles for base restrictive/default access and Permission Sets for granting additive permissions to specific users.

Key Concept

Profiles establish restrictive baseline security while Permission Sets grant additive field and object access.
Rate this question

Topics

Profiles and Object/Field-Level Security

More questions from this topic