SAA Security & Access Management 3 — Questions and Answers
Question 1: A company integrates Salesforce with an external system using a connected app. Which OAuth flow is most appropriate for a server-to-server integration with no user interaction?
- JWT Bearer Token Flow (Correct answer)
- Web Server Flow
- User-Agent Flow
- Device Flow
Correct answer: JWT Bearer Token Flow
The JWT Bearer Token Flow enables server-to-server integrations by allowing a connected app to authenticate using a digital certificate without user interaction.
Question 2: What does the 'Modify All Data' permission allow a user to do that 'View All Data' does not?
- Create, edit, and delete all records regardless of sharing settings (Correct answer)
- Access all Setup menu options
- Assign permission sets to other users
- Reset other users' passwords
Correct answer: Create, edit, and delete all records regardless of sharing settings
'Modify All Data' grants full CRUD access to every record in the org, while 'View All Data' only grants read access across all records.
Question 3: An architect is designing a Customer Community where external users should only see their own cases. Which OWD setting achieves this for the Case object?
- Private (Correct answer)
- Public Read Only
- Public Read/Write
- Controlled by Parent
Correct answer: Private
Setting Case OWD to Private ensures that users can only see records they own, which is the baseline for community user isolation.
Question 4: Which Salesforce feature enables administrators to track who viewed, exported, or changed sensitive records?
- Field Audit Trail
- Login History
- Setup Audit Trail
- Event Monitoring (Correct answer)
Correct answer: Event Monitoring
Event Monitoring provides detailed logs of user actions including record views, exports, API calls, and logins, enabling security and compliance auditing.
Question 5: A profile has 'Read' access to Opportunity but a permission set assigned to the user grants 'Edit' on Opportunity. What is the effective permission?
- Edit, because permissions are additive — the most permissive level applies (Correct answer)
- Read, because profile takes precedence over permission sets
- No access, due to conflicting permissions
- It depends on the order the permission set was assigned
Correct answer: Edit, because permissions are additive — the most permissive level applies
Salesforce permissions are additive; if any profile or permission set grants a higher level of access, that higher level is the effective permission.
Question 6: What is the primary difference between a Role and a Profile in Salesforce security?
- Roles control record-level access via hierarchy; profiles control object and field-level access (Correct answer)
- Roles control field visibility; profiles control record sharing
- Roles are mandatory; profiles are optional
- Roles replace sharing rules in complex orgs
Correct answer: Roles control record-level access via hierarchy; profiles control object and field-level access
Profiles determine what objects and fields a user can access, while roles control which records a user can see through the role hierarchy.
Question 7: When configuring a Named Credential in Salesforce, what security benefit does it provide for external callouts?
- It stores authentication details securely and prevents credentials from appearing in Apex code (Correct answer)
- It encrypts the HTTP response payload automatically
- It enforces IP restrictions on outbound callouts
- It logs all callout details to Event Monitoring
Correct answer: It stores authentication details securely and prevents credentials from appearing in Apex code
Named Credentials securely store endpoint URLs and authentication credentials, keeping sensitive information out of Apex code and org configuration.
SAA Security & Access Management 3
A company integrates Salesforce with an external system using a connected app.
Which OAuth flow is most appropriate for a server-to-server integration with no user interaction?