SP Security Principles and Practices 3 — Questions and Answers
Question 1: Which Salesforce org security setting determines how long an inactive session remains valid before requiring re-authentication?
- Password Expiration Policy
- Session Timeout (Correct answer)
- Login Hours
- Identity Verification Frequency
Correct answer: Session Timeout
The Session Timeout setting specifies the idle time after which a user's session expires and they must log in again.
Question 2: A partner community user should only see Opportunity records owned by their own account team. Which sharing mechanism best achieves this?
- OWD set to Public Read Only
- Owner-based sharing rules
- High-volume community user sharing
- Account relationship sharing (portal sharing) (Correct answer)
Correct answer: Account relationship sharing (portal sharing)
Portal (account relationship) sharing automatically grants community users access to records associated with their account, limiting visibility to relevant data.
Question 3: What is the function of a 'Muting Permission Set' in a Permission Set Group?
- Temporarily disables an entire Permission Set Group
- Removes specific permissions granted by other permission sets in the group (Correct answer)
- Logs all permission usage for audit purposes
- Prevents users from requesting additional permissions
Correct answer: Removes specific permissions granted by other permission sets in the group
A Muting Permission Set selectively revokes specific permissions within a Permission Set Group without removing the entire permission set.
Question 4: Which security control should be implemented to prevent users from exporting Salesforce data to external applications via API?
- Disable API access in the user's profile (Correct answer)
- Enable Shield Event Monitoring
- Set OWD to Private
- Enforce IP whitelisting
Correct answer: Disable API access in the user's profile
Removing API Enabled permission from a user's profile or permission set prevents that user from accessing Salesforce data via the API.
Question 5: What does Salesforce's 'Transaction Security' feature (part of Shield) allow?
- Encrypts all API payloads in real time
- Defines policies that trigger automated actions when specific events occur (Correct answer)
- Enforces MFA for high-risk transactions
- Restricts data export to approved file formats
Correct answer: Defines policies that trigger automated actions when specific events occur
Transaction Security lets admins create policies that monitor events (like logins or data exports) and automatically respond with actions such as blocking or notifying.
Question 6: An admin wants to ensure that users accessing Salesforce from unrecognized devices must verify their identity via email code. Which feature handles this?
- Login Flows
- Two-Factor Authentication
- Identity Verification (Email OTP for new devices) (Correct answer)
- Connected App OAuth policy
Correct answer: Identity Verification (Email OTP for new devices)
Salesforce's identity verification sends a one-time email code when a user logs in from a device not recognized as trusted, adding a second verification layer.
Question 7: Which type of Salesforce audit tool captures a time-stamped record of changes to field values on records?
- Login History
- Field History Tracking (Correct answer)
- Setup Audit Trail
- Event Monitoring Logs
Correct answer: Field History Tracking
Field History Tracking records the old and new values, changed-by user, and timestamp for up to 20 fields per object when values are modified.
SP Security Principles and Practices 3
Which Salesforce org security setting determines how long an inactive session remains valid before requiring re-authentication?