Security and Access: 20% Flashcards

Question

What is IMAGEPROXYURL used for?

Answer 1

**Description:** Securely retrieves external images and prevents unauthorized requests for user credentials. **Use:** and replace http://exampledomain.com/pic.png with your image. Example: This IMAGEPROXYURL function retrieves and displays an image from Twitter’s image host, an external source. This function loads the Salesforce Twitter profile image over HTTPS. This function also prevents the image from making unauthorized requests for user credentials.

Answer 2

**Description:** Encodes text and merge field values for use in JavaScript by inserting escape characters, such as a backslash (\), before unsafe JavaScript characters, such as the apostrophe ('). **Use:** {!JSENCODE(text)} and replace text with the merge field or text string that contains the unsafe JavaScript characters. **Example:** If the merge field foo\_\_c contains **Enter the user's name, {!JSENCODE(foo\_\_c)} results in: \u003CB\u003EEnter the user\'s name\u003C\/b\u003E**

Answer 3

LEFT **Description:** Returns the specified number of characters from the beginning of a text string. Use: LEFT(text, num\_chars) and replace text with the field or expression you want returned; replace num\_chars with the number of characters from the left you want returned. **Example:** TRIM(LEFT(LastName, 5)) & "-" & TRIM(RIGHT(SSN\_\_c, 4)) This formula displays the first five characters of a name and the last four characters of a social security number separated by a dash. Note that this example uses a text custom field called SSN. **Tips:** Reference auto-number fields as text fields in formulas. If the num\_chars value is less than zero, Salesforce replaces the value with zero.

Answer 4

LEN **Description:** Returns the number of characters in a specified text string. **Use:** LEN(text) and replace text with the field or expression whose length you want returned. **Example:** LEN(PartNumber\_\_c) This formula returns the number of characters in a Product Code field.

Answer 5

LN Description: Returns the natural **logarithm** of a specified number. Natural logarithms are based on the constant e value of 2.71828182845904. Use: LN(number) and replace number with the field or expression for which you want the natural logarithm. Note: the LN function is the inverse of the EXP function. **Example:** LN(10) returns the natural logarithm of 10, which is 2.30. LN(Value\_\_c) returns the natural logarithm of a custom number field called Value.

Answer 6

**LOWER** **Description:** Converts all letters in the specified text string to lowercase. Any characters that are not letters are unaffected by this function. Locale rules are applied if a locale is provided. **Use: LOWER(text, [locale])** and replace text with the field or text you wish to convert to lowercase, and locale with the optional two-character ISO language code or five-character locale code, if available. **Example:** MYCOMPANY.COM LOWER("MYCOMPANY.COM") returns “mycompany.com.”

Answer 7

* Example: * **Field Name: Padding** * **LPAD(Name, 20)** truncates the Name field after 20 characters. For example, if the name is mycompany.com, the value returned is "mycompany.com. * **My\_Company: No Change** * **LPAD('my\_company.com', 14, 'z')** returns “my\_company.com” without change because it has 14 characters * **Field Name Padded with Z** * **LPAD(Name, 15, 'z')** returns the name “zmycompany.com. * **Field Name: Truncating** * **LPAD(Name, 2)** truncates the name after the second character. For example, if the name is mycompany.com, the value returned is “my.”

Answer 8

MCEILING **Description:** Rounds a number up to the nearest integer, towards zero if negative. **Use:** MCEILING(number) Example: **MCEILING(2.5) returns 3, which is 2.5 rounded up to the nearest integer.** MCEILING(-2.5) returns -2, which is -2.5 rounded up towards zero for a negative number.

Answer 9

**Description:** Rounds a number down to the nearest integer, away from zero if negative. Use: MFLOOR(number) Example: MFLOOR(2.5) returns 2, which is 2.5 rounded down to the nearest integer. MFLOOR(-2.5) returns -3, which is -2.5 rounded away from zero for a negative number.

Answer 10

Description: Returns the specified number of characters from the **middle of a text string** given the starting position. Use: **MID(text, start\_num, num\_chars)** and replace text with the field or expression to use when returning characters; replace start\_num with the number of characters from the left to use as a starting position; replace num\_chars with the total number of characters to return. Example: **MID (Division, 3, 4) returns four characters of the Division name beginning with the third character from the left.** On a user record, this represents the department code.

Answer 11

**Description:** Returns a remainder after a number is divided by a specified divisor. **Use:** MOD(number, divisor) and replace number with the field or expression you want divided; replace divisor with the number to use as the divisor. **Example:** MOD(3, 3) returns 0 MOD(4, 3) returns 1 MOD(123, 100) returns 23 You might want to prevent users from scheduling meetings on a Saturday or Sunday. Use the following example to apply a validation rule to a custom date field called My Date. CASE(MOD(My\_Date\_\_c - DATE(1900, 1, 7), 7), 0, 0, 6, 0, 1) = 0 This example displays the following error message when the value of My Date is not Monday through Friday: “My Date is not a weekday.”

Answer 12

PARENTGROUPVAL **Description:** This function returns the value of a specified parent grouping. A “parent” grouping is any level above the one containing the formula. You can use this function only in custom summary formulas and at grouping levels for reports, but not at summary levels. **Use:** Summary and Joined: PARENTGROUPVAL(summary\_field, grouping\_level) Matrix: PARENTGROUPVAL(summary\_field, parent\_row\_grouping, parent\_column\_grouping) Where summary\_field is the summarized field value, grouping\_level is GRAND\_SUMMARY or the API name of the parent level group for summary reports, and parent\_row\_level and parent\_column\_level are the parent levels for matrix reports. In reports with multiple grouping levels, you can set the grouping\_level to be any group level higher than the formula display level. **Example:** **TOTAL\_PRICE:SUM/PARENTGROUPVAL(TOTAL\_PRICE:SUM, GRAND\_SUMMARY)** **This formula calculates, for each product, its relative size compared to the grand total. In this example, the report is a summary of opportunities and their products, grouped by Product Name.**

Answer 13

**Description:** This function returns the value of a specified previous grouping. A “previous” grouping is one that comes before the current grouping in the report. Choose the grouping level and increment. The increment is the number of columns or rows before the current summary. The default is 1; the maximum is 12. You can use this function only in custom summary formulas and at grouping levels for reports, but not at summary levels. Use: **PREVGROUPVAL(summary\_field, grouping\_level [, increment])** Where summary\_field is the name of the grouped row or column, grouping\_level is the API name of the peer level group whose summary value for the previous grouping is used, and increment is the number of groupings previous. In reports with multiple grouping levels, you can specify the grouping\_level to be the same group level as the formula display level or a group level higher than the formula display level. Example: **AMOUNT:SUM - PREVGROUPVAL(AMOUNT:SUM, CLOSE\_DATE)** This formula calculates, for each month, the difference in amount from the previous month shown in the report. In this example, the report is an opportunity matrix with columns grouped by Close Date and rows by Stage.

Answer 14

REGEX Description: **Compares a text field to a regular expression and returns TRUE if there is a match.** Otherwise, it returns FALSE. A regular expression is a string used to describe a format of a string according to certain syntax rules. Use: REGEX(text, regex\_text) and replace text with the text field, and regex\_text with the regular expression you want to match. Validation Rule Example: This example ensures that a custom field called SSN matches a regular expression representing a valid social security number format of the form 999-99-9999. **NOT( OR( LEN (SSN\_\_c) = 0, REGEX(SSN\_\_c, "[0-9]{3}-[0-9]{2}-[0-9]{4}") ) )**

Answer 15

**Description:** Encodes text and merge field values for use in URLs by replacing characters that are illegal in URLs, such as blank spaces, with the code that represent those characters as defined in RFC 3986, Uniform Resource Identifier (URI): Generic Syntax. For example, blank spaces are replaced with %20, and exclamation points are replaced with %21. **Use:** {!URLENCODE(text)} and replace text with the merge field or text string that you want to encode. Example: If the merge field foo\_\_c contains **Mark's page, {!URLENCODE(foo\_c)} results in: %3CB%3EMark%27s%20page%3C%2Fb%3E** **Tips:** This function is only available in custom buttons and links, and in Visualforce.

Answer 16

TRUE Dates and times are always calculated using the user’s time zone.

Answer 17

Picklist fields can only be used in these functions: ## Footnote **ISPICKVAL**—Compares the value of a picklist to a single value. **CASE**—Compares the value of a picklist to multiple values. **TEXT**—Returns a picklist value’s API Name so that you can work with a reference to the value (even if the displayed value changes) in functions that support text values, such as CONTAINS. (Available in only flow formula resources, formula fields, validation rules, and workflow field updates.)

Answer 18

Multi-select picklist fields can only be used in these functions: ## Footnote **INCLUDES** **ISBLANK** **ISNULL** **ISCHANGED** (Only in assignment rules, validation rules, workflow field updates, and workflow rules in which the evaluation criteria is set to Evaluate the rule when a record is: created, and every time it’s edited) **PRIORVALUE** (Only in assignment rules, validation rules, workflow field updates, and workflow rules in which the evaluation criteria is set to Evaluate the rule when a record is: created, and every time it’s edited)

Answer 19

When possible, use **RecordTypeId** instead of RecordType. Name to reference a specific record type. While RecordType.Name makes a formula more readable, you must update the formula if the name of the record type changes, whereas the ID of a record type never changes. Also, RecordType.Name requires a cross-object reference to the record type, while RecordTypeId doesn’t. However, if you are deploying formulas across organizations (for example, between sandbox and production), use RecordType.Name because IDs are not the same across organizations. ## Footnote **Avoid using $RecordType in formulas, except in default value formulas. Instead, use the RecordType merge field (for example, Account.RecordType.Name) or the RecordTypeId field on the object.**

Answer 20

TRUE You **CANNOT** include an object as the lookup field in a formula. To reference an object, reference the object's ID field or another field on the object. For example, Account.Owner is invalid because it references the object directly. Account.Owner.FirstName or Account.OwnerId are valid references for your formula.

Answer 21

A Cross-object formula is a formula that spans two related objects and references merge fields on those objects. A cross-object formula can reference merge fields from a master (“parent”) object if an object is on the detail side of a master-detail relationship. A cross-object formula also works with lookup relationships. You can reference fields from objects that are up to 10 relationships away. A cross-object formula is available anywhere formulas are used except when creating default values.

Answer 22

TRUE ## Footnote If you create a formula that references a field on another object and display that formula in your page layout, ***users can see the field on the object even if they don’t have access to that object record.*** For example, if you create a formula field on the Case object that references an account field, and display that formula field in the case page layout, users can see this field even if they don’t have access to the account record.

Answer 23

TRUE You can use the Power of One on any object. For example, if you had a report with 10 accounts, each with three opportunities, your Opportunities report returns 30 records. Adding the Power of One formula field to Account allows you to see the number of distinct accounts represented in the records. Some pros say they add a Power of One field to every object in their org!

Answer 24

This error **most often occurs when the number of opening parentheses doesn’t match the number of closing parentheses**. It can be particularly difficult to avoid this error if you’re using several functions at once. Try breaking your function into multiple lines so it’s easier to tell which sets of parentheses belong together. **You’ll also see this error if you forget a comma between two function parameters.** This error is confusing because the actual problem doesn’t match up with the syntax checker. If you’re certain your parentheses are correct, double check that the commas in your function are correct as well.

Answer 25

**Incorrect parameter type:** If you give a function a number parameter when it expects text (or any other combination of data types), this is the error you see. Always check the help text or the documentation so you know what kind of parameters a function accepts.

