Question

Difficulty: Very hardSession Settings and Password Policies

A Salesforce administrator needs to implement customized security settings for a company to satisfy compliance requirements. The security policy mandates that:
1. Call Center agents must experience a strict 15-minute session timeout, while standard employees retain the organization default of 2 hours.
2. System Administrators must be locked out after 3 invalid login attempts, while standard users must be allowed 5 invalid login attempts before lockout.

Which TWO administrative actions must the administrator take to fulfill these compliance requirements?

  1. Configure a 15-minute session timeout directly on the Call Center User profile to override the organization-wide session setting.Answer
  2. Define profile-specific Password Policies on the System Administrator profile and Standard User profile to enforce distinct invalid login attempt limits.Answer
  3. C
    Create and assign a Permission Set to Call Center agents that grants a custom 15-minute session timeout setting.
  4. D
    Add Call Center IP ranges to the Organization-Wide Network Access settings to automatically enforce session termination after 15 minutes of inactivity.

Answer

The administrator must set the 15-minute session timeout on the Call Center User profile and configure profile-specific Password Policies for maximum invalid login attempts on both the System Administrator and Standard User profiles.
Both Session Settings (such as Session Timeout) and Password Policies (such as Maximum Invalid Login Attempts) are configured globally by default, but can be explicitly overridden at the Profile level to meet granular security requirements for different user roles.

Step-by-Step Solution

1
Analyze requirement 1 regarding role-specific session timeout settings.
Determine that session timeout limits are managed globally under Session Settings but can be customized per user group via Profile settings.
Profiles allow overriding default org session settings, whereas Permission Sets do not support session timeout configurations.
2
Analyze requirement 2 regarding profile-differentiated password lockout thresholds.
Identify that password policies (including lockout attempts) can be overridden on individual profiles.
Profile-level Password Policies take precedence over Org-Wide Password Policies, allowing different lockout limits for Admins vs Standard Users.
3
Evaluate distractor options against Salesforce architecture boundaries.
Reject permission sets and network access IP settings as valid solutions for session timeout enforcement.
Network Access IP ranges only manage login challenge bypass, and Permission Sets cannot manage session settings or password policy overrides.

Key Concept

Profile-level overrides for Session Settings and Password Policies
Rate this question