Cloud Kicks added a custom field named Bonus_Amount__c to the Sales Representative custom object. The system administrator needs to restrict access so that only three Regional Sales Managers can view and edit Bonus_Amount__c, while all other sales team members assigned to the standard 'Sales Representative' profile cannot view or edit the field. To minimize administrative overhead and avoid profile proliferation, which configuration should the administrator implement?
- Set Field-Level Security (FLS) on Bonus_Amount__c to restrict Read and Edit access on the Sales Representative profile, create a permission set granting Read and Edit access to the field, and assign the permission set to the three Regional Sales Managers.Answer
- BClone the Sales Representative profile to create a Regional Sales Manager profile, grant Read and Edit access to Bonus_Amount__c on the new profile, and reassign the three managers to this new profile.
- CRemove Bonus_Amount__c from the Sales Representative page layout and configure Dynamic Forms component visibility rules on the record page to show the field only to the Regional Sales Managers.
- DAdd the Regional Sales Managers' office IP range to Network Access under Security Controls to automatically unlock Field-Level Security for users logging in within that network range.
Answer
Set Field-Level Security on the custom field to restrict access on the base profile, create a permission set granting Read and Edit access to the field, and assign that permission set to the specific users requiring access.
Salesforce security best practice dictates establishing the most restrictive baseline access using Profiles and Field-Level Security (FLS), then using Permission Sets to grant additive field access to specific users who require it. This satisfies the requirement while preventing profile proliferation.
Step-by-Step Solution
Key Concept
Profiles establish baseline access (most restrictive FLS), and Permission Sets grant additive access to specific users.