Examkin

Question

Difficulty: HardRole Hierarchy and Sharing Rules

Cloud Matrix Systems tracks enterprise compliance using a custom object named Regional_Audit__c. The Organization-Wide Default (OWD) for Regional_Audit__c is set to Private. An administrator manually deselected the 'Grant Access Using Hierarchies' option on the Regional_Audit__c object definition. Later, an owner-based sharing rule is configured to share Regional_Audit__c records owned by Field Auditors with the Regional Compliance Manager role. The Compliance Director, who is positioned directly above the Regional Compliance Manager in the role hierarchy, reports being unable to view these shared records. Which configuration change should the administrator make to allow the Compliance Director to view the records while adhering to the principle of least privilege?

  1. Select the 'Grant Access Using Hierarchies' checkbox on the Regional_Audit__c custom object definition.Answer
  2. B
    Change the Organization-Wide Default (OWD) sharing setting for Regional_Audit__c to Public Read/Only.
  3. C
    Assign a permission set with the 'View All' object permission on Regional_Audit__c to the Compliance Director.
  4. D
    Create a criteria-based sharing rule to share all Regional_Audit__c records directly with the Compliance Director role.

Answer

Select the 'Grant Access Using Hierarchies' checkbox on the Regional_Audit__c custom object definition.
Selecting the 'Grant Access Using Hierarchies' checkbox on the custom object definition allows record access—whether derived from record ownership or sharing rules—to propagate up the role hierarchy to superior roles. This directly grants the Compliance Director access to records shared with the Regional Compliance Manager while preserving Private OWD for the rest of the organization.

Step-by-Step Solution

1
Analyze the Organization-Wide Default and object configuration
Regional_Audit__c has Private OWD and 'Grant Access Using Hierarchies' is deselected.
For standard objects, hierarchy access is mandatory, but for custom objects, it can be disabled. Disabling it prevents users higher in the role hierarchy from inheriting access granted to lower roles.
2
Evaluate the sharing mechanism and role positioning
Records are shared with Regional Compliance Managers via a sharing rule, but the Compliance Director (higher in the hierarchy) cannot view them.
Because hierarchy access is disabled on the object, access granted to the Regional Compliance Manager role does not roll up to the Compliance Director.
3
Identify the minimal configuration change required
Re-enabling 'Grant Access Using Hierarchies' on the custom object restores automatic access roll-up up the hierarchy.
This grants the Compliance Director access to records owned by or shared with subordinate roles without altering org-wide access levels or assigning administrative permissions.

Key Concept

Custom Object Role Hierarchy Access Roll-up
Estimated Time:2m 0s
Rate this question

Topics

Role Hierarchy and Sharing Rules

More questions from this topic