Sales operations at Universal Containers (UC) has created Public Reports and Dashboards folders for sales managers. Sales operations and sales managers report to the VP of Sales. Sales operations currently spends a few hours each month updating users that should have access to edit reports and dashboards in these folders. How should UC grant access to sales managers to automate access to these Public Reports and Dashboards folders?
Answer : C
Comprehensive and Detailed 150 to 250 words of Explanation From Platform Sharing and Visibility Architect/Course Guide/topics:
A public group provides the cleanest reusable security boundary for report and dashboard folder access. UC can create a Sales Managers public group and maintain the appropriate managers as members, then grant that group the required folder access. Folder sharing remains attached to the group instead of being maintained user by user, which removes the recurring monthly administration described in the scenario. Enhanced folder sharing supports audiences such as users, roles, territories, and public groups, with the folder access level determining whether members can view, edit, or manage the content. Profiles are not the normal sharing target for public report and dashboard folders, so changing a profile does not solve the folder-membership problem. The role hierarchy also should not be treated as though folder access automatically rolls upward in the same way as record access. Folder security is a separate authorization layer. Public groups are particularly effective when a functional population must receive identical access even though membership changes over time. Study Guide reference: Access to Other Data - report and dashboard folders, enhanced folder sharing, public groups, analytics permissions, and scalable administration.
===============
The corporate identity and access team needs to audit User setup in the Salesforce org. Which permission should be granted to this team so they can perform their audit?
Answer : A
Comprehensive and Detailed 150 to 250 words of Explanation From Platform Sharing and Visibility Architect/Course Guide/topics:
View All Users is the narrowly scoped system permission intended for users who must see every User record regardless of the User object's sharing restrictions. That makes it appropriate for an identity and access audit because the team can review user configuration without receiving broad visibility to unrelated business data. View All Data is far more powerful: it bypasses record-level restrictions across the organization and would violate least privilege when the requirement is limited to User setup. The User object also has specialized visibility and sharing semantics, so simply thinking in terms of a generic object-level Read permission does not address the need to bypass restrictive User sharing. The preferred architecture is to grant View All Users through a dedicated permission set assigned only to the identity and access auditors, then remove it when no longer required. Study Guide reference: Access to Other Data - User record sharing, View All Users, identity administration, system permissions, and least privilege.
===============
What should an architect recommend to make sure that users that gained access to a custom object record through Apex managed sharing do not lose access to it when its owner is changed?
Answer : B
Comprehensive and Detailed 150 to 250 words of Explanation From Platform Sharing and Visibility Architect/Course Guide/topics:
For custom objects, a dedicated Apex Sharing Reason should be used when programmatic shares must survive a change of record owner. Apex-managed shares that use a custom sharing reason are designed to represent access granted by business logic independently of ownership. A share created with RowCause Manual is different: manual shares can be removed when ownership changes, so they are not reliable for persistent application-managed access. The with sharing keyword also does not control the persistence of share-table rows; it controls whether Apex respects the current record-sharing model when executing queries and DML. A custom sharing reason has an additional operational advantage because it gives the application a stable way to identify, update, or remove only the shares created for that business process. Study Guide reference: Access to Records - Apex-managed sharing, Apex Sharing Reasons, RowCause, ownership changes, and custom-object share lifecycle. The implementation should also be validated with representative users so effective permissions, sharing inheritance, and any cross-object access behave exactly as designed before production release.
===============
Sales executives at Universal Containers (UC) want to create list views to filter opportunities for large at-risk opportunities. These list views should only be available to certain executives who specialize in closing problematic deals. What should UC do to solve this requirement?
Answer : C
Comprehensive and Detailed 150 to 250 words of Explanation From Platform Sharing and Visibility Architect/Course Guide/topics:
A public group is the appropriate audience because the executives are selected for a specialist responsibility rather than because they all occupy one role. UC can create a group containing only the executives who handle large at-risk deals and share the relevant list views with that group. Using the role hierarchy could expose the views to executives who share the role but do not perform this specialist function. Direct user-by-user sharing is not the standard scalable list-view pattern; a public group centralizes membership and makes later changes easier to administer. As with all list-view sharing, this controls who can see and select the view definition, not who can see the underlying Opportunity records. Each executive still sees only Opportunities permitted by the normal object and record-security model. Study Guide reference: Access to Other Data - list-view sharing, public groups, specialist audiences, scalable administration, and separation of view visibility from record access.
