Examkin

Soru

Zorluk: ZorProfiles and Object/Field-Level Security

BioHealth Labs utilizes a custom object named Product_Batch__c to track pharmaceutical production data. Most Quality Assurance inspectors assigned to the custom profile 'QA Inspector' must not be able to view or edit the sensitive Formulation_Secret__c field on this object. However, three Lead QA Inspectors who share the same 'QA Inspector' profile require Read and Edit access to Formulation_Secret__c across all interfaces, including reports, list views, and the API. Which configuration should the administrator implement to satisfy these security requirements while minimizing administrative overhead?

  1. Set Field-Level Security (FLS) for Formulation_Secret__c to deselect Visible on the 'QA Inspector' profile, create a Permission Set granting Read and Edit access to Formulation_Secret__c, and assign the Permission Set to the three Lead QA Inspectors.Cevap
  2. B
    Clone the 'QA Inspector' profile to create a 'Lead QA Inspector' profile, enable Read and Edit access on Formulation_Secret__c in the new profile, and reassign the three Lead QA Inspectors to this profile.
  3. C
    Remove Formulation_Secret__c from the standard page layout and use Dynamic Forms component visibility rules on the Lightning Record Page to conditionally show the field only to the three Lead QA Inspectors.
  4. D
    Add the corporate network IP addresses to the Organization-Wide Network Access settings to restrict viewing Formulation_Secret__c to trusted network locations.

Cevap

Set Field-Level Security (FLS) on Formulation_Secret__c to deselect Visible for the 'QA Inspector' profile, create a Permission Set granting Read and Edit access to Formulation_Secret__c, and assign the Permission Set to the three Lead QA Inspectors.
The option advocating setting Field-Level Security to hidden on the profile and granting access via a Permission Set correctly follows Salesforce security architecture. Profile FLS acts as the restrictive base, ensuring the field is protected across all interfaces (reports, API, list views, record pages), while the Permission Set seamlessly extends Read and Edit access to specific users without profile duplication.

Adım Adım Çözüm

1
Identify the base security level needed for the majority of users assigned to the profile.
Since most 'QA Inspector' profile users should not see Formulation_Secret__c, deselecting 'Visible' on the 'QA Inspector' profile establishes a secure default across all UI and API channels.
Profiles set the baseline permissions for users sharing that profile role.
2
Determine the optimal mechanism to grant elevated access to a subset of users.
Permission Sets grant additive permissions to individual users without requiring dedicated custom profiles.
Salesforce best practice dictates keeping profile counts low and using Permission Sets for specialized user access.
3
Assign the new Permission Set containing Read and Edit FLS for Formulation_Secret__c to the three Lead QA Inspectors.
The three Lead QA Inspectors gain full Read and Edit access to the field across reports, list views, and API, while other inspectors remain restricted.
Combining restrictive baseline FLS with additive Permission Sets satisfies the principle of least privilege efficiently.

Anahtar Kavram

Field-Level Security (FLS) Baseline & Permission Set Extension
Bu soruyu puanla

Konular

Profiles and Object/Field-Level Security

Bu konudan daha fazla soru