Examkin

Soru

Zorluk: OrtaRole Hierarchy and Sharing Rules

BrightHorizon Media utilizes a custom object named Security_Incident__c to log internal IT security events. The Organization-Wide Default (OWD) for Security_Incident__c is set to Private. Management requires that upper-level managers in the role hierarchy should NOT automatically inherit access to security incident records owned by their subordinates. However, the Compliance Director role must be granted Read access to any Security_Incident__c record where the Severity field is set to 'Critical'. Which configuration should a System Administrator implement to satisfy these access requirements?

  1. Deselect 'Grant Access Using Hierarchies' on the custom object definition, and create a criteria-based sharing rule to share records where Severity equals 'Critical' with the Compliance Director role.Cevap
  2. B
    Leave 'Grant Access Using Hierarchies' selected on the custom object, and create a Permission Set granting 'View All' on Security_Incident__c assigned to the Compliance Director user.
  3. C
    Change the Organization-Wide Default (OWD) on Security_Incident__c to Public Read-Only, and set up an owner-based sharing rule to hide non-critical records from managers.
  4. D
    Keep 'Grant Access Using Hierarchies' enabled, set the OWD to Public Read/Write, and write a criteria-based sharing rule targeting the Compliance Director role.

Cevap

Deselect 'Grant Access Using Hierarchies' on the custom object definition, and create a criteria-based sharing rule to share records where Severity equals 'Critical' with the Compliance Director role.
For custom objects, administrators can deselect the 'Grant Access Using Hierarchies' checkbox in Organization-Wide Defaults / Sharing Settings. This prevents users higher in the role hierarchy from automatically receiving access to records owned by or shared with their subordinates. To grant conditional access to a specific role based on field values (Severity = 'Critical'), a criteria-based sharing rule is the correct and supported mechanism.

Adım Adım Çözüm

1
Analyze hierarchy access requirements for the custom object
By default, custom objects have 'Grant Access Using Hierarchies' selected, allowing record access to propagate up the role hierarchy. Unchecking this setting disables automatic access propagation.
Prevents managers higher in the role hierarchy from automatically viewing records owned by subordinates.
2
Determine the record sharing mechanism for selective record access
Since access depends on field values (Severity = 'Critical') rather than record ownership, a criteria-based sharing rule is required.
Criteria-based sharing rules grant access to specified roles or groups when field criteria are met, regardless of record owner.

Anahtar Kavram

Disabling Grant Access Using Hierarchies on custom objects combined with criteria-based sharing rules.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Role Hierarchy and Sharing Rules

Bu konudan daha fazla soru