Security and Access

Advanced record and field access in the Salesforce sharing model, profiles versus permission sets, delegated administration, user authentication and complex account models (20% of exam).

5 minutes 5 Questions

Security and Access is a core domain of the Salesforce Certified Platform Administrator II (Advanced Administrator) exam, typically weighted around 20% of the test. It focuses on how administrators control who can see and do what in a Salesforce org, using a layered security model. At the organiza…

Concepts covered
Restriction Rules and Scoping RulesLogin Hours, Login IP Ranges and Trusted IP RangesOrganization-Wide Defaults and External Sharing ModelContacts to Multiple AccountsDelegated AdministrationTroubleshooting Record Access with Sharing HierarchySingle Sign-On with SAML and Identity ProvidersAccount Hierarchies and Business Account ModelsField-Level Security Across Profiles and Permission SetsRole Hierarchy and Grant Access Using HierarchiesPermission Set Groups and Muting Permission SetsSession Settings and High-Assurance SessionsCustom Profiles Versus Permission SetsPerson AccountsControlled by Parent Access on Detail RecordsEnterprise Territory Management Record AccessMulti-Factor Authentication for UsersView All, Modify All and Administrative PermissionsEmail Template Folder AccessConnected App Access PoliciesOwner-Based and Criteria-Based Sharing RulesReport and Dashboard Folder AccessAccount Teams, Opportunity Teams and Manual Sharing
Test mode:
Start practice test

Admin II - Security and Access Example Questions

Test your knowledge of Security and Access

Question 1

Northern Trail Outfitters has a custom Site Inspection object that is the detail in a master-detail relationship with a custom Facility object. The Facility org-wide default is Private. Field auditors get Read Only access to Facilities through a criteria-based sharing rule. A permission set gives them Create, Read, and Edit on Site Inspection. Auditors can open inspection records, but they get an insufficient privileges error when they try to edit them. What should the administrator do?

Correct Answer: Change the Facility sharing rule access level to Read/Write

In a master-detail relationship, the detail record's sharing is Controlled by Parent, so editing a Site Inspection requires Read/Write access to its master Facility. Raising the Facility sharing rule to Read/Write lets the existing Edit object permission take effect.
A Site Inspection sharing rule cannot be created, because detail objects inherit sharing from the master. The detail's org-wide default is locked to Controlled by Parent and cannot be set to Public Read/Write. Detail records have no owner field, so auditors cannot be made owners of inspections.
Key concept: master-detail sharing inheritance (Controlled by Parent) combined with object permissions.

Question 2

At Universal Containers, the org-wide default for the custom Project object is Public Read Only. Employees should see only their own region's projects in list views and lookups by default, but they must still be able to open any project when needed. Contractors, who hold internal licenses, must be blocked from viewing projects outside their assigned region anywhere in Salesforce. What should the administrator configure?

Correct Answer: A restriction rule for contractors and a scoping rule for employees

A restriction rule truly limits which records contractors can access everywhere in Salesforce, while a scoping rule only sets the default records employees see in list views and lookups, leaving every project they already have access to still openable.
Reversing the rules fails both groups: a scoping rule cannot block contractors, and a restriction rule would stop employees from opening other regions' projects. Restriction rules for both groups have the same problem for employees. A Private default with a sharing rule granting employees read access controls record access, not default visibility, so it cannot scope list views by region.
Key concept: restriction rules restrict access, while scoping rules only filter default visibility.

Question 3

Universal Containers has enabled Contacts to Multiple Accounts. An independent consultant is stored as one contact and advises several client accounts. For each client, the team must record whether the consultant is the authorized signer and the date the engagement began. These values differ from one client to the next. The values must also appear on each client's page and in account-level reports. What should the administrator do?

Correct Answer: Add custom fields to the Account Contact Relationship and its related list

The Account Contact Relationship record holds data unique to each contact-account pairing. Custom fields there, such as an authorized signer checkbox and an engagement start date, can vary by client, appear in the Related Contacts list on each account page, and be reported on at the account level.
Custom fields on Contact store a single value across all accounts, and field history tracking does nothing to make values vary by client. A custom junction object duplicates functionality the platform already provides. Roles picklist values could flag the signer, but storing the date on Contact still forces one value for every client.
Key concept: relationship-specific data belongs on the Account Contact Relationship object.

More Security and Access questions
606 questions (total)
Practice 100 questions
One session at a time, always new questions