Practice Free Plat-Arch-205 Salesforce Certified Platform Sharing and Visibility Architect Exam Questions Answers With Explanation

Salesforce provides parent implicit sharing for several standard Account relationships. When a user has access to an Opportunity, Case, or Contact, Salesforce can grant Read Only access to the related parent Account so the user can understand the business context of the child record. In this scenario, the sales representative owns the Opportunities, so the representative has direct access to those records and receives implicit Read access to the parent Account even though the Account OWD is Private. That implicit access does not grant Account edit rights. Create/Edit permission on Opportunity determines what the user can do to Opportunity records; it does not translate into Create or Edit access on Account. Object permissions and record access must still be evaluated independently. This behavior is native to standard relationships and should not be confused with a manually created sharing rule. The important exam distinction is that child-record access can produce limited parent visibility, but the inherited access is Read Only unless another mechanism grants more. Study Guide reference: Access to Records - implicit sharing, parent implicit access, Account/Opportunity security, record ownership, and OWD interaction.

The requirement follows a direct manager-to-subordinate relationship, so the role hierarchy is the native record-access mechanism. By placing the operations users below the operations manager and enabling Grant Access Using Hierarchies for the custom Scheduled Course object, Salesforce can automatically provide the manager access to records owned by those subordinate users. The manager must also have the necessary object-level Edit permission because hierarchy access cannot create object capability that the user lacks. A public group alone does not share records; it is simply a reusable collection that must be referenced by another sharing mechanism. An ownership-based sharing rule could create access, but it would duplicate a relationship already expressed by the hierarchy and add unnecessary maintenance across hundreds of regions. Study Guide reference: Access to Records - Role Hierarchy, Grant Access Using Hierarchies, custom-object sharing, manager access, and object permissions. The implementation should also be validated with representative users so effective permissions, sharing inheritance, and any cross-object access behave exactly as designed before production release.

System.runAs() is used in Apex tests to execute a block of code in the context of a specified user so that user-dependent record-sharing behavior can be verified. It is particularly useful when the application relies on a Private OWD, role hierarchy, manual or managed shares, or classes declared with sharing. A well-designed test creates representative users, runs the relevant code under those users, and confirms that authorized users can retrieve the intended records while unauthorized users cannot. The key distinction is that runAs() is not itself a production security mechanism and does not replace explicit enforcement of CRUD or Field-Level Security. Object permissions, field permissions, and record sharing remain separate layers that the implementation must enforce appropriately. This question therefore focuses on the sharing aspect of user context rather than on field-level authorization. Study Guide reference: Access to Records - Apex sharing tests, System.runAs(), user context, record visibility, and secure testing of sharing behavior.

Because Invoice is the detail side of a master-detail relationship to Account, its record-level access is controlled by the master. In Salesforce this is effectively a Controlled by Parent model: users can reach the detail record only to the extent that they can reach the associated master record, assuming they also have the necessary object permission on the detail object. The AR users have no access to the relevant Accounts, so they cannot discover or open the dependent Invoice records in list views, reports, or Global Search. Creating a sharing rule directly on the master-detail child does not solve the underlying access problem because the child does not maintain an independent sharing model in the same way as an independently owned record. The required access must therefore be established at the Account level; once the relevant Accounts are shared to AR, the dependent Invoice records become available according to the parent relationship. Study Guide reference: Access to Records - master-detail relationships, Controlled by Parent, OWD, inherited record access, and sharing at the master record.

The valid runtime mechanism among the choices is declaring the Apex class with sharing so Salesforce evaluates record-level sharing when the class queries Shipment records. Because the Shipment OWD is Private, Apex that ignores sharing can expose records outside the user ' s intended visibility. The sensitive Shipment Amount introduces a second security layer: with sharing does not enforce object CRUD or Field-Level Security. The implementation must separately enforce field access, for example with user-mode operations, Security.stripInaccessible(), or valid Schema Describe checks. System.runAs() is useful for tests but does not secure production execution, and isShareable is not a valid Apex sharing keyword. The correct architecture therefore combines record-sharing enforcement with explicit CRUD/FLS enforcement instead of assuming one mechanism protects every layer. Study Guide reference: Permissions to Standard Objects, Custom Objects, and Fields - with sharing, Apex execution context, CRUD/FLS, user-mode operations, and secure Lightning/Apex architecture. The implementation should also be validated with representative users so effective permissions, sharing inheritance, and any cross-object access behave exactly as designed before production release.

