Examkin

Question

Difficulty: HardUser Management and Provisioning

A Salesforce Administrator needs to provision access for 15 new regional auditors. All 15 auditors require the base access provided by the standard 'Read Only' profile. However, 5 of these auditors also require permissions to create and edit records on a custom object named 'Compliance Audit', while the remaining 10 auditors must not have access to modify this object. How should the administrator provision these users to meet the security requirements while minimizing administrative maintenance?

  1. Assign all 15 auditors the standard Read Only profile, and create and assign a Permission Set granting Create and Edit access on the Compliance Audit object to the 5 auditors who require it.Answer
  2. B
    Create a new custom profile with Create and Edit access on the Compliance Audit object for the 5 auditors, and assign the standard Read Only profile to the remaining 10 auditors.
  3. C
    Assign all 15 auditors the standard Read Only profile and add the corporate IP address range to the Network Access settings to automatically grant edit permissions on the Compliance Audit object.
  4. D
    Deactivate the user accounts of the 10 auditors whenever the 5 specialized auditors are working on the Compliance Audit object to prevent concurrent access.

Answer

Assign all 15 auditors the standard Read Only profile, and create and assign a Permission Set granting Create and Edit access on the Compliance Audit object to the 5 auditors who require it.
Assigning all users a common baseline profile and using a Permission Set for the 5 users who need extra permissions adheres strictly to Salesforce security architecture guidelines. Profiles establish the base privileges, and Permission Sets grant incremental permissions without cluttering the org with multiple single-purpose profiles.

Step-by-Step Solution

1
Identify baseline user access requirements across all target users.
All 15 auditors require identical baseline read-only access.
Establishing a single common profile minimizes administrative complexity.
2
Evaluate the additive permission requirements for the subset of users.
5 auditors require additional Create and Edit access on the custom 'Compliance Audit' object.
Profiles should define baseline access, while Permission Sets extend access for specific sub-groups.
3
Select the appropriate Salesforce security component to grant the extra access.
Create a Permission Set with object-level Create and Edit permissions for 'Compliance Audit' and assign it to the 5 specific auditors.
This adheres to the principle of least privilege and Salesforce best practices for access management.

Key Concept

Profiles vs. Permission Sets for additive access management
Rate this question

Topics

User Management and Provisioning

More questions from this topic