Back to Salesforce Certified Platform Administrator (SF Admin)

Configuration and Setup

Configure organizational settings, user interface, users, roles, profiles, and security controls (20% of exam).

Covers organizational setup including company settings and user interface configuration. Includes user setup and management with roles, profiles, and permission sets. Also covers security and access controls such as object-level, field-level, and record-level security settings.
5 minutes 5 Questions

Configuration and Setup in Salesforce refers to the foundational administrative tasks that establish how your Salesforce org operates and how users interact with the platform. This domain is crucial for Platform Administrators as it encompasses the core settings that define your organization's Sale…

Concepts covered: Login IP Ranges, Login Hours, Company Settings and Information, Fiscal Year Settings, Business Hours and Holidays, Language and Locale Settings, Lightning Experience Interface, Switching Between Lightning and Classic, Home Page Customization, App Menu Configuration, User Creation and Management, User License Types, Profiles and Their Purposes, Permission Sets, Permission Set Groups, Role Hierarchy, Public Groups, Queues, Delegated Administration, Login History and Access, Password Policies, Manual Sharing, Criteria-Based Sharing Rules, Session Settings, Object-Level Security, Field-Level Security, Record-Level Security, Organization-Wide Defaults (OWD), Sharing Rules, Two-Factor Authentication

Test mode:
Start practice test
SF Admin - Configuration and Setup Example Questions

Test your knowledge of Configuration and Setup

Question 1

Scenario: Evergreen Logistics employs truck dispatchers who work rotating schedules. The 'Dispatcher' profile currently has no Login Hours configured. The Fleet Manager informs the Salesforce Administrator that dispatchers have been accessing the system at all hours, including 3 AM when no supervisor is available to oversee their work. The Fleet Manager wants to restrict dispatcher access to 5 AM - 11 PM every day of the week. After the administrator configures Login Hours on the Dispatcher profile, a dispatcher named Kevin attempts to log in at 4:30 AM to check route assignments before his early shift begins. Kevin receives an error and calls the help desk frustrated, stating that he always logs in early to prepare. The help desk escalates to the administrator. What should the administrator explain to Kevin about why he cannot access the system at 4:30 AM?

Correct Answer: Login Hours prevent authentication attempts outside the configured time window, so Kevin must wait until 5 AM when the allowed access period begins for his profile.

Login Hours is a profile-level security feature that restricts when users can authenticate and access Salesforce. When configured, it creates a specific time window during which users assigned to that profile can log in.

The correct answer explains that Login Hours prevent authentication attempts outside the configured time window. Since the Fleet Manager requested access be restricted to 5 AM - 11 PM, Kevin's attempt to log in at 4:30 AM falls outside this allowed window. The system will block his login attempt entirely until the allowed access period begins at 5 AM. This is the expected and intended behavior of Login Hours - it acts as a gate that prevents users from even authenticating when outside their permitted hours.

The second answer is incorrect because Login Hours do not work by restricting users after they've been logged in for a period of time. Login Hours specifically control when users can initially authenticate - they either can log in during the allowed window or they cannot. There's no 30-minute grace period or browser refresh workaround.

The third answer is incorrect because Login Hours use the individual user's timezone (as set in their personal settings), not the administrator's timezone. Each user's Login Hours restriction is evaluated based on their own configured timezone, making the restriction relevant to each user's local time.

The fourth answer is incorrect because Login Hours do not require a propagation or timeout period after configuration. Once Login Hours are configured on a profile, they take effect immediately. There is no one-hour waiting period for the restrictions to activate.

Question 2

Cascade Enterprises has a complex organizational structure with multiple business units. The 'Regional Account Manager' profile currently has Login IP Ranges configured for 10.150.0.0-10.150.255.255 (Eastern Region Office) and 10.160.0.0-10.160.255.255 (Western Region Office). The company recently implemented a VPN solution that assigns users IP addresses in the 172.16.0.0-172.16.255.255 range when connecting remotely. A Regional Account Manager named Thomas has been successfully working from the Eastern Region Office for months. Thomas now needs to work from home occasionally using the company VPN, but when he attempts to log in from his home using VPN (assigned IP 172.16.50.88), he receives an error message indicating he cannot access Salesforce from his current location. Thomas's manager confirms his credentials are correct and his account is active. The administrator investigates and finds that the organization has Trusted IP Ranges configured at the Network Access level covering 10.0.0.0-10.255.255.255 and 172.16.0.0-172.16.255.255. Despite the VPN IP being within the organization's Trusted IP Range, why is Thomas unable to log in?