A public group is the scalable audience mechanism for list views that should be visible only to a defined set of users. UC can create groups that represent the relevant geography or specialist population and share each list view with the appropriate group instead of trying to maintain visibility user by user. This becomes especially important when there are dozens of list views and frequent personnel changes: administrators update group membership rather than modifying many view definitions. A queue is intended for supported record ownership and workload distribution, not for controlling list-view visibility. Direct sharing to arbitrary individual users is also not the standard list-view model; a public group provides the reusable abstraction when the target audience does not correspond to a single role. The architect must also distinguish visibility of the list-view definition from visibility of the underlying Opportunity records. Sharing a list view does not grant record access; users still see only records permitted by their object permissions, OWD, hierarchy, sharing rules, teams, and other record-level mechanisms. Study Guide reference: Access to Other Data - list-view sharing, public groups, scalable audience management, and separation of view visibility from record access.

View All Records is an object-specific sharing override. Granting View All on Case lets the service representative see every Case regardless of the Case OWD, but it does not automatically grant the same access to Account or other related standard objects. Each object still requires its own object permission and record-access path. This is an important distinction from normal implicit sharing: Salesforce does not treat a broad View All grant on the child object as though the user had individually received each child record through ownership or a normal share, so the expected parent access must be evaluated separately. If Contact is Controlled by Parent, Contact visibility depends on the user ' s access to the parent Account. The architect must therefore design Account access explicitly rather than assuming that universal Case visibility cascades through the customer data model. Study Guide reference: Access to Records - View All Records, object-specific sharing overrides, Account/Case relationships, Controlled by Parent, and Private OWD.

Price Books have specialized organization-wide access levels. Use is the appropriate level when sales agents must not only view products and pricing but also select the Price Book and add its products to Opportunities. View Only supports inspection and reporting but does not represent the same ability to transact with the Price Book during the sales process. Salesforce therefore distinguishes Use, View Only, and No Access so organizations can separate catalog visibility from sales usability. If UC later needs to restrict specialized Price Books, it can establish a more restrictive baseline and explicitly share those Price Books with selected users, roles, or groups at the Use level. The Price Book security model must also be combined with normal Product, Opportunity, and object permissions because each layer controls a different part of the process. Study Guide reference: Access to Other Data - Price Book security, Use access, View Only, product pricing, and Opportunity product access.

A Salesforce File posted to a record inherits visibility from the record context according to the file-sharing configuration. The file owner retains access, and users who can access the associated record can generally access the file at the level permitted by the file ' s visibility settings. The object ' s Private OWD therefore matters because only users who obtain access to the specific record through ownership, hierarchy, teams, sharing rules, or another valid mechanism fall within the record audience. A shared Chatter post link does not by itself bypass the underlying record and file security model. Architects should treat file security as a related but distinct layer: the ContentDocument and ContentDocumentLink model determines where a file is shared, while record access and file visibility determine who can actually open it. Study Guide reference: Access to Other Data - Salesforce Files, record-associated file visibility, Chatter feeds, ContentDocument access, and record sharing. The implementation should also be validated with representative users so effective permissions, sharing inheritance, and any cross-object access behave exactly as designed before production release.

Apex-managed sharing gives the development team substantial control over who receives record access, so it must be tested from the perspective of different users. System.runAs() is the appropriate test technique among the choices because it allows the test to execute sharing-sensitive behavior under representative user contexts and verify both positive and negative access outcomes. The test suite should include users who are supposed to receive access and users who must remain restricted, then confirm that the managed share entries produce exactly the intended visibility. A keyword such as without sharing would weaken record enforcement rather than validate it, and with sharing does not enforce Field-Level Security. In production code, record sharing, object CRUD, and FLS still have to be handled as separate concerns; runAs() simply provides a reliable way to exercise user-context behavior in tests. Study Guide reference: Access to Records - Apex-managed sharing, System.runAs(), Private OWD, user-context testing, and validation of least-privilege access.

