Security & Access Management Flashcards

A Salesforce admin needs to ensure that users in the 'Support' role can see records owned by users in the 'Sales' role, but not vice versa. Which feature best accomplishes this?

Answer: Role Hierarchy

Role Hierarchy grants record access upward, so a higher role can see records owned by lower roles below them in the hierarchy.

Which login security setting requires users to confirm their identity via a one-time code sent to their phone or email when logging in from an unrecognized device?

Answer: Identity Verification (MFA)

Multi-Factor Authentication (Identity Verification) challenges users with an additional verification step when logging in from an unrecognized browser or device.

A user should be able to read all Opportunity records but only edit Opportunities they own. Which OWD and role hierarchy combination achieves this?

Answer: OWD = Public Read Only, no role hierarchy needed

Public Read Only OWD lets all users read every record while owners retain full edit rights by default.

Which type of Salesforce sharing rule is based on criteria such as record field values rather than record ownership?

Answer: Criteria-based sharing rules

Criteria-based sharing rules share records when field values meet specified conditions, regardless of who owns the record.

An admin wants to prevent users from logging in to Salesforce outside of business hours (8 AM–6 PM, Monday–Friday). Which setting enforces this?

Answer: Login Hours

Login Hours settings on a profile restrict the time windows during which users assigned that profile can log in.

What is the effect of setting a field's Field-Level Security to 'Read-Only' for a given profile?

Answer: Users on that profile can see but not edit the field

Read-Only FLS means the field is visible to users on that profile but they cannot modify its value.

A Salesforce admin needs to give a group of contractors temporary access to a specific set of fields and objects without changing their profile. What is the best tool?

Answer: Assign a Permission Set to the contractors

Permission Sets allow admins to grant additional access to specific users without altering their base profile.