Free and Premium Salesforce Plat-Arch-205 Dumps Questions Answers

Public Read-Only gives John baseline Read access to every Account, but it does not let him edit Paul ' s Account. When Paul manually grants John Edit access, Salesforce adds an explicit AccountShare entry representing that exceptional access. The new share has a Manual row cause and a Read/Write access level; it does not transfer ownership and it does not convert the existing OWD-derived access into an owner share. Salesforce evaluates all applicable access mechanisms and gives the user the highest effective access, so the explicit manual share raises John ' s effective access on that record from Read Only to Read/Write. The design illustrates the additive nature of Salesforce record security: OWD establishes the baseline and explicit shares can open a specific record further. Ownership remains with Paul, and the manual share should be used only where a deliberate exception to the baseline is required. Study Guide reference: Access to Records - manual sharing, AccountShare, RowCause, OWD, additive record access, and effective access calculation.

Price Books have specialized organization-wide access levels. Use is the appropriate level when sales agents must not only view products and pricing but also select the Price Book and add its products to Opportunities. View Only supports inspection and reporting but does not represent the same ability to transact with the Price Book during the sales process. Salesforce therefore distinguishes Use, View Only, and No Access so organizations can separate catalog visibility from sales usability. If UC later needs to restrict specialized Price Books, it can establish a more restrictive baseline and explicitly share those Price Books with selected users, roles, or groups at the Use level. The Price Book security model must also be combined with normal Product, Opportunity, and object permissions because each layer controls a different part of the process. Study Guide reference: Access to Other Data - Price Book security, Use access, View Only, product pricing, and Opportunity product access.

The custom Apex layer is responsible for enforcing Salesforce security; the Lightning component does not automatically make server-side data access safe. The valid runtime control among the choices is the Apex security mechanism that checks or enforces the user ' s access before data is returned or changed. Field-Level Security must be respected for sensitive values such as Shipment Amount, and the record-sharing model must also be enforced so a Private OWD is not bypassed. Schema Describe checks such as isAccessible(), isCreateable(), and isUpdateable() can be used for explicit field and object permission checks. Current secure-Apex patterns also include user-mode database operations and Security.stripInaccessible(), which can enforce or sanitize CRUD/FLS more comprehensively. Record visibility is a separate layer and should be preserved with the appropriate sharing context. System.runAs() is a testing facility, not a production authorization mechanism, and isShareable is not a valid Apex security keyword. Study Guide reference: Permissions to Standard Objects, Custom Objects, and Fields - secure Apex, CRUD/FLS, record-sharing enforcement, user-mode operations, and Lightning/Apex security boundaries.

The requirement cuts horizontally across a role hierarchy that is intentionally organized by country, so the solution belongs in the sharing-rule layer rather than in a redesign of the hierarchy. A sharing rule can open the relevant Accounts to sales managers in other countries without collapsing distinct regional roles. Among the supplied choices, the owner-based sharing-rule option represents the correct architectural family. If the business condition is literally based on an Account Segment field, a criteria-based sharing rule would be the more precise Salesforce mechanism because criteria-based rules select records by field values whereas owner-based rules select records by the owner ' s role or group. A permission set cannot grant access to selected Account records, and a public group contains users rather than Account records. Putting U.S. and Canadian managers in the same role would not cause peers to inherit one another ' s records and would distort the hierarchy ' s organizational meaning. Study Guide reference: Access to Records - cross-hierarchy sharing, owner-based versus criteria-based rules, roles, public groups, and record-level access.

The requirement is a many-to-many external relationship: one part-time agent can work for several distributor Accounts. Contacts to Multiple Accounts can model those relationships through Account Contact Relationships, and a Sharing Set can use the related-account relationship to grant the Experience Cloud user access to the appropriate distributor Accounts. This is substantially more scalable than maintaining Apex share rows or manual sharing rules every time an agent begins or stops working for a distributor. The user ' s access follows the underlying relationship data instead of a separate custom sharing-maintenance process. Customer Community Plus supports the richer external sharing architecture needed for this scenario. The architect should ensure the Sharing Set mapping uses the eligible Account/Contact relationship field and grants only the required access level. Study Guide reference: Access to Records - Sharing Sets, Contacts to Multiple Accounts, Account Contact Relationships, Customer Community Plus, and scalable external record sharing. The implementation should also be validated with representative users so effective permissions, sharing inheritance, and any cross-object access behave exactly as designed before production release.

