Examkin

Soru

Zorluk: Çok zorProfiles and Object/Field-Level Security

An administrator at a financial institution needs to restrict access to a new sensitive custom field, `Compliance_Audit_Status__c`, on the `Opportunity` object. A subset of users assigned to the standard Sales User profile requires Read and Edit access to this field, while users assigned to the Compliance Manager profile require Read-Only access. All other users must be completely restricted from accessing this field across all interfaces, including reports, list views, and the API. Furthermore, login attempts by Compliance Managers from outside specified corporate IP addresses must be strictly blocked rather than triggering identity verification.

Which TWO actions should the administrator take to fulfill these security requirements?

  1. Set Field-Level Security (FLS) for `Compliance_Audit_Status__c` to Visible (Read-Only) on the Compliance Manager profile, set FLS to Hidden on the Sales User profile, and grant Read/Edit access to the designated subset of sales reps using a Permission Set.Cevap
  2. Add the corporate IP address range to the Login IP Ranges section directly within the Compliance Manager Profile settings.Cevap
  3. C
    Configure Dynamic Forms component visibility rules on the Opportunity record page to hide the `Compliance_Audit_Status__c` field from unauthorized user roles.
  4. D
    Add the corporate IP address range to Network Access settings under Organization-Wide Security Settings in Setup.

Cevap

The administrator must set Field-Level Security on the profiles (restricting access on the standard Sales profile while granting Read-Only on the Compliance profile) and assign a Permission Set to the subset of sales reps requiring Read/Edit access. Additionally, the administrator must specify corporate IP addresses under Login IP Ranges on the Compliance Manager Profile.
To secure data effectively across all interfaces (including UI, reports, and API), Field-Level Security (FLS) must be configured on profiles and supplemented with Permission Sets for additive access. Restricting FLS on the standard Sales User profile while granting access to a specific subset of users via a Permission Set satisfies least-privilege access without profile duplication. Furthermore, placing IP restrictions within Profile Login IP Ranges strictly denies login attempts from outside those ranges, fulfilling the login restriction requirement.

Adım Adım Çözüm

1
Analyze field access requirements across user groups
Identify that the standard Sales User profile must have the field hidden by default, while a subset requires Read/Edit access.
Salesforce security follows a principle of least privilege where base profiles define minimal access and permission sets grant additive permissions.
2
Configure Field-Level Security (FLS) and Permission Sets
Hide the field on the Sales User profile, set Read-Only on the Compliance Manager profile, and create a Permission Set with Read/Edit access for the specific sales subset.
FLS guarantees data restriction across all channels (UI, API, Reports), and permission sets prevent profile proliferation.
3
Evaluate login security requirements for Compliance Managers
Determine that login attempts outside corporate IPs must be denied rather than challenged.
Profile Login IP Ranges enforce strict login blocking outside defined ranges, whereas org-wide Network Access only bypasses multi-factor verification.

Anahtar Kavram

Field-Level Security (FLS) for data privacy across all API/UI boundaries, combined with Profile Login IP Ranges for strict login enforcement.
Bu soruyu puanla

Konular

Profiles and Object/Field-Level Security

Bu konudan daha fazla soru