Tüm alıştırma soruları

1784 soru

Soru 321Soru

A renewable energy corporation uses a single baseline profile to grant standard read-only access to all 40 regional operations managers. To streamline an upcoming quarterly grid maintenance program, 8 of these managers require temporary edit permissions on a custom Inverter Asset object and the ability to run data exports. Following the maintenance program, these additional privileges must cease. Which solution should the system administrator implement to meet these access requirements while adhering to Salesforce security best practices?

Cevabı ve açıklamayı göster

Cevap: Create a permission set granting edit access to the Inverter Asset object and export permissions, assign it to the 8 managers, and set an expiration date on the permission set assignment.

Cevap

Create a permission set granting edit access to the custom object and export permissions, assign it to the specific managers, and configure an expiration date on the permission set assignment.
The option advocating a Permission Set with an expiration date is correct because permission sets grant additive permissions without modifying baseline profiles. Leveraging assignment expiration dates ensures temporary privileges are automatically revoked upon completion of the maintenance period.

Adım Adım Çözüm

1
Analyze the access requirement type
Identify that the 8 managers require additive object-level permissions and system privileges on top of their baseline profile, limited to a specific time frame.
Profiles should define minimum baseline access shared by a job function, while Permission Sets layer on extra permissions for specific subsets of users.
2
Evaluate permission assignment tools for temporary access
Determine that assigning a Permission Set with an Expiration Date satisfies both the additive requirement and the automated time-bound cleanup requirement.
Permission Set assignment expiration dates automatically revoke user access when the specified duration concludes, eliminating manual admin oversight.
3
Evaluate and reject profile-based alternatives
Reject profile cloning, profile reassignment, and OWD alterations.
Profile modifications introduce administrative sprawl and risk altering baseline access for unaffected users.

Anahtar Kavram

Additive permissions and access lifecycle management using Permission Sets and Expiration Dates
Tahmini Süre:2m 0s
Soru 322Soru

A global healthcare organization is onboarding a remote clinical care team into Salesforce. Compliance policies dictate that members of this team must strictly be prevented from logging in if they are outside the corporate Virtual Private Network (VPN) IP range (192.0.2.0 - 192.0.2.255). However, all other standard employees in the organization must retain the ability to log in from any external location by completing an identity verification challenge (MFA) when outside the trusted network. Which configuration strategy should the Salesforce Administrator implement to enforce this requirement for the new remote care team?

Cevabı ve açıklamayı göster

Cevap: Assign the clinical care team users a custom profile configured with the IP range (192.0.2.0 - 192.0.2.255) under the Login IP Ranges section of that profile.

Cevap

Assign the clinical care team users a custom profile configured with the IP range (192.0.2.0 - 192.0.2.255) under the Login IP Ranges section of that profile.
Configuring Login IP Ranges on the Profile enforces a strict security boundary. Users assigned to a profile with defined Login IP Ranges are completely prohibited from authenticating if their request originates outside the specified IP range. Meanwhile, users on other profiles remain governed by organization-wide settings.

Adım Adım Çözüm

1
Analyze the security requirement for restricting login access based on IP address.
Identified that the restriction must hard-block logins for specific users outside a specified IP range, while allowing other users in the org to log in externally.
Different user roles require distinct login security policies.
2
Evaluate Salesforce security mechanisms for IP restrictions.
Profile-level Login IP Ranges restrict users assigned to that specific profile to only log in from within the allowed IP bounds. Any attempt outside the range is immediately denied.
Organization-wide Network Access only manages identity verification (mfa bypass) across the entire org, whereas Profile Login IP Ranges strictly enforce login boundaries per profile.
3
Verify feature capabilities of profiles versus permission sets.
Login IP Ranges can only be configured within Profile settings and are absent from Permission Set configurations.
Salesforce architecture handles authentication boundaries like IP ranges and Login Hours exclusively via Profiles.

Anahtar Kavram

Profile Login IP Ranges vs. Org-Wide Network Access
Tahmini Süre:2m 0s
Soru 323Soru

A system administrator at an event management company needs to grant access to a custom object named 'Vendor Contracts' to two newly hired event coordinators. None of the other users sharing the same baseline profile require access to this object. What is the Salesforce recommended best practice to grant access to these two users?

Cevabı ve açıklamayı göster

Cevap: Create a permission set granting access to the Vendor Contracts object and assign it to the two event coordinators.

Cevap

Create a permission set granting access to the Vendor Contracts object and assign it to the two event coordinators.
Permission sets are the recommended mechanism in Salesforce to grant additional object, field, or system permissions to specific users without modifying their assigned profiles or affecting other users sharing that profile.

