Pass the Salesforce Architect Exams Plat-Arch-205 Questions and answers with ExamsMirror

The Presenters junction object expresses a dynamic user-to-record relationship: each Presentation has a different set of users who must be able to edit it, and that set can change over time. Apex-managed sharing is appropriate because a trigger on the junction object can create a share when a presenter is added and remove that access when the relationship is deleted or changed. The Presentation object ' s OWD can remain Private while only the users represented by the junction records receive the necessary Edit access. A permission set cannot grant access to one specific Presentation record; it supplies object, field, or system permissions and must be combined with a record-level sharing mechanism. Standard Sales Team functionality also does not apply to an arbitrary Presentation custom object. For a robust custom-object design, the implementation should use a dedicated Apex Sharing Reason so the programmatic shares are easy to distinguish and manage throughout the record lifecycle. Study Guide reference: Access to Records - Apex-managed sharing, junction objects, dynamic user-to-record relationships, custom sharing reasons, and Private OWD.

Partner users do participate in an external role hierarchy, but the hierarchy available under a partner account is limited. Salesforce supports a maximum of three partner role levels, commonly represented as Partner User, Partner Manager, and Partner Executive. The affiliate ' s requested structure contains four external management layers, so it cannot be represented one-for-one using four separate partner roles. This matters because the business wants vertical visibility: sales representatives should remain isolated from peers, while higher levels should inherit access to opportunities owned by users beneath them. The partner role hierarchy can support that pattern only within its available depth. The architect must therefore collapse or redesign one organizational level, supplement the hierarchy with another sharing mechanism, or determine whether every management title actually requires a distinct Salesforce role. In large Experience Cloud implementations, minimizing external role proliferation is also important because every partner account can add groups and sharing complexity. Study Guide reference: Access to Records - Experience Cloud, partner roles, external role hierarchy, role-depth limits, partner record visibility, and external sharing scalability.

A public group is the scalable audience mechanism for list views that should be visible only to a defined set of users. UC can create groups that represent the relevant geography or specialist population and share each list view with the appropriate group instead of trying to maintain visibility user by user. This becomes especially important when there are dozens of list views and frequent personnel changes: administrators update group membership rather than modifying many view definitions. A queue is intended for supported record ownership and workload distribution, not for controlling list-view visibility. Direct sharing to arbitrary individual users is also not the standard list-view model; a public group provides the reusable abstraction when the target audience does not correspond to a single role. The architect must also distinguish visibility of the list-view definition from visibility of the underlying Opportunity records. Sharing a list view does not grant record access; users still see only records permitted by their object permissions, OWD, hierarchy, sharing rules, teams, and other record-level mechanisms. Study Guide reference: Access to Other Data - list-view sharing, public groups, scalable audience management, and separation of view visibility from record access.

This is an ownership data skew problem. Salesforce sharing performance degrades when a single user or queue owns an excessively large number of records of the same object because ownership is deeply involved in sharing calculations, role changes, group membership evaluation, transfers, and other access operations. A common design guideline is to avoid concentrating more than roughly ten thousand records of one object under a single owner when possible. Here, each donations representative owns more than fifty thousand donor Accounts, well beyond that threshold, and the organization has more than twenty million members overall. The problem is therefore structural, not simply a one-time recalculation event or an incorrect permission assignment. The architect should distribute ownership more evenly and, where concentration cannot be avoided, keep heavily skewed owners out of unnecessary roles and groups to reduce sharing complexity. Study Guide reference: Implications of Security Model Choice - ownership data skew, enterprise-scale sharing, Account ownership, role/group participation, and sharing performance.

Because Invoice is the detail side of a master-detail relationship to Account, its record-level access is controlled by the master. In Salesforce this is effectively a Controlled by Parent model: users can reach the detail record only to the extent that they can reach the associated master record, assuming they also have the necessary object permission on the detail object. The AR users have no access to the relevant Accounts, so they cannot discover or open the dependent Invoice records in list views, reports, or Global Search. Creating a sharing rule directly on the master-detail child does not solve the underlying access problem because the child does not maintain an independent sharing model in the same way as an independently owned record. The required access must therefore be established at the Account level; once the relevant Accounts are shared to AR, the dependent Invoice records become available according to the parent relationship. Study Guide reference: Access to Records - master-detail relationships, Controlled by Parent, OWD, inherited record access, and sharing at the master record.

