PD1 Security Model 4 — Questions and Answers
Question 1: What is the minimum access level that Apex Managed Sharing can grant on a custom object record?
- None
- Read Only (Correct answer)
- Read/Write
- Full Access
Correct answer: Read Only
Apex Managed Sharing can grant Read Only, Read/Write, or Full Access, but the minimum non-trivial access level is Read Only.
Question 2: When using 'without sharing' in Apex, what happens to CRUD and FLS enforcement?
- CRUD is enforced but FLS is not
- Both CRUD and FLS are enforced
- Neither CRUD nor FLS is enforced unless explicitly checked (Correct answer)
- FLS is enforced but CRUD is not
Correct answer: Neither CRUD nor FLS is enforced unless explicitly checked
'Without sharing' only affects record-level sharing; CRUD and FLS are still not automatically enforced in Apex unless the developer explicitly checks them.
Question 3: A developer needs to allow a community (Experience Cloud) guest user to read certain records. Which sharing mechanism supports this?
- Role hierarchy
- Guest user sharing rules (Correct answer)
- Profile-based permission sets
- Apex managed sharing with Full Access
Correct answer: Guest user sharing rules
Guest user sharing rules allow unauthenticated Experience Cloud users to access records that meet specific criteria.
Question 4: Which Apex Database method enforces both FLS and CRUD when performing DML?
- Database.insert(record)
- Database.insert(record, AccessLevel.USER_MODE) (Correct answer)
- Database.insertImmediate(record)
- Database.insertWithSharing(record)
Correct answer: Database.insert(record, AccessLevel.USER_MODE)
Passing AccessLevel.USER_MODE to Database DML methods enforces the running user's CRUD and FLS permissions during the operation.
Question 5: What happens to Apex Managed Sharing records when a record's OWD is changed from Private to Public Read/Write?
- Sharing records are preserved but ignored
- Sharing records are automatically deleted by Salesforce (Correct answer)
- Sharing records cause a validation error
- Sharing records are converted to manual shares
Correct answer: Sharing records are automatically deleted by Salesforce
When OWD is changed to a more permissive setting, Salesforce automatically deletes Apex Managed Sharing records because they are no longer needed.
Question 6: A developer wants to verify that the current user can create a new Account record before executing a DML insert. Which check is correct?
- Schema.SObjectType.Account.fields.getMap().isCreateable()
- Schema.SObjectType.Account.isCreateable() (Correct answer)
- Account.SObjectType.getDescribe().isInsertable()
- UserInfo.canCreate('Account')
Correct answer: Schema.SObjectType.Account.isCreateable()
Schema.SObjectType.Account.isCreateable() returns true if the running user's profile and permission sets allow creating Account records.
Question 7: Which Salesforce object stores the reason (row cause) for a programmatically created sharing record?
- The RowCause field on the __Share object (Correct answer)
- The ShareReason__c custom field
- The AccessReason field on SharingRule
- The Cause field on RecordShare
Correct answer: The RowCause field on the __Share object
The RowCause field on the __Share object stores the reason for the share, and Apex Managed Sharing uses a custom RowCause value defined in Setup.
PD1 Security Model 4
What is the minimum access level that Apex Managed Sharing can grant on a custom object record?