Adım Adım Çözüm

1
Identify the access requirement
Two specific users need additive object access that other users on the same profile do not need.
Profiles define baseline access for groups of users, whereas permission sets extend access to individual users.
2
Select the appropriate security mechanism
Create a Permission Set containing the necessary object permissions and assign it to the target users.
Using permission sets follows the principle of least privilege while keeping profile management simplified.

Anahtar Kavram

Using Permission Sets for Additive User Permissions
Tahmini Süre:45s
Soru 324Soru

A Salesforce Administrator at an architectural firm needs to configure file management rules for design blueprints attached to custom Project records. The administrator must ensure that when a draft is updated, all attached Project records automatically point to the latest revision, and that only file owners or administrators can modify the file's privacy level on attached records. Which two actions should the administrator take to fulfill these requirements? (Choose 2 answers.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Upload new revisions directly using the 'Upload New Version' button on the existing Salesforce File record.; Set the 'File Privacy on Records' property to 'Private on Records' on the file details page.

Cevap

The administrator should upload new revisions using the 'Upload New Version' feature on the Salesforce File and set the 'File Privacy on Records' attribute to 'Private on Records'.
Salesforce Files natively supports revision tracking through the 'Upload New Version' feature, which updates the file content everywhere it is shared without severing existing links to records. Additionally, configuring 'File Privacy on Records' to 'Private on Records' restricts visibility modifications on attached records exclusively to file owners and administrators.

Adım Adım Çözüm

1
Analyze version control requirements for attached files in Salesforce.
Using the 'Upload New Version' button on a Salesforce File keeps all existing record relationships intact while updating the active document version across all linked records.
Creating separate file uploads for each revision creates duplicate files and broken record links.
2
Analyze file privacy controls on record attachments.
Setting 'File Privacy on Records' to 'Private on Records' restricts non-owner/non-admin users from altering the file's sharing privacy on record detail pages.
By default, files attached to records inherit visibility from the record unless explicitly restricted via the File Privacy setting.

Anahtar Kavram

Salesforce Files Versioning and File Privacy Controls
Soru 325Soru

A financial advisory firm uses a custom object named Wealth_Plan__c to track confidential client investment strategies. To maintain strict data privacy, advisors must only access the wealth plans they own. However, branch managers directly above the advisors in the organizational role hierarchy must be able to view and edit all wealth plans owned by their direct reports.

Which Organization-Wide Default (OWD) setting and hierarchy configuration should the administrator implement for the Wealth_Plan__c object?

Cevabı ve açıklamayı göster

Cevap: Set the Organization-Wide Default to Private, and leave Grant Access Using Hierarchies selected.

Cevap

Set the Organization-Wide Default to Private, and leave Grant Access Using Hierarchies selected.
Setting the Organization-Wide Default to Private ensures that advisors only have access to records they own. Leaving 'Grant Access Using Hierarchies' enabled allows users higher in the role hierarchy (such as branch managers) to automatically inherit the ownership access rights of their direct reports.

Adım Adım Çözüm

1
Determine the baseline access required for individual record owners.
Since advisors should only access their own records, the most restrictive baseline access level required is Private.
Organization-Wide Defaults set the baseline level of access across the organization.
2
Evaluate role hierarchy requirements for upper management.
Branch managers above advisors in the role hierarchy require full view and edit access to records owned by their subordinates.
By default, Grant Access Using Hierarchies is enabled for custom objects, allowing access to propagate up the role hierarchy.
3
Combine the OWD setting with the hierarchy setting.
Configuring Private OWD while keeping Grant Access Using Hierarchies enabled fulfills both security requirements without redundant sharing rules.
This maintains strict record ownership privacy while granting automatic supervisory access.

Anahtar Kavram

Organization-Wide Defaults (OWD) and Role Hierarchy Access
Soru 326Soru

Northern Trail Outfitters uses a custom object named Executive_Sponsorship__c to manage confidential strategic client engagements. Business governance policies require that sales representatives are restricted to viewing only the records they own. Additionally, senior managers above the record owners in the role hierarchy must NOT automatically inherit view or edit privileges to these sensitive records. Which combination of Organization-Wide Default (OWD) settings on Executive_Sponsorship__c will satisfy these requirements?

Cevabı ve açıklamayı göster

Cevap: Set Default Internal Access to Private and deselect the 'Grant Access Using Hierarchies' checkbox on the object.

