Apex Freight Services needs to restrict access to a sensitive custom field, Contract_Value__c, on the Account object. Most users assigned to the standard Sales User profile should be prevented from viewing or editing this field. However, three regional Finance Managers who are also assigned the Sales User profile require both Read and Edit access. Which two steps should the administrator take to meet these security requirements while adhering to Salesforce best practices?
- Set the Field-Level Security for Contract_Value__c on the Sales User profile to clear both Read Access and Edit Access.Answer
- Create a Permission Set that grants Read Access and Edit Access for Contract_Value__c, and assign it to the three regional Finance Managers.Answer
- CRemove Contract_Value__c from the Account Page Layout and use Dynamic Forms component visibility rules to display it to the three regional Finance Managers.
- DClone the Sales User profile, enable Read Access and Edit Access for Contract_Value__c on the cloned profile, and reassign the three regional Finance Managers to the new profile.
Answer
The administrator should restrict Field-Level Security (FLS) on the Sales User profile by removing Read and Edit access for Contract_Value__c, and create a Permission Set granting Read and Edit FLS for Contract_Value__c to assign to the three regional Finance Managers.
Field-Level Security (FLS) controls field access at the platform data layer, ensuring fields are hidden in reports, API integrations, list views, and page layouts. Clearing Read and Edit access on the Sales User profile secures the field by default for all standard sales users. Creating a Permission Set with Read and Edit access and assigning it to the three Finance Managers follows the fundamental Salesforce principle of using profiles for baseline restrictions and permission sets for additive access.
Step-by-Step Solution
Key Concept
Field-Level Security (FLS) and Additive Access via Permission Sets