Plat-Arch-205 Salesforce Certified Platform Sharing and Visibility Architect Question and Answers

Apex-managed sharing gives the development team substantial control over who receives record access, so it must be tested from the perspective of different users. System.runAs() is the appropriate test technique among the choices because it allows the test to execute sharing-sensitive behavior under representative user contexts and verify both positive and negative access outcomes. The test suite should include users who are supposed to receive access and users who must remain restricted, then confirm that the managed share entries produce exactly the intended visibility. A keyword such as without sharing would weaken record enforcement rather than validate it, and with sharing does not enforce Field-Level Security. In production code, record sharing, object CRUD, and FLS still have to be handled as separate concerns; runAs() simply provides a reliable way to exercise user-context behavior in tests. Study Guide reference: Access to Records - Apex-managed sharing, System.runAs(), Private OWD, user-context testing, and validation of least-privilege access.

A PDF stored in a private library is intended to remain private to the file owner until it is deliberately shared or published through another supported context. Salesforce Files does not automatically use the ordinary business-record role hierarchy to expose a private file to managers above the owner. The private-library boundary therefore differs from standard object sharing, where role hierarchy can provide upward access. If collaboration is required, the user should share the file with the appropriate people, group, record, or library rather than relying on hierarchy inheritance. This question tests the fact that file visibility has its own security model and should be evaluated separately from record-level OWD and role hierarchy. The organization should also avoid granting broad system permissions merely to solve an individual file-sharing requirement. Study Guide reference: Access to Other Data - Salesforce Files, private libraries, file ownership, file-sharing contexts, and distinction between file security and record security.

Because Invoice is the detail side of a master-detail relationship to Account, its record-level access is controlled by the master. In Salesforce this is effectively a Controlled by Parent model: users can reach the detail record only to the extent that they can reach the associated master record, assuming they also have the necessary object permission on the detail object. The AR users have no access to the relevant Accounts, so they cannot discover or open the dependent Invoice records in list views, reports, or Global Search. Creating a sharing rule directly on the master-detail child does not solve the underlying access problem because the child does not maintain an independent sharing model in the same way as an independently owned record. The required access must therefore be established at the Account level; once the relevant Accounts are shared to AR, the dependent Invoice records become available according to the parent relationship. Study Guide reference: Access to Records - master-detail relationships, Controlled by Parent, OWD, inherited record access, and sharing at the master record.

The relevant Experience Cloud capability is Super User access, which gives selected external users broader visibility to records belonging to other users associated with the same external account. For Customer Community Plus, the modern terminology commonly used is Portal Super User; the answer choice uses the broader or legacy Partner Super User wording, but it represents the same architectural concept being tested. Delegated external-user administration focuses on managing external users rather than granting broad same-account Case visibility, and a generic community-administration permission is not the record-sharing mechanism required. Super User access should be assigned only to carefully selected agents because it materially expands what they can see within the distributor account. The organization ' s external OWD can remain restrictive between distributors while the elevated user receives the intended same-account visibility. Study Guide reference: Access to Records - Customer Community Plus, Super User access, same-account Case visibility, external-user administration, and Experience Cloud least privilege.

For custom objects, Salesforce allows the administrator to disable automatic upward access through the role hierarchy by clearing Grant Access Using Hierarchies. With the NPS object ' s OWD set to Private and hierarchy access disabled, a manager does not gain access simply because the manager occupies a role above the record owner. This is the correct pattern for sensitive employee information when the reporting hierarchy itself must not imply visibility. Apex sharing should not be used to subtract access that is granted by another mechanism; Salesforce sharing is fundamentally additive. Removing all object permissions from managers would be too broad because it would block every NPS record, including records a manager might legitimately need through another explicit authorization process. The secure design establishes a restrictive baseline and then opens only the records that a specific business requirement justifies. Study Guide reference: Access to Records - Private OWD, Grant Access Using Hierarchies, custom-object hierarchy behavior, sensitive-record isolation, and least-privilege sharing.

The users can open the Invoice record, which proves that object and record access are already sufficient to reach the record. The fact that only a small set of system fields is visible while the administrator sees the full detail strongly indicates a Field-Level Security difference. If the Sales Users profile lacks visibility to the remaining fields, Salesforce suppresses those fields even though the page layout contains them. A page layout marked Read-Only would still display the fields; it would only prevent editing. A role-based sharing rule also cannot grant field visibility because sharing rules operate at the record level. The correct troubleshooting path is therefore to review the Invoice object ' s field permissions for the affected profile and any assigned permission sets, using Field Accessibility where useful to understand the effective result. The scenario reinforces that object permission, record sharing, and Field-Level Security are separate controls and must be diagnosed independently. Study Guide reference: Permissions to Standard Objects, Custom Objects, and Fields - Field-Level Security, field accessibility, profiles, permission sets, and separation of field security from record sharing.