Cevap

Set Default Internal Access to Private and deselect the 'Grant Access Using Hierarchies' checkbox on the Executive_Sponsorship__c custom object.
Setting the Default Internal Access of a custom object to Private restricts baseline record access so that non-owners cannot view records unless explicitly shared. Disabling the 'Grant Access Using Hierarchies' option (which is enabled by default for custom objects) prevents users higher in the role hierarchy from automatically inheriting access to records owned by or shared with their subordinates.

Adım Adım Çözüm

1
Determine the required baseline record visibility.
Since users should only see records they own, the Organization-Wide Default (OWD) Default Internal Access must be set to Private.
Private is the most restrictive OWD setting, preventing non-owners from viewing records unless granted access through sharing rules or manual sharing.
2
Evaluate role hierarchy sharing behavior for custom objects.
By default, Salesforce enables 'Grant Access Using Hierarchies' for all objects, allowing managers to access subordinate records.
For custom objects, administrators can deselect 'Grant Access Using Hierarchies' to prevent record access from automatically propagating up the role hierarchy.
3
Combine OWD baseline setting with hierarchy setting.
Setting OWD to Private and unchecking 'Grant Access Using Hierarchies' fulfills both security constraints.
This configuration restricts access strictly to record owners and explicitly disables management hierarchy access.

Anahtar Kavram

Organization-Wide Defaults (OWD) and Hierarchy Access Control on Custom Objects
Soru 327Soru

A Salesforce administrator needs to establish a relationship between a custom object named Equipment_Maintenance__c and the standard Asset object. The business requirement dictates that if an Asset record is deleted, all associated Equipment_Maintenance__c records must be automatically deleted as well. Which relationship type should the administrator create on the Equipment_Maintenance__c object?

Cevabı ve açıklamayı göster

Cevap: A Master-Detail relationship with Asset as the master object

Cevap

A Master-Detail relationship with Asset as the master object
Creating a Master-Detail relationship on the custom child object with the parent object as the master enforces cascading deletion, ensuring that deleting the parent automatically removes all related child records.

Adım Adım Çözüm

1
Analyze the deletion requirement
Deleting a parent record must trigger an automatic cascade deletion of all child records.
Salesforce relationship types determine record lifecycle and cascading deletion behavior.
2
Select the appropriate object relationship type
Configure a Master-Detail relationship on the child object (Equipment_Maintenance__c) pointing to Asset.
Master-Detail relationships tie child record lifecycle directly to the master record.

Anahtar Kavram

Master-Detail Cascading Deletion
Soru 328Soru

An administrator at CloudPulse Technologies is reviewing the Company Information page in Setup after receiving a notification that a new hire cannot be provisioned. Upon inspecting the User Licenses section on the Company Information page, the administrator observes that all standard Salesforce user licenses are fully assigned. Which administrative action will immediately release a user license for reallocation while preserving the inactive user's historical record ownership and audit data?

Cevabı ve açıklamayı göster

Cevap: Deactivate the inactive user record.

Cevap

Deactivating the inactive user record immediately releases the assigned Salesforce user license so it can be assigned to a new user, without deleting historical data or transferring record ownership.
Deactivating a user record sets the Active field to false, which immediately returns the user license to the organization's pool of available licenses on the Company Information page. It preserves all history, ownership of existing records, and system logs associated with that user.

Adım Adım Çözüm

1
Inspect Company Information and User Licenses
Confirm that total assigned Salesforce user licenses equal total total licenses available in the organization.
Before provisioning a new user, an available license of the appropriate type must be present in the org.
2
Determine the appropriate user management action
Select user deactivation rather than freezing or deleting.
Freezing only blocks login access without freeing the license, whereas deactivation blocks login access AND immediately frees the license while preserving data integrity.
3
Execute deactivation
Uncheck the Active checkbox on the user detail record.
This updates the license counts listed on the Company Information page, freeing 1 Salesforce license for the new employee.

Anahtar Kavram

User License Allocation & Deactivation vs. Freezing
Tahmini Süre:1m 0s
Soru 329Soru

A Salesforce Administrator at SolarSpark Energy configures login security for users assigned to the Call Center Representative profile. The administrator defines a Login IP Range on the profile of 192.168.1.1 to 192.168.1.100. Additionally, the corporate headquarters IP range of 10.0.0.1 to 10.0.0.255 is listed under organization-wide Network Access. A representative attempts to log in from an office computer with the IP address 10.0.0.45. Which outcome will occur upon this login attempt?

Cevabı ve açıklamayı göster

Cevap: The login attempt is denied because the user's IP address is outside the Login IP Ranges specified on their profile.

