SP Security Principles and Practices 2 — Questions and Answers
Question 1: Which Salesforce feature allows administrators to restrict login access to specific IP address ranges?
- Login Hours
- Trusted IP Ranges
- Network Access (Correct answer)
- Session Settings
Correct answer: Network Access
Network Access under Security Controls allows administrators to define trusted IP ranges that users can log in from without being challenged.
Question 2: What is the purpose of Salesforce Shield Platform Encryption?
- Encrypt data in transit between browser and server
- Encrypt data at rest in Salesforce databases (Correct answer)
- Enforce field-level security on reports
- Mask sensitive data in Apex debug logs
Correct answer: Encrypt data at rest in Salesforce databases
Shield Platform Encryption encrypts data at rest in Salesforce, protecting sensitive fields stored in the database.
Question 3: A user can view an Account record but cannot see the Annual Revenue field. Which security mechanism is most likely controlling this?
- Record-level sharing
- Object permissions
- Field-Level Security (Correct answer)
- Role hierarchy
Correct answer: Field-Level Security
Field-Level Security (FLS) controls visibility and editability of individual fields independent of object or record access.
Question 4: What does enabling 'Require Secure Connections (HTTPS)' in Session Settings enforce?
- Users must use MFA on every login
- All sessions must use HTTPS rather than HTTP (Correct answer)
- API calls must include a session token
- Login is restricted to corporate IP ranges
Correct answer: All sessions must use HTTPS rather than HTTP
This setting forces all Salesforce sessions to use HTTPS, preventing data from being transmitted over unencrypted HTTP connections.
Question 5: Which permission set feature allows temporary access elevation for users who need it only occasionally?
- Permission Set Groups
- Permission Set Expiration (Correct answer)
- Muting Permission Sets
- Time-based Permission Sets
Correct answer: Permission Set Expiration
Permission Set Expiration allows assigning a permission set with a defined end date, granting temporary elevated access that auto-revokes.
Question 6: What is the primary risk mitigated by enabling 'Lock sessions to the IP address from which they originated'?
- Brute-force password attacks
- Session hijacking via stolen session tokens (Correct answer)
- Cross-site scripting attacks
- API credential leakage
Correct answer: Session hijacking via stolen session tokens
Locking sessions to the originating IP prevents attackers who steal a session token from using it from a different IP address.
Question 7: When should a Salesforce admin use a 'Login Flow' in the context of security?
- To automate lead assignment on login
- To enforce custom authentication steps or collect additional user data at login (Correct answer)
- To redirect users to a custom home page after login
- To log failed login attempts to a custom object
Correct answer: To enforce custom authentication steps or collect additional user data at login
Login Flows allow organizations to add custom screens or logic (such as security questions or terms acceptance) to the authentication process.
SP Security Principles and Practices 2
Which Salesforce feature allows administrators to restrict login access to specific IP address ranges?