System.runAs() is used in Apex tests to execute a block of code in the context of a specified user so that user-dependent record-sharing behavior can be verified. It is particularly useful when the application relies on a Private OWD, role hierarchy, manual or managed shares, or classes declared with sharing. A well-designed test creates representative users, runs the relevant code under those users, and confirms that authorized users can retrieve the intended records while unauthorized users cannot. The key distinction is that runAs() is not itself a production security mechanism and does not replace explicit enforcement of CRUD or Field-Level Security. Object permissions, field permissions, and record sharing remain separate layers that the implementation must enforce appropriately. This question therefore focuses on the sharing aspect of user context rather than on field-level authorization. Study Guide reference: Access to Records - Apex sharing tests, System.runAs(), user context, record visibility, and secure testing of sharing behavior.

External organization-wide defaults are designed for this exact separation of internal and external access. UC can keep the internal default for Delivery at the level required by employees while setting Default External Access to Private for authenticated external users. That creates a restrictive baseline for distributors without reducing internal visibility. Sharing rules are additive: they can open access beyond the organization-wide default, but they cannot take away access already granted by a public OWD. For that reason, neither an owner-based nor a criteria-based rule can be used to make external access more restrictive. After the external OWD is Private, UC can selectively grant the required records through the appropriate Experience Cloud mechanism, such as sharing sets, partner roles, sharing rules, or other supported sharing constructs depending on the relationship model. This follows the least-privilege design principle used throughout Salesforce security architecture: establish the most restrictive baseline that satisfies the broad population, then add narrowly scoped exceptions. Study Guide reference: Access to Records - organization-wide defaults, external OWDs, Experience Cloud record access, sharing rules, and least-privilege sharing.

Deferred Sharing Calculation is intended for major administrative changes that would otherwise cause Salesforce to repeatedly recalculate sharing while the organization is still in an intermediate state. During a large role hierarchy restructuring and mass Account ownership realignment, each individual change can affect group membership and record access. With deferred calculation enabled, administrators can suspend automatic calculation while they perform the planned restructuring and then explicitly resume and recalculate after the final model is in place. This reduces repeated work and can materially improve the operational stability of a very large reorganization. The capability must be governed carefully because access changes made while calculation is suspended are not reflected until the recalculation is completed. Skinny tables solve a different database-performance problem, and Divisions partition data but do not prevent repeated sharing recalculations. Study Guide reference: Implications of Security Model Choice - Deferred Sharing Calculation, large organizational changes, role and ownership maintenance, sharing recalculation, and operational governance.

Mary has no effective access because object-level Read permission is a prerequisite for every record-level access mechanism. Public Read-Only OWD and the role hierarchy can determine which Invoice records a user may see only after the user is authorized to read the Invoice object itself. Mary ' s profile does not grant that permission, so neither the public OWD nor her position above Joe can make Joe ' s Invoice records available. Record sharing never substitutes for object CRUD. This is a core Salesforce security-order concept: object permissions establish whether a user can use an object, Field-Level Security determines which fields are available, and OWD, hierarchy, sharing rules, teams, and manual sharing determine which records are visible. Granting Read through a profile or permission set would be required before Public Read-Only or hierarchy-derived access could take effect. Study Guide reference: Permissions to Standard Objects, Custom Objects, and Fields - object CRUD, profiles, permission sets, OWD interaction, role hierarchy, and layered security evaluation.

Salesforce can make a custom list view visible to a role and its internal subordinates, which is appropriate when the intended audience already aligns with the role hierarchy. Using that audience avoids maintaining dozens of list views against individual users and allows the hierarchy to represent the geographic or organizational population naturally. A queue is intended for supported record ownership and workload distribution, not for governing list-view visibility. Direct sharing to arbitrary individual users is also not the standard list-view model; when the population does not correspond to a role, a public group is typically the better abstraction. The architect must distinguish list-view visibility from record visibility: being able to select a view does not grant access to the Opportunities that satisfy its filter. Each user still sees only records allowed by object permissions, OWD, hierarchy, sharing rules, teams, and other record-level mechanisms. Study Guide reference: Access to Other Data - list views, roles and internal subordinates, public groups, scalable view administration, and separation of view access from record access.