Cevap

The login attempt is denied because the user's IP address is outside the Login IP Ranges specified on their profile.
When Login IP Ranges are defined on a user profile in Salesforce, logins outside those specified ranges are strictly denied. Organization-wide Network Access settings (Trusted IP Ranges) only determine whether a user must verify their identity when logging in from a new IP; they do not grant access to users whose profile IP restrictions explicitly exclude their current IP address.

Adım Adım Çözüm

1
Evaluate profile-level login security restrictions.
Login IP Ranges are defined on the user's profile as 192.168.1.1 to 192.168.1.100.
Profile-level IP restrictions take precedence and strictly enforce access boundaries.
2
Compare the user's login IP address against the defined Profile Login IP Ranges.
The user's IP address (10.0.0.45) falls outside the profile range of 192.168.1.1 to 192.168.1.100.
Any login attempt outside specified profile IP ranges is completely blocked by Salesforce.
3
Assess the impact of organization-wide Network Access trusted IP ranges.
Organization-wide Network Access settings (10.0.0.1 to 10.0.0.255) cannot override a profile-level IP restriction.
Org Network Access settings only control identity verification prompts for users without profile-level restrictions or within allowed ranges.

Anahtar Kavram

Profile IP Ranges vs. Org-Wide Network Access Trusted IP Ranges
Tahmini Süre:1m 30s
Soru 330Soru

A Salesforce administrator at a software company needs to create two custom fields on the Account object to track client subscription details. The business requirements state:
1. A field to store whether an account currently has an active subscription (a simple true/false indicator).
2. A field allowing sales reps to choose one or more applicable feature add-ons from a predefined list.

Which two custom field data types should the administrator configure to meet these requirements? (Select 2)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Checkbox; Picklist (Multi-Select)

Cevap

The administrator should select Checkbox for the active subscription indicator and Picklist (Multi-Select) for selecting multiple predefined feature add-ons.
The Checkbox data type provides a straightforward boolean (true/false) field, ideal for indicating active status. The Picklist (Multi-Select) data type allows users to select multiple values simultaneously from a set list of predefined values, satisfying the requirement to select multiple feature add-ons.

Adım Adım Çözüm

1
Analyze requirement 1: Storing a simple true/false indicator for active subscription.
Determine that a Checkbox field best captures binary boolean data (Yes/No or True/False).
Checkbox is the native Salesforce custom field data type designed specifically for boolean true/false values.
2
Analyze requirement 2: Selecting multiple choices from a predefined set of feature add-ons.
Determine that a Picklist (Multi-Select) field allows selecting one or more values from a set list.
Standard single-select picklists allow only one choice, whereas Picklist (Multi-Select) enables selecting multiple predefined options.

Anahtar Kavram

Selecting appropriate Salesforce custom field data types based on specific business data input requirements.
Soru 331Soru

An organization's compliance policy requires that when any user's session expires due to inactivity, the active session token must be immediately invalidated and the user redirected to the main login page, forcing a full re-authentication from scratch. During an internal audit, an administrator notices that when sessions time out, users are presented with a pop-up modal on their current page prompting for password re-entry rather than terminating the session entirely. Which configuration change must the administrator make to comply with the policy?

Cevabı ve açıklamayı göster

Cevap: Select the 'Force logout on session timeout' setting in Organization-Wide Session Settings.

Cevap

Select the 'Force logout on session timeout' setting in Organization-Wide Session Settings.
In Salesforce, navigating to Setup > Session Settings provides a global configuration option called 'Force logout on session timeout'. When this setting is enabled, session expiration completely invalidates the session token and redirects the browser to the login page. When left unchecked, Salesforce retains the session context and displays a lock overlay requesting credential re-entry.

Adım Adım Çözüm

1
Analyze the compliance requirement
The requirement demands full session invalidation and redirection to the main login page upon inactivity timeout.
By default, Salesforce locks the session without terminating it, allowing users to re-enter credentials via an inline prompt to resume their work.
2
Evaluate Salesforce administrative settings controlling session timeout behaviors
Organization-Wide Session Settings contain the checkbox 'Force logout on session timeout'.
When checked, this setting ensures that an expired session cannot be unlocked in-place and forces a complete logout and page redirect.
3
Eliminate invalid control locations
Permission Sets, Profile Login IP Ranges, and Network Access do not control session termination modal behavior.
Session Settings are controlled centrally in Setup or overridden at the Profile level, whereas IP ranges control network entry points.

Anahtar Kavram

Session Settings and Password Policies
Soru 332Soru

Cloud Kicks operates customer support centers in Tokyo and San Francisco. Tokyo support agents work Monday through Friday from 09:00 to 17:00 JST, while San Francisco agents work Monday through Friday from 09:00 to 17:00 PST. The management team requires Case Escalation Rules to calculate target resolution times strictly during local operating hours for each regional team. Additionally, corporate holidays must pause the escalation timers for affected teams without maintaining redundant holiday records. Which configuration strategy should the administrator implement to fulfill these requirements?