Answer 26

If you input too many or too few parameters into a function, the syntax checker alerts you. Again, check the help text or documentation for guidelines on inputting parameters to specific functions.

Answer 27

**Field does not exist:** This error indicates that you’ve included a field in your formula that your object doesn’t support. In this case, **check your spelling and capitalization**. If you can’t find any mistakes, try inserting the field from the Insert Field menu again to make sure you’re referencing it correctly. Another reason you see this error is if **you forget to put quotation marks around a text literal or a hyperlink.**

Answer 28

**FALSE** Salesforce **does not** recalculate the value of campaign roll-up summary fields when leads or contacts are deleted. Select the Force a mass recalculation of this field option on the edit page of the roll-up summary field to manually recalculate the value.

Answer 29

You can’t use: * **long text area** * **multi-select picklist** * **Description fields** * **system fields like Last Activity** * **cross-object formula fields** * **and lookup fields. . .** in the field column of roll-up summary filters.

Answer 30

TRUE ## Footnote After you have created a roll-up summary field on an object, you **CANNOT** convert the object's master-detail relationship into a lookup relationship.

Answer 31

**TRUE** ## Footnote Roll-up summary fields are **not** available for mapping lead fields of converted leads.

Answer 32

TRUE If a roll-up summary field doesn’t contain cross-object field references or functions that derive values on the fly, such as NOW or TODAY, it ***CAN*** calculate the values of formula fields.

Answer 33

1. Changing the roll-up summary definition (such as the object, function, or field being aggregated) 2. Changing the expression of a formula field referenced in a roll-up summary field 3. Replacing picklist values for picklist fields referenced in the roll-up summary filter 4. Changing picklist record type definitions 5. Changing currency conversion rates 6. Changing price book entries

Answer 34

Calculating roll-up summary field values can take up to **30 minutes**, depending on the number of records affected and other factors.

Answer 35

TRUE If your organization uses multiple currencies, the currency of the **master record** determines the currency of the roll-up summary field. For example, if the master and detail records are in different currencies, the detail record value is converted into the currency of the master record.

Answer 36

TRUE ## Footnote If your organization has advanced currency management enabled, currency roll-up summary fields are invalid if they are on accounts and summarizing opportunity values, or on opportunities and summarizing custom object values.

Answer 37

TRUE ## Footnote Salesforce prevents users from saving a record if it invalidates a related record. For example, a master record has a validation rule that requires the roll-up summary field value to be greater than 100. If the user’s change to a related child record would put the value over 100, the user can’t save the record.

Answer 38

FALSE Once created, you **cannot** change the detail object selected or delete any field referenced in your roll-up summary definition.

Answer 39

* Starts with * Contains * Does not contain * Includes * Excludes * Within

Answer 40

Each custom object can have up to **two** master-detail relationships and many lookup relationships. Each relationship is included in the maximum number of custom fields allowed.

Answer 41

**TRUE** **Master-Detail to Lookup = no roll-up fields** You can convert a master-detail relationship to a lookup relationship as long as **no roll-up summary fields** exist on the master object.

Answer 42

Converting a master-detail relationship to a lookup for a custom object on the “detail” side, changes the organization-wide default for the object to **public read/write.**

Answer 43

**FALSE** **Lookup to Master-Detail = lookup field contains a value** You **CAN** convert a lookup relationship to a master-detail relationship if the lookup field in all the records contains a value.

Answer 44

Converting a lookup to a master-detail-relationship changes the organization-wide default to Controlled by Parent and the sharing model is updated to **public read/write.**

Answer 45

You can create a relationship from an object to itself, but it must be a **lookup** relationship.

Answer 46

TRUE You can create a relationship from an object to itself, but it must be a lookup relationship, and **a single record can't be linked to itself.** However, *a record can indirectly relate to itself.* For example, the Holiday Promotion campaign can have the Direct Mail campaign selected in the lookup relationship, and the Direct Mail campaign can have the Holiday Promotion campaign selected in the lookup relationship.

Answer 47

TRUE You can't create a _many-to-many self-relationship_, that is, **the two master-detail relationships on the junction object CANNOT have the same master object.**

Answer 48

As a best practice, don't exceed **10,000** child records for a master-detail relationship.

Answer 49

“Primary master with junction object and secondary master” in the primary master object's report category. “Secondary master with junction object and primary master” in the secondary master object's report category.

Answer 50

To create multilevel master-detail relationships, you need the **“Customize Application”** user permission.

Answer 51

TRUE By default, records CANNOT be reparented in master-detail relationships. Administrators can, however, allow child records in master-detail relationships on custom objects to be reparented to different parent records by selecting the Allow reparenting option in the master-detail relationship definition.

Answer 52

You can have up to **three** custom detail levels.

Answer 53

FALSE Standard objects CANNOT be on the detail side of a custom object in a master-detail relationship.

Answer 54

## Footnote You can use multilevel master-detail relationships in custom report types. The **Allow Reports** checkbox must be checked when you create the custom object. Custom report types created for multilevel master-detail relationships count towards the organizations custom report type limit and no reports are generated if this limit is exceeded.

Answer 55

TRUE Custom junction objects **can't** have detail objects. That is, a custom junction object can't become the master object in a multilevel master-detail relationship.

Answer 56

TRUE You **can’t** delete a custom object if it is on the master side of a master-detail relationship. If you delete a custom object that is on the detail side of a master-detail relationship, the relationship is converted to a lookup relationship.

Answer 57

TRUE If you delete a detail record and later, separately, delete its master record, you **cannot** undelete the detail record, **as it no longer has a master record to relate to.**

Answer 58

A profile or a permission set can have an entity, such as Account, with a master-detail relationship. **A broken permission dependency exists if the child entity has permissions that the parent should have.** Salesforce updates the parent entity for a broken permission dependency on the first save action for the profile or permission set.

Answer 59

Junction object records are deleted when either associated master record is deleted and placed in the Recycle Bin. If both associated master records are deleted, t**he junction object record is deleted permanently** and can't be restored.

Answer 60

TRUE Sharing access to a junction object record is determined **by a user's sharing access to both associated master records and the Sharing Setting option on the relationship field.** For example, if the sharing setting on both parents is Read/Write, then the user must have Read/Write access to both parents in order to have Read/Write access to the junction object. If the sharing setting on both masters is Read-Only, a user with Read-Only rights on the master records would have Read access to the junction object.

Answer 61

In a many-to-many relationship, a user can't delete a parent record if there are more than **200** junction object records associated with it and if the junction object has a roll-up summary field that rolls up to the other parent. **To delete this object, manually delete junction object records until the count is fewer than 200.**

Answer 62

The first master-detail relationship you create on your junction object becomes the **primary** relationship.

Answer 63

The junction object's detail and edit pages use the color and any associated icon of the primary master object.

Answer 64

Record ownership: The junction object records **inherit the value of the Owner field from their associated primary master record.** Because objects on the detail side of a relationship do not have a visible Owner field, this is only relevant if you later delete both master-detail relationships on your junction object.

Answer 65

Division: If your organization uses divisions to segment data, **the junction object records inherit their division from their associated primary master record.** Similar to the record ownership, this is only relevant if you later delete both master-detail relationships.

Answer 66

If you delete the primary master-detail relationship or convert it to a lookup relationship, **the secondary master object becomes primary.**

Answer 67

FALSE You can define Apex triggers on both master objects **and the junction object.**

Answer 68

TRUE A junction object **can't** be on the master side of another master-detail relationship.

Answer 69

If the lookup field is optional, you can specify one of three behaviors to occur if the lookup record is deleted: 1. **Clear the value of this field** * This is the default. Clearing the field is a good choice when the field doesn’t have to contain a value from the associated lookup record. 2. **Don’t allow deletion of the lookup record that’s part of a lookup relationship** * If you have dependencies built on the lookup relationship, such as a workflow rule, this option doesn’t allow the lookup record to be deleted. 3. **Delete this record also** * Available only if a custom object contains the lookup relationship, not if it’s contained by a standard object. * However, the lookup object can be either standard or custom. Choose when the lookup field and its associated record are tightly coupled and you want to completely delete related data.

Answer 70

TRUE Choosing Delete this record also can result in a cascade-delete. A cascade-delete bypasses security and sharing settings, which means users can delete records when the target lookup record is deleted even if they don’t have access to the records. To prevent records from being accidentally deleted, cascade-delete is disabled by default. Contact Salesforce to get the cascade-delete option enabled for your organization.

Answer 71

Cascade-delete and its related options aren’t available for lookup relationships to: * **business hours** * **network** * **lead** * **price book** * **product,** * **user objects.**

Answer 72

Only **lookup, external lookup, and indirect lookup** relationships are available for external objects. No other relationship types are supported.

Answer 73

TRUE ## Footnote Depending on the availability of the external system, related lists of child external objects **can load slowly** when users view the parent record detail pages.

Answer 74

FALSE Relationships that involve external objects allow users to create child records from the record detail pages of parent records. However, **the relationship field on each new child record IS NOT automatically populated** to identify the parent record.

Answer 75

FALSE Syncing doesn’t create relationship fields on the external objects in your Salesforce org. **However, you can change the field type of a sync-created custom field to Lookup Relationship, External Lookup Relationship, or Indirect Lookup Relationship.** Changing the field type of an existing custom field is simpler and more efficient than manually creating a relationship field on the external object.

Answer 76

To reflect the foreign key relationship within your org, **change the field type of that text field to External Lookup Relationship.**

Answer 77

TRUE ## Footnote Cascade-delete **isn’t** available for external object relationships.

Answer 78

TRUE ## Footnote Lookup search **isn’t** available for external lookup relationship fields. To edit an external lookup relationship field, manually enter the value of the External ID standard field for the parent record. This limitation doesn’t apply when the parent external object is associated with the cross-org adapter for Salesforce Connect.

Answer 79

With external lookup and indirect lookup relationships, the parent record appears **as a clickable link** in the relationship field on the child record. If the child record is viewed by a user who doesn’t have access to the parent record, the parent record appears in the relationship field as plain text instead of a link.

Answer 80

TRUE ## Footnote Lookup filters aren’t available for external lookup relationship fields.

Answer 81

TRUE ## Footnote Indirect lookup relationship fields can be created on external objects only.

Answer 82

Only objects that have a custom field with the **External ID** and **Unique** attributes are available as parent objects in indirect lookup relationships. If you don't see the desired object when you create an indirect lookup relationship field, add a custom unique, external ID field to that object.

Answer 83

TRUE Converting a relationship from lookup to master-detail or vice versa can cause existing custom reports to become unusable due to the different standard report types available for each type of relationship. We recommend that you test your custom reports immediately after converting the relationship type. If you revert your relationship back to the original type, the reports are restored and become usable again.

Answer 84

When specifying filter criteria on roll-up summary fields, does not contain uses **“or”** logic on comma-separated values.

Answer 85

On list views, reports, and dashboards, does not contain uses **“and”** logic.

Answer 86

**Available for dashboard filters only.** Use to filter on ranges of values. For each range, the filter returns results that are greater than or equal to the minimum value and less than the maximum value. For example, if you enter “Number of Employees from 100 through 500,” your results include accounts with 100 employees up to those with 499 employees. Accounts with 500 employees aren’t included in the results.

Answer 87

Available **when you create list views based on a Geolocation custom field.** Shows results that are within the specified radius from a fixed latitude and longitude. For example, if you enter “Warehouse location within 50 miles 37.775° –122.418°,”, your list view includes all warehouses within a 50–mile radius of San Francisco, California.

