Apex Financial Services uses a custom object named Audit_Report__c with an Organization-Wide Default (OWD) set to Private. The Security Administrator must implement access controls to satisfy two operational requirements:
1. Managers must automatically inherit Read and Edit access to all Audit Report records owned by their subordinates in the role hierarchy.
2. Members of the Compliance Department must receive Read/Write access to any Audit Report record where the Risk_Rating__c field is set to 'High Risk', regardless of who owns the record.
Which TWO configuration steps should the System Administrator take to fulfill these requirements?
- Ensure that the 'Grant Access Using Hierarchies' checkbox remains selected on the Audit_Report__c custom object definition.Answer
- Create a criteria-based sharing rule on Audit_Report__c to share records matching Risk_Rating__c = 'High Risk' with the Compliance Department public group with Read/Write access.Answer
- CDeselect 'Grant Access Using Hierarchies' on Audit_Report__c and create individual owner-based sharing rules targeting each executive manager's role.
- DCreate a permission set granting 'View All' and 'Modify All' object permissions on Audit_Report__c and assign it to Compliance Department users.
Answer
The System Administrator should ensure 'Grant Access Using Hierarchies' remains selected on the custom object and create a criteria-based sharing rule sharing records where Risk Rating equals 'High Risk' with the Compliance Department public group.
Keeping 'Grant Access Using Hierarchies' enabled allows managers higher in the role hierarchy to automatically inherit access to records owned by their subordinates. Creating a criteria-based sharing rule allows access to be conditionally extended to the Compliance Department based on specific field values like Risk Rating.
Step-by-Step Solution
Key Concept
Role Hierarchy Inheritance and Criteria-Based Sharing Rules