Examkin

Question

Difficulty: HardProfiles and Object/Field-Level Security

An administrator at Cloud Kicks needs to grant a temporary auditor group access to a sensitive custom field, Tax_ID__c, on the Account object. The auditors currently share the 'Custom: Support User' profile with standard support agents who do not have access to this field. The requirements specify that only the auditors should have Read access to Tax_ID__c, and they must be strictly denied login access when attempting to log in from outside the corporate network IP address range. Standard support agents must retain their existing field visibility and maintain remote login access. Which administrative configuration best meets these requirements?

  1. Create a new custom profile for the auditor group with Login IP Ranges restricted to the corporate network, and assign the auditors a permission set that grants Read access to the Tax_ID__c field.Answer
  2. B
    Add the corporate network IP range under Organization-Wide Network Access, and modify the existing Custom: Support User profile to enable Read access for the Tax_ID__c field.
  3. C
    Create a single permission set that defines the corporate network Login IP Ranges and enables Read access for the Tax_ID__c field, then assign it to the auditor group.
  4. D
    Use Dynamic Forms on the Account Lightning record page to display Tax_ID__c only when the user belongs to the auditor group, and configure the corporate IP range in Network Access.

Answer

Create a new custom profile for the auditor group with Login IP Ranges restricted to the corporate network, and assign the auditors a permission set that grants Read access to the Tax_ID__c field.
Profile Login IP Ranges explicitly prevent users assigned to that profile from logging in outside the designated IP addresses. Because standard support users must maintain remote access, the auditor group requires a separate profile with the corporate Login IP Range configured. Field-Level Security for Tax_ID__c is then cleanly granted using a permission set assigned to the auditors.

Step-by-Step Solution

1
Evaluate the IP restriction requirement.
Identify that restricting login access exclusively to specific IP ranges (denying access outside the range) must be configured via Profile Login IP Ranges, as Organization-Wide Network Access only controls identity verification requirements.
Login IP Ranges are configured on Profiles, not Permission Sets or Network Access settings.
2
Evaluate user separation for IP restrictions.
Create a distinct profile for the auditor group so that standard support users retain their ability to log in remotely outside the corporate network.
Profile settings apply to all users assigned to that profile; shared profiles cannot enforce different IP rules for a sub-group.
3
Evaluate the Field-Level Security requirement.
Grant Read access to Tax_ID__c using a Permission Set assigned specifically to the auditors, preserving the principle of least privilege.
Permission Sets allow additive field permissions without modifying base profiles.

Key Concept

Profile Login IP Ranges vs. Permission Sets & Org-Wide Network Access
Estimated Time:2m 0s
Rate this question

Topics

Profiles and Object/Field-Level Security

More questions from this topic