Answer 88

TRUE By default, records **can’t** be reparented in master-detail relationships. **Administrators can**, however, allow child records in master-detail relationships on custom objects to be reparented to different parent records by selecting the **Allow reparenting option in the master-detail relationship definition.**

Answer 89

**TRUE** Custom objects on the detail side of a master-detail relationship can't have sharing rules, manual sharing, or queues, **as these require the Owner field.**

Answer 90

**FALSE** Detail and subdetail records inherit security settings and permissions from the master record. **You can’t set permissions on the detail record independently.**

Answer 91

FALSE The master-detail relationship field (which is the field linking the objects) **is required** on the page layout of the detail and subdetail records.

Answer 92

Each custom object can have up to two master-detail relationships and up to **25** total relationships.

Answer 93

FALSE ## Footnote The Related To entry **can’t** be changed after you save the relationship.

Answer 94

TRUE Lookup relationships are similar to master-detail relationships, except they **don’t support sharing or roll-up summary fields.**

Answer 95

TRUE ## Footnote Link an object with itself (*except for the user object*; see Hierarchical). For example, you might want to link a custom object called Bug with itself to show how two different bugs are related to the same problem.

Answer 96

TRUE Lookup relationships from objects related to the campaign member object aren’t supported; however, you can create lookup relationships from the campaign member object related to other objects.

Answer 97

A special lookup relationship available for only the user object. It l**ets users use a lookup field to associate one user with another that does not directly or indirectly refer to itself.** For example, you can create a custom hierarchical relationship field to store each user's direct manager.

Answer 98

**Formula:** YEAR( My\_Date\_\_c ) \<\> YEAR ( TODAY() ) **Error Message:** Date must be in the current year. **Error Location**: My Date

Answer 99

**Description:** Validates that the range between two custom fields, Salary Min and Salary Max, is no greater than $20,000. **Formula:** (Salary\_Max\_\_c - Salary\_Min\_\_c) \> 20000 **Error Message:** Salary range must be within $20,000. Adjust the Salary Max or Salary Min values. **Error Location**: Salary Max

Answer 100

**Description:** Validates a custom field called Web Site to ensure that its last four characters are in an explicit set of valid website extensions. AND( RIGHT( Web\_Site\_\_c, 4) \<\> ".COM", RIGHT( Web\_Site\_\_c, 4) \<\> ".com", RIGHT( Web\_Site\_\_c, 4) \<\> ".ORG", RIGHT( Web\_Site\_\_c, 4) \<\> ".org", RIGHT( Web\_Site\_\_c, 4) \<\> ".NET", RIGHT( Web\_Site\_\_c, 4) \<\> ".net" ) **Error Message:** Web Site must have an extension of .com, .org, or .net . **Error Location:** Web Site

Answer 101

OR( LEN(BillingCountry) = 1, NOT( CONTAINS( "AF:AX:AL:DZ:AS:AD:AO:AI:AQ:AG:AR:AM:" & "AW:AU:AZ:BS:BH:BD:BB:BY:BE:BZ:BJ:BM:BT:BO:" & "BA:BW:BV:BR:IO:BN:BG:BF:BI:KH:CM:CA:CV:KY:" & "CF:TD:CL:CN:CX:CC:CO:KM:CG:CD:CK:CR:CI:HR:" & "CU:CY:CZ:DK:DJ:DM:DO:EC:EG:SV:GQ:ER:EE:ET:FK:" & "FO:FJ:FI:FR:GF:PF:TF:GA:GM:GE:DE:GH:GI:GR:GL:" & "GD:GP:GU:GT:GG:GN:GW:GY:HT:HM:VA:HN:HK:HU:" & "IS:IN:ID:IR:IQ:IE:IM:IL:IT:JM:JP:JE:JO:KZ:KE:KI:" & "KP:KR:KW:KG:LA:LV:LB:LS:LR:LY:LI:LT:LU:MO:MK:" & "MG:MW:MY:MV:ML:MT:MH:MQ:MR:MU:YT:MX:FM:MD:MC:" & "MC:MN:ME:MS:MA:MZ:MM:MA:NR:NP:NL:AN:NC:NZ:NI:" & "NE:NG:NU:NF:MP:NO:OM:PK:PW:PS:PA:PG:PY:PE:PH:" & "PN:PL:PT:PR:QA:RE:RO:RU:RW:SH:KN:LC:PM:VC:WS:" & "SM:ST:SA:SN:RS:SC:SL:SG:SK:SI:SB:SO:ZA:GS:ES:" & "LK:SD:SR:SJ:SZ:SE:CH:SY:TW:TJ:TZ:TH:TL:TG:TK:" & "TO:TT:TN:TR:TM:TC:TV:UG:UA:AE:GB:US:UM:UY:UZ:" & "VU:VE:VN:VG:VI:WF:EH:YE:ZM:ZW", BillingCountry)))

Answer 102

TRUE Validation rules don't apply if you create records for an object with Quick Create.

Answer 103

TRUE The detail page of a custom activity field **does not** list associated validation rules. To edit the validation rule for a custom activity field, select the validation rule from Setup by entering Activities in the Quick Find box, then selecting Activities and choose Task Validation Rules or Event Validation Rules.

Answer 104

Use the **RecordType.Id** merge field in your formula to apply different validations for different record types.

Answer 105

FALSE You **don’t** have to begin a validation rule formula with the IF function. Any Boolean error condition expression works. For example: Correct: CloseDate \< TODAY() Incorrect: IF(CloseDate \< TODAY(), TRUE, FALSE)

Answer 106

TRUE When a validation rule contains the BEGINS or CONTAINS function, it processes blank fields as valid. For example, if you have a validation rule that tests whether the serial number of an asset begins with “3”, all assets with a blank serial number are considered valid.

Answer 107

When using a validation rule to ensure that a number field contains a specific value, use the **ISBLANK** function to include fields that don’t contain any value. For example, to validate that a custom field contains a value of ‘1’, use the following validation rule to display an error if the field is blank or any other number: OR (ISBLANK (field\_\_c), field\_\_c\<\>1)

Answer 108

FALSE **Avoid using the IsClosed or IsWon** opportunity merge fields in validation formulas. **Instead, use the ISPICKVAL function** to determine if the Stage contains the appropriate value. For example, the following validation formula makes a custom Project Start Date field required whenever the Stage is “Closed Won”:

Answer 109

Simplify your validation formulas by using **checkbox** fields, which don't require any operator because they return true or false. For example, the following validation formula checks to be sure an opportunity has opportunity products using the HasOpportunityLineItem merge field before users can save a change to it: ## Footnote NOT(OR(ISNEW(),HasOpportunityLineItem))

Answer 110

FALSE If you have a multilingual organization, translate your error messages. **You can translate error messages using the Translation Workbench.**

Answer 111

Val assigns auto work easily Salesforce processes rules in the following order: 1. Validation rules 2. Assignment rules 3. Auto-response rules 4. Workflow rules (with immediate actions) 5. Escalation rules

Answer 112

TRUE ## Footnote When one validation rule fails, Salesforce continues to check other validation rules on that field or other fields n the page and displays all error messages at once.

Answer 113

If validation rules exist for activities and you create an activity during lead conversion, **the lead converts but a task isn’t created.**

Answer 114

Validation rules are only enforced during lead conversion if **validation and triggers for lead conversion are enabled in your organization.**

Answer 115

TRUE ## Footnote Campaign hierarchies ignore validation rules.

Answer 116

TRUE ## Footnote Salesforce runs validation rules before it creates records submitted via Web-to-Lead and Web-to-Case and then creates records that have valid values.

Answer 117

FALSE Validation rules continue to run on individual records if the owner is changed.

Answer 118

FALSE If the Mass Transfer tool is used to change the ownership of multiple records, **validation rules don’t run on those records.**

Answer 119

Validation rule formulas don’t or can’t refer to: * **Compound fields**, including addresses, first and last names, and dependent picklists and lookups * NOTE However, you **_can_** use compound fields in ISNULL, ISBLANK, and ISCHANGED functions. * **Campaign statistic fields**, including statistics for individual campaigns and campaign hierarchies * **Merge fields for auto-number or compound address fields, such as Mailing Address** * NOTE You **_can_** use merge fields for individual address fields, such as Billing City, in validation rule formulas.

Answer 120

TRUE You can use roll-up summary fields in validation rules because the fields don’t display on edit pages.

Answer 121

TRUE Do not use roll-up summary fields as the error location.

Answer 122

Validation rules and lookup filters achieve similar ends, but offer different advantages. **Use a lookup filter:** * To improve user efficiency by limiting the number of available options in a lookup search dialog. * To improve user efficiency by automating filters on lookup search dialogs that your users manually set. **Use a validation rule:** * If you're close to the maximum number of lookup filters allowed. * To implement a complex business rule that requires you to use a formula. Formulas can reference fields that basic filter criteria can't reference, such as fields on the parent of the source object. Formulas can also use functions. For example, use ISNEW to apply the rule only on record creation, or ISCHANGED to apply the rule only when a field changes.

Answer 123

When defining validation rules, you can set the error location to Top of Page or Field. If the error location is set to a field that is later deleted, to a field that is read only, or to a field that isn’t visible on the page layout, **Salesforce automatically changes the location to Top of Page.**

Answer 124

Field and Value Set

Answer 125

**We have three types of picklists:** * Standard * Custom * Custom Multi-Select **And picklist fields can have the following properties:** * Restricted * Dependent or Controlling

Answer 126

Values can be defined three ways: 1. Set individual values when you create the picklist. These are specific to a single picklist field. 2. Use the built-in set of values for the standard picklist fields that come with your Salesforce org. 3. Create a global value set. A global value set is a custom set of values you create to share with more than one picklist field.

Answer 127

* Delete it from your org * Use a Formula for a Default Value * Select Multiple Values * Make it Restricted * Make it a Dependent Picklist

Answer 128

* **Local picklist**—Lets users select a single value from a list that you define. This picklist is ***unique*** and had its own set of values. * **Shared picklist**—Lets users select a single value from a ***global*** picklist value set that you define in Setup. All custom picklist fields that use a global value set inherit its values and can’t have additional values. * **Multi-select picklist**—Allows users to select ***more than one*** picklist value from a list that you define. These fields display each value separated by a semicolon.

Answer 129

uniqueness errors can result

Answer 130

TRUE A global picklist is a restricted picklist by nature. Only a Salesforce admin can add to or modify its values. Users can’t add unapproved values, even through the API.

Answer 131

You can assign a value based on the current user. The following formula sets an Opportunity priority to High for all users in the Fast Response Sales profile. Other users see the default listed in the Values set. ## Footnote **IF($Profile.Name = "Fast Response Sales", "High", "")**

Answer 132

You can have up to **500** picklist global value sets in an org. Each global value set, or restricted picklist, can contain a mix of **1,000** active and inactive values. Unrestricted picklists can have up to **1,000** active values.

Answer 133

TRUE There’s no limit on the number of custom picklists that use global picklist value sets.

Answer 134

If you apply a global picklist value set to more than **13** different objects, you can deactivate values from the picklist value set, but you can’t replace any picklist values or delete values from the set.

Answer 135

To see all the fields where this value set is used, look under **Fields Where Used** **on the global picklist’s detail page.**

Answer 136

TRUE You can’t undo a custom picklist field’s association with a global value set. If you need a picklist field to use a different global value set, or different individual values, delete the custom picklist field and create a new one in its place.

