PD1 Security Model 3 — Questions and Answers
Question 1: Which Salesforce feature allows a developer to grant temporary elevated access to a record without permanently modifying sharing settings?
- Permission Set Groups
- Manual Sharing (Correct answer)
- Sharing Rules
- Apex Managed Sharing with reason
Correct answer: Manual Sharing
Manual Sharing allows record owners and administrators to share individual records with users or groups on a temporary, one-off basis.
Question 2: When an Apex class is declared with 'inherited sharing', what happens when it is called from a class declared 'without sharing'?
- It enforces sharing rules regardless of caller
- It runs without sharing, inheriting the caller's context (Correct answer)
- It throws a sharing exception
- It defaults to 'with sharing'
Correct answer: It runs without sharing, inheriting the caller's context
A class with 'inherited sharing' adopts the sharing context of its caller; if called from a 'without sharing' class, it runs without sharing.
Question 3: A developer queries the Contact object in Apex without specifying USER_MODE. Which security layer is NOT automatically enforced?
- Object-level security (CRUD)
- Field-level security (FLS)
- Both CRUD and FLS (Correct answer)
- Record sharing rules
Correct answer: Both CRUD and FLS
In default system mode Apex, neither CRUD nor FLS is enforced automatically; developers must use Schema methods or USER_MODE to enforce them.
Question 4: Which method should a developer call to check if the running user has read access to a specific field before rendering it in Apex?
- Schema.SObjectField.getDescribe().isAccessible() (Correct answer)
- UserInfo.isFieldAccessible()
- FieldPermission.canRead()
- Schema.DescribeSObjectResult.isQueryable()
Correct answer: Schema.SObjectField.getDescribe().isAccessible()
Schema.SObjectField.getDescribe().isAccessible() returns true if the current user has read (FLS) access to that field.
Question 5: In the Salesforce sharing model, what does the 'Grant Access Using Hierarchies' setting control?
- Whether role hierarchy grants record access above the owner's role (Correct answer)
- Whether sharing rules apply to the entire hierarchy
- Whether users can share records with subordinates
- Whether OWD can be overridden by role hierarchy
Correct answer: Whether role hierarchy grants record access above the owner's role
When enabled, 'Grant Access Using Hierarchies' allows users above a record owner in the role hierarchy to automatically gain access to that record.
Question 6: A developer creates a trigger on a custom object that performs a SOQL query. What sharing context does the SOQL use by default?
- User mode — enforces sharing of the running user
- System mode — ignores sharing rules and returns all records (Correct answer)
- Guest user mode
- Admin mode — uses system admin's sharing
Correct answer: System mode — ignores sharing rules and returns all records
Apex triggers run in system mode by default, meaning SOQL queries ignore sharing rules and return all records the code has access to.
Question 7: Which type of Salesforce sharing rule grants access based on the values of fields on the record?
- Owner-based sharing rule
- Criteria-based sharing rule (Correct answer)
- Territory-based sharing rule
- Profile-based sharing rule
Correct answer: Criteria-based sharing rule
Criteria-based sharing rules grant access to records that meet specific field value criteria, regardless of who owns the record.
PD1 Security Model 3
Which Salesforce feature allows a developer to grant temporary elevated access to a record without permanently modifying sharing settings?