Cevabı ve açıklamayı göster

Cevap: Create distinct Business Hours records for Tokyo and San Francisco with their respective time zones, define corporate holiday records, associate those holidays with both Business Hours records, and set Case Escalation Rule entries to evaluate using the Case Business Hours.

Cevap

Create distinct Business Hours records for Tokyo and San Francisco with their respective time zones, define corporate holiday records, associate those holidays with both Business Hours records, and set Case Escalation Rule entries to evaluate using the Case Business Hours.
In Salesforce Core Administration, managing multi-regional support schedules requires defining custom Business Hours records that specify the operating days, operating hours, and time zone for each region. To pause SLA calculations on specific non-working days, Holiday records created in Setup must be explicitly associated with each relevant Business Hours schedule. When Escalation Rule entries are set to use the Business Hours on the Case, Salesforce accurately calculates escalation trigger times based on the case's regional schedule and associated holidays.

Adım Adım Çözüm

1
Configure regional Business Hours schedules
Two distinct Business Hours entries exist (Tokyo with JST time zone and San Francisco with PST time zone), defining regional operating windows.
Salesforce Escalation Rules calculate elapsed time based on the assigned Business Hours record rather than user time zone preferences.
2
Create and associate corporate Holidays
Corporate Holiday records are created once in Setup and explicitly added to both Tokyo and San Francisco Business Hours schedules.
Holidays pause the Business Hours timer only when explicitly linked to the specific Business Hours configuration.
3
Configure Escalation Rule entries
Escalation Rule Items are configured to determine escalation trigger times using the Business Hours specified on the Case record.
Ensures that cases assigned to Tokyo or San Francisco evaluate SLA escalation timelines strictly within their local operating hours and holidays.

Anahtar Kavram

Business Hours, Holidays, and Time Zone Association in Escalation Rules
Soru 333Soru

Northern Trail Outfitters tracks executive reviews using a custom object named Partner_Evaluation__c. To prevent automatic upward data visibility across the organization, an administrator deselected the 'Grant Access Using Hierarchies' checkbox on the Partner_Evaluation__c object definition, while keeping its Organization-Wide Default (OWD) set to Private. Following a corporate restructuring, users assigned to the 'VP of Operations' role require Read and Edit access to all Partner_Evaluation__c records owned by regional managers in the 'Regional Operations Director' role. However, users in the VP of Operations role must not be granted access to evaluations owned by managers in other divisions. Which configuration fulfills this access requirement while adhering to the principle of least privilege?

Cevabı ve açıklamayı göster

Cevap: Create an owner-based sharing rule on Partner_Evaluation__c that shares records owned by members of the 'Regional Operations Director' role with the 'VP of Operations' role, specifying Read/Write access.

Cevap

Create an owner-based sharing rule on Partner_Evaluation__c that shares records owned by members of the 'Regional Operations Director' role with the 'VP of Operations' role, specifying Read/Write access.
Creating an owner-based sharing rule selectively grants Read/Write access to records owned by users in the 'Regional Operations Director' role and shares them specifically with users in the 'VP of Operations' role. This satisfies the requirement while preserving the disabled 'Grant Access Using Hierarchies' setting on the object and adhering strictly to the principle of least privilege.

Adım Adım Çözüm

1
Analyze object-level OWD and hierarchy access settings
The custom object OWD is Private, and 'Grant Access Using Hierarchies' is deselected, preventing automatic access propagation through the role hierarchy.
When 'Grant Access Using Hierarchies' is unchecked on a custom object, users higher in the role hierarchy do not implicitly receive access to records owned by subordinates.
2
Evaluate record access requirements against security tools
Access must be granted specifically from record owners in the 'Regional Operations Director' role to users in the 'VP of Operations' role with Read/Write permissions.
Owner-based sharing rules can target records owned by members of a specific role and grant access to members of another target role without affecting other divisions or changing object-wide defaults.
3
Assess alternative sharing and permission mechanisms against least privilege
Changing OWD to Public Read/Write or assigning 'Modify All' permissions grants excessive access across the org, whereas re-enabling hierarchy access globally overrides the security design decision.
An owner-based sharing rule is the precise configuration mechanism that satisfies the requirement using the principle of least privilege.

