CSA Security & Access Management 2 — Questions and Answers
Question 1: A Salesforce admin needs to ensure that users in the 'Support' role can see records owned by users in the 'Sales' role, but not vice versa. Which feature best accomplishes this?
- Sharing Rules
- Role Hierarchy (Correct answer)
- Permission Sets
- Field-Level Security
Correct answer: Role Hierarchy
Role Hierarchy grants record access upward, so a higher role can see records owned by lower roles below them in the hierarchy.
Question 2: Which login security setting requires users to confirm their identity via a one-time code sent to their phone or email when logging in from an unrecognized device?
- Single Sign-On
- Identity Verification (MFA) (Correct answer)
- IP Restrictions
- Login Hours
Correct answer: Identity Verification (MFA)
Multi-Factor Authentication (Identity Verification) challenges users with an additional verification step when logging in from an unrecognized browser or device.
Question 3: A user should be able to read all Opportunity records but only edit Opportunities they own. Which OWD and role hierarchy combination achieves this?
- OWD = Public Read Only, no role hierarchy needed (Correct answer)
- OWD = Private, use Sharing Rules to grant Read access to all
- OWD = Public Read/Write, restrict edit via validation rules
- OWD = Public Read Only, grant Edit only to record owner via profiles
Correct answer: OWD = Public Read Only, no role hierarchy needed
Public Read Only OWD lets all users read every record while owners retain full edit rights by default.
Question 4: Which type of Salesforce sharing rule is based on criteria such as record field values rather than record ownership?
- Owner-based sharing rules
- Criteria-based sharing rules (Correct answer)
- Manual sharing
- Apex managed sharing
Correct answer: Criteria-based sharing rules
Criteria-based sharing rules share records when field values meet specified conditions, regardless of who owns the record.
Question 5: An admin wants to prevent users from logging in to Salesforce outside of business hours (8 AM–6 PM, Monday–Friday). Which setting enforces this?
- Trusted IP Ranges
- Login Hours (Correct answer)
- Session Timeout
- Network Access
Correct answer: Login Hours
Login Hours settings on a profile restrict the time windows during which users assigned that profile can log in.
Question 6: What is the effect of setting a field's Field-Level Security to 'Read-Only' for a given profile?
- The field is hidden from users on that profile
- Users on that profile can see but not edit the field (Correct answer)
- Users on that profile can edit but not see the field
- The field is removed from all page layouts for that profile
Correct answer: Users on that profile can see but not edit the field
Read-Only FLS means the field is visible to users on that profile but they cannot modify its value.
Question 7: A Salesforce admin needs to give a group of contractors temporary access to a specific set of fields and objects without changing their profile. What is the best tool?
- Create a new profile for contractors
- Assign a Permission Set to the contractors (Correct answer)
- Use Sharing Rules to expose the fields
- Modify the OWD to Public Read/Write
Correct answer: Assign a Permission Set to the contractors
Permission Sets allow admins to grant additional access to specific users without altering their base profile.
CSA Security & Access Management 2
A Salesforce admin needs to ensure that users in the 'Support' role can see records owned by users in the 'Sales' role, but not vice versa.
Which feature best accomplishes this?