Answer 137

As you add new values to an existing global picklist, you can add the new values to all record types that use the picklist. Select **Add the new picklist values to all Record Types that use this Global Value Set**; otherwise, you have to add the new values to existing records types manually.

Answer 138

You can promote fields that have **up to 1,000** values (both active and inactive).

Answer 139

**NO - You can promote only restricted picklists.** To promote an unrestricted picklist, convert it to a restricted picklist.

Answer 140

**FALSE** You **cannot** promote a field to an existing global value set.

Answer 141

Picklist values translated using Translation workbench have a limit of **40** characters.

Answer 142

For an app to help manage picklist values, see **Picklist Field Merge Salesforce Lab App** ## Footnote Automate migrating a picklist field into a global value set Picklist Field Merge app allows administrators to automate several part of migrating existing picklist fields into a global value set. It takes care of such aspects of the migration as merging values, updating existing records and more.

Answer 143

**FALSE** ## Footnote You can’t undo a custom picklist field’s association with a global value set. If you need a picklist field to use a different global value set, or different individual values, **delete the custom picklist field and create a new one in its place.**

Answer 144

## Footnote IF A FIELD IS INDEXED, YOU CAN USE SIDEBAR SEARCH OR ADVANCED SEARCH TO FIND VALUES IN THE FIELD. HAVING A FIELD INDEXED CAN ALSO SPEED UP OTHER OPERATIONS ON THE FIELD, SUCH AS REPORTING. CHECK OUT THIS BLOG POST TO FIND OUT MORE: KNOW THY SALESFORCE FIELD INDEXES FOR FAST REPORTS, LIST VIEWS, AND SOQL.

Answer 145

When selecting picklist values for a list view filter, the combined size of the selected picklist values must be less than **240** characters

Answer 146

**Custom single-select picklists can have:** Up to **1,000** values Up to **255** characters per value **Custom multi-select picklists can have:** Up to **500** values Up to **255** characters per value

Answer 147

Users can select up to **100** values at a time on a record.

Answer 148

You can have up to **500** picklist global value sets in an org. Each global value set, or restricted picklist, can contain a mix of **1,000** active and inactive values. Unrestricted picklists can have up to **1,000** active values.

Answer 149

**There’s no limit** on the number of custom picklists that use global picklist value sets

Answer 150

Transaction Security is a feature that monitors Salesforce events in real time to spot potential trouble based on rules you create. With Transaction Security, you can create policies that consist of events, notifications, and actions.

Answer 151

These are some of the available event types for Transaction Security policies. * **API Event** for monitoring and protecting all API queries. This prevents unauthorized data exports. * **List View Event** for access to list views. This tracks user’s access to list views from both the UI and API queries. * **Login Event** for monitoring login details. This blocks logins from untrusted locations, unsupported browsers, and specific device types. * **Report Event** for report views and exports. This blocks or requires multi-factor authentication for access to sensitive information or notifies when reports are run or exported.

Answer 152

* Block the operation. * Require a higher level of assurance using multi-factor authentication. * Do nothing (this can be useful for testing). * Opt-in for Policy notifications, sent via: * Email * In-app notification to the Salesforce app * Both email and in-app notifications

Answer 153

**New Policy Options are:** 1. Condition Builder 2. Apex **Notification options are:** 1. Email 2. In-App notification

Answer 154

As a best practice, before creating transaction security policies, you can **view or query events to determine appropriate thresholds for normal business usage.**

Answer 155

Event An event is anything that happens in Salesforce, including user clicks, record state changes, and measuring values. Events are immutable and timestamped.

Answer 156

Event Channel A stream of events on which an event producer sends event messages and event consumers read those messages.

Answer 157

Event Subscriber A subscriber to a channel that receives messages from the channel. For example, a security app is notified of new report downloads.

Answer 158

Event Message A message used to transmit data about the event.

Answer 159

Event Publisher The publisher of an event message over a channel, such as a security and auditing app.

Answer 160

FALSE Enhanced Transaction Security policies support both standard and custom objects.

Answer 161

Depending on whether you’re using **permission sets or profiles**, do one of the following. ## Footnote In permission sets or the enhanced profile user interface, select a permission. In the Find Settings dialog box, **enter View Real-Time Event Monitoring Data**. Click Edit, select the option, and click Save. Repeat these steps for the Customize Application permission. In the original profile user interface, select a profile name, and then click Edit. Select **View Real-Time Event Monitoring Data**, and Customize Application if you plan to create transaction security policies. Click Save.

Answer 162

Block a user or enforce multi-factor authentication (MFA). You can also optionally receive in-app or email notifications of the event.

Answer 163

**Event:** Report Event **Condition Logic:** All Conditions Are Met **Conditions:** Rows Processed Greater Than 2,000 Queried Entities *Contains* Lead **Notes:** Use the _Contains_ operator, rather than Equals, to also include reports that are based on multiple objects, one of which is Lead.

Answer 164

Event: Report Event Condition Logic: All Conditions Are Met Conditions: Name of Columns Contains Email Notes: Use the Contains operator to include any of these column names: Email, Customer Email, or Email of Customer.

Answer 165

Event: Login Event Condition Logic: All Conditions Are Met Conditions: Source IP Equals 12.34.56.78 Notes: Only the specific IP address 12.34.56.78 triggers the policy. If you want track logins from any IP addresses that start with 12.34.56, use the condition Source IP Starts With 12.34.56

Answer 166

Event: Login Event Condition Logic: All Conditions Are Met Conditions: Browser Contains Chrome Notes: You can also track logins from the Safari and Firefox browsers.

Answer 167

Event: API Event Condition Logic: All Conditions Are Met Conditions: Queried Entities Contains Lead Elapsed Time Greater Than 1000 Notes: Use the Contains operator, rather than Equals, to also include queries on multiple objects, of which one is Lead.

Answer 168

Event: List View Event Condition Logic: All Conditions Are Met Conditions: Event Source Equals API Notes: To track when a user uses the UI to query a list view specify Classic or Lightning instead of API.

Answer 169

Event: List View Event Condition Logic: Any Condition Is Met Conditions: Session Level Equals LOW Session Level Equals STANDARD Notes: Use the same condition in separate transaction security policies to track when a user without high assurance executes a report (Report Event) or an API query (API Event).

Answer 170

Event: List View Event Condition Logic: Custom Condition Logic is Met Custom Condition Logic: (1 OR 2) AND 3 Conditions: Scope Equals Everything Name Equals SuperSecureListView Username Ends With @spy.mycompany.com

Answer 171

Condition Builder is powerful, but it doesn’t support all c**omplex use cases, such as branching logic, querying for data, or looping over the queried data**. In those types of cases, you use Apex classes to define the conditions a Transaction Security policy triggers.

Answer 172

Use Setup to create an enhanced transaction security policy that uses Apex. You can specify an existing Apex class or create an empty class that you then code. The Apex class must implement the **TxnSecurity.EventCondition** interface.

Answer 173

With session-based permission sets, you can limit functional access for select permissions in a permission set to an activated session. When a session ends for any reason, a session-based permission set must be activated again before the user can access restricted resources.

Answer 174

Selecting **Session Activation Required** indicates to Salesforce that a permission set becomes enabled only with an activated session.

Answer 175

To make it usable, you need to have a way to activate a session for the permission set. **With code:** the PermissionSet object in the Soap API contains a field called HasActivationRequired, a boolean that indicates whether the permission set requires an associated active session (true) or not (false). Insert a record into the SessionPermSetActivation object with the combination of session ID and permission set to achieve the activation. **With a flow:** * Use a Get Records element to look up the permission set. * In the Get Records element, store the permission set’s name in a variable, so that you can use the name in the action. * Drag a Core Action element onto the canvas, and choose either Activate Session-Based Permission Set or Deactivate Session-Based Permission Set. * Activate it then distribute your flow to users who need to run it.

Answer 176

1. Make sure that you understand how permissions affect territory model and record access in Enterprise Territory Management. 2. Assign user permissions as needed. 3. Add the Assigned Territories related list to your account page layouts. This list lets Salesforce admins manually assign territories to accounts, and it lets users identify which territories are assigned to their accounts. Make sure that the related list includes the standard and custom fields (if any) that admins and users need. 4. Add the Users in Assigned Territories related list to your account page layouts. This list lets administrators and users see all users assigned to the territories that are assigned to an account, according to their permissions. Make sure that the related list includes the standard and custom fields (if any) that administrators and users need. 5. Add the Territory field to your Opportunity page layouts. This field lets administrators and sales managers manually assign a territory to an opportunity from a list of the territories assigned to the opportunity’s account. Add the Territory Name and Territory Description fields to Opportunity list views and reports so that users can identify assigned territories there. 6. Add any custom buttons, links, or actions you’ve created to territory page layouts.

Answer 177

**Record-level access = S'MORE** **Sharing Manual Organization (WD) RolE** 1. **Organization-wide defaults** specify the default level of access users have to each others’ records. You use org-wide sharing settings to lock down your data to the most restrictive level, and then use the other record-level security and sharing tools to selectively give access to other users. 2. **Role hierarchies** give access for users higher in the hierarchy to all records owned by users below them in the hierarchy. Role hierarchies don’t have to match your organization chart exactly. Instead, each role in the hierarchy should represent a level of data access that a user or group of users needs. 3. **Sharing rules** are automatic exceptions to organization-wide defaults for particular groups of users, so they can get to records they don’t own or can’t normally see. Sharing rules, like role hierarchies, are only used to give additional users access to records. They can’t be stricter than your organization-wide default settings. 4. **Manual sharing** allows owners of particular records to share them with other users. Although manual sharing isn’t automated like org-wide sharing settings, role hierarchies, or sharing rules, it can be useful in some situations, such as when a recruiter going on vacation needs to temporarily assign ownership of a job application to someone else.

Answer 178

**S**ystem Use **A**udi**t** = RaLFH SAT down to audit system use Record (a) Login Field History Setup Audit Trail **Record Modification Fields**: All objects include fields to store the name of the user who created the record and who last modified the record. This provides some basic auditing information. **Login History**: You can review a list of successful and failed login attempts for the past six months. For more information, see Monitor Login History. **Field History Tracking**: You can turn on auditing to automatically track changes in the values of individual fields. Although field-level auditing is available for all custom objects, only some standard objects allow it. For more information, see Field History Tracking. **Setup Audit Trail:** The Setup Audit Trail logs when modifications are made to your organization’s configuration. For more information, see Monitor Setup Changes.

Answer 179

If users are logged in when their login hours end, **they can continue to view their current page, but they can’t take any further action.**

Answer 180

**Usage-Based Entitlements** **examples: limited monthly logins/record limit for data.com** A usage-based entitlement is a limited resource that your organization can use on a periodic basis. For example, the allowed number of monthly logins to a Partner Community or the record limit for Data.com list users are usage-based entitlements.

Answer 181

6 sassy communities chat **S**tandard, **A**uthenticated, **S**ervice, **S**ites (Y) **C**ommunities, **C**hatter * Standard User Licenses * Chatter User Licenses * Communities User Licenses * Service Cloud Portal User Licenses * Sites and Site.com User Licenses * Authenticated Website User Licenses

Answer 182

* Customer Portal User Licenses * Customer Portal—Enterprise Administration User Licenses * User Licenses

Answer 183

What Is an Internal User and Internal License? An internal user logs in to Salesforce via login.salesforce.com or a company myDomain, like salesforce.acme.com, using an internal license. Internal users primarily access the Salesforce platform using Lightning Experience or Salesforce Classic. Internal users can also access Experience Cloud sites.

