PD1 Security Model 2 — Questions and Answers
Question 1: A developer needs to ensure that users can only see Accounts they own or that are shared with them explicitly. Which OWD (Organization-Wide Default) setting achieves this?
- Public Read Only
- Public Read/Write
- Private (Correct answer)
- Controlled by Parent
Correct answer: Private
Setting OWD to Private restricts record access to the record owner and users explicitly granted access via sharing rules or manual sharing.
Question 2: Which Apex class method checks whether the current user has a specific permission set assigned?
- UserInfo.hasPermission()
- FeatureManagement.checkPermission() (Correct answer)
- PermissionSet.isAssigned()
- Schema.describeSObjects()
Correct answer: FeatureManagement.checkPermission()
FeatureManagement.checkPermission() returns true if the current user has the specified custom permission enabled via a permission set.
Question 3: A record-level sharing rule is based on criteria. Which two objects can be used as the basis for criteria-based sharing rules?
- Any standard or custom object with OWD set to Private or Public Read Only (Correct answer)
- Only custom objects
- Only objects that support Apex managed sharing
- Any object regardless of OWD setting
Correct answer: Any standard or custom object with OWD set to Private or Public Read Only
Criteria-based sharing rules can be created for standard or custom objects whose OWD is set to Private or Public Read Only.
Question 4: In Salesforce, what is the purpose of the 'View All Data' system permission?
- Allows a user to edit all records in the org
- Allows a user to read all records regardless of sharing settings (Correct answer)
- Grants access to all Setup pages
- Bypasses field-level security on all objects
Correct answer: Allows a user to read all records regardless of sharing settings
The 'View All Data' permission allows users to read every record in the org, overriding all sharing model restrictions.
Question 5: Which keyword in an Apex class declaration causes all DML operations inside it to run with the sharing rules of the calling user?
- without sharing
- with sharing (Correct answer)
- inherited sharing
- global
Correct answer: with sharing
Declaring a class 'with sharing' enforces the current user's record-level sharing rules during DML and SOQL operations within that class.
Question 6: A developer wants to programmatically share a custom object record with a specific user using Apex. Which object type should they insert?
- CustomObject__Share (Correct answer)
- SharingRule__c
- RecordShare__c
- CustomObject__History
Correct answer: CustomObject__Share
For any custom object (MyObj__c), Salesforce automatically creates a MyObj__Share object that supports Apex managed sharing via DML.
Question 7: Field-Level Security (FLS) is enforced automatically in which context?
- Apex code running with sharing
- Apex code running without sharing
- Lightning Web Components using @wire with standard controllers
- Apex code using SOQL with USER_MODE (Correct answer)
Correct answer: Apex code using SOQL with USER_MODE
SOQL queries using USER_MODE enforce both FLS and sharing rules, while standard Apex SOQL runs in system mode by default.
PD1 Security Model 2
A developer needs to ensure that users can only see Accounts they own or that are shared with them explicitly.
Which OWD (Organization-Wide Default) setting achieves this?