Examkin

Question

Difficulty: Very hardOrganization-Wide Defaults (OWD)

Universal Containers has created a custom object named Project__c to track confidential client deliverables. Management requires that record owners can read and edit their own projects. Managers must automatically inherit full access to the project records owned by their direct and indirect subordinates based on the existing role hierarchy. Additionally, a specialized compliance team needs Read-Only access to all project records across the entire organization, regardless of ownership. Profiles and object-level permissions already grant Read, Create, and Edit access on Project__c to all relevant users. Which combination of Organization-Wide Defaults (OWD) and sharing mechanisms should an administrator configure to fulfill these security requirements while enforcing the most restrictive baseline access?

  1. Set the Organization-Wide Default for Project__c to Private, ensure 'Grant Access Using Hierarchies' remains selected, and create a Criteria-Based Sharing Rule to share all Project__c records with the compliance team.Answer
  2. B
    Set the Organization-Wide Default for Project__c to Public Read-Only, and modify the user Profile for standard users to revoke Read object permissions for records they do not own.
  3. C
    Set the Organization-Wide Default for Project__c to Private, deselect 'Grant Access Using Hierarchies' because custom objects do not support role hierarchy access, and create manual sharing rules for managers.
  4. D
    Set the Organization-Wide Default for Project__c to Private, deselect 'Grant Access Using Hierarchies', and assign a new Profile to manager roles that enables the 'View All' object permission on Project__c.

Answer

Set the Organization-Wide Default for Project__c to Private, ensure 'Grant Access Using Hierarchies' remains selected, and create a Criteria-Based Sharing Rule to share all Project__c records with the compliance team.
The correct configuration establishes Private baseline OWD for Project__c so that records are restricted to record owners by default. Keeping 'Grant Access Using Hierarchies' enabled allows managers in the role hierarchy above the owner to automatically inherit access to subordinate records. Finally, creating a Criteria-Based Sharing Rule selectively opens Read-Only access to the compliance team without opening access to all users across the organization.

Step-by-Step Solution

1
Determine the most restrictive baseline Organization-Wide Default (OWD).
Since non-owners (other than managers and compliance) should not see projects by default, the baseline OWD must be set to Private.
OWD defines the baseline level of access for the most restricted user.
2
Evaluate role hierarchy access behavior for custom objects.
Ensure 'Grant Access Using Hierarchies' remains enabled on the Project__c custom object.
For custom objects, Grant Access Using Hierarchies is checked by default and allows users above record owners in the role hierarchy to automatically inherit access.
3
Select the appropriate mechanism to grant additional access to the compliance team.
Create a Sharing Rule (Criteria-Based or Public Group sharing) granting Read-Only access to the compliance team.
Sharing rules selectively extend access beyond OWD baselines to specific groups of users without opening org-wide access.

Key Concept

Organization-Wide Defaults (OWD) and Role Hierarchy Sharing for Custom Objects
Estimated Time:2m 0s
Rate this question

Topics

Organization-Wide Defaults (OWD)

More questions from this topic