SAA Security & Access Management 2 — Questions and Answers
Question 1: A company wants to ensure that users can only access Salesforce from their corporate network. Which feature should an architect configure?
- Login IP Ranges on profiles (Correct answer)
- Network Access in Setup
- Trusted IP Ranges in Session Settings
- IP Whitelisting in OAuth
Correct answer: Login IP Ranges on profiles
Login IP Ranges set on a profile restrict users with that profile to logging in only from specified IP addresses.
Question 2: Which Salesforce feature allows an administrator to automatically log out inactive users after a specified period?
- Session Timeout policy in Security Settings (Correct answer)
- Login Hours on profiles
- Identity Verification settings
- OAuth token expiry
Correct answer: Session Timeout policy in Security Settings
Session Timeout settings in Security Settings define how long an inactive session persists before automatic logout.
Question 3: A Salesforce org uses Territory Management. How does territory assignment affect record access?
- Territories grant access to accounts and related records beyond role hierarchy (Correct answer)
- Territories replace profiles for access control
- Territories only affect opportunity visibility
- Territories are enforced by permission sets
Correct answer: Territories grant access to accounts and related records beyond role hierarchy
Enterprise Territory Management extends account and related record access to users assigned to matching territories, independent of the role hierarchy.
Question 4: What is the purpose of the 'Grant Login Access' feature in Salesforce?
- Allows users to delegate login access to administrators or partners for support (Correct answer)
- Grants System Administrator profile to a user temporarily
- Provides API-only login for integration users
- Enables single sign-on for external users
Correct answer: Allows users to delegate login access to administrators or partners for support
Grant Login Access lets users authorize administrators or Salesforce Support to log in as them for troubleshooting purposes.
Question 5: Which object-level security mechanism prevents a user from even knowing a particular object exists in Salesforce?
- Setting Tab visibility to 'Tab Hidden' and removing object permissions (Correct answer)
- Field-Level Security
- Sharing rules
- Restriction Rules
Correct answer: Setting Tab visibility to 'Tab Hidden' and removing object permissions
Removing object permissions (Read, Create, etc.) from a profile and hiding the tab prevents users from seeing or interacting with that object entirely.
Question 6: An architect needs to allow a specific set of users to bypass sharing rules and see all records of a particular object. What is the most appropriate approach?
- Create a permission set with 'View All' for that object and assign it to those users (Correct answer)
- Change the org-wide default to Public Read Only
- Add users to the highest role in the hierarchy
- Use a sharing rule with criteria based on record ownership
Correct answer: Create a permission set with 'View All' for that object and assign it to those users
'View All' object permission on a permission set grants unrestricted read access to all records of that object regardless of sharing settings.
Question 7: When should an architect use Restriction Rules in Salesforce?
- To further limit record access for specific users beyond what sharing rules and OWD grant (Correct answer)
- To grant access to records not covered by OWD
- To enforce field-level encryption on sensitive data
- To restrict login access to certain IP ranges
Correct answer: To further limit record access for specific users beyond what sharing rules and OWD grant
Restriction Rules narrow record visibility for specified users or groups, ensuring they see only a subset of records they would otherwise have access to.
SAA Security & Access Management 2
A company wants to ensure that users can only access Salesforce from their corporate network.
Which feature should an architect configure?