Read/Write Opportunity Team access allows the team member to edit the Opportunity record, assuming the user also has the necessary object- and field-level permissions. Updating a normal Opportunity field such as Stage therefore falls within the access granted by the team membership. Ownership transfer is a separate privilege and is not automatically granted merely because a user can edit the record. Likewise, being a member of the Opportunity Team does not necessarily give the user authority to add or remove other team members; team administration is controlled by ownership and applicable administrative permissions. This distinction reflects Salesforce ' s layered security model: Opportunity Team membership supplies record access, while object permissions and ownership-related privileges govern what operations the user can perform. The owner always has the broadest control over the Opportunity and can manage collaboration more extensively than an ordinary team member. Study Guide reference: Access to Records - Opportunity Teams, Read/Write access, ownership, team administration, and collaborative sales security.

Large changes to roles, ownership, OWD, and sharing rules can force Salesforce to recalculate very large numbers of sharing rows. In an organization with a complex hierarchy spanning many regions and countries, that recalculation can become a major operational event. Parallel sharing recalculation is the relevant capability because Salesforce can process eligible portions of the sharing recalculation workload concurrently instead of treating the entire job as one serial operation. Divisions are primarily a data-partitioning and reporting feature; they do not optimize access recalculation. Skinny tables are database-query performance structures and likewise do not address the sharing model. The architect should also recognize that Account sharing changes can cascade into related Contacts, Opportunities, and Cases through implicit sharing relationships, increasing the scale of the work. Major hierarchy and ownership reorganizations therefore require planned maintenance, monitoring of background sharing jobs, and a design that limits unnecessary complexity in the role and group model. Study Guide reference: Implications of Security Model Choice - enterprise-scale sharing, hierarchy changes, ownership realignment, parallel recalculation, and sharing performance.

The field is unavailable because an encrypted field cannot be used directly as the criterion in a criteria-based sharing rule. This is a platform limitation arising from the security properties of encrypted data, not a consequence of the architect ' s personal Field-Level Security. Granting the administrator more visibility to the field therefore would not make the field eligible for sharing-rule criteria. The design implication is important: encryption can affect downstream functionality such as filtering, searching, deterministic comparisons, reporting, and sharing-rule logic. If UC needs sharing behavior related to the sensitive Social Security Number, the architect should avoid duplicating the plaintext value merely to bypass the restriction. A safer design is to use a non-sensitive classification, segment, status, or derived security indicator that expresses the business condition without exposing the protected identifier. The encryption decision and the sharing design must therefore be considered together rather than independently. Study Guide reference: Implications of Security Model Choice - Shield Platform Encryption limitations, criteria-based sharing, sensitive-data architecture, and security design trade-offs.

A Public Group is the standard reusable container for users who need common record access but do not share a natural position in the role hierarchy. Public groups can include individual users, roles, roles with subordinates, and other groups, then be referenced by sharing rules or manual sharing. The role hierarchy is intended for vertical access based on organizational responsibility, so forcing unrelated users into one role would distort the security model. Sharing Sets serve a different purpose: they are relationship-based Experience Cloud mechanisms that map an external user ' s Account or Contact relationship to target records. For unrelated internal users, the architect should create a public group and then use that group as the recipient in the appropriate sharing mechanism. This centralizes membership management and lets the record-sharing rule remain stable even as individual users change. Study Guide reference: Access to Records - Public Groups, sharing-rule recipients, cross-functional access, role hierarchy, and scalable record-sharing design.

A criteria-based Account sharing rule is appropriate because the desired access is determined by a property of the Account record: whether the record represents a retail Person Account. With Account OWD set to Private, UC can keep Business Accounts restricted and automatically grant the Retail Sales role access to all Accounts that meet the Person Account criterion. An owner-based rule on AccountContactRelation addresses a different relationship and would not provide the required Account visibility. Granting access to a Person Account record type on a profile also does not make every existing Person Account visible; record-type access controls which record types users can create or use, not which records they can see. The architect therefore needs a record-level sharing rule tied to the Account ' s Person Account characteristic. Study Guide reference: Access to Records - criteria-based sharing rules, Person Accounts, Record Types, Account OWD, and distinction between record-type availability and record visibility.