Examkin

Soru

Zorluk: Çok zorRole Hierarchy and Sharing Rules

Northern Trail Outfitters tracks executive reviews using a custom object named Partner_Evaluation__c. To prevent automatic upward data visibility across the organization, an administrator deselected the 'Grant Access Using Hierarchies' checkbox on the Partner_Evaluation__c object definition, while keeping its Organization-Wide Default (OWD) set to Private. Following a corporate restructuring, users assigned to the 'VP of Operations' role require Read and Edit access to all Partner_Evaluation__c records owned by regional managers in the 'Regional Operations Director' role. However, users in the VP of Operations role must not be granted access to evaluations owned by managers in other divisions. Which configuration fulfills this access requirement while adhering to the principle of least privilege?

  1. Create an owner-based sharing rule on Partner_Evaluation__c that shares records owned by members of the 'Regional Operations Director' role with the 'VP of Operations' role, specifying Read/Write access.Cevap
  2. B
    Re-enable 'Grant Access Using Hierarchies' on the Partner_Evaluation__c object and position the 'VP of Operations' role directly above the 'Regional Operations Director' role in the role hierarchy.
  3. C
    Create a Permission Set with 'Modify All' object-level permissions for Partner_Evaluation__c and assign it to all users holding the 'VP of Operations' role.
  4. D
    Change the Organization-Wide Default (OWD) of Partner_Evaluation__c from Private to Public Read/Write.

Cevap

Create an owner-based sharing rule on Partner_Evaluation__c that shares records owned by members of the 'Regional Operations Director' role with the 'VP of Operations' role, specifying Read/Write access.
Creating an owner-based sharing rule selectively grants Read/Write access to records owned by users in the 'Regional Operations Director' role and shares them specifically with users in the 'VP of Operations' role. This satisfies the requirement while preserving the disabled 'Grant Access Using Hierarchies' setting on the object and adhering strictly to the principle of least privilege.

Adım Adım Çözüm

1
Analyze object-level OWD and hierarchy access settings
The custom object OWD is Private, and 'Grant Access Using Hierarchies' is deselected, preventing automatic access propagation through the role hierarchy.
When 'Grant Access Using Hierarchies' is unchecked on a custom object, users higher in the role hierarchy do not implicitly receive access to records owned by subordinates.
2
Evaluate record access requirements against security tools
Access must be granted specifically from record owners in the 'Regional Operations Director' role to users in the 'VP of Operations' role with Read/Write permissions.
Owner-based sharing rules can target records owned by members of a specific role and grant access to members of another target role without affecting other divisions or changing object-wide defaults.
3
Assess alternative sharing and permission mechanisms against least privilege
Changing OWD to Public Read/Write or assigning 'Modify All' permissions grants excessive access across the org, whereas re-enabling hierarchy access globally overrides the security design decision.
An owner-based sharing rule is the precise configuration mechanism that satisfies the requirement using the principle of least privilege.

Anahtar Kavram

Owner-Based Sharing Rules & Role Hierarchy Access Suppression
Bu soruyu puanla

Konular

Role Hierarchy and Sharing Rules

Bu konudan daha fazla soru