Auditing and Monitoring

Monitoring and troubleshooting system activity, protecting sensitive data in production and sandboxes, and reviewing security settings and pending release updates (10% of exam).

5 minutes 5 Questions

Auditing and Monitoring is a key knowledge area in the Salesforce Certified Platform Administrator II (Advanced Administrator) exam, focused on tracking changes, securing the org, and ensuring data integrity. Salesforce provides several native tools for this purpose. First, the Setup Audit Trail r…

Concepts covered
Login History and Identity Verification HistoryRelease Updates That Change System AccessEvent MonitoringField History Tracking and Field Audit TrailDebug Logs and Trace FlagsData Classification Settings for Sensitive FieldsSecurity Health CheckMasking Sensitive Data in SandboxesSetup Audit TrailEncryption of Sensitive Data at Rest
Test mode:
Start practice test

Admin II - Auditing and Monitoring Example Questions

Test your knowledge of Auditing and Monitoring

Question 1

Universal Containers tracks changes to several Opportunity fields with Field History Tracking. A new compliance rule requires those field changes to stay queryable inside Salesforce for seven years. The company has purchased Salesforce Shield, and the compliance team wants the simplest solution that keeps the data on the platform. What should the administrator do?

Correct Answer: Define a Field Audit Trail retention policy on Opportunity

Field Audit Trail, part of Salesforce Shield, lets the administrator define a retention policy per object. Field history data is then archived into the FieldHistoryArchive big object and stays queryable on the platform for up to ten years, which covers the seven-year requirement.
Standard Field History Tracking has no configurable retention setting, so its period cannot simply be extended to seven years. Setup Audit Trail records configuration changes, not record field changes, and exporting it moves data off the platform. A before-save flow copying old values to a log object is custom work, not the simplest option, and it consumes data storage.
Key concept: Shield Field Audit Trail for long-term field history retention.

Question 2

At Northern Trail Outfitters, an external system publishes a platform event through a dedicated integration user. A platform event-triggered flow subscribes to the event and runs under its default running user. The flow intermittently fails to create follow-up cases. The administrator set a trace flag on the integration user, but the debug logs show only the event publish and none of the flow's interviews. What should the administrator do next to capture the flow's execution?

Correct Answer: Trace the Automated Process entity with the Workflow category at Finer

Platform event-triggered flows run as the Automated Process user by default, not as the user who published the event. Setting a trace flag on the Automated Process entity with the Workflow category at Finer captures the flow's interview execution.
Tracing the integration user at Finest still logs only that user's transaction, which is the publish, because the flow runs in a separate transaction under a different user. The Platform Integration entity is not the default running user for event-triggered flows. Tracing your own admin user with Apex Code misses both the correct user and the flow logging category.
Key concept: debug log trace flags must target the actual running user of asynchronous automation.

Question 3

Northern Trail Outfitters must flag Contact fields that hold personal data so auditors can identify them. The administrator enabled data classification and set the Data Sensitivity Level to Restricted on several Contact fields. A week later, the auditor reports that sales reps can still view and edit those fields in production and in a newly refreshed full sandbox. What explains this behavior, and what should the administrator do next?

Correct Answer: Sensitivity labels only describe data; remove field access from the reps' profiles and permission sets.

Data classification settings such as Data Sensitivity Level are metadata that describe how sensitive a field is. They do not restrict viewing or editing, so the administrator must remove field-level access from the reps' profiles and permission sets.
Restriction rules filter which records a user can see, not which fields, and sensitivity labels do not trigger them. Shield Platform Encryption protects data at rest but does not hide fields from users who have field access. Classification is set on the field definition, not on individual records, so no mass update is needed. The refreshed sandbox simply copied production's metadata and permissions.
Key concept: data classification is descriptive metadata, while field-level security controls access.

More Auditing and Monitoring questions
297 questions (total)
Practice 100 questions
One session at a time, always new questions