Examkin

Question

Difficulty: HardProfiles and Object/Field-Level Security

An administrator at a global logistics company must grant Read access to a custom currency field, Contract_Margin__c, on the Contract object to a specific group of three financial auditors. Currently, Field-Level Security (FLS) restricts access to this field across all profiles. The auditors share the standard Financial Analyst profile with fifteen other users who must not be able to view or export this sensitive margin data. Which configuration should the administrator implement to grant the necessary field access while adhering to security best practices?

  1. Create a Permission Set that grants Read access to Contract_Margin__c, and assign the Permission Set to the three financial auditors.Answer
  2. B
    Clone the Financial Analyst profile, enable Read access for Contract_Margin__c on the new profile, and reassign the three financial auditors to this cloned profile.
  3. C
    Enable Read access for Contract_Margin__c on the Financial Analyst profile, and use Dynamic Forms component visibility rules to hide the field from the other fifteen users.
  4. D
    Add the IP addresses of the three auditors to the Profile Login IP Ranges, and grant Read access to Contract_Margin__c on the Financial Analyst profile.

Answer

Create a Permission Set that grants Read access to Contract_Margin__c, and assign the Permission Set to the three financial auditors.
The correct approach is to keep the standard profile settings restricted and create a Permission Set granting Read access to Contract_Margin__c for the three auditors. Permission Sets are the recommended solution in Salesforce for granting additive permissions to specific users without introducing unnecessary profile overhead.

Step-by-Step Solution

1
Analyze the baseline access requirements
Identified that the Financial Analyst profile currently hides Contract_Margin__c from all eighteen members, but three specific members require Read access.
Profiles set baseline permissions for groups of users, but selective additive access must be handled cleanly without impacting the entire group.
2
Evaluate access expansion mechanism options
Selected Permission Sets as the optimal architecture for additive field-level security (FLS).
Permission Sets grant additional access to individual users without altering profile baselines or introducing security risks via UI-only restrictions.
3
Verify security boundary enforcement
Assigning the Permission Set to only the three auditors ensures FLS is strictly enforced at the data layer across UI, Reports, and API.
FLS configured via Permission Sets restricts both UI access and API/reporting access for non-assigned users.

Key Concept

Field-Level Security (FLS) and Permission Sets vs. Profiles
Rate this question

Topics

Profiles and Object/Field-Level Security

More questions from this topic