===============
Universal Containers (UC) wants to reduce the amount of redundant leads entered into the system. UC also wants to ensure that leads are only edited/reassigned by the lead owner. Which organization-wide default (OWD) approach should be recommended to help UC implement these requirements?
Answer : B
Comprehensive and Detailed 150 to 250 words of Explanation From Platform Sharing and Visibility Architect/Course Guide/topics:
Public Read-Only is the correct Lead OWD because it balances duplicate prevention with ownership-based editing. Users can see existing Lead records across the organization, which helps them identify whether a prospect already exists before creating another Lead, but they cannot edit another user's Lead merely because they can view it. A Private OWD would protect ownership more strictly but would undermine the duplicate-reduction objective because users might not be able to discover Leads owned elsewhere. Public Read/Write/Transfer would go too far in the opposite direction by allowing broader modification or reassignment than the requirement permits. The organization can complement the OWD with Duplicate Rules and Matching Rules for stronger prevention and warning behavior, but the OWD still establishes the right record-visibility baseline. Study Guide reference: Access to Records - Lead OWD, Public Read-Only, record ownership, duplicate prevention, and least-privilege access. The implementation should also be validated with representative users so effective permissions, sharing inheritance, and any cross-object access behave exactly as designed before production release.
===============
Universal Containers uses the standard Case object to track various support requests sent to servicing agents. Currently, the Case object has more than 400 fields. Eight different types of case processes have been established, each with a unique combination of statuses. The Director of Customer Service wants to ensure that servicing agents see only the required information specific to the case type they are addressing. Which option is recommended to implement this requirement?
Answer : A
Comprehensive and Detailed 150 to 250 words of Explanation From Platform Sharing and Visibility Architect/Course Guide/topics:
Dynamic Forms is the most maintainable solution for an object with hundreds of fields and several distinct business processes. It allows the Lightning record page to be decomposed into individual fields and field sections, then uses visibility rules to show only the information relevant to the current Work Order or Case type. Record Type can be used as the controlling condition so one governed Lightning page supports multiple process variants without multiplying page layouts or introducing custom LWC code. A custom override with metadata would create unnecessary development and maintenance overhead for behavior the platform can provide declaratively. Separate page layouts per type can work, but with hundreds of fields they become harder to govern and often duplicate large portions of configuration. Dynamic Forms is therefore the declarative-first architecture. The architect must still enforce sensitive-data restrictions through Field-Level Security because conditional page visibility is not an authorization control. Study Guide reference: Implications of Security Model Choice - Dynamic Forms, Record Types, field sections, component visibility, large-field-count page design, and UI visibility versus FLS.
===============
Which method should be used to grant an unrelated group of users access to a set of records?
Answer : C
Comprehensive and Detailed 150 to 250 words of Explanation From Platform Sharing and Visibility Architect/Course Guide/topics:
A Public Group is the standard reusable container for users who need common record access but do not share a natural position in the role hierarchy. Public groups can include individual users, roles, roles with subordinates, and other groups, then be referenced by sharing rules or manual sharing. The role hierarchy is intended for vertical access based on organizational responsibility, so forcing unrelated users into one role would distort the security model. Sharing Sets serve a different purpose: they are relationship-based Experience Cloud mechanisms that map an external user's Account or Contact relationship to target records. For unrelated internal users, the architect should create a public group and then use that group as the recipient in the appropriate sharing mechanism. This centralizes membership management and lets the record-sharing rule remain stable even as individual users change. Study Guide reference: Access to Records - Public Groups, sharing-rule recipients, cross-functional access, role hierarchy, and scalable record-sharing design.
===============