The finance analyst receives parent implicit access to the Account because she has been granted access to the related Opportunity. Salesforce provides Read Only access to the parent Account when a user has legitimate access to certain standard child records such as Opportunities, Cases, or Contacts. This lets the user understand the customer context of a record the user is authorized to work with. The same rule does not mean that Opportunity access automatically grants visibility to every Contact associated with that Account; Contact access depends on the organization ' s Contact sharing configuration and other applicable access mechanisms. The role hierarchy is also not the cause described here, because the new visibility appears specifically after the Opportunity was shared to the analyst. The scenario is testing standard implicit sharing rather than a deliberately configured sharing rule. Study Guide reference: Access to Records - implicit sharing, parent implicit access, Opportunity-to-Account relationships, standard-object sharing behavior, and Private OWD.

The valid runtime mechanism among the choices is declaring the Apex class with sharing so Salesforce evaluates record-level sharing when the class queries Shipment records. Because the Shipment OWD is Private, Apex that ignores sharing can expose records outside the user ' s intended visibility. The sensitive Shipment Amount introduces a second security layer: with sharing does not enforce object CRUD or Field-Level Security. The implementation must separately enforce field access, for example with user-mode operations, Security.stripInaccessible(), or valid Schema Describe checks. System.runAs() is useful for tests but does not secure production execution, and isShareable is not a valid Apex sharing keyword. The correct architecture therefore combines record-sharing enforcement with explicit CRUD/FLS enforcement instead of assuming one mechanism protects every layer. Study Guide reference: Permissions to Standard Objects, Custom Objects, and Fields - with sharing, Apex execution context, CRUD/FLS, user-mode operations, and secure Lightning/Apex architecture. The implementation should also be validated with representative users so effective permissions, sharing inheritance, and any cross-object access behave exactly as designed before production release.

Price Books use specialized access semantics rather than the same generic sharing pattern as ordinary business objects. The High Risk Price Book should be the authorization boundary for the sensitive product catalog. UC can maintain broad View Only access where users need to inspect pricing while explicitly sharing the High Risk Price Book with trained staff at the level required to use it during the Opportunity sales process. Users need appropriate Price Book use access to select that Price Book and add its products to an Opportunity. This approach keeps the high-risk product entitlement centralized in the pricing catalog instead of trying to enforce it through page layouts, validation rules, or a broad Opportunity permission. Standard sharing rules are not the normal way to express this Price Book access model, and a solution that grants the entitlement to all sales users would violate the requirement. The architecture should pair the specialized Price Book access with normal Opportunity and Product permissions so only the trained population can transact with the restricted products. Study Guide reference: Access to Other Data - Price Book security, View Only, Use access, product visibility, pricing governance, and least-privilege sales access.

Field-Level Security is the authoritative mechanism because Banking Reps must be able to see the Date of Birth value while Customer Support Reps must additionally be able to edit it. Configuring the field as Visible but Read-Only for Banking Reps and Visible/Edit for Customer Support Reps enforces the requirement across Salesforce interfaces rather than only on one page. Search layouts and page layouts are presentation controls; they cannot override restrictive FLS and should not be used as the sole security boundary. A validation rule tied to a profile name would be brittle, would not address field visibility, and would embed authorization logic in a business rule that becomes difficult to maintain. The architect should implement the field permissions through the organization ' s profile/permission-set strategy and verify that no other permission set grants unintended edit access. Study Guide reference: Permissions to Standard Objects, Custom Objects, and Fields - Field-Level Security, search visibility, read-only fields, profiles, permission sets, and enforceable field authorization.

The requirement cuts horizontally across a role hierarchy that is intentionally organized by country, so the solution belongs in the sharing-rule layer rather than in a redesign of the hierarchy. A sharing rule can open the relevant Accounts to sales managers in other countries without collapsing distinct regional roles. Among the supplied choices, the owner-based sharing-rule option represents the correct architectural family. If the business condition is literally based on an Account Segment field, a criteria-based sharing rule would be the more precise Salesforce mechanism because criteria-based rules select records by field values whereas owner-based rules select records by the owner ' s role or group. A permission set cannot grant access to selected Account records, and a public group contains users rather than Account records. Putting U.S. and Canadian managers in the same role would not cause peers to inherit one another ' s records and would distort the hierarchy ' s organizational meaning. Study Guide reference: Access to Records - cross-hierarchy sharing, owner-based versus criteria-based rules, roles, public groups, and record-level access.

