CSA Security & Access Management 4 — Questions and Answers
Question 1: Which report type in Salesforce allows an admin to audit which users have which profiles and permission sets assigned?
- User Login History report
- User and Permission Set Assignment report (Correct answer)
- Setup Audit Trail
- Field Accessibility report
Correct answer: User and Permission Set Assignment report
The User and Permission Set Assignment report (from User reports) shows which profiles and permission sets are linked to each user.
Question 2: What is the maximum number of IP addresses that can be added to a profile's Login IP Ranges list?
- 5
- 10
- 20 (Correct answer)
- Unlimited
Correct answer: 20
Each profile allows up to 10 IP range entries (each range can span many IPs), but Salesforce limits you to 10 ranges per profile.
Question 3: When should an admin use Manual Sharing instead of a Sharing Rule?
- When sharing needs to apply automatically to all future records meeting criteria
- When the sharing requirement is for a specific record and doesn't follow a predictable pattern (Correct answer)
- When sharing must be enforced at the field level
- When the OWD must be changed to Private
Correct answer: When the sharing requirement is for a specific record and doesn't follow a predictable pattern
Manual Sharing is used for one-off, record-specific sharing that can't be automated through ownership or criteria-based rules.
Question 4: Which Salesforce security layer controls whether a user can see a tab for a given object in the app navigation?
- Object Permissions
- Tab Settings on Profile (Correct answer)
- App Manager Visibility
- Page Layout Assignment
Correct answer: Tab Settings on Profile
Tab Settings on a profile (Default On, Default Off, Tab Hidden) control whether the object's tab is visible to users with that profile.
Question 5: An organization wants all leads created by marketing to be shared automatically with the entire Sales team. The OWD for Leads is Private. What is the best approach?
- Change OWD for Leads to Public Read/Write
- Create an owner-based sharing rule sharing Leads owned by Marketing role with Sales role (Correct answer)
- Use Apex Managed Sharing to programmatically share each record
- Assign the 'View All' permission for Leads to Sales profile
Correct answer: Create an owner-based sharing rule sharing Leads owned by Marketing role with Sales role
An owner-based sharing rule can automatically share records owned by the Marketing role with the Sales role, keeping OWD Private elsewhere.
Question 6: Which user license type in Salesforce is best suited for external partners who only need access to a limited set of objects via a portal?
- Salesforce Platform License
- Partner Community License (Correct answer)
- Full Salesforce License
- Identity License
Correct answer: Partner Community License
Partner Community Licenses are designed for external partners and provide access to a limited set of standard and custom objects through Experience Cloud.
Question 7: What does the 'View Setup and Configuration' permission allow a Salesforce user to do?
- Modify any setup configuration
- View setup pages, audit trails, and metadata without making changes (Correct answer)
- Access all installed packages
- See all users' personal settings
Correct answer: View setup pages, audit trails, and metadata without making changes
'View Setup and Configuration' grants read-only access to the Setup menu and Setup Audit Trail without allowing changes.
CSA Security & Access Management 4
Which report type in Salesforce allows an admin to audit which users have which profiles and permission sets assigned?