Security & Access Management Flashcards

What does a profile control in Salesforce?

Answer: Object and field permissions

A profile in Salesforce is a collection of settings and permissions that determine what a user can do within the application. It controls object-level permissions (e.g., create, read, edit, delete for specific objects) and field-level permissions (e.g., visibility and editability of individual fields). Profiles are fundamental for defining a user's baseline access and capabilities.

What is the purpose of permission sets?

Answer: Extend user permissions

Permission sets in Salesforce are used to grant additional permissions and access settings to users, beyond what is provided by their profile. They are a flexible way to extend specific privileges to a subset of users without changing their entire profile. This allows for more granular control and adheres to the principle of least privilege, giving users only the access they need.

Which feature restricts access to specific records?

Answer: Sharing rules

Sharing rules in Salesforce are used to extend record access to users beyond what is granted by organization-wide defaults and the role hierarchy. They allow administrators to grant access to specific records based on criteria (e.g., record owner, field values) or group membership. This ensures that users can see the necessary data for their work, even if they are not high in the role hierarchy.

How do organization-wide defaults (OWD) work?

Answer: Set baseline record access

Organization-Wide Defaults (OWD) in Salesforce establish the baseline level of access that users have to records they do not own. They define the most restrictive access settings for each object, such as Public Read Only, Public Read/Write, or Private. OWDs are the foundation upon which other sharing mechanisms, like role hierarchies and sharing rules, build to grant broader access.

What is a login IP restriction used for?

Answer: Restrict login by IP

Login IP restrictions in Salesforce are a security measure designed to control where users can log in from. By defining a range of approved IP addresses, administrators can ensure that users can only access the Salesforce org from trusted networks or locations. This significantly reduces the risk of unauthorized access from external or unknown sources, enhancing data security.

What happens if a user is assigned multiple permission sets?

Answer: Permissions are combined

When a user is assigned multiple permission sets, Salesforce combines all permissions granted by each set. This means the user receives the sum of all access and capabilities defined across all assigned permission sets, rather than one overriding another. It's an additive model, ensuring users have the broadest necessary access from their combined assignments.

How can you secure sensitive field data from users?

Answer: Field-level security

Field-level security (FLS) is the primary method in Salesforce to control which fields users can view and edit. It allows administrators to restrict access to sensitive data on an individual field basis, regardless of the user's record access. This ensures that even if a user can see a record, specific sensitive fields within that record can be hidden or made read-only.

What does two-factor authentication (2FA) require?

Answer: Password + additional verification

Two-factor authentication (2FA) enhances security by requiring two distinct forms of identification before granting access. This typically involves something the user knows (like a password) combined with something the user has (like a mobile device for a verification code). This layered approach significantly reduces the risk of unauthorized access, even if a password is compromised.

Which object controls password policies in Salesforce?

Answer: Profiles

In Salesforce, password policies, such as length requirements, complexity, and expiration, are primarily controlled at the profile level. Each profile can have its own specific password policy settings, which then apply to all users assigned to that profile. This allows administrators to enforce different security standards for various groups of users within the organization.