Answer 184

**What Is an External User and External License?** Salesforce customers who want to create an experience connected to their CRM data for their end customers, prospects, partners, brokers, dealers, and other external stakeholders use external licenses to provide access. Some typical use cases are partner portals, self-service forums and help centers, customer portals, and broker and dealer portals. **A user with an external license can access only the Experience Cloud sites that the user is a member of. An external user can’t access the internal Lightning Experience or Salesforce Classic.** For example, Acme Insurance is a Salesforce customer. Acme employees have internal licenses and log in to Salesforce. Acme created a broker portal for its partners with the URL partners.acme.com. **When Acme brokers log in to partners.acme.com with an external license, they’re not aware that they’re using Salesforce. Instead, the Acme portal is a secure space just for Acme brokers, not for Acme employees.**

Answer 185

Anyone who is an employee of a company or needs employee privileges requires an internal license. For example, Acme Insurance uses Salesforce as its CRM. The Acme sales and service teams, who are full-time employees, need an internal license to log in to Salesforce to do their day-to-day work. Acme uses consultants to take care of the company’s Salesforce setup and administration. The consultants also need internal licenses, even though they aren’t Acme employees. Other users who need an internal license to the Acme org are the company’s accountants and lawyers, who also work for other companies, to access the company’s information. **The key point is that you’re treating all these users as employees. Acme is granting the same privileges to employees and consultants and is fine with the broader data and permission access.**

Answer 186

Use **external licenses.** This will: * Limit access to your data * Restrict privacy or security and sharing considerations * Provide a more limited set of permissions (for example, can’t manage other users in the org or have access to modify all data) * Limit access to a subset of information that is contained in your org

Answer 187

Internal licenses provide broader access to your company data and information. **The incorrect use of an internal license for an external use case can provide external users unwanted or inappropriate access to your data and records.** Internal license types are built with one use case in mind: a company employee or consultant that needs access to company data in the Salesforce org. **External license types are created for a multitude of use cases and include an added security level not available with internal licenses.** The best practice for any org is to use external licenses for external use cases, and internal licenses for internal use cases.

Answer 188

With Customer 360 Identity, **customers and partners can _self-register, log in, update their profile, and securely access web and mobile apps with a single identity_.** Plus, Customer 360 Identity is customized to your specific business process and brand using the power of the Salesforce Platform. And you can use the product to store and manage customer and partner user records and to authenticate these users in several ways.

Answer 189

**Customer 360 Identity** is available when you purchase the _External Identity license_. You can purchase the External Identity license in blocks of active users. These users are typically consumers of your business, such as customers, purchasers, patients, partners, and dealers.

Answer 190

TRUE The External Identity license works with Community licenses. **It’s also included for free** with all paid Community user licenses in Enterprise, Performance, and Unlimited Editions.

Answer 191

TRUE You can upgrade the External Identity license to a Community license to benefit from Experience Cloud features, including Cases, Contracts, Notes, Orders, and Tasks. The External Identity license requires unique usernames within the Salesforce org that an Experience Cloud site belongs to.

Answer 192

* **From Setup, enter Delegated Administration** in the Quick Find box, then select Delegated Administration and click New * Select or create a delegated group. * To allow group users to log in as users in the role hierarchy that they administer, select Enable Group for Login Access. Depending on your org settings, individual users first grant login access to allow their administrators to log in as them. * Click Save. * For each related list, click Add to define your delegated group details.

Answer 193

To prevent users from granting access to a publisher—for example, to comply with regulatory or privacy concerns—**click Available to Administrators Only for that publisher.**

Answer 194

TRUE Users can’t grant login access to managed packages that are licensed to your entire Salesforce org. Only admins with the Manage Users permission can grant access to these publishers. Also, some managed packages don’t have login access. If a package isn’t listed on the Login Access Policies page, login access isn’t available for that package.

Answer 195

Delegated administrators can: * **Create and edit users in specified roles and all subordinate roles**. User editing tasks include **resetting passwords, setting quotas, creating default opportunity teams, and creating personal groups** for those users. * **Unlock users.** * **Assign users to specified profiles.** * **Assign or remove permission sets** for users in their delegated groups. * Create **public groups** and manage membership in specified public groups. * **Log in as a user who has granted login access to the administrator.** * **Manage custom objects and customize nearly every aspect of a custom object.** However, a delegated admin *can’t create or modify relationships on the object or set org-wide sharing defaults.* * **Administer users across all delegated groups to which the delegated admin is assigned.** For example, Sam Smith is specified as a delegated administrator in two delegated groups, Group A and Group B. Sam can assign a permission set or public group from Group A to users in Group B.

Answer 196

**FALSE** Delegated administrators **CANNOT** assign profiles or permission sets with the “Modify All Data” permission

Answer 197

TRUE Delegated Administrators don’t see the None Specified option when selecting a role for new users

Answer 198

FALSE ## Footnote They CANNOT modify permission sets.

Answer 199

YES - Assign the "Manage Roles" permission for the delegated administrator to change the role of portal account owners

Answer 200

TRUE When you define IP address restrictions for a profile, a login from any other IP address is denied.

Answer 201

TRUE How you restrict the range of valid IP addresses on a profile depends on your Salesforce edition.

Answer 202

PROFILES, then click New in the Login IP Ranges related list.

Answer 203

The location of IP ranges depends on whether you have the "Edit Profiles & Page Layouts" org preference enabled as an add-on feature. **With the "Edit Profiles & Page Layouts" org preference enabled, IP ranges are on individual profiles.** **Without** the "Edit Profiles & Page Layouts" org preference enabled, IP ranges are on the **Session Settings** page.

Answer 204

Session Settings Then, click New in the Login IP Ranges related list.

Answer 205

To enable this option, in Setup, enter Session Settings in the Quick Find box, then **select Session Settings and select Enforce login IP ranges on every request.** This option affects all user profiles that have login IP restrictions.

Answer 206

You can set object permissions with profiles or **permission set**

Answer 207

two special permissions: View All Data Modify All Data

Answer 208

TRUE You can’t edit the object permissions on a standard profile. However, you can clone any existing profile, and use that as the basis for a new profile, adjusting the apps and system settings as needed.

Answer 209

Permission sets = oaf objects apps fields 1) to grant access to **objects or apps** 2) and to grant permissions—temporarily or long term—to specific **fields.**

Answer 210

On the Object Settings pages in the enhanced profile user interface, you can: * View or edit: * Tab settings * Record types and page layout assignments * Object permissions * Field permissions for an object * Search for an object, permission, or setting * Clone the profile * Delete custom profile * Change the profile name or description * Go to the profile overview page * Switch to a different settings page

Answer 211

* **Apex class methods**, such as Web service methods * Any method used in a **custom Visualforce controller or controller extension** applied to a Visualforce page

Answer 212

TRUE Triggers always fire on trigger events (such as insert or update), regardless of permission settings.

Answer 213

FALSE Assigned app settings specify the apps that users can select in the Lightning Platform app menu. **Unlike profiles, you CANNOT assign a default app in permission sets.** ***You can only specify whether apps are visible.***

Answer 214

TRUE Permission sets can be assigned to a community’s membership, granting users who are assigned to the permission set access to the community. If you add a permission to a permission set that is being used to grant membership to a community, the community members also get access to the permissions unrelated to community membership. Salesforce recommends checking if a permission set is used in any community’s membership list before adding new permissions to it.

Answer 215

FALSE ## Footnote A new permission set starts with no user license selected and no permissions enabled. A cloned permission set has the same user license and enabled permissions as the permission set that it’s cloned from. **You can’t change the user license in a cloned permission set. *Clone a permission set only if the new one requires the same user license as the original.***

Answer 216

Object permissions A profile or a permission set can have an entity, such as Account, with a master-detail relationship. **A broken permission dependency exists if the child entity has permissions that the parent should have.** Salesforce updates the parent entity for a broken permission dependency on the first save action for the profile or permission set. IF THE CHILD ENTITY HAS THESE PERMISSIONS THESE PERMISSIONS ARE ENABLED ON THE PARENT ENTITY **Child:** Modify All OR View All **then, Parent has:** View All **Child:** View All OR Read **then, Parent has:** Read

Answer 217

Permission set **GROUPS** If your org has many permission sets, using **permission set groups** can help improve performance.

Answer 218

When you create a permission set using a specific permission set license, **users assigned to the permission set receive all functionality associated with the permission set license.**

Answer 219

TRUE In API version 25.0 and later, **every profile is automatically associated with a permission set, whether you explicitly assign it to one or not.** This permission set stores the profile’s user, object, and field permissions, plus setup entity access settings. You can query on these profile-owned permission sets but not modify them. They’re not visible in the user interface.

Answer 220

TRUE **Some user licenses restrict the number of custom apps or tabs that a user can access.** In this case, you can assign only the allotted number through the user’s assigned profile and permission sets. For example, a user with the App Subscription user license with access to one Light App can access only that app’s custom tabs.

Answer 221

From Setup, in the Quick Find box, enter User, and then select User Management Settings. Enable Enhanced Profile User Interface.

Answer 222

Shield Platform Encryption gives your data **a whole new layer of security while preserving critical platform functionality.** It enables you to encrypt sensitive data at rest, and not just when transmitted over a network, so your company can confidently comply with privacy policies, regulatory requirements, and contractual obligations for handling private data. Your data encryption key material is never saved or shared across orgs. You can choose to have Salesforce generate key material for you or upload your own key material. By default, the Shield Key Management Service derives data encryption keys on demand from a master secret and your org-specific key material, and stores that derived data encryption key in an encrypted key cache. You can also opt out of key derivation on a key-by-key basis, or store your final data encryption key outside of Salesforce and have the Cache-Only Key Service fetch it on demand from a key service that you control. No matter how you choose to manage your keys, Shield Platform Encryption secures your key material at every stage of the encryption process.

Answer 223

I have to wear a shield to the **FAT Plate Event** A trio of security tools that admins and developers can use to build a new level of trust, transparency, compliance, and governance right into business-critical apps. It includes **Platform Encryption, Event Monitoring, and Field Audit Trail.** Ask your Salesforce administrator if Salesforce Shield is available in your organization.

Answer 224

As an admin, you can use Health Check to identify and fix potential vulnerabilities in your security settings, all from a single page. A summary score shows **how your org measures against a security baseline, like the Salesforce Baseline Standard.** You can upload up to five custom baselines to use instead of the Salesforce Baseline Standard.

Answer 225

Salesforce strongly recommends that customers implement the following changes to enhance security. 1. Implement **two-factor authentication** techniques to restrict access to your network. For more information, see Two-Factor Authentication. 2. Modify your Salesforce implementation to **activate IP range restrictions**. These restrictions allow users to access Salesforce only from your corporate network or VPN. For more information, see Restrict Where and When Users Can Log In to Salesforce. 3. Set **session security restrictions** to make spoofing more difficult. For more information, see Modify Session Security Settings. 4. Educate your employees not to open suspect emails and to be vigilant in **guarding against phishing attempts.** 5. Use security solutions from leading vendors to **deploy spam filtering and malware protection.** 6. **Designate a security contact within your organization so that Salesforce can more effectively communicate with you.** Contact your Salesforce representative with this information. 7. **Use Transaction Security to monitor events and take appropriate actions.** For more information, see Legacy Transaction Security Policies.