This is an ownership data skew problem. Salesforce sharing performance degrades when a single user or queue owns an excessively large number of records of the same object because ownership is deeply involved in sharing calculations, role changes, group membership evaluation, transfers, and other access operations. A common design guideline is to avoid concentrating more than roughly ten thousand records of one object under a single owner when possible. Here, each donations representative owns more than fifty thousand donor Accounts, well beyond that threshold, and the organization has more than twenty million members overall. The problem is therefore structural, not simply a one-time recalculation event or an incorrect permission assignment. The architect should distribute ownership more evenly and, where concentration cannot be avoided, keep heavily skewed owners out of unnecessary roles and groups to reduce sharing complexity. Study Guide reference: Implications of Security Model Choice - ownership data skew, enterprise-scale sharing, Account ownership, role/group participation, and sharing performance.

Salesforce provides parent implicit sharing for several standard Account relationships. When a user has access to an Opportunity, Case, or Contact, Salesforce can grant Read Only access to the related parent Account so the user can understand the business context of the child record. In this scenario, the sales representative owns the Opportunities, so the representative has direct access to those records and receives implicit Read access to the parent Account even though the Account OWD is Private. That implicit access does not grant Account edit rights. Create/Edit permission on Opportunity determines what the user can do to Opportunity records; it does not translate into Create or Edit access on Account. Object permissions and record access must still be evaluated independently. This behavior is native to standard relationships and should not be confused with a manually created sharing rule. The important exam distinction is that child-record access can produce limited parent visibility, but the inherited access is Read Only unless another mechanism grants more. Study Guide reference: Access to Records - implicit sharing, parent implicit access, Account/Opportunity security, record ownership, and OWD interaction.

The durable design is to anchor the feedback record to the driver for hierarchy purposes, remove the driver ' s object-level Read permission, and allow managers above the driver to inherit record access through the role hierarchy. Ownership by the driver means that when the driver moves to a different manager or branch in the hierarchy, the access path can follow the updated hierarchy instead of remaining tied to a specific former manager. Removing Read permission prevents the driver from opening the Performance Feedback object even though the driver is used as the ownership anchor. Managers are stated to have Read permission, so hierarchy-derived record access can be effective for them. Transferring ownership to the current manager would make the design brittle when management changes, and an additional ownership-based sharing rule is unnecessary when the hierarchy already expresses the upward-access relationship. Study Guide reference: Access to Records - role hierarchy, record ownership, custom-object hierarchy access, object permissions, Private OWD, and management realignment.

The requirement is limited to one object and requires universal visibility without edit access, so the least-privilege solution is a permission set that grants View All Records for Opportunity. View All Records bypasses record-sharing restrictions for that object only. View All Data is much broader because it bypasses sharing across essentially all objects, which would conflict with UC ' s privacy principle and expose more information than the reporting team needs. A permission set is preferable to changing a broad profile when only a few users require the elevation because it can be assigned and removed independently. View All Records does not itself grant edit permission; object CRUD and Field-Level Security still control what users can change and which fields they can access. This preserves the rest of the security model while ensuring the reporting team can see every Opportunity. Study Guide reference: Permissions to Standard Objects, Custom Objects, and Fields - View All Records, View All Data, permission sets, sharing overrides, and least privilege.

A public group provides the cleanest reusable security boundary for report and dashboard folder access. UC can create a Sales Managers public group and maintain the appropriate managers as members, then grant that group the required folder access. Folder sharing remains attached to the group instead of being maintained user by user, which removes the recurring monthly administration described in the scenario. Enhanced folder sharing supports audiences such as users, roles, territories, and public groups, with the folder access level determining whether members can view, edit, or manage the content. Profiles are not the normal sharing target for public report and dashboard folders, so changing a profile does not solve the folder-membership problem. The role hierarchy also should not be treated as though folder access automatically rolls upward in the same way as record access. Folder security is a separate authorization layer. Public groups are particularly effective when a functional population must receive identical access even though membership changes over time. Study Guide reference: Access to Other Data - report and dashboard folders, enhanced folder sharing, public groups, analytics permissions, and scalable administration.