Anahtar Kavram

Owner-Based Sharing Rules & Role Hierarchy Access Suppression
Soru 334Soru

An administrator at Cloud Kicks is designing a custom object schema for tracking Customer Invoices related to Accounts. The business analyst presents three mandatory requirements:
1. Deleting an Account record must not delete its associated Invoice records.
2. The total dollar amount of all related Invoices must be displayed on the Account record using a standard declarative roll-up field without writing custom code or Apex triggers.
3. Invoices must maintain independent Organization-Wide Defaults (OWD) and sharing access from Accounts.

Which architectural constraint prevents fulfilling all three requirements using standard declarative relationship features alone?

Cevabı ve açıklamayı göster

Cevap: Standard roll-up summary fields require a Master-Detail relationship, which automatically cascades record deletion to child records and forces child records to inherit the parent object's sharing permissions.

Cevap

Standard roll-up summary fields require a Master-Detail relationship, which automatically cascades record deletion to child records and forces child records to inherit the parent object's sharing permissions.
Standard declarative roll-up summary fields are strictly supported only on Master-Detail relationships. However, Master-Detail relationships enforce two mandatory platform behaviors: deleting the master record cascades deletion to all detail records, and detail records inherit their access controls ('Controlled by Parent') from the master record. Because requirements 1 and 3 mandate independent security and preservation of records upon deletion, standard declarative tools alone cannot satisfy all three criteria without custom automation such as Record-Triggered Flows or Apex.

Adım Adım Çözüm

1
Analyze Requirement 1 and Requirement 3 regarding record deletion behavior and security access controls.
Requirements 1 and 3 require that child records survive parent deletion and maintain independent sharing settings, which are characteristics of a Lookup relationship.
Lookup relationships allow independent security settings (OWD) and prevent cascading deletion of child records.
2
Analyze Requirement 2 regarding parent object summary calculations.
Requirement 2 demands a standard declarative roll-up summary field on the Account object.
Standard declarative roll-up summary fields are functionally restricted to Master-Detail relationships.
3
Evaluate platform relationship constraints against all three requirements.
Configuring a Master-Detail relationship enables standard roll-up summaries, but automatically enforces cascade deletion and forces child security to be 'Controlled by Parent'.
Standard declarative features cannot simultaneously support roll-up summary fields while preserving independent security and deletion behavior.

Anahtar Kavram

Master-Detail vs. Lookup Relationship Capabilities and Constraints
Tahmini Süre:2m 0s
Soru 335Soru

A Salesforce administrator is designing a security architecture that adheres to the principle of least privilege while maintaining scalability. Match each business access requirement on the left with the most appropriate Salesforce permission component or mechanism on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Granting an extra additive permission (such as Export Reports) to a small team of support reps without modifying their underlying profile.
Bundling multiple permission sets together to streamline assignment for users who perform the sales executive job function.
Disabling a single permission (such as Delete on Contracts) for a subset of users within a combined job-role permission group.
Granting special system access to a contractor that automatically terminates after a 60-day audit window.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

1. Granting additive permissions without profile modification matches Standalone Permission Set. 2. Bundling multiple permission sets for job functions matches Permission Set Group. 3. Disabling a specific permission within a group matches Muting Permission Set. 4. Granting temporary access that automatically terminates matches Permission Set Assignment with Expiration Date.
Each business scenario matches its optimal Salesforce security feature: standalone permission sets provide additive permissions; permission set groups consolidate permissions by job function; muting permission sets selectively disable inherited group permissions; and assignment expiration dates ensure time-bound access automatically terminates.

Adım Adım Çözüm

1
Analyze additive access needs
Identify that granting specific additional permissions to selected users without altering baseline profiles is solved by creating a Standalone Permission Set.
Profiles establish baseline access; permission sets grant additional capabilities cleanly.
2
Analyze persona and group management requirements
Identify that grouping multiple related permission sets for job functions aligns with Permission Set Groups.
Permission Set Groups consolidate multiple permission sets into one easily assignable bundle.
3
Analyze permission restrictions within bundled groups
Identify that suppressing specific permissions in a Permission Set Group requires a Muting Permission Set.
Muting Permission Sets selectively disable permissions granted by other sets within the group without breaking the core sets.
4
Analyze time-bound access requirements
Identify that setting an automatic expiration date on a permission assignment fulfills temporary audit access requirements.
User User Permission Set / Permission Set Group assignments support native expiration dates for automatic offboarding.