Apex-managed sharing gives the development team substantial control over who receives record access, so it must be tested from the perspective of different users. System.runAs() is the appropriate test technique among the choices because it allows the test to execute sharing-sensitive behavior under representative user contexts and verify both positive and negative access outcomes. The test suite should include users who are supposed to receive access and users who must remain restricted, then confirm that the managed share entries produce exactly the intended visibility. A keyword such as without sharing would weaken record enforcement rather than validate it, and with sharing does not enforce Field-Level Security. In production code, record sharing, object CRUD, and FLS still have to be handled as separate concerns; runAs() simply provides a reliable way to exercise user-context behavior in tests. Study Guide reference: Access to Records - Apex-managed sharing, System.runAs(), Private OWD, user-context testing, and validation of least-privilege access.

A Public Group is the standard reusable container for users who need common record access but do not share a natural position in the role hierarchy. Public groups can include individual users, roles, roles with subordinates, and other groups, then be referenced by sharing rules or manual sharing. The role hierarchy is intended for vertical access based on organizational responsibility, so forcing unrelated users into one role would distort the security model. Sharing Sets serve a different purpose: they are relationship-based Experience Cloud mechanisms that map an external user ' s Account or Contact relationship to target records. For unrelated internal users, the architect should create a public group and then use that group as the recipient in the appropriate sharing mechanism. This centralizes membership management and lets the record-sharing rule remain stable even as individual users change. Study Guide reference: Access to Records - Public Groups, sharing-rule recipients, cross-functional access, role hierarchy, and scalable record-sharing design.

Dynamic Forms is the declarative solution for adapting record presentation without replacing the standard Salesforce page with custom Visualforce or Lightning code. It allows administrators to place fields and field sections individually on a Lightning record page and apply visibility rules based on record context or supported device conditions. That is a better fit for form-factor and alignment problems than maintaining custom view-action overrides that detect devices and route users to different layouts. The declarative approach reduces code ownership, regression risk, testing effort, and long-term maintenance while preserving the standard Salesforce record experience. Where the requirement is driven by record type, the same mechanism can show different field sections for different business processes. The architect must still remember that Dynamic Forms controls presentation rather than security: fields that are hidden by component visibility can still be available through reports, list views, APIs, or other interfaces if Field-Level Security grants access. Sensitive information therefore still requires proper FLS. Study Guide reference: Implications of Security Model Choice - Dynamic Forms, Lightning App Builder, component visibility, record types, device form factors, maintainability, and UI visibility versus security.

Partner Community is the appropriate external license model because the distributors participate in a B2B sales process and require Opportunity visibility. Partner-oriented licenses support the external role hierarchy and the sales-object collaboration model needed for channel users such as distributors and resellers. Customer Community is primarily aimed at high-volume customer self-service and does not provide the same Opportunity-oriented partner model. Customer Community Plus adds more advanced sharing than basic Customer Community, but it is not the primary licensing model for external channel sales collaboration. At the scale described, the architect must also design the partner role hierarchy and external sharing model carefully so that one distributor cannot see another distributor ' s records and so that role/group proliferation does not create unnecessary sharing complexity. The license defines the ceiling of what the external user can do; UC must still configure object permissions and record-level sharing to expose only the Opportunities relevant to each distributor. Study Guide reference: Access to Records - Experience Cloud licensing, Partner Community, Opportunity access, partner roles, external sales collaboration, and scalable partner sharing.

A Default Account Team is designed for sales representatives who repeatedly collaborate with the same internal specialists on customer Accounts. The representative can define recurring team members such as legal, engineering, or finance and specify the access each team member receives to the Account and, where applicable, related Opportunities and Cases. The default team can then be applied automatically to new or transferred Accounts or added to existing Accounts, eliminating the repetitive manual-sharing work described in the scenario. A criteria-based sharing rule is better suited to record access determined by stable record attributes and a fixed audience; it does not model a recurring collaboration team tied to a particular salesperson. View All Data would be dramatically overprivileged because it bypasses record-level controls across the organization. Default Account Teams therefore improve productivity while preserving least privilege and making the collaboration relationship explicit. Study Guide reference: Access to Records - Default Account Teams, team roles, related-record access, collaboration, and least-privilege sharing.

