Soru

Zorluk: OrtaProfiles and Object/Field-Level Security

Apex Global Logistics has a sensitive custom field, Contract_Renewal_Value__cContract\_Renewal\_Value\_\_c, on the Vendor Account record. The Procurement Operations team requires view and edit access to this field, whereas warehouse staff—who share the same base Operations profile—must not have access. Additionally, system compliance mandates that Procurement Operations users be prohibited from logging into Salesforce when outside the corporate network IP range of 192.168.10.0192.168.10.0 to 192.168.10.255192.168.10.255. Which two configuration steps should the Salesforce Administrator take to meet these security requirements? (Select 2 answers)

  1. Create a Permission Set granting Read and Edit access to Contract_Renewal_Value__c and assign it to the Procurement Operations users.Cevap
  2. Create a custom Procurement profile assigned to Procurement Operations users and configure the Login IP Ranges on that profile.Cevap
  3. C
    Use Dynamic Forms on the Vendor Account Lightning Record Page to set component visibility rules hiding Contract_Renewal_Value__c from warehouse staff.
  4. D
    Add the corporate network IP range under Network Access in Organization Settings to restrict login access for Procurement Operations users.

Cevap

The administrator must create a Permission Set granting Read and Edit access on Contract_Renewal_Value__c for the Procurement team, and create a custom Procurement profile to enforce Profile Login IP Ranges.
The correct solution uses a Permission Set to grant Read and Edit access on the sensitive field specifically to Procurement Operations users without affecting warehouse staff. Additionally, because Login IP Ranges restrict login access exclusively when configured on a Profile (and cannot be set via Permission Sets), creating a distinct custom profile for Procurement users allows setting the required Login IP Ranges without impacting warehouse staff.

Adım Adım Çözüm

1
Evaluate field access requirements across user groups
Since warehouse staff and Procurement users share a profile, baseline Field-Level Security (FLS) for Contract_Renewal_Value__c should remain restricted on the base profile. Access is granted additively to Procurement users via a Permission Set.
Using Permission Sets for incremental field access avoids profile proliferation.
2
Evaluate login restriction requirements
Login IP Ranges enforce strict login blocking outside designated ranges and must be defined on a Profile. Because warehouse staff should not be restricted by these IP ranges, Procurement users must be assigned a distinct custom profile.
Permission Sets cannot enforce Login IP Ranges; login hours and IP restrictions are exclusively managed at the Profile level.

Anahtar Kavram

Combining Permission Sets for additive Field-Level Security (FLS) with Profile-level Login IP Restrictions
Tahmini Süre:1m 30s
Bu soruyu puanla