Anahtar Kavram

Permission Set Architecture and Muting Functionality
Soru 336Soru

Pair each Salesforce access control requirement on the left with the appropriate security mechanism on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Completely hide a sensitive custom field from users assigned to a profile across all views, reports, and API calls.
Grant Create and Read access for the Account object to all users assigned to a standard user profile.
Prevent users assigned to a specific profile from logging into Salesforce outside of standard business working hours.
Deny login attempts for users on a profile if their connection originates outside designated corporate IP ranges.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Field-Level Security hides fields universally; Object Permissions grant object-level CRUD access; Profile Login Hours control allowable login times; Profile Login IP Ranges restrict login access by network IP address.
Each administrative requirement corresponds directly to a specific profile security setting: Field-Level Security controls field access across all entry points; Object Permissions govern object-level CRUD access; Profile Login Hours define allowed authentication windows; and Profile Login IP Ranges enforce network boundaries.

Adım Adım Çözüm

1
Identify the level of security required for each access scenario.
Categorize requirements into field visibility, object access, temporal login restrictions, and network location restrictions.
Salesforce security features enforce controls at different scopes (Field, Object, and System Security Settings).
2
Match field visibility requirements to Field-Level Security (FLS).
Hiding fields across layouts, API, and reports maps directly to FLS settings.
Page layouts only control visibility on UI record pages, whereas FLS enforces security across all access channels.
3
Match object CRUD requirements to Object Permissions on Profile.
Granting Create and Read access for an object maps to Object Permissions.
Object permissions establish the baseline actions a user can perform on records of that object type.
4
Match time and network location restrictions to Profile Login Hours and Profile Login IP Ranges.
Working hours limits map to Profile Login Hours, while IP whitelist restrictions map to Profile Login IP Ranges.
Profile-level login restrictions enforce system access boundaries prior to record-level access evaluation.

Anahtar Kavram

Profiles control baseline object permissions, field-level security, and system-level login restrictions (IP ranges and login hours).
Soru 337Soru

Match each Salesforce security requirement on the left with the most appropriate security or access control mechanism on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Completely block user login authentication if the user attempts to log in from an IP address outside corporate network ranges.
Restrict visibility of the Salary__c custom field on the Employee object across all UI layouts, reports, search results, and API integrations.
Hide a sensitive section on a Lightning Record Page based on user location while keeping the field data accessible in reports and standard UI views.
Grant Read and Edit permissions on a custom Audit__c object to a single compliance officer without modifying the shared base profile.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

1. Completely blocking authentication outside allowed IPs matches Profile Login IP Ranges. 2. Securing a field across API, UI, and reports matches Field-Level Security (FLS). 3. Hiding UI components on Lightning record pages without affecting reports matches Dynamic Forms Component Visibility. 4. Elevating privileges for an individual without changing the profile matches Permission Set.
Each requirement strictly aligns with its appropriate Salesforce administrative feature: Profile Login IP Ranges block authentication at the edge; Field-Level Security restricts data at the object/schema level across all tools; Dynamic Forms provides UI-only conditional rendering; and Permission Sets safely grant extra permissions to targeted individuals.

Adım Adım Çözüm

1
Analyze authentication enforcement requirements vs network level access.
Profile Login IP Ranges strictly deny authentication outside specified ranges, unlike Org-Wide Trusted IP Ranges which prompt for multi-factor/activation.
Hard security login restrictions are governed at the Profile level.
2
Evaluate field access security controls across UI and API channels.
Field-Level Security (FLS) is the mandatory configuration to hide or secure fields universally across API, reports, list views, and page layouts.
Page layout rules do not prevent API or report exposure, whereas FLS enforces schema-level field protection.
3
Distinguish between UI display rules and database security controls.
Dynamic Forms Component Visibility controls UI rendering on record pages only, leaving report and API data access untouched.
Dynamic Forms provides presentation layer flexibility without imposing security-level field restrictions.
4
Determine the principle of least privilege for individual user exceptions.
Permission Sets grant additional permissions to specific users ad-hoc, maintaining profile hygiene and consistency across shared roles.
Modifying profiles for single-user exceptions creates administrative overhead and breaks profile scoping.

Anahtar Kavram

Salesforce Security Architecture: Profile Login Restrictions, Field-Level Security, Dynamic Forms, and Permission Sets
Soru 338Soru

A Salesforce administrator is configuring access control for a growing team and needs to select the appropriate access control mechanism for different security scenarios. Match each Salesforce permission component on the left to its primary administrative function on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Permission Set
Permission Set Group
Muting Permission Set
Session-Based Permission Set

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Permission Set pairs with granting discrete extra permissions; Permission Set Group pairs with bundling multiple permission sets; Muting Permission Set pairs with disabling specific permissions inside a group; Session-Based Permission Set pairs with enabling access only during specific active session conditions.
Each permission management component corresponds directly to its architectural function: Permission Sets add individual access, Permission Set Groups package multiple sets together, Muting Permission Sets selectively remove access within a group, and Session-Based Permission Sets gate access based on active session conditions.