Public Read-Only is the correct Lead OWD because it balances duplicate prevention with ownership-based editing. Users can see existing Lead records across the organization, which helps them identify whether a prospect already exists before creating another Lead, but they cannot edit another user ' s Lead merely because they can view it. A Private OWD would protect ownership more strictly but would undermine the duplicate-reduction objective because users might not be able to discover Leads owned elsewhere. Public Read/Write/Transfer would go too far in the opposite direction by allowing broader modification or reassignment than the requirement permits. The organization can complement the OWD with Duplicate Rules and Matching Rules for stronger prevention and warning behavior, but the OWD still establishes the right record-visibility baseline. Study Guide reference: Access to Records - Lead OWD, Public Read-Only, record ownership, duplicate prevention, and least-privilege access. The implementation should also be validated with representative users so effective permissions, sharing inheritance, and any cross-object access behave exactly as designed before production release.

Salesforce provides parent implicit sharing for several standard Account relationships. When a user has access to an Opportunity, Case, or Contact, Salesforce can grant Read Only access to the related parent Account so the user can understand the business context of the child record. In this scenario, the sales representative owns the Opportunities, so the representative has direct access to those records and receives implicit Read access to the parent Account even though the Account OWD is Private. That implicit access does not grant Account edit rights. Create/Edit permission on Opportunity determines what the user can do to Opportunity records; it does not translate into Create or Edit access on Account. Object permissions and record access must still be evaluated independently. This behavior is native to standard relationships and should not be confused with a manually created sharing rule. The important exam distinction is that child-record access can produce limited parent visibility, but the inherited access is Read Only unless another mechanism grants more. Study Guide reference: Access to Records - implicit sharing, parent implicit access, Account/Opportunity security, record ownership, and OWD interaction.

Account Teams are designed to model collaboration around an Account while allowing different access levels to the Account and its related Opportunities and Cases. UC can give the sales associate Read access to the Account, Read access to related Cases, and no general Opportunity access through the team configuration. If the associate later needs access to a particular Opportunity, that record can be opened separately through an Opportunity Team or another appropriate sharing mechanism. Introducing separate Case Teams or sharing rules would duplicate functionality that the Account Team already provides for this collaboration model. The design also preserves the Private OWD, because access is granted only to the users explicitly added to the team. Object permissions still apply independently, so the sales associate must have the required object-level Read permission before the team access can be effective. Study Guide reference: Access to Records - Account Teams, related Opportunity and Case access, team roles, Private OWD, and least-privilege collaboration.

A public group is the scalable audience mechanism for list views that should be visible only to a defined set of users. UC can create groups that represent the relevant geography or specialist population and share each list view with the appropriate group instead of trying to maintain visibility user by user. This becomes especially important when there are dozens of list views and frequent personnel changes: administrators update group membership rather than modifying many view definitions. A queue is intended for supported record ownership and workload distribution, not for controlling list-view visibility. Direct sharing to arbitrary individual users is also not the standard list-view model; a public group provides the reusable abstraction when the target audience does not correspond to a single role. The architect must also distinguish visibility of the list-view definition from visibility of the underlying Opportunity records. Sharing a list view does not grant record access; users still see only records permitted by their object permissions, OWD, hierarchy, sharing rules, teams, and other record-level mechanisms. Study Guide reference: Access to Other Data - list-view sharing, public groups, scalable audience management, and separation of view visibility from record access.

View All Records is an object-specific sharing override. Granting View All on Case lets the service representative see every Case regardless of the Case OWD, but it does not automatically grant the same access to Account or other related standard objects. Each object still requires its own object permission and record-access path. This is an important distinction from normal implicit sharing: Salesforce does not treat a broad View All grant on the child object as though the user had individually received each child record through ownership or a normal share, so the expected parent access must be evaluated separately. If Contact is Controlled by Parent, Contact visibility depends on the user ' s access to the parent Account. The architect must therefore design Account access explicitly rather than assuming that universal Case visibility cascades through the customer data model. Study Guide reference: Access to Records - View All Records, object-specific sharing overrides, Account/Case relationships, Controlled by Parent, and Private OWD.

