Plat-Arch-205 Exam Dumps - Salesforce Architect Exams Questions and Answers

The users can open the Invoice record, which proves that object and record access are already sufficient to reach the record. The fact that only a small set of system fields is visible while the administrator sees the full detail strongly indicates a Field-Level Security difference. If the Sales Users profile lacks visibility to the remaining fields, Salesforce suppresses those fields even though the page layout contains them. A page layout marked Read-Only would still display the fields; it would only prevent editing. A role-based sharing rule also cannot grant field visibility because sharing rules operate at the record level. The correct troubleshooting path is therefore to review the Invoice object ' s field permissions for the affected profile and any assigned permission sets, using Field Accessibility where useful to understand the effective result. The scenario reinforces that object permission, record sharing, and Field-Level Security are separate controls and must be diagnosed independently. Study Guide reference: Permissions to Standard Objects, Custom Objects, and Fields - Field-Level Security, field accessibility, profiles, permission sets, and separation of field security from record sharing.

Price Books use specialized access semantics rather than the same generic sharing pattern as ordinary business objects. The High Risk Price Book should be the authorization boundary for the sensitive product catalog. UC can maintain broad View Only access where users need to inspect pricing while explicitly sharing the High Risk Price Book with trained staff at the level required to use it during the Opportunity sales process. Users need appropriate Price Book use access to select that Price Book and add its products to an Opportunity. This approach keeps the high-risk product entitlement centralized in the pricing catalog instead of trying to enforce it through page layouts, validation rules, or a broad Opportunity permission. Standard sharing rules are not the normal way to express this Price Book access model, and a solution that grants the entitlement to all sales users would violate the requirement. The architecture should pair the specialized Price Book access with normal Opportunity and Product permissions so only the trained population can transact with the restricted products. Study Guide reference: Access to Other Data - Price Book security, View Only, Use access, product visibility, pricing governance, and least-privilege sales access.

For custom objects, a dedicated Apex Sharing Reason should be used when programmatic shares must survive a change of record owner. Apex-managed shares that use a custom sharing reason are designed to represent access granted by business logic independently of ownership. A share created with RowCause Manual is different: manual shares can be removed when ownership changes, so they are not reliable for persistent application-managed access. The with sharing keyword also does not control the persistence of share-table rows; it controls whether Apex respects the current record-sharing model when executing queries and DML. A custom sharing reason has an additional operational advantage because it gives the application a stable way to identify, update, or remove only the shares created for that business process. Study Guide reference: Access to Records - Apex-managed sharing, Apex Sharing Reasons, RowCause, ownership changes, and custom-object share lifecycle. The implementation should also be validated with representative users so effective permissions, sharing inheritance, and any cross-object access behave exactly as designed before production release.

Super User access is designed for selected external partner managers who need visibility across records associated with other users at the same partner account. Granting that elevated access to the individual partner manager is more scalable than creating and maintaining separate ownership-based sharing rules for every distributor. The requirement is deliberately limited to certain managers, so the organization can keep the external sharing model private between distributors while giving designated managers broader visibility within their own distributor organization. Sharing Sets are best suited to deterministic Account/Contact relationship mappings and do not replace the manager-level elevation represented by the Super User model. Because Super User access is powerful, it should be assigned only to users who genuinely need it and should be reviewed as part of the external-access governance process. Study Guide reference: Access to Records - Partner Community, Super User access, partner manager visibility, same-account external sharing, distributor isolation, and scalable Experience Cloud access.

The Presenters junction object expresses a dynamic user-to-record relationship: each Presentation has a different set of users who must be able to edit it, and that set can change over time. Apex-managed sharing is appropriate because a trigger on the junction object can create a share when a presenter is added and remove that access when the relationship is deleted or changed. The Presentation object ' s OWD can remain Private while only the users represented by the junction records receive the necessary Edit access. A permission set cannot grant access to one specific Presentation record; it supplies object, field, or system permissions and must be combined with a record-level sharing mechanism. Standard Sales Team functionality also does not apply to an arbitrary Presentation custom object. For a robust custom-object design, the implementation should use a dedicated Apex Sharing Reason so the programmatic shares are easy to distinguish and manage throughout the record lifecycle. Study Guide reference: Access to Records - Apex-managed sharing, junction objects, dynamic user-to-record relationships, custom sharing reasons, and Private OWD.