Adım Adım Çözüm

1
Identify the primary capability of a standalone Permission Set
It provides additive object, field, or system access to users independently of profile settings.
Salesforce security best practices mandate using Profiles for baseline access and Permission Sets for incremental permissions.
2
Analyze how multiple Permission Sets are managed efficiently
Permission Set Groups aggregate several permission sets so administrators assign one group instead of individual sets.
Consolidation reduces administration overhead across job roles.
3
Determine how to restrict specific permissions inside a consolidated group
A Muting Permission Set masks or disables specific permissions within a Permission Set Group.
Muting allows reusing permission set groups while catering to edge-case users who require fewer privileges.
4
Evaluate conditional access requirements
Session-Based Permission Sets require explicit activation via Flow or API during a user's session.
This enforces elevated security controls only when specialized tasks are actively performed.

Anahtar Kavram

Permission Sets, Permission Set Groups, and Muting Permission Sets Architecture
Soru 339Soru

A Salesforce Administrator needs to manually provision a new support team member in Salesforce Setup and grant them additional object permissions using a Permission Set. What is the correct sequence of steps to complete this user provisioning process?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence to provision a new user and assign additional access is: First, navigate to Users in Setup and select New User. Second, enter the mandatory identity fields and assign a baseline User License and Profile. Third, save the user record to establish the account. Fourth, open Permission Set Assignments on the new user record to grant the required Permission Set.
When provisioning a new Salesforce user, an administrator must first open the new user form in Setup, complete the mandatory fields (including baseline License and Profile), and save the record. Once saved, the user record exists in the org, allowing the administrator to access the Permission Set Assignments related list to grant supplemental permissions.

Adım Adım Çözüm

1
Initiate User Creation
Opens the New User configuration screen in Setup.
You must navigate to Setup > Users to start building a new user account.
2
Define Mandatory Attributes
Populates identity information along with required User License and Profile settings.
Salesforce requires baseline identity data and core security settings prior to record saving.
3
Save the User Record
Generates the user record in the org and triggers the welcome email.
The user record must exist in the database before permission set assignments can be linked.
4
Assign Permission Set
Extends functional permissions to the user beyond their baseline profile.
Permission sets are assigned to existing user records via the Permission Set Assignments related list.

Anahtar Kavram

Standard User Provisioning Sequence
Tahmini Süre:1m 0s
Soru 340Soru

Cloud Kicks uses a custom object named Patent_Filing__c to manage intellectual property documentation. Management requires that users can only view and edit Patent_Filing__c records that they own or that are owned by their subordinates in the role hierarchy. Additionally, members of the Executive Leadership public group must be granted View access to all Patent_Filing__c records across the organization.

Which two administration settings should the System Administrator configure to meet these record-level access requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Set the Organization-Wide Default (OWD) internal access for Patent_Filing__c to Private with Grant Access Using Hierarchies enabled.; Create a criteria-based or owner-based sharing rule that grants Read access on Patent_Filing__c records to the Executive Leadership public group.

Cevap

The administrator must set the Organization-Wide Default internal access for Patent_Filing__c to Private with Grant Access Using Hierarchies enabled, and create a sharing rule that shares Patent_Filing__c records with the Executive Leadership public group.
To satisfy the requirement where only record owners and higher role hierarchy levels have access by default, the Organization-Wide Default (OWD) must be set to Private, and Grant Access Using Hierarchies must remain enabled. To grant additional access to executives who may sit outside the direct reporting hierarchy, a sharing rule must be implemented to extend Read permissions to their public group.

Adım Adım Çözüm

1
Determine the most restrictive baseline sharing access needed for the custom object.
Since users should not see records owned by peers, the Organization-Wide Default must be set to Private.
OWD sets the baseline security level for records users do not own.
2
Ensure record access propagates vertically up the role hierarchy.
Keep 'Grant Access Using Hierarchies' enabled (checked) on the custom object.
This grants managers automatic access to records owned by their subordinates.
3
Extend access laterally to the executive team.
Configure a sharing rule to share records with the Executive Leadership public group.
Sharing rules are used to open up access beyond OWD baselines for specific user groups.

Anahtar Kavram

Organization-Wide Defaults (OWD) and Role Hierarchy Sharing Controls
Tahmini Süre:1m 30s
ÖncekiSayfa 17 / 90Sonraki
Tüm alıştırma soruları — Salesforce Certified Administrator | Examkin