HAC Security & Authentication 3 — Questions and Answers
Question 1: What is the purpose of HubSpot's 'field-level permissions' in the CRM?
- To encrypt individual CRM fields at rest
- To control which users or teams can view or edit specific contact/company properties (Correct answer)
- To set mandatory fields during form submissions
- To audit changes made to individual record fields
Correct answer: To control which users or teams can view or edit specific contact/company properties
Field-level permissions allow admins to restrict visibility or editing of sensitive CRM properties to specific users or teams.
Question 2: Which HubSpot feature logs every change made to contact records, including who made the change and when?
- Data quality command center
- Property history (Correct answer)
- Audit log
- Activity feed
Correct answer: Property history
HubSpot's property history tracks every value change on a contact property, showing the old value, new value, user, and timestamp.
Question 3: When configuring SAML SSO in HubSpot, what URL must be provided to the identity provider as the 'Assertion Consumer Service (ACS) URL'?
- The HubSpot portal's main login page URL
- A HubSpot-generated endpoint URL specific to the portal's SSO configuration (Correct answer)
- The identity provider's metadata URL
- The HubSpot API gateway URL
Correct answer: A HubSpot-generated endpoint URL specific to the portal's SSO configuration
HubSpot generates a unique ACS URL during SSO setup that must be registered in the IdP so SAML assertions are sent to the correct endpoint.
Question 4: What permission level is required to manage HubSpot's account security settings, including SSO and 2FA enforcement?
- Sales manager
- Marketing admin
- Super admin (Correct answer)
- Account admin (non-super)
Correct answer: Super admin
Only super admins can access and modify account-level security settings like SSO configuration and 2FA enforcement policies.
Question 5: A HubSpot admin notices that a former employee's account was used to export a large contacts list two days after their departure. What feature, if enabled, would have best prevented this?
- IP allowlisting
- Timely user deactivation combined with session invalidation (Correct answer)
- Restricting export permissions to super admins only
- Enabling audit logs
Correct answer: Timely user deactivation combined with session invalidation
Promptly deactivating the user account immediately invalidates their session, preventing post-departure access and data exports.
Question 6: In HubSpot's permission system, what is a 'team' primarily used for?
- Assigning billing responsibility to groups of users
- Organizing users to segment CRM data and manage record access (Correct answer)
- Creating shared inbox routing rules only
- Granting elevated security permissions to groups
Correct answer: Organizing users to segment CRM data and manage record access
Teams in HubSpot group users together to control CRM record visibility, assign records, and manage data segmentation across the portal.
Question 7: What does enabling 'Require email verification' on HubSpot forms help prevent?
- Bot submissions by requiring CAPTCHA completion
- Fake or mistyped email addresses from entering the CRM (Correct answer)
- Duplicate contact creation across portals
- SQL injection attacks via form fields
Correct answer: Fake or mistyped email addresses from entering the CRM
Email verification sends a confirmation link to the submitted address, ensuring only reachable, valid emails get recorded in the CRM.
HAC Security & Authentication 3
What is the purpose of HubSpot's 'field-level permissions' in the CRM?