The requirement is a many-to-many external relationship: one part-time agent can work for several distributor Accounts. Contacts to Multiple Accounts can model those relationships through Account Contact Relationships, and a Sharing Set can use the related-account relationship to grant the Experience Cloud user access to the appropriate distributor Accounts. This is substantially more scalable than maintaining Apex share rows or manual sharing rules every time an agent begins or stops working for a distributor. The user ' s access follows the underlying relationship data instead of a separate custom sharing-maintenance process. Customer Community Plus supports the richer external sharing architecture needed for this scenario. The architect should ensure the Sharing Set mapping uses the eligible Account/Contact relationship field and grants only the required access level. Study Guide reference: Access to Records - Sharing Sets, Contacts to Multiple Accounts, Account Contact Relationships, Customer Community Plus, and scalable external record sharing. The implementation should also be validated with representative users so effective permissions, sharing inheritance, and any cross-object access behave exactly as designed before production release.

An Opportunity Team is specifically designed for multiple internal users who collaborate on an individual sales deal. The owner can add specialists such as product, solution, legal, or finance participants, assign each member a team role, and grant the appropriate Read Only or Read/Write access to that Opportunity. This is more maintainable than ad hoc manual sharing because the collaboration relationship is explicitly modeled as part of the sales process. The expected Account or Opportunity ownership change is also important: Salesforce provides options to retain the team when ownership changes, allowing the collaboration structure to continue through reassignment. Manual sharing of the Account would be unnecessarily broad because the requirement is to collaborate on one Opportunity, not to expose all customer information. Opportunity Teams therefore provide the correct scope, governance, and business semantics for a private Opportunity model. Study Guide reference: Access to Records - Opportunity Teams, team access levels, ownership changes, Private OWD, and collaborative sales access.

Mary has no effective access because object-level Read permission is a prerequisite for every record-level access mechanism. Public Read-Only OWD and the role hierarchy can determine which Invoice records a user may see only after the user is authorized to read the Invoice object itself. Mary ' s profile does not grant that permission, so neither the public OWD nor her position above Joe can make Joe ' s Invoice records available. Record sharing never substitutes for object CRUD. This is a core Salesforce security-order concept: object permissions establish whether a user can use an object, Field-Level Security determines which fields are available, and OWD, hierarchy, sharing rules, teams, and manual sharing determine which records are visible. Granting Read through a profile or permission set would be required before Public Read-Only or hierarchy-derived access could take effect. Study Guide reference: Permissions to Standard Objects, Custom Objects, and Fields - object CRUD, profiles, permission sets, OWD interaction, role hierarchy, and layered security evaluation.

A criteria-based sharing rule combined with a public group precisely matches the requirement. The records are selected by a business characteristic - whether an Opportunity is high value - while the recipients are a cross-functional set of auditors who do not belong to one common role. The public group provides a stable audience that can be maintained independently, and the criteria-based rule automatically exposes only the Opportunities that meet the defined condition. Placing the auditors at the top of the role hierarchy would grant much broader access and distort the hierarchy ' s organizational purpose. Default Opportunity Teams are tied to deal collaboration and individual owners, so they are not an appropriate enterprise audit mechanism. Starting from a Private OWD and opening only the qualifying records to the auditor group preserves least privilege. Study Guide reference: Access to Records - criteria-based sharing, public groups, Private OWD, cross-functional audit access, and least privilege.

A Sharing Set is the standard declarative mechanism for Customer Community users whose Case access can be derived from their Account or Contact relationship. The user ' s external identity is linked to a Contact and therefore to an Account; the Sharing Set can map that user relationship to the Account relationship on Case and grant access when they match. This is especially appropriate for high-volume external users because it avoids building a conventional role hierarchy merely to express simple account-based access. A normal sharing rule is not the best fit for that license model, and Apex sharing would add code and maintenance even though Salesforce already provides a native relationship-based mechanism. The architect should configure the Sharing Set for the applicable external profile, include Case as the target object, select the appropriate access mapping, and grant only the level of access required. Study Guide reference: Access to Records - Customer Community security, Sharing Sets, high-volume external users, account/contact mappings, and Case access.

The requirement follows a direct manager-to-subordinate relationship, so the role hierarchy is the native record-access mechanism. By placing the operations users below the operations manager and enabling Grant Access Using Hierarchies for the custom Scheduled Course object, Salesforce can automatically provide the manager access to records owned by those subordinate users. The manager must also have the necessary object-level Edit permission because hierarchy access cannot create object capability that the user lacks. A public group alone does not share records; it is simply a reusable collection that must be referenced by another sharing mechanism. An ownership-based sharing rule could create access, but it would duplicate a relationship already expressed by the hierarchy and add unnecessary maintenance across hundreds of regions. Study Guide reference: Access to Records - Role Hierarchy, Grant Access Using Hierarchies, custom-object sharing, manager access, and object permissions. The implementation should also be validated with representative users so effective permissions, sharing inheritance, and any cross-object access behave exactly as designed before production release.