Answer 226

**1. Record Modification Fields** * All objects include fields to store the name of the user who created the record and who last modified the record. This provides some basic auditing information 2. **Login History** * You can review a list of successful and failed login attempts to your organization for the past six months. See Monitor Login History. 3. **Field History Tracking** * You can also enable auditing for individual fields, which will automatically track any changes in the values of selected fields. Although auditing is available for all custom objects, only some standard objects allow field-level auditing. See Field History Tracking. * Setup Audit Trail 4. Administrators can also view a **Setup Audit Trail**, which logs when modifications are made to your organization’s configuration. See Monitor Setup Changes with Setup Audit Trail.

Answer 227

* **Password policies**—Set various password and login policies, such as specifying an amount of time before all users’ passwords expire and the level of complexity required for passwords. See Set Password Policies. * **User password expiration—**Expire the passwords for all users in your organization, except for users with “Password Never Expires” permission. See Expire Passwords for All Users. * **User password resets—**Reset the password for specified users. See Reset Passwords for Your Users. * **Login attempts and lockout periods**—If a user is locked out of Salesforce because of too many failed login attempts, you can unlock them. See Edit Users.

Answer 228

SAMueL is single but he Delegates Authentically You have two options to implement single sign-on—**federated authentication using Security Assertion Markup Language (SAML)** or **delegated authentication.**

Answer 229

Federated authentication using Security Assertion Markup Language (SAML) lets you send authentication and authorization data between affiliated but unrelated web services. You can log in to Salesforce from a client app. Salesforce enables federated authentication for your org automatically.

Answer 230

Delegated authentication SSO integrates Salesforce with an authentication method that you choose. You can integrate authentication with your LDAP (Lightweight Directory Access Protocol) server or use a token instead of a password for authentication. You manage delegated authentication at the permission level, not at the org level, giving you more flexibility. With permissions, you can require some to use delegated authentication while others use their Salesforce-managed password.Delegated authentication offers the following benefits. * Uses a stronger form of user authentication, such as integration with a secure identity provider * Makes your login page private and accessible only behind a corporate firewall * Differentiates your org from all other companies that use Salesforce to reduce phishing attacks

Answer 231

Using My Domain, you can define a Salesforce subdomain name to manage login and authentication for your org in several key ways. * Highlight your business identity with your unique domain URL * Brand your login page and customize content on the right side of the page * Block or redirect page requests that don’t use the new domain name * Work in multiple Salesforce orgs at the same time * Set custom login policy to determine how users are authenticated * Let users log in using a social account, like Google and Facebook, from the login page * Allow users to log in once to access external services

Answer 232

Two-factor authentication is the most effective way to protect your org’s user accounts. As a Salesforce admin, amplify your org’s security by requiring a second level of authentication for every user login. You can also require two-factor authentication when a user meets certain criteria, such as attempting to view reports or access a connected app. Two-factor authentication is an essential user authentication method—so essential that Salesforce provides two types of two-factor authentication. **Service-based—**Also known as device activation, service-based two-factor authentication is automatically enabled for all orgs. **Policy-based—**Admins enable policy-based two-factor authentication. It is an admin’s best tool to protect org user accounts.

Answer 233

WHERE AND WHEN they can log in Network-based security limits **where** users can log in from, and **when** they can log in. This is different from user authentication, which only determines who can log in. Use network-based security to limit the window of opportunity for an attacker and to make it more difficult for an attacker to use stolen credentials.

Answer 234

Device activation tracks information about the devices from which users have verified their identity. Salesforce prompts users to verify their identity when they access Salesforce from an unrecognized browser or application. Device activation is an extra layer of security on top of username and password authentication. When a user logs in from outside a trusted IP range from an unrecognized browser or app, Salesforce challenges the user to verify identity. Salesforce uses the highest-priority verification method available for each user. In order of priority, the methods are: Push notification or location-based automated verification with the Salesforce Authenticator mobile app (version 2 or later) connected to the user’s account U2F security key registered with the user’s account Verification code generated by a mobile authenticator app connected to the user’s account Verification code sent via SMS to the user’s verified mobile device Verification code sent via email to the user’s registered email address

Answer 235

After logging in, a user establishes a session with the platform. **Use session security to limit exposure to your network when a user leaves the computer unattended while still logged in. Session security also limits the risk of internal attacks, such as when one employee tries to use another employee’s session.** Choose from several session settings to control session behavior. You can control when an inactive user session expires. ***The default session timeout is two hours of inactivity.*** When the session timeout is reached, users are prompted with a dialog that allows them to log out or continue working. If they don’t respond to this prompt, they are logged out.

Answer 236

By default, Salesforce uses **TLS (Transport Layer Security)** and requires secure connections (HTTPS) for all communication. The Require secure connections (HTTPS) setting determines whether TLS (HTTPS) is required for access to Salesforce. If you ask Salesforce to disable this setting and change the URL from https:// to http://, you can still access the application. However, for added security, require all sessions to use TLS. For more information, see Modify Session Security Settings.

Answer 237

**Login flows allow admins to build post-authentication processes to match their business practices, associate the flow with a user profile, and send the user through that flow when logging in.** Salesforce directs users to the login flow after they authenticate but before they access your org or community. After users complete the login flow, they’re logged in to your Salesforce org or community. The login process can also log out users immediately if necessary.

Answer 238

* Enhance or customize the login experience. For example, add a logo or login message. * Collect and update user data. For example, request an email address, phone number, or mailing address. * Interact with users, and ask them to perform an action. For example, complete a survey or accept terms of service. * Connect to an external identity service or geo-fencing service, and collect or verify user information. * Enforce strong authentication. For example, implement a two-factor authentication method using hardware, SMS, biometric, or another authentication technique. * Run a confirmation process. For example, have a user define a secret question, and validate the answer during login. * Create more granular policies. For example, set up a policy that sends a notification every time a user logs in during non-standard working hours.

Answer 239

**FDA** ## Footnote Salesforce offers the following ways to use SSO. **Federated authentication using Security Assertion Markup Language (SAML)** lets you send authentication and authorization data between affiliated but unrelated web services. You can log in to Salesforce from a client app. Salesforce enables federated authentication for your org automatically. **Delegated authentication SSO** integrates Salesforce with an authentication method that you choose. You can integrate authentication with your LDAP (Lightweight Directory Access Protocol) server or use a token instead of a password for authentication. You manage delegated authentication at the permission level, not at the org level, giving you more flexibility. With permissions, you can require some to use delegated authentication while others use their Salesforce-managed password.Delegated authentication offers the following benefits. * Uses a stronger form of user authentication, such as integration with a secure identity provider * Makes your login page private and accessible only behind a corporate firewall * Differentiates your org from all other companies that use Salesforce to reduce phishing attacks * You must contact Salesforce to enable delegated authentication before you can configure it on your org. **Authentication providers** let your users log in to your Salesforce org using their login credentials from an external service provider. Salesforce supports the OpenID Connect protocol, which lets users log in from any OpenID Connect provider, such as Google, PayPal, and LinkedIn. When an authentication provider is enabled, Salesforce doesn’t validate a user’s password. Instead, Salesforce uses the user’s login credentials from the external service provider to establish authentication credentials.

Answer 240

Connect for Office is a desktop client that integrates Salesforce with your PC. As an administrator, you can control which desktop clients your users can access as well as whether users are automatically notified when updates are available.

Answer 241

Two-Factor Authentication for API Logins For each profile, you can require a verification code, also called a time-based one-time password, or TOTP. Users with the Two-Factor Authentication for API Logins permission use a verification code instead of the standard security token whenever it’s requested, such as when resetting the account’s password. Verification codes are generated by an authenticator app that users connect to their account.

Answer 242

**Event** An event is anything that happens in Salesforce, including user clicks, record state changes, and measuring values. Events are immutable and timestamped. **Event Channel** A stream of events on which an event producer sends event messages and event consumers read those messages. **Event Subscriber** A subscriber to a channel that receives messages from the channel. For example, a security app is notified of new report downloads. **Event Message** A message used to transmit data about the event. **Event Publisher** The publisher of an event message over a channel, such as a security and auditing app.

Answer 243

**RECORD = 4 = S(h)MOR** They’re listed in order of increasing access. You use org-wide defaults to lock down your data to the most restrictive level, and then use the other record-level security tools to grant access to selected users, as required. **Org-wide defaults** specify the default level of access users have to each other’s records. **Role hierarchies** ensure managers have access to the same records as their subordinates. Each role in the hierarchy represents a level of data access that a user or group of users needs. **Sharing rules** are automatic exceptions to org-wide defaults for particular groups of users, to give them access to records they don’t own or can’t normally see. **Manual sharing** lets record owners give read and edit permissions to users who might not have access to the record any other way.

Answer 244

With record-level security, if the org-wide defaults are anything less than **Public Read/Write,** you can open access back up for certain roles using the role hierarchy.

Answer 245

Only the **record owner,** and **users above that role** in the hierarchy, can view, edit, and report on those records.

Answer 246

**Public Read Only:** **ALL = view/report** **OWNER/USERS ABOVE ROLE = edit** **All users** can view and report on records, but **only the owner**, and **users above that role** in the hierarchy, can **edit** them.

Answer 247

**Public Read/Write** **ALL = View/Edit/Report** All users can view, edit, and report on all records.

Answer 248

**Controlled by Parent** A user can view, edit, or delete a record if she can perform that same action on the record it belongs to.

Answer 249

OWD Sharing is Private Read Only OR Public Read Only = Open up with **ROLES or SHARING RULES** When the org-wide sharing setting for an object is Private or Public Read Only, **an admin can grant users additional access to records by _setting up a role hierarchy or defining sharing rules_.** Sharing rules can only be used to grant additional access. They cannot be used to restrict access to records beyond what was originally specified with the org-wide sharing defaults.

Answer 250

Use the **Grant Access Using Hierarchies** checkbox to disable access to records to users above the record owner in the hierarchy for custom objects. If you deselect this checkbox for a custom object, only the record owner and users granted access by the org-wide defaults receive access to the records.

Answer 251

Even if Grant Access Using Hierarchies is deselected, some users—such as **those with the “View All” and “Modify All” object permissions and the “View All Data” and “Modify All Data” system permissions**—can still access records they don’t own.

Answer 252

**Apex managed sharing allows developers to programmatically share records associated with custom objects.** When you use Apex managed sharing for any custom object, only users with the “Modify All Data” permission can add or change the sharing on that custom object's records, and the sharing access stays the same even if the record owner changes. For more information, see Apex Sharing.

Answer 253

Disabling the Grant Access Using Hierarchies setting in your organization-wide default settings allows you to **ignore the hierarchies when determining access to data.**

Answer 254

You can only modify the Grant Access Using Hierarchies setting for **custom objects.**

Answer 255

Contacts that aren’t linked to an account are always **private**. Only the owner of the contact and administrators can view it.

Answer 256

TRUE Contact sharing rules **don’t** apply to private contacts.

Answer 257

TRUE ## Footnote Notes and attachments marked as private via the Private checkbox are accessible only to the person who attached them and to administrators.

Answer 258

TRUE **Events marked as private via the Private checkbox are accessible only by the event owner.** Other users can’t see the event details when viewing the event owner’s calendar. ***However, users with the “View All Data” or “Modify All Data” permission can see private event details in reports and searches, or when viewing other users’ calendars.***

Answer 259

Users above a record owner in the role hierarchy can only view or edit the record owner’s records **if they have the “Read” or “Edit” object permission for the type of record.**

Answer 260

FALSE Visibility to users as a result of the Site User Visibility preference **_IS NOT_** inherited through the role hierarchy. If a manager in the role hierarchy isn’t a member of a site, but their subordinate is, the manager doesn’t gain access to other members of the site. ***This only applies if Salesforce Experiences are enabled in your organization.***

Answer 261

The ability to delete individual records is controlled by: 1. administrators 2. the record owner 3. users in a role hierarchy above the record owner 4. and any user who has been granted “Full Access.”

