Pass the Salesforce Architect Exams Sharing-and-Visibility-Architect Questions and answers with ValidTests

With a private sharing model, a criteria-based sharing rule is the most effective way to grant auditors access to specific records like high-value opportunities. Criteria-based sharing rules allow records to be shared with a public group based on defined criteria (e.g., Opportunity Amount > $50,000).

Option A (Correct): Sharing rules are scalable and do not require reconfiguration of the Role Hierarchy or default Opportunity Teams.

Option B: Adding auditors to the default Opportunity Team is inefficient and impractical, as it applies to specific opportunities manually, not automatically for high-value opportunities.

Option C: Placing auditors at the highest level of the Role Hierarchy grants them excessive access to all opportunities, not just high-value ones, violating the principle of least privilege.

References:

Criteria-Based Sharing Rules

UESTION NO: 18

A sales coach at Universal Containers wants to create and share a report folder with other sales coaches.

Which two permissions are required to accomplish this?

A. Create Report Folders and manage Reports in Public Folders

B. Create and customize Reports and Report Folders

C. Manage Reports in Public Folders and edit My Reports

Answer: B

To create and share a report folder, users need specific permissions. The "Create and Customize Reports" permission allows creating reports and folders, while folder management permissions are required to share the folder with others.

Option A: "Manage Reports in Public Folders" is for administering public folders, not creating or sharing a personal folder.

Option B (Correct): "Create and Customize Reports and Report Folders" ensures that users can create and share folders effectively.

Option C: "Edit My Reports" is only for editing personal reports, not for creating or sharing report folders.

References:

Report Folder Permissions

Salesforce Report and Dashboard Permissions

To meet the requirement of sharing opportunities for collaboration and automatically expiring access, the following approach is best:

Apex Sharing (Answer A): Apex sharing allows sales managers to share opportunities with specific users. This is essential for ad-hoc and granular sharing that isn't feasible with criteria-based or owner-based sharing rules.

Scheduled Apex Job (Answer B): Use a scheduled Apex job to remove sharing entries after a specific date, ensuring access expires two weeks after the new fiscal year begins. This provides automation and aligns with the requirement for access expiration.

Option C: Sharing rules cannot handle time-based expiration, making them unsuitable for this use case.

References:

Apex Managed Sharing Overview

Scheduled Apex

In Apex, the IsUpdateable() method of the Schema.DescribeFieldResult class checks if the current user has permission to update a specific field. Using this method ensures that the Apex class respects Field-Level Security (FLS) for all profiles, avoiding unauthorized updates.

Option A: Adding the "With Sharing" keyword enforces record-sharing rules but does not enforce field-level security.

Option B: Placing the code in an inner class with "With Sharing" does not address the field-level security issue.

Option C (Correct): Using IsUpdateable() ensures field permissions are honored programmatically, preventing updates to read-only fields.

References:

Schema.DescribeFieldResult Methods

Enforcing Field-Level Security in Apex

Private Organization-Wide Defaults (OWD):

Setting OWD to Private ensures that users only have access to records they own unless additional sharing mechanisms are implemented (e.g., Role Hierarchy, Sharing Rules).

Why Option C is Correct:

Sales Users: Can view all accounts via a sharing rule but only edit their own records (ownership-based access).

Sales Managers: Use the Role Hierarchy to view and edit records owned by their team.

Service Users: Add criteria-based sharing rules to exclude access to "Prospect" record types.

Why Others Are Incorrect:

Option A (Public Read/Write): Grants all users full edit access, which violates the "edit only their own records" requirement for Sales Users.

Option B (Public Read/Transfer): This is typically used for cases, not for granular access control as described.

For more information, see Salesforce OWD and Sharing Rules documentation: https://help.salesforce.com/

OWD Settings and Access Control:

When the OWD for Contacts is "Controlled by Parent," access to the Contact is determined by access to the related Account.

Why Option C is Correct:

Service reps have "View All" permission on Cases, granting them access to related Accounts. Since Contacts are controlled by the parent Account, service reps also gain access to relevant Contacts.

Why Others Are Incorrect:

Option A: Service reps can access Accounts related to Cases they can view, even if the OWD is Private.

Option B: Contacts controlled by the parent are accessible as long as the parent Account is accessible.

For detailed guidance, see Salesforce documentation on OWD and Controlled by Parent: https://help.salesforce.com/

Site User Visibility Setting:

When "Site User Visibility" is turned off, external users cannot search for or view other external users within the community.

This setting helps maintain privacy and control user visibility.

Why Option B is Correct:

Disabling Site User Visibility directly impacts the ability to search for other external users.

Why Others Are Incorrect:

Option A: Updating their user profile is unrelated to this setting.

Option C: Internal user visibility is not affected by this setting.

For further guidance, see Salesforce Community Sharing Settings documentation: https://help.salesforce.com/

For custom objects, Salesforce allows disabling the Access Using Hierarchies option. By setting the Organization-Wide Default (OWD) to Private and unchecking Access Using Hierarchies, you ensure that records are only accessible to the owner and explicitly granted users. This prevents the owner’s manager or anyone higher in the role hierarchy from automatically gaining access.

Option A: Removing CRUD permissions from profiles would block all access to the object for managers, which may not align with business requirements.

Option B: Apex sharing is unnecessary when the problem can be solved declaratively by adjusting the OWD and hierarchy settings.

Option C (Correct): Setting OWD to Private and disabling Access Using Hierarchies is the most straightforward solution for restricting access to managers.

References:

Control Access to Records

With a private organization-wide default (OWD) model for the Account object, users do not have automatic access to related records they do not own. However, Salesforce provides implicit sharing, which ensures that the owner of a child record, such as an Opportunity, is granted Read access to the related parent Account. This implicit sharing does not extend to Edit or Create permissions unless additional sharing rules, roles, or explicit access mechanisms are configured. Therefore, the sales rep will have Read access to the Account associated with their owned Opportunities. (developer.salesforce.com)

Field-level security (FLS) defines which fields a user can view or edit. If a user can see some fields (like Name, Created Date, etc.) but not others, the issue is likely related to FLS settings on the user's profile.

Option A: Role-based sharing rules control record access, not field access.

Option B (Correct): The Sales User profile likely lacks FLS access for the fields in question. Adjusting the profile or permission sets to grant visibility to these fields will resolve the issue.

Option C: Page layouts define which fields are displayed but cannot override field-level security. If the profile lacks FLS access, the fields won’t appear regardless of the layout.

References:

Field-Level Security Overview

The Public Group and Sharing Rule approach grants access to specified users and, by default, extends access to their managers in the Role Hierarchy. Here’s how the settings interact:

Public Group: The group includes a specific set of sales engineers.

Sharing Rule: It grants access to opportunities for the Public Group. This rule respects the existing Role Hierarchy.

Role Hierarchy: In Salesforce, managers in the hierarchy automatically gain access to records their subordinates can access, ensuring seamless visibility for leadership.

Option A (Correct): Managers of sales engineers in the Role Hierarchy will gain access because sharing rules honor the Role Hierarchy.

Option B: Subordinates of managers will not gain access because sharing rules do not propagate access downward in the hierarchy.

Option C: Other sales engineers outside the specified Public Group will not gain access unless explicitly included in the sharing rule.

References:

Sharing Rules Overview

Role Hierarchy and Sharing