certified-sharing-and-visibility-architect Salesforce Certified Platform Sharing and Visibility Architect Practice Questions

This statement is true. The inherited sharing keyword makes the sharing context of a class dependent on its calling context. If the calling class or execution context (like an Aura component controller) is running with sharing, the inherited sharing class will also run with sharing. If the calling context is without sharing, it will run without sharing. This provides flexibility and ensures that a utility class, for example, respects the security context of whatever code invokes it.

Object-level permissions are the first gate of security. If a user's profile and permission sets do not grant at least 'Read' access to an object, they cannot view any records of that object, including in reports. Even if the report is in a public folder, the user lacks the fundamental permission to see the Invoice__c object, so Salesforce will block the report from running and display an 'Insufficient Privileges' error.

In organizations with Large Data Volumes (LDV), recalculating sharing rules after a change is not instantaneous. The process runs as an asynchronous background job. For millions of records, this recalculation can take several hours or even more than a day to complete. During this time, the old sharing grants will persist until the recalculation process has finished evaluating all records against the new criteria. The other options are incorrect; manual refreshes are not required, another user's share doesn't affect this, and a read-only field wouldn't prevent the rule from running.

This scenario describes ownership skew, which is a major cause of performance issues in LDV orgs. When a single user owns a vast number of records, any changes to that user's role, group membership, or related sharing rules can cause massive recalculations and lock contention on the share table. The best practice is to avoid using this skewed user directly in sharing rules. Instead, use criteria-based rules that do not depend on the owner. Assigning the user to a public group and then using ownership-based sharing on that group does not solve the underlying problem.

This requirement is a classic use case for Apex Managed Sharing. Because the sharing logic is based on a related object's field values and requires different access levels (Read vs. Write), declarative sharing rules are insufficient. An Apex trigger on the junction object is the correct pattern. It can create Financial_Plan__Share records with the appropriate AccessLevel ('Edit' or 'Read') and a custom RowCause to identify the shares. The trigger must also handle updates (e.g., role change) and deletions to correctly revoke access. This provides immediate, granular, and automated control over the sharing.

In Large Data Volume (LDV) scenarios involving Enterprise Territory Management, the complexity and efficiency of assignment rules are the most common cause of performance issues. Simplifying rules by using indexed fields (like Record IDs, Owner IDs, custom fields marked as External ID) and reducing the total number of rules will have the most significant impact on performance. Replacing the standard feature with a custom solution is a massive undertaking and should be a last resort. Increasing batch size could exacerbate timeouts, and while archiving data is a valid LDV strategy, optimizing the active rule set is the most direct solution to the described problem.

The Security.stripInaccessible() method is the most efficient and recommended way to enforce FLS for read access on a list of SObjects. It removes fields from the SObject records that the user cannot access, preventing them from being displayed on the Visualforce page. While looping with isAccessible() works, it is far more verbose and less performant for multiple records and fields. WITH SECURITY_ENFORCED enforces sharing rules and FLS at the query level, but the requirement is to run the initial query without sharing. Checking object permissions with isReadable() doesn't solve the field-level requirement.

A Sharing Set is used to grant high-volume community users (like Partner Community users) access to records that are associated with their account or contact record. This perfectly fits the requirement for Cases. For the Opportunity requirement, a criteria-based sharing rule can be created to share Opportunity records with a specific Partner Role or Group when the custom lookup field contains a user from that partner account. Share Groups are for sharing records owned by high-volume users, not for sharing records with them.

The 'Sharing' button on a record detail page (in Classic, or the 'Sharing Hierarchy' action in Lightning) is the most direct tool for troubleshooting access to a single record. It provides a detailed list of every user, group, and role that has access and, crucially, the 'Reason' for that access (e.g., 'Manual Share', 'Owner', 'Sharing Rule: [Rule Name]'). This immediately pinpoints the exact mechanism. 'Login As' confirms access but doesn't explain the reason. Health Check is for org-wide issues, not specific records. The Setup Audit Trail shows changes but not the current state of access.

This statement is true. The dashboard's running user determines the data context for all viewers of that dashboard. If the running user is a System Administrator (who can see all data), the dashboard components will display aggregated data from all records, effectively bypassing the viewing user's personal record-level security. This is a critical security consideration when designing dashboards.