Answer 262

You must have **“Read/Write”** access to a record to be able to add notes or attachments to the record.

Answer 263

Y**ou must have at least “Read” access to a record** to be able to add activities or other associated records to it.

Answer 264

1. the record owner 2. users in a role hierarchy above the record owner 3. and any user that has been granted “Full Access.”

Answer 265

If a user transfers ownership of a record, **_Salesforce deletes any manual shares_ created by the original record owner,** which can cause users to lose access. **When account ownership is transferred, manual shares created by the original account owner on child records, such as opportunities and cases, are also deleted.**

Answer 266

Sharing model = VISIBILITY TO RECORDS User/Object Permissions = CONTROL WHAT USERS CAN DO WITH RECORDS While your **sharing model controls _visibility_** to records, **user permissions and object-level permissions control _what users can do_** to those records.

Answer 267

To restrict users’ access to records they don’t own that are associated with accounts they do own, **set the appropriate access level on the role.** For example, you can restrict a user’s access to opportunities they don’t own yet are associated with accounts they do own using the Opportunity Access option.

Answer 268

Regardless of the organization-wide defaults, users can, at a minimum, view the accounts in their **_territories_**. Also, users can be granted access to view and edit the contacts, opportunities, and cases associated with their territories’ accounts.

Answer 269

TRUE ## Footnote The organization-wide default settings **can’t** be changed from private to public for a custom object if Apex code uses the sharing entries associated with that object. For example, if Apex code retrieves the users and groups who have sharing access on a custom object Invoice\_\_c (represented as Invoice\_\_share in the code), you can’t change the object’s organization-wide sharing setting from private to public.

Answer 270

OWD = Private (for campaigns) Sharing Rule = Public Full access for Marketing Users Sharing Rule = Read Only for Campaign Owners (in Biz Unit) To segment visibility between business units while maintaining existing behavior within a business unit: * Set the **campaign organization-wide default to Private.** * Create a _sharing rule_ to grant **marketing users** **Public Full Access** to all campaigns owned by users within their business unit. * Create a _sharing rule_ to grant all non-marketing users in a business unit **Read Only** access to all campaigns owned by users in their business unit.

Answer 271

When a single user, such as a regional marketing manager, owns multiple campaigns and needs to segment visibility between business units, **_share campaigns individually_ instead of using sharing rules.** Sharing rules apply to all campaigns owned by a user and don’t allow segmenting visibility.

Answer 272

**_Create all campaign sharing rules_** prior to changing your organization-wide default to reduce the effect the change has on your users.

Answer 273

To share all campaigns in your organization with a group of users or a specific role, **create a sharing rule that applies to campaigns owned by members of the “Entire Organization” public group.**

Answer 274

Minimize the number of sharing rules you need to create **by using the “Roles and Subordinates” option instead of choosing a specific role.**

Answer 275

TRUE If campaign hierarchy statistics are added to the page layout, a user can see aggregate data for a parent campaign and all the campaigns below it in the hierarchy regardless of whether that user has sharing rights to a particular campaign within the hierarchy. **Therefore, consider your organization’s campaign sharing settings when enabling campaign hierarchy statistics.** If you don’t want users to see aggregate hierarchy data, remove any or all of the campaign hierarchy statistics fields from the Campaign Hierarchy related list. These fields will still be available for reporting purposes.

Answer 276

TRUE ## Footnote If the sharing model is set to Public Full Access for campaigns, any user can delete those types of records.

Answer 277

Campaign member sharing is controlled **by _campaign sharing rules_. Users that can see a campaign can also see associated campaign members.**

Answer 278

Orgs that use **person accounts** can modify the Organization-Wide Sharing Default for Contacts. This allows for flexibility in how you share business contacts, including the ability to define contact sharing rules and manually share business contacts. Manually sharing contacts applies only to the business accounts because ***person accounts don’t have contacts. To share information about a person account, you must share the entire account.***

Answer 279

In Salesforce orgs created **_before Spring ’20,_** when you first enable external organization-wide defaults, the default internal access and default external access are set to the **original default access level.** ***The only exceptions are User and newly created custom objects, which are set to Private by default.*** ## Footnote **In orgs created _after Spring ’20_, the default external access level is set to Private for all objects, unless the default internal access level is Controlled by Parent.**

Answer 280

TRUE ## Footnote A manager always has access to the same data as his or her employees, regardless of the org-wide default settings.

Answer 281

In the Organization Wide Defaults section, click Edit. **_Deselect Grant Access Using Hierarchies_** if you want to prevent users from gaining automatic access to data owned by or shared with their subordinates in the hierarchies.

Answer 282

TRUE ## Footnote Regardless of your organization's sharing settings, users can gain access to records they don’t own through other means such as user permissions like “View All Data,” sharing rules, or manual sharing of individual records.

Answer 283

TRUE ## Footnote The Grant Access Using Hierarchies option is always selected on standard objects and isn’t editable.

Answer 284

If you disable the Grant Access Using Hierarchies option, sharing with a role or territory and subordinates only shares with the users directly associated with the role or territory selected. **Users in roles or territories above them in the hierarchies _won’t_ gain access.**

Answer 285

If your organization disables the Grant Access Using Hierarchies option, **activities associated with a custom object _are still visible to users above_ the activity’s assignee in the role hierarchy.**

Answer 286

**Public Read/Write and Grant Access Using Hierarchies = TRUE** If a master-detail relationship is broken by deleting the relationship, **the former detail custom object's default setting is automatically reverted to Public Read/Write and Grant Access Using Hierarchies is selected by default.**

Answer 287

TRUE Record access granted to users via sharing sets isn’t extended to their superiors in the role hierarchy.

Answer 288

TRUE Users at any role level can view, edit, and report on all data that’s owned by or shared with users below them in their role hierarchy, unless your org’s sharing model for an object specifies otherwise.

Answer 289

n Salesforce orgs created in Spring ’21 or later, you can create up to **5,000** roles. In orgs created before Spring ’21, you can create up to **500** roles and can contact Salesforce Customer Support to increase this limit.

Answer 290

TRUE ## Footnote Every user must be assigned to a role, or their data won’t display in opportunity reports, forecast roll-ups, and other displays based on roles.

Answer 291

FALSE ## Footnote Put all users that require visibility to the entire org at the **_highest_** level in the hierarchy.

Answer 292

FALSE ## Footnote **Create roles only for your current requirements**. Don’t create temporary placeholder roles in anticipation of future needs.

Answer 293

FALSE ## Footnote **_Don’t_** use reporting requirements to determine what hierarchy levels you need.

Answer 294

TRUE ## Footnote When you change a user’s role, the sharing rules for the new role are applied.

Answer 295

FALSE ## Footnote Salesforce Knowledge users **CAN** modify category visibility settings on the role detail page.

Answer 296

When an account owner isn’t assigned a role, **the sharing access for related contacts is Read/Write, provided the organization-wide default for contacts isn’t Controlled by Parent. Sharing access on related opportunities and cases is No Access.**

Answer 297

TRUE ## Footnote To prevent disruptions, avoid changing the role hierarchy during business hours.

Answer 298

To avoid performance issues, Salesforce recommends that no single user owns more than 10,000 records of an object. For users who must own more than that number of objects, don't assign them a role or place them in a separate role at the top of the hierarchy. It’s also important to keep that user out of public groups potentially used as the source for sharing rules.

Answer 299

To improve performance, **minimize the number of levels in your role hierarchy**. Eliminate roles that aren't needed, and delete sharing rules that grant access to records already shared via the role hierarchy.

Answer 300

TRUE ## Footnote The Managers in the Role Hierarchy related list shows all of the users above you in the hierarchy. These users have the same access to your data as you do—**they have access to all data you own or that has been shared with you.**

Answer 301

For each role in your hierarchy, Salesforce automatically creates sharing groups, which you can use in sharing rules and manual sharing: **Role—**users in the role plus users in roles above it in the hierarchy **Role and Subordinates—**users in the role plus users in roles above and below it in the hierarchy **Role and Internal Subordinates—**users in the role, plus users in roles above and below it in the hierarchy, excluding portal or site users. This group is only available when Salesforce Experiences or portals are enabled for your organization. **Roles, Internal and Portal Subordinates—**users in the role, plus users in roles above and below it in the hierarchy, including portal or site users. This group is only available when Salesforce Experiences or portals are enabled for your organization.

Answer 302

If territory management is enabled for your organization, each territory has sharing groups: **Territory—**users in the territory plus users in territories above it in the hierarchy **Territory and Subordinates—**users in the territory plus users in territories above and below it in the hierarchy

Answer 303

RECORD OWNER/FIELD VALUES Sharing rules can be based on 1. who owns the record 2. on the values of fields in the record.

Answer 304

Each sharing rule has three components. records, users, access

Answer 305

Salesforce recommends applying inherited rules to child territories. When you add a parent territory to your territory hierarchy, it’s best to apply inherited account assignment rules to its child territories. Defining each territory hierarchy branch as its own “tree” makes the “siblings” at the same level mutually exclusive. That way, you prevent the rules engine from evaluating more branches of your hierarchy than what’s necessary, which improves performance.

Answer 306

**Start at the lowest level of the territory hierarchy first,** making changes there, and then moving up the hierarchy level by level. Using this method avoids having to recalculate access levels to accounts, opportunities, contacts, and cases for the same territories.

Answer 307

Salesforce recommends defining criteria on **numeric fields**, not string fields. And **avoid defining numeric criteria as text.** Operators on string fields aren’t case-sensitive, which can affect performance. So instead of defining criteria on string fields, consider defining criteria on numeric fields. Also, numeric fields defined as text slow down performance. So, for example, in a filter criterion for number of employees, enter 1000, not one thousand. When you define assignment rules, **make them as restrictive as possible.** For example, avoid including lots of OR conditions. That way, Salesforce doesn’t assign too many accounts to a territory. **Create filter criteria that reflects these ratios to get better performance: \<10K records and 3 territories per 1 user.** More than 10,000 records associated with a record can create performance inefficiencies. For example, 12,000 accounts assigned to a territory are probably too many. For the ratio of number of territories to number of users assigned, the rule of thumb is 3 to 1. And if you’re required to add more than 1,500 users to a territory, don’t use Setup. Manage user-to-territory assignment through the API.

Answer 308

You can set up Salesforce to run account assignment rules when an account is updated. Because Salesforce _runs the assignment rules for all your accounts_ even when just one was updated, **performance can take a hit.** To avoid performance slowdowns, use these methods with caution.

Answer 309

A rule identifies one or more characteristics you use to define that territory, and tells Enterprise Territory Management to assign accounts with those characteristics to that territory automatically. Accounts are assigned to territories according to your rules automatically on account creation or update only if your territory model is in Active state.

Answer 310

TRUE Do not assign a rule to a territory if that rule is a child of another rule already assigned to the territory. Also, if a rule has *Apply to Child Territories* selected, do not assign the rule separately to child territories.

Answer 311

TRUE Rules can work together within territories and child territories. For example, you create a territory called Western States, with child territories Washington, Oregon, and California. From the Western States territory record, you create a rule that assigns accounts in Washington, Oregon, and California to that territory. You apply that rule to child territories and then, from the California territory record, you create a rule that assigns accounts in California to the California territory. For any child territories for the California territory, you don’t have to specify the state in the criteria if you mark the California territory rule as inheritable to child territories. Instead, you can use more specific criteria, such as ZIP code or industry.

