Examkin

Question

Difficulty: Very hardOrganization-Wide Defaults (OWD)

An administrator at a financial services firm must configure record access for two objects: the standard Opportunity object and a custom object named Risk_Assessment__c. Management mandates that Opportunities must remain accessible to record owners and automatically roll up access to superiors in the role hierarchy. Conversely, Risk_Assessment__c records contain highly sensitive data that must be accessible solely by the record owner, explicitly preventing managers higher in the role hierarchy from inheriting record access automatically. Which setup for Organization-Wide Defaults (OWD) and hierarchy sharing settings correctly fulfills these security requirements?

  1. Set Opportunity OWD to Private (where Grant Access Using Hierarchies is enabled by default and cannot be changed), and set Risk_Assessment__c OWD to Private while deselecting Grant Access Using Hierarchies.Answer
  2. B
    Set both Opportunity and Risk_Assessment__c OWD to Private, and deselect the Grant Access Using Hierarchies checkbox on both object sharing settings.
  3. C
    Set Risk_Assessment__c OWD to Public Read-Only, and use Profile object settings to remove Read access for users occupying higher levels in the role hierarchy.
  4. D
    Set Risk_Assessment__c OWD to Private with Grant Access Using Hierarchies enabled, then assign a Permission Set Group to managers that revokes inherited sharing access.

Answer

Set Opportunity OWD to Private (where Grant Access Using Hierarchies is enabled by default and cannot be modified), and set Risk_Assessment__c OWD to Private while deselecting the Grant Access Using Hierarchies checkbox.
Organization-Wide Defaults establish the baseline record access. For standard objects like Opportunity, access automatically propagates up the role hierarchy because 'Grant Access Using Hierarchies' is mandatory and cannot be disabled. For custom objects like Risk_Assessment__c, 'Grant Access Using Hierarchies' can be unchecked when OWD is Private, which successfully restricts access exclusively to the record owner.

Step-by-Step Solution

1
Analyze standard object sharing hierarchy behavior
Standard objects (such as Opportunity) have 'Grant Access Using Hierarchies' permanently checked and locked by Salesforce. Setting OWD to Private allows owners and superiors in the hierarchy to access records.
Salesforce architecture enforces role hierarchy access for all standard objects.
2
Analyze custom object sharing hierarchy behavior
Custom objects (such as Risk_Assessment__c) allow administrators to deselect 'Grant Access Using Hierarchies'.
Deselecting this option prevents record access from propagating up the role hierarchy.
3
Determine the baseline OWD for strict owner-only access
Combine a Private OWD with unchecked 'Grant Access Using Hierarchies' on the custom object.
This guarantees that non-owners, including managers above the owner, receive no access via OWD or hierarchy.

Key Concept

Organization-Wide Defaults and Grant Access Using Hierarchies behavior across standard versus custom objects
Rate this question

Topics

Organization-Wide Defaults (OWD)

More questions from this topic