Platform Developer II sample questions

Question 1

A developer needs to dynamically construct a SOQL query at runtime based on user-selected filters from a Visualforce page. The filter values are passed directly into the query string. What is the primary security vulnerability in this approach and how should it be mitigated?

Accepted Answer

Vulnerability: SOQL Injection. Mitigation: Use the `String.escapeSingleQuotes()` method on user inputs.

Answer

Vulnerability: Cross-Site Scripting (XSS). Mitigation: Use the `ENCODEHTML()` function on the inputs.

Answer

Vulnerability: Heap Size Limit Exceeded. Mitigation: Add a `LIMIT` clause to the dynamic query string.

Answer

Vulnerability: Cross-Site Request Forgery (CSRF). Mitigation: Use a controller with the `with sharing` keyword.

Question 2

A retail company has a requirement that `Sales_Rep__c` users should only see `Order__c` records for their assigned region. However, `Regional_Manager__c` users must be able to see all `Order__c` records within their region and the regions of all sales reps who report to them in the role hierarchy. The organization-wide default for `Order__c` is Private. How can a developer programmatically grant this specific access to managers?

Accepted Answer

Use an Apex trigger to create `Order__Share` records, granting access to the manager's role.

Answer

Create a criteria-based sharing rule based on the manager's region.

Answer

Enable Grant Access Using Hierarchies in the Sharing Settings and rely on the role hierarchy.

Answer

Create a custom controller for viewing orders that runs in `without sharing` mode.

Question 3

A developer is writing an Apex trigger that fires on `after update` of the `Opportunity` object. The trigger needs to perform a callout to an external web service. What is the primary issue with this design, and what is the recommended solution?

Accepted Answer

Issue: Callouts cannot be made from a synchronous Apex trigger. Solution: Execute the callout from an asynchronous method (e.g., `@future` or Queueable).

Answer

Issue: Callouts are not allowed in `after` triggers. Solution: Move the logic to a `before` trigger.

Answer

Issue: The `Opportunity` object is locked during the trigger execution. Solution: Use a `FOR UPDATE` clause in a SOQL query to unlock it.

Answer

Issue: Governor limits on callouts will be exceeded. Solution: Use the Composite API to batch the callouts.

Question 4

What are the key benefits of using a `StandardSetController` in a Visualforce page? (Select THREE)

Accepted Answer

Built-in pagination functionality (next, previous, first, last).

Accepted Answer

Support for server-side sorting of record sets.

Accepted Answer

Automatic handling of record selection for mass actions.

Answer

Ability to perform callouts directly from the controller.

Answer

Bypasses governor limits for SOQL queries.

Question 5

**Case Study:** A company has a complex process for provisioning `Service_Request__c` records. When a record is inserted, several automations fire: 1. A `before insert` trigger (`TRG_ServiceRequest_Before`) sets a default `Priority__c`. 2. An `after insert` trigger (`TRG_ServiceRequest_After`) creates a related `Service_Task__c` record. 3. A record-triggered Flow (after-save) updates a `Provisioning_Status__c` field on the parent `Account` to 'In Progress'. This Account update causes an Account trigger to fire. 4. A Process Builder (on create) sends an email alert to the Account owner. A user reports that when they create a new `Service_Request__c`, the `Provisioning_Status__c` on the Account is being set correctly, but the `Service_Task__c` record is not being created. Debug logs show the `after insert` trigger on `Service_Request__c` starts but never completes its DML operation, and no error is thrown. What is the most likely cause of this issue? ```mermaid graph TD subgraph Transaction 1 (Service_Request__c Insert) A[Start] --> B(Before Trigger: Set Priority); B --> C(Database Save); C --> D(After Trigger: Create Service_Task__c); D --> E(Flow: Update Account Status); E --> F(Process Builder: Email Alert); F --> G(Commit); end subgraph Transaction 2 (Account Update from Flow) H[Start Account Update] --> I(Account Triggers Fire); I --> J(Commit Account); end E --> H; ```

Accepted Answer

An unhandled exception in the Account trigger, fired by the Flow's update, is causing the entire `Service_Request__c` transaction to roll back.