Field-Level Security is the authoritative mechanism because Banking Reps must be able to see the Date of Birth value while Customer Support Reps must additionally be able to edit it. Configuring the field as Visible but Read-Only for Banking Reps and Visible/Edit for Customer Support Reps enforces the requirement across Salesforce interfaces rather than only on one page. Search layouts and page layouts are presentation controls; they cannot override restrictive FLS and should not be used as the sole security boundary. A validation rule tied to a profile name would be brittle, would not address field visibility, and would embed authorization logic in a business rule that becomes difficult to maintain. The architect should implement the field permissions through the organization ' s profile/permission-set strategy and verify that no other permission set grants unintended edit access. Study Guide reference: Permissions to Standard Objects, Custom Objects, and Fields - Field-Level Security, search visibility, read-only fields, profiles, permission sets, and enforceable field authorization.

Super User access is designed for selected external partner managers who need visibility across records associated with other users at the same partner account. Granting that elevated access to the individual partner manager is more scalable than creating and maintaining separate ownership-based sharing rules for every distributor. The requirement is deliberately limited to certain managers, so the organization can keep the external sharing model private between distributors while giving designated managers broader visibility within their own distributor organization. Sharing Sets are best suited to deterministic Account/Contact relationship mappings and do not replace the manager-level elevation represented by the Super User model. Because Super User access is powerful, it should be assigned only to users who genuinely need it and should be reviewed as part of the external-access governance process. Study Guide reference: Access to Records - Partner Community, Super User access, partner manager visibility, same-account external sharing, distributor isolation, and scalable Experience Cloud access.

Partner Community is the appropriate external license model because the distributors participate in a B2B sales process and require Opportunity visibility. Partner-oriented licenses support the external role hierarchy and the sales-object collaboration model needed for channel users such as distributors and resellers. Customer Community is primarily aimed at high-volume customer self-service and does not provide the same Opportunity-oriented partner model. Customer Community Plus adds more advanced sharing than basic Customer Community, but it is not the primary licensing model for external channel sales collaboration. At the scale described, the architect must also design the partner role hierarchy and external sharing model carefully so that one distributor cannot see another distributor ' s records and so that role/group proliferation does not create unnecessary sharing complexity. The license defines the ceiling of what the external user can do; UC must still configure object permissions and record-level sharing to expose only the Opportunities relevant to each distributor. Study Guide reference: Access to Records - Experience Cloud licensing, Partner Community, Opportunity access, partner roles, external sales collaboration, and scalable partner sharing.

A sharing rule can extend record-level access only after the user has the fundamental object permission required to use the object. The affected users have no Read permission on Account, so membership in a public group and a sharing rule that exposes inactive Accounts cannot make those records visible. Salesforce evaluates security in layers: the license and object permissions establish whether a user can use an object at all; Field-Level Security controls individual fields; and record-level mechanisms such as OWD, role hierarchy, sharing rules, teams, and manual sharing determine which records are available. A page layout does not grant record or object access, and the position of the Account owner in the role hierarchy is irrelevant when the user ' s profile prevents Account access entirely. The administrator must first grant appropriate Account Read permission through the profile or a permission set, then allow the sharing rule to determine which Accounts the user can reach. Study Guide reference: Permissions to Standard Objects, Custom Objects, and Fields - object CRUD, profiles, permission sets, interaction between object permission and record sharing, and layered security evaluation.

A public group provides the appropriate reusable population for auditors who are distributed across the organization but share the same record-visibility requirement. UC can maintain the auditors in one group and use an appropriate sharing rule to grant that group access to the qualifying high-value Opportunities. Placing auditors at the top of the role hierarchy would distort the hierarchy ' s business meaning and could expose many unrelated records because hierarchy access is broader than the audit requirement. Adding auditors to every salesperson ' s default Opportunity Team would also be operationally cumbersome and semantically wrong: Opportunity Teams represent collaboration on specific deals, not an enterprise audit function. The public-group pattern separates organizational position from the functional access requirement and makes membership easy to maintain as auditors join or leave the team. With a Private Opportunity OWD, the group should receive only the records needed for the audit process. Study Guide reference: Access to Records - public groups, criteria-based sharing, Private OWD, cross-functional access, and least-privilege audit design.