A criteria-based Account sharing rule is appropriate because the desired access is determined by a property of the Account record: whether the record represents a retail Person Account. With Account OWD set to Private, UC can keep Business Accounts restricted and automatically grant the Retail Sales role access to all Accounts that meet the Person Account criterion. An owner-based rule on AccountContactRelation addresses a different relationship and would not provide the required Account visibility. Granting access to a Person Account record type on a profile also does not make every existing Person Account visible; record-type access controls which record types users can create or use, not which records they can see. The architect therefore needs a record-level sharing rule tied to the Account ' s Person Account characteristic. Study Guide reference: Access to Records - criteria-based sharing rules, Person Accounts, Record Types, Account OWD, and distinction between record-type availability and record visibility.

Shipment is a custom object, so Salesforce allows the administrator to control whether access automatically rolls upward through the role hierarchy. If Grant Access Using Hierarchies is disabled, a correctly configured manager role does not by itself provide access to Shipment records owned by subordinate users. With a Private OWD, this produces exactly the symptom described: managers cannot see their team ' s records even though the hierarchy is otherwise correct. Re-enabling Grant Access Using Hierarchies restores the normal upward inheritance pattern for the custom object, assuming managers also have the required object-level permissions. An ownership-based sharing rule is not required merely to reproduce ordinary manager-to-subordinate access, and there is no separate generic switch called ' Role Hierarchy implicit sharing ' that replaces this custom-object setting. Study Guide reference: Access to Records - custom-object OWD, Grant Access Using Hierarchies, role hierarchy, inherited access, and Private sharing. The implementation should also be validated with representative users so effective permissions, sharing inheritance, and any cross-object access behave exactly as designed before production release.

Account Teams are designed to model collaboration around an Account while allowing different access levels to the Account and its related Opportunities and Cases. UC can give the sales associate Read access to the Account, Read access to related Cases, and no general Opportunity access through the team configuration. If the associate later needs access to a particular Opportunity, that record can be opened separately through an Opportunity Team or another appropriate sharing mechanism. Introducing separate Case Teams or sharing rules would duplicate functionality that the Account Team already provides for this collaboration model. The design also preserves the Private OWD, because access is granted only to the users explicitly added to the team. Object permissions still apply independently, so the sales associate must have the required object-level Read permission before the team access can be effective. Study Guide reference: Access to Records - Account Teams, related Opportunity and Case access, team roles, Private OWD, and least-privilege collaboration.

Because Invoice is the detail side of a master-detail relationship to Account, its record-level access is controlled by the master. In Salesforce this is effectively a Controlled by Parent model: users can reach the detail record only to the extent that they can reach the associated master record, assuming they also have the necessary object permission on the detail object. The AR users have no access to the relevant Accounts, so they cannot discover or open the dependent Invoice records in list views, reports, or Global Search. Creating a sharing rule directly on the master-detail child does not solve the underlying access problem because the child does not maintain an independent sharing model in the same way as an independently owned record. The required access must therefore be established at the Account level; once the relevant Accounts are shared to AR, the dependent Invoice records become available according to the parent relationship. Study Guide reference: Access to Records - master-detail relationships, Controlled by Parent, OWD, inherited record access, and sharing at the master record.

The security defect is field-level write authorization, not record-level sharing. Apex can execute with elevated behavior, so code that performs DML must explicitly respect whether the running user is allowed to update the fields being changed. The Schema Describe check represented by isUpdateable() verifies field update permission before DML and directly addresses the Read-Only Field-Level Security condition in the scenario. By contrast, the with sharing keyword controls record visibility through the sharing model; it does not itself enforce object CRUD or Field-Level Security. Moving the same logic into another with sharing class therefore would not stop a field from being updated when the user lacks field edit permission. In modern Salesforce development, user-mode database operations and Security.stripInaccessible() can provide broader and often simpler enforcement of CRUD and FLS, but the explicit isUpdateable() check remains technically valid for the option set given. The architectural rule is to evaluate object permissions, field permissions, and record sharing as separate layers. Study Guide reference: Permissions to Standard Objects, Custom Objects, and Fields - CRUD, Field-Level Security, secure Apex, Schema Describe checks, and user-mode operations.