Answer

The Process Builder is failing silently and rolling back the transaction.

Answer

The record-triggered Flow runs in a separate transaction from the `after insert` trigger.

Answer

The `before insert` trigger is changing a value that invalidates the criteria for the `after insert` trigger to run.

Question 6

A financial services company uses a custom Apex REST service to receive transaction data from a third-party system. The service must process batches of up to 200 transactions, create corresponding custom `Transaction__c` records, and update the related `Account`. If any transaction in the batch is invalid, the entire operation must be rolled back, and a specific error message must be returned. Which Apex feature is most appropriate for maintaining transactional integrity in this scenario?

Accepted Answer

Setting a `Database.Savepoint` before the DML operations and using `Database.rollback()` in a `catch` block.

Answer

Using `Database.insert(records, allOrNone=false)` and manually deleting records if an error occurs.

Answer

Implementing a `try-catch` block and throwing a custom exception to automatically roll back the transaction.

Answer

Using the `allOrNone` header in the incoming REST request to enforce atomicity.

Question 7

A developer is building a Lightning Web Component to display a list of related `Case` records on an `Account` page. The component must be reusable and configurable by an administrator, allowing them to specify the `Status` and `Priority` to filter the cases shown. How should the developer implement this configurability for the Lightning App Builder?

Accepted Answer

Expose public properties using the `@api` decorator in the JavaScript file and define them in the component's `.js-meta.xml` file.

Answer

Define public properties in the JavaScript file with the `@track` decorator and reference them in the controller.

Answer

Create an Apex controller with public properties and expose it to the component.

Answer

Use Custom Metadata Types to store the filter values and query them in the component's `connectedCallback` lifecycle hook.

Question 8

Universal Containers needs to synchronize large volumes of `Product__c` records (potentially over 1 million) nightly from an external Product Information Management (PIM) system. The process involves complex transformations and enrichment logic that cannot be handled by middleware. A developer has decided to implement this using Batch Apex. To optimize performance and avoid governor limit issues, what is the best approach for the `start` method to query the records to be processed?

Accepted Answer

Return a `Database.QueryLocator` from a SOQL query on the `Product__c` object.

Answer

Return an `Iterable ` containing all `Product__c` records retrieved via a standard SOQL query.

Answer

Use a REST callout in the `start` method to fetch record IDs from the PIM and return them as an `Iterable `.

Answer

Execute a SOSL query that returns a `List >` and flatten it into a single list.

Question 9

A developer needs to write a unit test for a method that makes an HTTP callout to an external weather service. The test must verify the logic that parses the JSON response and updates a `Forecast__c` record. Which two approaches are necessary to ensure the test runs successfully without making a real callout and properly isolates the test data? (Select TWO)

Accepted Answer

Enclose the callout logic within `Test.startTest()` and `Test.stopTest()` blocks.

Accepted Answer

Implement the `HttpCalloutMock` interface and use `Test.setMock` to provide a fake response.

Answer

Annotate the test method with `@IsTest(SeeAllData=true)` to access the real `Forecast__c` records.

Answer

Use a `@TestSetup` method to configure the Remote Site Setting for the weather service endpoint.

Answer

Use `JSON.deserialize` with a hardcoded string inside the test method to simulate the response.

Question 10

A Visualforce page uses a custom controller to display a data table of `Opportunity` records. The controller uses a large, complex SOQL query to gather the data. Users report that the page sometimes throws a 'Maximum view state size limit exceeded' error, especially when filtering results that return many rows. Which modification is the most effective way to mitigate this specific error?

Accepted Answer

Declare the List variable that holds the `Opportunity` records with the `transient` keyword.

Answer

Refactor the SOQL query to use a `LIMIT` clause to reduce the number of records returned.

Answer

Move the SOQL query from the controller's constructor to an action method.

Answer

Use JavaScript Remoting to fetch and display the data on the client side.

Salesforce Certified Platform Developer II Practice Questions

Unlock the full exam and previous versions

Create an account to continue.

Create an account to continue.

Related exams