CSA Security & Access Management — Questions and Answers
Question 1: What does a profile control in Salesforce?
- Page layout only
- Theme settings
- Object and field permissions (Correct answer)
- Notification frequency
Correct answer: Object and field permissions
A profile in Salesforce is a collection of settings and permissions that determine what a user can do within the application. It controls object-level permissions (e.g., create, read, edit, delete for specific objects) and field-level permissions (e.g., visibility and editability of individual fields). Profiles are fundamental for defining a user's baseline access and capabilities.
Question 2: What is the purpose of permission sets?
- Delete user access
- Create dashboards
- Extend user permissions (Correct answer)
- Backup records
Correct answer: Extend user permissions
Permission sets in Salesforce are used to grant additional permissions and access settings to users, beyond what is provided by their profile. They are a flexible way to extend specific privileges to a subset of users without changing their entire profile. This allows for more granular control and adheres to the principle of least privilege, giving users only the access they need.
Question 3: Which feature restricts access to specific records?
- Validation rules
- Field history tracking
- Sharing rules (Correct answer)
- Page layouts
Correct answer: Sharing rules
Sharing rules in Salesforce are used to extend record access to users beyond what is granted by organization-wide defaults and the role hierarchy. They allow administrators to grant access to specific records based on criteria (e.g., record owner, field values) or group membership. This ensures that users can see the necessary data for their work, even if they are not high in the role hierarchy.
Question 4: How do organization-wide defaults (OWD) work?
- Override profiles
- Apply themes
- Set baseline record access (Correct answer)
- Add new fields
Correct answer: Set baseline record access
Organization-Wide Defaults (OWD) in Salesforce establish the baseline level of access that users have to records they do not own. They define the most restrictive access settings for each object, such as Public Read Only, Public Read/Write, or Private. OWDs are the foundation upon which other sharing mechanisms, like role hierarchies and sharing rules, build to grant broader access.
Question 5: What is a login IP restriction used for?
- Enhance UI
- Enable bulk edits
- Restrict login by IP (Correct answer)
- Send alerts
Correct answer: Restrict login by IP
Login IP restrictions in Salesforce are a security measure designed to control where users can log in from. By defining a range of approved IP addresses, administrators can ensure that users can only access the Salesforce org from trusted networks or locations. This significantly reduces the risk of unauthorized access from external or unknown sources, enhancing data security.
Question 6: What happens if a user is assigned multiple permission sets?
- Only one set applies
- No access granted
- Permissions are combined (Correct answer)
- Latest set overrides others
Correct answer: Permissions are combined
When a user is assigned multiple permission sets, Salesforce combines all permissions granted by each set. This means the user receives the sum of all access and capabilities defined across all assigned permission sets, rather than one overriding another. It's an additive model, ensuring users have the broadest necessary access from their combined assignments.
Question 7: How can you secure sensitive field data from users?
- Record types
- Validation rules
- Field-level security (Correct answer)
- Custom apps
Correct answer: Field-level security
Field-level security (FLS) is the primary method in Salesforce to control which fields users can view and edit. It allows administrators to restrict access to sensitive data on an individual field basis, regardless of the user's record access. This ensures that even if a user can see a record, specific sensitive fields within that record can be hidden or made read-only.
Question 8: What does two-factor authentication (2FA) require?
- Email only
- Username
- Password + additional verification (Correct answer)
- Visualforce page
Correct answer: Password + additional verification
Two-factor authentication (2FA) enhances security by requiring two distinct forms of identification before granting access. This typically involves something the user knows (like a password) combined with something the user has (like a mobile device for a verification code). This layered approach significantly reduces the risk of unauthorized access, even if a password is compromised.
Question 9: Which object controls password policies in Salesforce?
- Roles
- Permission sets
- Profiles (Correct answer)
- Dashboards
Correct answer: Profiles
In Salesforce, password policies, such as length requirements, complexity, and expiration, are primarily controlled at the profile level. Each profile can have its own specific password policy settings, which then apply to all users assigned to that profile. This allows administrators to enforce different security standards for various groups of users within the organization.
CSA Security & Access Management
What does a profile control in Salesforce?