CSA Security & Access Management 5 — Questions and Answers
Question 1: Which Salesforce feature logs every configuration change made in Setup, including who made the change and when?
- Login History
- Debug Logs
- Setup Audit Trail (Correct answer)
- Field History Tracking
Correct answer: Setup Audit Trail
The Setup Audit Trail records up to 6 months of setup changes, showing the user, date, time, and nature of every configuration modification.
Question 2: A Salesforce admin wants certain users to access Salesforce only via SAML-based single sign-on from the company's identity provider. Which setting enforces SSO-only login?
- Enable MFA on those profiles
- Set 'Is Single Sign-On Enabled' on the profile and disable username/password login via My Domain policy (Correct answer)
- Remove the password on user records
- Set Login Hours to 0 on those profiles
Correct answer: Set 'Is Single Sign-On Enabled' on the profile and disable username/password login via My Domain policy
Enabling 'Is Single Sign-On Enabled' on a profile combined with a My Domain policy to block direct Salesforce logins forces users to authenticate exclusively via SSO.
Question 3: What is the difference between 'View All' and 'Modify All' object permissions?
- 'View All' ignores sharing rules to grant read access; 'Modify All' ignores sharing rules to grant full CRUD access (Correct answer)
- 'View All' only works with custom objects; 'Modify All' works with standard objects
- 'View All' is a system permission; 'Modify All' is a profile-only permission
- They are identical in effect
Correct answer: 'View All' ignores sharing rules to grant read access; 'Modify All' ignores sharing rules to grant full CRUD access
'View All' grants read-only access to all records of an object bypassing sharing rules, while 'Modify All' grants full CRUD access to all records bypassing sharing rules.
Question 4: An admin notices several failed login attempts in the Login History. Which field in Login History identifies the reason a login attempt failed?
- Status (Correct answer)
- Login Type
- Source IP
- Application
Correct answer: Status
The 'Status' field in Login History shows whether the login succeeded and, if not, provides the reason for failure (e.g., wrong password, locked out).
Question 5: Which Salesforce feature allows you to restrict which connected apps and OAuth flows a user can authorize?
- Named Credentials
- Connected App Policies and OAuth scopes on profiles (Correct answer)
- Remote Site Settings
- Certificate and Key Management
Correct answer: Connected App Policies and OAuth scopes on profiles
Connected App Policies combined with profile-level permissions control which connected apps users can authorize and what OAuth scopes they can grant.
Question 6: A record owner wants to share a specific Opportunity record with a colleague who is not in their role hierarchy and no sharing rule covers this scenario. What should the record owner do?
- Ask the admin to change the OWD to Public Read/Write
- Use the 'Sharing' button on the record to grant manual sharing (Correct answer)
- Assign a Permission Set to the colleague
- Ask the admin to add the colleague to the role hierarchy above the owner
Correct answer: Use the 'Sharing' button on the record to grant manual sharing
Manual Sharing (the 'Sharing' button on a record) lets the record owner or admin grant access to specific users, groups, or roles for that single record.
Question 7: Which of the following best describes the purpose of Salesforce's 'Health Check' tool?
- Monitors server uptime and performance metrics
- Scores your org's security settings against Salesforce baseline standards and highlights risks (Correct answer)
- Checks for duplicate records in the database
- Audits field-level security settings for all profiles
Correct answer: Scores your org's security settings against Salesforce baseline standards and highlights risks
Health Check evaluates your org's security configuration against Salesforce-recommended baselines and gives a score with a list of settings to improve.
CSA Security & Access Management 5
Which Salesforce feature logs every configuration change made in Setup, including who made the change and when?