Examkin

Question

Difficulty: HardOrganization-Wide Defaults (OWD)

A global firm tracks strategic mergers and acquisitions using a custom object named Joint_Venture__c. Executive leadership mandates that baseline access must be restricted so that users can only view and edit Joint_Venture__c records they personally own. Additionally, because executive team roles overlap in the role hierarchy, record access must NOT automatically propagate to managers higher up in the role hierarchy. Which TWO configurations must the System Administrator implement on the Joint_Venture__c object to satisfy these business security requirements?

  1. Set the Default Internal Access for Joint_Venture__c to Private.Answer
  2. Deselect the Grant Access Using Hierarchies checkbox on the Joint_Venture__c sharing settings.Answer
  3. C
    Remove View All and Modify All permissions from standard user Profiles for the Joint_Venture__c object.
  4. D
    Set the Default Internal Access to Public Read-Only and create a Restriction Rule to revoke view access from superior roles.

Answer

The System Administrator must set the Organization-Wide Default (OWD) internal access for Joint_Venture__c to Private and deselect the Grant Access Using Hierarchies checkbox in Sharing Settings.
To satisfy the requirement that users can only access Joint_Venture__c records they own, the baseline Organization-Wide Default (OWD) must be set to Private. Furthermore, because Salesforce automatically grants record access to users above the owner in the role hierarchy by default, the administrator must deselect Grant Access Using Hierarchies on the custom object's sharing settings to prevent management access.

Step-by-Step Solution

1
Determine the required Organization-Wide Default (OWD) setting for baseline record access.
Setting Default Internal Access to Private ensures that non-owner users have no access to Joint_Venture__c records by default.
Salesforce security architecture relies on OWD to set the most restrictive baseline level of record access for an organization.
2
Evaluate role hierarchy propagation for the custom object.
Unchecking Grant Access Using Hierarchies disables automatic access rollout to managers above record owners in the role hierarchy.
By default, custom objects inherit hierarchy access. Disabling this checkbox specifically prevents superior roles from inheriting owner access on custom objects.
3
Verify that object-level security settings (Profiles/Permission Sets) are not being misapplied for record-level restrictions.
Confirm that record access control is handled via OWD rather than Profile settings.
Profiles grant permissions (Create, Read, Edit, Delete) but cannot restrict individual record visibility governed by OWD.

Key Concept

Organization-Wide Defaults (OWD) set the baseline record-level access in Salesforce. For custom objects, baseline access can be set to Private, and automatic role hierarchy access rollout can be disabled by unchecking Grant Access Using Hierarchies.
Rate this question

Topics

Organization-Wide Defaults (OWD)

More questions from this topic