Because Invoice is the detail side of a master-detail relationship to Account, its record-level access is controlled by the master. In Salesforce this is effectively a Controlled by Parent model: users can reach the detail record only to the extent that they can reach the associated master record, assuming they also have the necessary object permission on the detail object. The AR users have no access to the relevant Accounts, so they cannot discover or open the dependent Invoice records in list views, reports, or Global Search. Creating a sharing rule directly on the master-detail child does not solve the underlying access problem because the child does not maintain an independent sharing model in the same way as an independently owned record. The required access must therefore be established at the Account level; once the relevant Accounts are shared to AR, the dependent Invoice records become available according to the parent relationship. Study Guide reference: Access to Records - master-detail relationships, Controlled by Parent, OWD, inherited record access, and sharing at the master record.

Salesforce Content Deliveries are designed to distribute files externally through generated links and include an option to require a password before the recipient can access the content. That directly satisfies the CISO ' s requirement without adding a third-party product or building an Experience Cloud site solely for file delivery. A content delivery can provide a controlled external URL while the password is communicated separately to the customer. Administrators can also establish organization-level policies for content-delivery password behavior so the security requirement is applied consistently. An Experience Cloud site would introduce identity, licensing, and site-management overhead that is unnecessary when the business simply needs to send a protected file link. The architect should still consider the sensitivity of the content, expiration requirements, and broader information-governance policy when deciding whether content delivery is appropriate for a particular file. Study Guide reference: Access to Other Data - Salesforce Files, Content Deliveries, external file access, password protection, and secure content distribution.

A criteria-based sharing rule combined with a public group precisely matches the requirement. The records are selected by a business characteristic - whether an Opportunity is high value - while the recipients are a cross-functional set of auditors who do not belong to one common role. The public group provides a stable audience that can be maintained independently, and the criteria-based rule automatically exposes only the Opportunities that meet the defined condition. Placing the auditors at the top of the role hierarchy would grant much broader access and distort the hierarchy ' s organizational purpose. Default Opportunity Teams are tied to deal collaboration and individual owners, so they are not an appropriate enterprise audit mechanism. Starting from a Private OWD and opening only the qualifying records to the auditor group preserves least privilege. Study Guide reference: Access to Records - criteria-based sharing, public groups, Private OWD, cross-functional audit access, and least privilege.

Private is the correct organization-wide default because at least one population must be prevented from seeing a subset of Account records. Salesforce sharing is additive: once an OWD grants broad access, sharing rules cannot be used to take that access away for a particular group. Starting with Private creates the restrictive baseline needed to keep Prospect Accounts hidden from Service users. UC can then grant Read access to all Accounts for the sales population, let ownership give sales users edit access to their own Accounts, and use the role hierarchy so sales managers inherit the appropriate access to records owned by their team. Service users can receive Read access only to the non-Prospect Accounts through an appropriately designed sharing rule. Public Read/Write or Public Read/Transfer would establish an access baseline that is already broader than the requirements allow and therefore could not be corrected through ordinary sharing rules. Study Guide reference: Access to Records - OWD design, Private baseline, additive sharing, role hierarchy, criteria-based sharing, and least privilege.

An Opportunity Team is specifically designed for multiple internal users who collaborate on an individual sales deal. The owner can add specialists such as product, solution, legal, or finance participants, assign each member a team role, and grant the appropriate Read Only or Read/Write access to that Opportunity. This is more maintainable than ad hoc manual sharing because the collaboration relationship is explicitly modeled as part of the sales process. The expected Account or Opportunity ownership change is also important: Salesforce provides options to retain the team when ownership changes, allowing the collaboration structure to continue through reassignment. Manual sharing of the Account would be unnecessarily broad because the requirement is to collaborate on one Opportunity, not to expose all customer information. Opportunity Teams therefore provide the correct scope, governance, and business semantics for a private Opportunity model. Study Guide reference: Access to Records - Opportunity Teams, team access levels, ownership changes, Private OWD, and collaborative sales access.