Examkin

Soru

Zorluk: OrtaProfiles and Object/Field-Level Security

A growing manufacturing company has a custom field, Salary_Range__c, on the Position object. All members of the Human Resources department share a single custom HR Profile. Management requires that two temporary HR interns on this profile be restricted from viewing or editing the Salary_Range__c field, while all other HR team members retain full view and edit access. Which configuration change should the Salesforce Administrator implement to meet this requirement while adhering to Salesforce security best practices?

  1. Remove Read and Edit permissions for Salary_Range__c on the HR Profile, create a Permission Set granting Read and Edit access to Salary_Range__c, and assign the Permission Set to all HR team members except the two interns.Cevap
  2. B
    Clone the HR Profile to create a new profile with Salary_Range__c permissions disabled, and reassign the two HR interns to this new profile.
  3. C
    Use Dynamic Forms on the Position Lightning Record Page to set component visibility rules that hide the Salary_Range__c field from the HR interns.
  4. D
    Add the IP addresses of the two HR interns to the organization-wide Network Access settings to restrict access to sensitive fields.

Cevap

Remove Read and Edit permissions for Salary_Range__c on the HR Profile, create a Permission Set granting Read and Edit access to Salary_Range__c, and assign the Permission Set to all HR team members except the two interns.
The option advocating restricting field permissions on the profile and granting them back via a permission set correctly enforces the principle of least privilege. In Salesforce, field-level security must be restricted at the profile level when any user on that profile should not view the data, and permission sets are then assigned to grant access to the remaining users.

Adım Adım Çözüm

1
Identify the baseline security level required across the shared profile
Since a subset of users on the profile must not see the field, the baseline profile access for Salary_Range__c must be set to restrict access (no Read, no Edit).
Profiles set the baseline permissions. In Salesforce security, permissions are additive, so base permissions must be restrictive when exceptions require lower access.
2
Design an additive access structure for the remaining team members
Create a Permission Set with Read and Edit Field-Level Security enabled for Salary_Range__c.
Permission sets allow administrators to grant additional access to specific users without modifying their assigned profile.
3
Assign the Permission Set to the appropriate users
Assign the new Permission Set to all regular HR team members, leaving the two interns without the assignment.
This achieves the desired access control cleanly while avoiding the creation of additional custom profiles.

Anahtar Kavram

Field-Level Security (FLS) & Permission Set Architecture
Bu soruyu puanla

Konular

Profiles and Object/Field-Level Security

Bu konudan daha fazla soru