Correct Answer: Profile-level Login IP Ranges take precedence and must include the VPN subnet for Thomas to authenticate, regardless of organization-level Trusted IP Range settings

In Salesforce, Profile-level Login IP Ranges and Organization-level Trusted IP Ranges serve different purposes and work independently.

Profile Login IP Ranges restrict WHERE users can log in from. If Login IP Ranges are configured on a profile, users assigned to that profile can ONLY log in from IP addresses within those specified ranges. This is a hard restriction on authentication.

Organization Trusted IP Ranges (Network Access) determine whether users need to verify their identity (such as through email verification or two-factor authentication) when logging in from an unfamiliar location. If a user logs in from a Trusted IP Range, they bypass this identity verification step.

In Thomas's case:
- His profile has Login IP Ranges set to only allow the Eastern and Western Region Office subnets (10.150.x.x and 10.160.x.x)
- The VPN assigns him IP 172.16.50.88
- Although 172.16.0.0-172.16.255.255 is in the organization's Trusted IP Ranges, this only affects identity verification, NOT login access

Since the VPN subnet (172.16.x.x) is not included in his profile's Login IP Ranges, Thomas cannot authenticate at all from that IP address. The administrator must add the VPN range (172.16.0.0-172.16.255.255) to the Regional Account Manager profile's Login IP Ranges to allow Thomas to log in while using VPN.

The other answers are incorrect because:
- Organization-level Trusted IP Ranges do not override profile-level Login IP Ranges - they serve completely different security functions
- The order in which IP ranges are configured has no bearing on how they function
- Permission sets cannot grant Login IP Range access; this is strictly a profile-level setting for authentication restrictions

Question 3

At Evergreen Solutions, the Salesforce Administrator, Thomas, is reviewing user access after receiving a complaint from the Compliance team. A Marketing Specialist named Andrea claims she cannot access the Lightning App called 'Campaign Central' that her team uses daily, even though she was hired three weeks ago and has been working with other Marketing tools successfully. Thomas confirms that Andrea is assigned to the 'Marketing Specialist Profile' which should include access to this app. He checks the Profile settings and sees that 'Campaign Central' is listed under Assigned Apps with 'Visible' checked. He also verifies that Andrea has no Permission Sets that might be affecting her app visibility. Andrea's colleague, Brandon, who is on the same Profile, can access 'Campaign Central' normally. Thomas discovers that when Andrea's user record was created, an incorrect checkbox was selected. What Profile-related setting should Thomas investigate at the user record level that could be preventing Andrea from seeing this specific Lightning App?

Correct Answer: The default app assignment specified in the user record that overrides the Profile's app visibility settings

The correct answer is that Thomas should investigate the default app assignment specified in the user record that overrides the Profile's app visibility settings.

When creating a user record in Salesforce, there is a 'Default App' field that can be set. While this setting primarily determines which app opens by default when the user logs in, the key issue here relates to how user records can sometimes have settings that interact with Profile-level app visibility.

However, more importantly, the scenario describes an 'incorrect checkbox' being selected during user creation. In Lightning Experience, at the user record level, there are settings that can affect what a user sees. The default app assignment on the user record can influence app visibility behavior.

Since Andrea's colleague Brandon (on the same Profile) can access the app normally, and the Profile settings show the app as visible, the issue must be at the individual user record level rather than the Profile level itself.

The other answers are incorrect for the following reasons:

  • Login Hours restrictions on a Profile would affect when a user can log in to Salesforce entirely, not selectively hide specific apps. If Login Hours were the issue, Andrea wouldn't be able to log in at all during restricted times, not just be unable to see one specific app.

  • Connected App OAuth policies relate to third-party application authentication and API access. 'Campaign Central' is described as a Lightning App within Salesforce, not an external connected application, so OAuth policies would not affect its visibility.

  • Session Settings control session duration and timeout behavior, requiring users to re-authenticate after a period of inactivity. These settings would not selectively hide apps from a user's view - they only affect how long a session remains active.

More Configuration and Setup questions
896 questions (total)
Start 100 question test