Answer 312

Manual assignment is **useful for accounts that have unique characteristics and therefore can’t be assigned by rules.**

Answer 313

Before you activate a territory model, **preview and validate its territory account assignments.** Preview assignments by running assignment rules when the model is in Planning state. Also verify your manual assignments.

Answer 314

If you make changes to the rules for a territory, **you must run rules again to view those changes.** In this case, you may want to run rules on that territory only. To do so, navigate to the territory’s detail page, scroll to the Assignment Rules Defined in this Territory related list, and click Run Rules.

Answer 315

The Manage Territories permission: **Provides users access to _territories_ in planning and archived state and to the list of accounts assigned to territories in planning and archived state.** ***_Does not_* provide access to the _accounts_ assigned to territories in planning and archived state.** Only the account name and ID fields appear in the list. To run territory planning reports, users must get access to accounts via a method other than the permission.

Answer 316

TRUE When an account is assigned to a territory, that territory’s users have access to the account. It’s easy to find out who those users are by looking at the account record.

Answer 317

Territories can have up to **15** assignment rules each.

Answer 318

On an opportunity record, you can assign and track the territory whose assigned sales reps work that opportunity. Manual territory assignments are controlled by your access to the opportunity’s **assigned (parent) account**. When you assign a territory to an opportunity, that opportunity is shared with all Salesforce users assigned to that territory’s parent in the territory model’s hierarchy.

Answer 319

TRUE Users who have full access to an opportunity’s account can assign any territory from the active model to the opportunity. Users who _do not_ can assign only a territory that is also assigned to the opportunity’s account. (The same restriction applies to territory assignments made via Apex in system mode.) For manual territory assignments, Salesforce suggests opportunities assigned to the territory’s account, but users with full access can search for and assign any territory in the active territory model.

Answer 320

The opportunity territory assignment filter **assigns territories to opportunities based on the filter logic in the Apex class.**

Answer 321

Only **Salesforce admins, opportunity owners**, and **users above the opportunity owners in the role hierarchy** can manage filter logic exclusion by selecting or deselecting Exclude from the territory assignment filter logic on opportunities.

Answer 322

Cloning lets you make a copy of a territory model that you can use to **test territory characteristics.**

Answer 323

Only models in **Planning, Active, or Archived** state can be cloned. When cloning is complete, the new model is in **Planning** state.

Answer 324

If you’re cloning a territory model with assignment rules, make sure that any picklist values referenced in the assignment rules are valid. If you’ve deleted or replaced a picklist value that’s referenced in an assignment rule, **the picklist value isn’t valid, and the cloning process fails.**

Answer 325

When the process is complete, Salesforce sends you an email to let you know.

Answer 326

You can assign users to territories that belong to models in **Active or Planning state**, though assignments made within Planning state models are for planning purposes only. They don’t affect user access to records.

Answer 327

TRUE The number of territories assigned to a user can impact performance. We recommend that you test thoroughly for performance issues, and if you observe any, reduce the number of territories per user.

Answer 328

Track user functions within territories by **creating territory roles** and assigning them to territory users as needed. For example, create roles such as Territory Owner, Sales Manager, Product Specialist, or Sales Representative. Users can even have different roles in different territories.

Answer 329

Add territory roles to the **UserTerritoryAssociation** object’s Role in Territory picklist so you can select roles for territory users. The Role in Territory picklist you define can be used for all territories in Active or Planning state.

Answer 330

When you’re satisfied with the structure of your territory model and its territory account assignments, you’re ready to **activate it.** Remember that **you can also maintain models in Planning and Archived states for further modeling and reference.**

Answer 331

Only **one** model can be in the Active state at one time in your organization.

Answer 332

You can only activate a model that is in the **Planning** state.

Answer 333

After activating a model, you cannot reset it to **Planning** state: you can only set it to **Archived** state.

Answer 334

* **Other public groups** * Permission Sets * Profiles * **User assigned to specific territories** * **Roles** ## Footnote **And users, of course.**

Answer 335

* Modify the org wide sharing setting for the Campaign Object * **Modify the org-wide sharing setting for the Campaign Member object** * Use a criteria-based sharing on the Campaign object to grant access to campaign members * Use a criteria based sharing rule defined on the Campaign Member object to grant access to campaign members ## Footnote Keep lead and contact details private even when they’re added to campaigns. Let your marketing department see only the campaign member details that you want them to. ***Sharing rules for campaign members can inherit from lead and contact rules or from the campaign.*** **Where:** This change applies to Lightning Experience, Salesforce Classic, and all versions of the mobile app in Professional, Enterprise, Performance, Unlimited, and Developer editions. **How:** To let users see only the campaign members whose lead or contact records they have access to, in Sharing Settings choose Controlled by Lead or Contact. To let users who have access to a campaign see campaign member details, choose Controlled by Campaign. Access provided by a user’s role or profile supersedes the organization-wide defaults.

Answer 336

1. **Assignment Rules can be run directly from the territory hierachy.** 2. The territory hierarchy determines the role hierarchy. 3. The territory hierarchy grants access to records based on ownership. 4. **The territory hierarchy determines the forecast hierarchy for territory forecasts.** 5. **Territories can be created from the territory hierarchy.**

Answer 337

What can Delegated Administrators NOT do? **1. Create profiles** 2. Create users 3. Manage custom objects 4. Login as a specific user

Answer 338

How do you create an Exception Report? 1. Create a custom report type with a "without" filter **2. Create a cross filter on the report builder** 3. Use an Exception report type 4. Create a cross filter on the custom report type

Answer 339

A custom object called Deliveries is created with a Master-detail relationship to Opportunities. Which report type is created? 1. None. A custom report type will need to be created manually. 2. Opportunities and Deliveries 3. Deliveries with Opportunities **4. Opportunities with Deliveries**

Answer 340

Which feature is required to use Territory Management? 1. Advanced Currency Management 2. Collaborative Forecasting 3. Multiple Currencies **4. Customizable Forecasting**

Answer 341

What are the three types of visibility with Data Categories? 1. None **2. Internal** 3. All Categories **4. Custom** **5. External**

Answer 342

What Publisher Action cannot be Global? 1. Log a Call 2. Create **3. Update** 4. Custom

Answer 343

How should a Workflow issue be properly monitored and Debugged? 1. Check the standard Debug Logs **2. Add a new monitored user and check the Debug Logs** 3. Check the standard Workflow logs 4. Check the Time Based Workflow Log

Answer 344

What is an Article Type? 1. Each Article created will have a corresponding Article Type that controls its content. **2. An Article Type defines the structure and format of an article.** 3. An Article Type defines the access and security of an article. 4. An Article Type defines which channel can access the article. Internal, Partner, Customer etc.

Answer 345

Andrew needs to import revenue quota data for Collaborative Forecasts and is using the Data Loader. What information must he include in the import file? (Choose 3) 1. **User record ID** 2. **Start date of the forecast period** 3. User full name 4. **Quota amount** 5. Quota opportunity

Answer 346

Tony is swamped and needs help. His manager suggested creating some delegated admins. If created what privileges can be given to the delegated admins? (Choose 3) 1. Modify the Role Hierarchy 2. **Create and Edit Users** 3. **Assign Users to Specified Profiles** 4. Modify Profile Permissions 5. **Manage Custom Objects**

Answer 347

For proper handling customers need to be sent to different departments based on which type of product they use, which Visual Workflow element should you use to route customers? 1. Step 2. Screen 3. **Decision** 4. Assignment

Answer 348

What objects are NOT supported when creating a custom report type for Collaborative Forecasts? (Choose 2) 1. **Accounts** 2. Forecasting Items 3. Forecasting Quotas 4. **Forecasting Categories** 5. Opportunities

Answer 349

The Chatter Free license is for **users who don't have Salesforce licenses but must have access to Chatter**. These users can access standard Chatter items such as **people, profiles, groups, and files**, but they **can't** access ***any Salesforce objects or data***. Chatter Free users can also be Chatter moderators. Chatter Free users don't see tabs like other Salesforce users. Chatter Free users access feeds, people, groups, and files using the App Launcher in Lightning Experience. In Salesforce Classic, users access these features from links in the page sidebar. Salesforce administrators can upgrade a Chatter Free license to a standard Salesforce or Lightning Platform Starter license at any time. You can't convert a standard Salesforce, Lightning Platform Starter, or Chatter Only license to a Chatter Free license.

Answer 350

Platform: Designed for users who need access to one custom app **but not to standard CRM functionality.** Lightning Platform - One App users are entitled to most of the same rights as Salesforce Platform users, plus they have access to an unlimited number of custom tabs. But t**hey're limited to one custom app, which is defined as up to 10 custom objects.** They're also limited to read-only access of the Accounts and Contacts objects. Push Topic object read permission isn't available. **NOTE Users with this license can only view dashboards if the running user also has the same license.** Each license provides an extra 20 MB of data storage and 100 MB of file storage, regardless of the Salesforce edition. **NOTE To view articles, a user must have the AllowView Knowledge permission on their profile. But this permission is off for default profiles. To give a user the AllowView Knowledge permission on their profile, activate the permission on a cloned profile and assign the cloned profile to the user.**

Answer 351

Chatter External This license is for users who are **outside of your company's email domain.** These external users, also called **customers**, can be invited to Chatter groups that allow customers. Customers can access information and interact with users only in the groups they're invited to. **They have no access to Chatter objects or data.** Chatter External users can view user profiles, but they can't edit them.

Answer 352

The Chatter Only license is also known as the Chatter Plus license. It's available **only to existing Chatter Plus customers**. The Chatter Plus license is for users who **don't have Salesforce licenses but must have access to Chatter and some additional Salesforce objects.** Chatter Plus users can be Chatter moderators and have access to standard Chatter people, profiles, groups, and files pages. They can also * View Salesforce accounts and contacts * Use Salesforce CRM Content, Ideas, and Answers * Access dashboards and reports * Use and approve workflows * Use the calendar to create and track activities. * View and modify up to 10 custom objects * Add records to groups If you're an existing Chatter Plus customer, you can buy more Chatter Plus licenses, or you can upgrade to Lightning Platform Starter. By default, the tabs for standard Salesforce objects are hidden from Chatter Plus users. Expose these tabs if you want to make them available to Chatter Plus users. For more information on Chatter Plus users, see Chatter Plus Frequently Asked Questions.

Answer 353

Lightning Platform Starter (for Partner and Customer Sites) The Lightning Platform Starter license is for users in Experience Cloud sites who must have access to Chatter and a wide variety of Salesforce objects. Lightning Platform Starter users can be **Chatter moderators and have access to standard Chatter people, profiles, groups, and files pages**. They can also interact with * Accounts * Assets * Cases * Contacts * Dashboards (read only) * Documents * External Objects (Salesforce Connect) * Events and Calendars * Ideas * List Views * Notes and Attachments * Reports * Tasks * Work Orders * Work Order Line Items

Answer 354

Sharing Settings

Answer 355

TRUE Org-wide defaults control the access to other users' data.

Answer 356

1. Based on Record Owner 2. Based on Criteria

Answer 357

1. Roles 2. Roles and Subordinates 3. Public Groups

Answer 358

No - a sharing rule must get created for that to work

Answer 359

Public Groups, Roles, Roles and Subordinates

Answer 360

Anyone in the chosen Roles for the group and **anyone above them** will have access to the records.