A Sharing Set is the standard declarative mechanism for Customer Community users whose Case access can be derived from their Account or Contact relationship. The user ' s external identity is linked to a Contact and therefore to an Account; the Sharing Set can map that user relationship to the Account relationship on Case and grant access when they match. This is especially appropriate for high-volume external users because it avoids building a conventional role hierarchy merely to express simple account-based access. A normal sharing rule is not the best fit for that license model, and Apex sharing would add code and maintenance even though Salesforce already provides a native relationship-based mechanism. The architect should configure the Sharing Set for the applicable external profile, include Case as the target object, select the appropriate access mapping, and grant only the level of access required. Study Guide reference: Access to Records - Customer Community security, Sharing Sets, high-volume external users, account/contact mappings, and Case access.

Price Books use specialized access semantics rather than the same generic sharing pattern as ordinary business objects. The High Risk Price Book should be the authorization boundary for the sensitive product catalog. UC can maintain broad View Only access where users need to inspect pricing while explicitly sharing the High Risk Price Book with trained staff at the level required to use it during the Opportunity sales process. Users need appropriate Price Book use access to select that Price Book and add its products to an Opportunity. This approach keeps the high-risk product entitlement centralized in the pricing catalog instead of trying to enforce it through page layouts, validation rules, or a broad Opportunity permission. Standard sharing rules are not the normal way to express this Price Book access model, and a solution that grants the entitlement to all sales users would violate the requirement. The architecture should pair the specialized Price Book access with normal Opportunity and Product permissions so only the trained population can transact with the restricted products. Study Guide reference: Access to Other Data - Price Book security, View Only, Use access, product visibility, pricing governance, and least-privilege sales access.

Because the Account page layout did not change, the next control to inspect is Field-Level Security and effective field accessibility. Salesforce can hide a field from a user even when that field remains present on the assigned page layout. The Field Accessibility view in Object Manager provides a consolidated way to determine whether a field is visible, read-only, or hidden for the relevant profile and configuration. This is a better diagnostic than logging in and checking several records because the symptom is field-level, not record-specific. A Who Sees What analysis focuses on record visibility and therefore does not explain why one field disappeared while the user can still open the Account. The administrator should verify the affected field ' s FLS for the user ' s profile and any relevant permission-set assignments, then confirm that the page layout and record type do not impose additional presentation restrictions. Field-Level Security is the enforceable security boundary; page layout placement alone is not. Study Guide reference: Permissions to Standard Objects, Custom Objects, and Fields - Field-Level Security, field accessibility, profiles, permission sets, and page layouts.

A Default Account Team is designed for sales representatives who repeatedly collaborate with the same internal specialists on customer Accounts. The representative can define recurring team members such as legal, engineering, or finance and specify the access each team member receives to the Account and, where applicable, related Opportunities and Cases. The default team can then be applied automatically to new or transferred Accounts or added to existing Accounts, eliminating the repetitive manual-sharing work described in the scenario. A criteria-based sharing rule is better suited to record access determined by stable record attributes and a fixed audience; it does not model a recurring collaboration team tied to a particular salesperson. View All Data would be dramatically overprivileged because it bypasses record-level controls across the organization. Default Account Teams therefore improve productivity while preserving least privilege and making the collaboration relationship explicit. Study Guide reference: Access to Records - Default Account Teams, team roles, related-record access, collaboration, and least-privilege sharing.

A PDF stored in a private library is intended to remain private to the file owner until it is deliberately shared or published through another supported context. Salesforce Files does not automatically use the ordinary business-record role hierarchy to expose a private file to managers above the owner. The private-library boundary therefore differs from standard object sharing, where role hierarchy can provide upward access. If collaboration is required, the user should share the file with the appropriate people, group, record, or library rather than relying on hierarchy inheritance. This question tests the fact that file visibility has its own security model and should be evaluated separately from record-level OWD and role hierarchy. The organization should also avoid granting broad system permissions merely to solve an individual file-sharing requirement. Study Guide reference: Access to Other Data - Salesforce Files, private libraries, file ownership, file-sharing contexts, and distinction between file security and record security.