PD1 Security Model 5 — Questions and Answers
Question 1: A developer is building a Visualforce page controller. Which approach correctly enforces field-level security before displaying sensitive data?
- Use 'with sharing' on the controller class
- Use Schema.DescribeFieldResult.isAccessible() before referencing the field value (Correct answer)
- Set the OWD to Private for the object
- Use a permission set to restrict the field
Correct answer: Use Schema.DescribeFieldResult.isAccessible() before referencing the field value
Checking isAccessible() on the DescribeFieldResult before displaying a field value is the correct way to enforce FLS in Apex/Visualforce controllers.
Question 2: What is the effect of enabling 'Modify All' object permission on a profile for a specific object?
- Allows reading and editing all records of that object, ignoring sharing
- Allows creating and deleting records of that object only
- Allows full CRUD on that object and overrides sharing rules for records of that type (Correct answer)
- Allows editing all fields including those restricted by FLS
Correct answer: Allows full CRUD on that object and overrides sharing rules for records of that type
'Modify All' on an object grants full CRUD access and overrides the org's sharing model for that specific object, similar to 'Modify All Data' but scoped to one object.
Question 3: In a multi-layered security model, which layer is evaluated LAST when determining if a user can access a record's field?
- Object-level permissions (CRUD)
- Record-level sharing
- Field-Level Security (FLS) (Correct answer)
- IP restrictions
Correct answer: Field-Level Security (FLS)
Salesforce evaluates object permissions first, then record-level sharing, and finally field-level security — FLS is the most granular and last layer checked.
Question 4: Which sharing mechanism should a developer use when business logic requires sharing records with users dynamically at runtime based on complex conditions?
- Owner-based sharing rules
- Criteria-based sharing rules
- Apex Managed Sharing (Correct answer)
- Manual sharing
Correct answer: Apex Managed Sharing
Apex Managed Sharing allows developers to programmatically share records at runtime based on any custom business logic that cannot be expressed in declarative sharing rules.
Question 5: A developer queries Accounts using SOQL in a class declared 'with sharing'. The running user is a standard user with OWD set to Private. What records are returned?
- All Account records in the org
- Only Accounts the user owns or has been explicitly shared with (Correct answer)
- Only Accounts the user created
- No records — a sharing exception is thrown
Correct answer: Only Accounts the user owns or has been explicitly shared with
In a 'with sharing' class, SOQL respects the running user's record visibility, so only records the user owns or that are shared with them via any sharing mechanism are returned.
Question 6: What is the purpose of the 'RowCause' value 'Manual' on a __Share object?
- It indicates the record was shared via a sharing rule
- It indicates the record was shared manually by a user through the UI or API (Correct answer)
- It indicates Apex Managed Sharing created the share
- It indicates the share was inherited from the role hierarchy
Correct answer: It indicates the record was shared manually by a user through the UI or API
A RowCause of 'Manual' on a __Share record means the share was created manually by a user through the Sharing button in the UI or via the API.
Question 7: A developer needs to restrict which users can execute a specific Apex method containing sensitive payroll logic. What is the recommended approach?
- Set the class to 'without sharing'
- Use a Custom Permission checked with FeatureManagement.checkPermission() at the start of the method (Correct answer)
- Restrict the class to global access modifier
- Use field-level security on the object
Correct answer: Use a Custom Permission checked with FeatureManagement.checkPermission() at the start of the method
Assigning a Custom Permission to a Permission Set and checking it with FeatureManagement.checkPermission() restricts method execution to only users with that permission.
PD1 Security Model 5
A developer is building a Visualforce page controller.
Which approach correctly enforces field-level security before displaying sensitive data?