Free Salesforce Plat-Arch-205 Practice Exam with Questions & Answers

A criteria-based Account sharing rule is appropriate because the desired access is determined by a property of the Account record: whether the record represents a retail Person Account. With Account OWD set to Private, UC can keep Business Accounts restricted and automatically grant the Retail Sales role access to all Accounts that meet the Person Account criterion. An owner-based rule on AccountContactRelation addresses a different relationship and would not provide the required Account visibility. Granting access to a Person Account record type on a profile also does not make every existing Person Account visible; record-type access controls which record types users can create or use, not which records they can see. The architect therefore needs a record-level sharing rule tied to the Account ' s Person Account characteristic. Study Guide reference: Access to Records - criteria-based sharing rules, Person Accounts, Record Types, Account OWD, and distinction between record-type availability and record visibility.

A public group is the appropriate audience because the executives are selected for a specialist responsibility rather than because they all occupy one role. UC can create a group containing only the executives who handle large at-risk deals and share the relevant list views with that group. Using the role hierarchy could expose the views to executives who share the role but do not perform this specialist function. Direct user-by-user sharing is not the standard scalable list-view pattern; a public group centralizes membership and makes later changes easier to administer. As with all list-view sharing, this controls who can see and select the view definition, not who can see the underlying Opportunity records. Each executive still sees only Opportunities permitted by the normal object and record-security model. Study Guide reference: Access to Other Data - list-view sharing, public groups, specialist audiences, scalable administration, and separation of view visibility from record access.

Field-Level Security is the appropriate control because the requirement concerns whether a user may see a sensitive field anywhere in Salesforce, not merely whether the field appears on one page layout. If the VIP Flag is hidden through FLS for non-authorized users, Salesforce can suppress that field across record pages, reports, list views, search results, APIs, and other interfaces according to the user ' s effective permissions. Removing the field from a page layout is only a presentation change and is not a reliable security boundary; a user who retains FLS could still reach the value through another surface. Record types likewise select business processes and page layouts but do not provide authoritative field confidentiality. The architect should therefore grant field visibility only to the Private Banking population, preferably through the organization ' s chosen profile/permission-set strategy, and keep the field hidden from everyone else. This follows the principle that sensitive information must be protected at the data-access layer rather than by cosmetic UI configuration. Study Guide reference: Permissions to Standard Objects, Custom Objects, and Fields - Field-Level Security, page layouts, record types, profiles, permission sets, and protection of sensitive fields.

A PDF stored in a private library is intended to remain private to the file owner until it is deliberately shared or published through another supported context. Salesforce Files does not automatically use the ordinary business-record role hierarchy to expose a private file to managers above the owner. The private-library boundary therefore differs from standard object sharing, where role hierarchy can provide upward access. If collaboration is required, the user should share the file with the appropriate people, group, record, or library rather than relying on hierarchy inheritance. This question tests the fact that file visibility has its own security model and should be evaluated separately from record-level OWD and role hierarchy. The organization should also avoid granting broad system permissions merely to solve an individual file-sharing requirement. Study Guide reference: Access to Other Data - Salesforce Files, private libraries, file ownership, file-sharing contexts, and distinction between file security and record security.

Shipment is a custom object, so Salesforce allows the administrator to control whether access automatically rolls upward through the role hierarchy. If Grant Access Using Hierarchies is disabled, a correctly configured manager role does not by itself provide access to Shipment records owned by subordinate users. With a Private OWD, this produces exactly the symptom described: managers cannot see their team ' s records even though the hierarchy is otherwise correct. Re-enabling Grant Access Using Hierarchies restores the normal upward inheritance pattern for the custom object, assuming managers also have the required object-level permissions. An ownership-based sharing rule is not required merely to reproduce ordinary manager-to-subordinate access, and there is no separate generic switch called ' Role Hierarchy implicit sharing ' that replaces this custom-object setting. Study Guide reference: Access to Records - custom-object OWD, Grant Access Using Hierarchies, role hierarchy, inherited access, and Private sharing. The implementation should also be validated with representative users so effective permissions, sharing inheritance, and any cross-object access behave exactly as designed before production release.

A criteria-based sharing rule combined with a public group precisely matches the requirement. The records are selected by a business characteristic - whether an Opportunity is high value - while the recipients are a cross-functional set of auditors who do not belong to one common role. The public group provides a stable audience that can be maintained independently, and the criteria-based rule automatically exposes only the Opportunities that meet the defined condition. Placing the auditors at the top of the role hierarchy would grant much broader access and distort the hierarchy ' s organizational purpose. Default Opportunity Teams are tied to deal collaboration and individual owners, so they are not an appropriate enterprise audit mechanism. Starting from a Private OWD and opening only the qualifying records to the auditor group preserves least privilege. Study Guide reference: Access to Records - criteria-based sharing, public groups, Private OWD, cross-functional audit access, and least privilege.

The requirement cuts horizontally across a role hierarchy that is intentionally organized by country, so the solution belongs in the sharing-rule layer rather than in a redesign of the hierarchy. A sharing rule can open the relevant Accounts to sales managers in other countries without collapsing distinct regional roles. Among the supplied choices, the owner-based sharing-rule option represents the correct architectural family. If the business condition is literally based on an Account Segment field, a criteria-based sharing rule would be the more precise Salesforce mechanism because criteria-based rules select records by field values whereas owner-based rules select records by the owner ' s role or group. A permission set cannot grant access to selected Account records, and a public group contains users rather than Account records. Putting U.S. and Canadian managers in the same role would not cause peers to inherit one another ' s records and would distort the hierarchy ' s organizational meaning. Study Guide reference: Access to Records - cross-hierarchy sharing, owner-based versus criteria-based rules, roles, public groups, and record-level access.

External organization-wide defaults are designed for this exact separation of internal and external access. UC can keep the internal default for Delivery at the level required by employees while setting Default External Access to Private for authenticated external users. That creates a restrictive baseline for distributors without reducing internal visibility. Sharing rules are additive: they can open access beyond the organization-wide default, but they cannot take away access already granted by a public OWD. For that reason, neither an owner-based nor a criteria-based rule can be used to make external access more restrictive. After the external OWD is Private, UC can selectively grant the required records through the appropriate Experience Cloud mechanism, such as sharing sets, partner roles, sharing rules, or other supported sharing constructs depending on the relationship model. This follows the least-privilege design principle used throughout Salesforce security architecture: establish the most restrictive baseline that satisfies the broad population, then add narrowly scoped exceptions. Study Guide reference: Access to Records - organization-wide defaults, external OWDs, Experience Cloud record access, sharing rules, and least-privilege sharing.

The record must be shared with a dynamically determined user: the manager of the person identified on the Case. A criteria-based sharing rule can evaluate Case fields, but its recipient is a fixed role, group, or other supported target; it cannot resolve a different manager for every record and share only to that person. Programmatic sharing is therefore the appropriate pattern. A trigger can inspect the Legal SME or complaint-agent field, determine the required manager or specialist, create the corresponding Case share, and remove or replace that share when the relationship changes. Making the subject of the complaint the owner would expose the sensitive Case to exactly the person who must not see it, while removing Case object permission from the entire support-agent population would be far broader than required. The design should keep the Case baseline restrictive and grant access only to the HR owner plus the dynamically determined authorized user. Study Guide reference: Access to Records - programmatic Case sharing, dynamic recipients, user lookup relationships, sensitive-record isolation, and least privilege.

Apex-managed sharing gives the development team substantial control over who receives record access, so it must be tested from the perspective of different users. System.runAs() is the appropriate test technique among the choices because it allows the test to execute sharing-sensitive behavior under representative user contexts and verify both positive and negative access outcomes. The test suite should include users who are supposed to receive access and users who must remain restricted, then confirm that the managed share entries produce exactly the intended visibility. A keyword such as without sharing would weaken record enforcement rather than validate it, and with sharing does not enforce Field-Level Security. In production code, record sharing, object CRUD, and FLS still have to be handled as separate concerns; runAs() simply provides a reliable way to exercise user-context behavior in tests. Study Guide reference: Access to Records - Apex-managed sharing, System.runAs(), Private OWD, user-context testing, and validation of least-privilege access.