Pass the Salesforce Architect Exams Plat-Arch-205 Questions and answers with ExamsMirror

View All Records is an object-specific sharing override. Granting View All on Case lets the service representative see every Case regardless of the Case OWD, but it does not automatically grant the same access to Account or other related standard objects. Each object still requires its own object permission and record-access path. This is an important distinction from normal implicit sharing: Salesforce does not treat a broad View All grant on the child object as though the user had individually received each child record through ownership or a normal share, so the expected parent access must be evaluated separately. If Contact is Controlled by Parent, Contact visibility depends on the user ' s access to the parent Account. The architect must therefore design Account access explicitly rather than assuming that universal Case visibility cascades through the customer data model. Study Guide reference: Access to Records - View All Records, object-specific sharing overrides, Account/Case relationships, Controlled by Parent, and Private OWD.

Deferred Sharing Calculation is intended for major administrative changes that would otherwise cause Salesforce to repeatedly recalculate sharing while the organization is still in an intermediate state. During a large role hierarchy restructuring and mass Account ownership realignment, each individual change can affect group membership and record access. With deferred calculation enabled, administrators can suspend automatic calculation while they perform the planned restructuring and then explicitly resume and recalculate after the final model is in place. This reduces repeated work and can materially improve the operational stability of a very large reorganization. The capability must be governed carefully because access changes made while calculation is suspended are not reflected until the recalculation is completed. Skinny tables solve a different database-performance problem, and Divisions partition data but do not prevent repeated sharing recalculations. Study Guide reference: Implications of Security Model Choice - Deferred Sharing Calculation, large organizational changes, role and ownership maintenance, sharing recalculation, and operational governance.

The security defect is field-level write authorization, not record-level sharing. Apex can execute with elevated behavior, so code that performs DML must explicitly respect whether the running user is allowed to update the fields being changed. The Schema Describe check represented by isUpdateable() verifies field update permission before DML and directly addresses the Read-Only Field-Level Security condition in the scenario. By contrast, the with sharing keyword controls record visibility through the sharing model; it does not itself enforce object CRUD or Field-Level Security. Moving the same logic into another with sharing class therefore would not stop a field from being updated when the user lacks field edit permission. In modern Salesforce development, user-mode database operations and Security.stripInaccessible() can provide broader and often simpler enforcement of CRUD and FLS, but the explicit isUpdateable() check remains technically valid for the option set given. The architectural rule is to evaluate object permissions, field permissions, and record sharing as separate layers. Study Guide reference: Permissions to Standard Objects, Custom Objects, and Fields - CRUD, Field-Level Security, secure Apex, Schema Describe checks, and user-mode operations.

A Default Account Team is designed for sales representatives who repeatedly collaborate with the same internal specialists on customer Accounts. The representative can define recurring team members such as legal, engineering, or finance and specify the access each team member receives to the Account and, where applicable, related Opportunities and Cases. The default team can then be applied automatically to new or transferred Accounts or added to existing Accounts, eliminating the repetitive manual-sharing work described in the scenario. A criteria-based sharing rule is better suited to record access determined by stable record attributes and a fixed audience; it does not model a recurring collaboration team tied to a particular salesperson. View All Data would be dramatically overprivileged because it bypasses record-level controls across the organization. Default Account Teams therefore improve productivity while preserving least privilege and making the collaboration relationship explicit. Study Guide reference: Access to Records - Default Account Teams, team roles, related-record access, collaboration, and least-privilege sharing.

Public Read-Only is the correct Lead OWD because it balances duplicate prevention with ownership-based editing. Users can see existing Lead records across the organization, which helps them identify whether a prospect already exists before creating another Lead, but they cannot edit another user ' s Lead merely because they can view it. A Private OWD would protect ownership more strictly but would undermine the duplicate-reduction objective because users might not be able to discover Leads owned elsewhere. Public Read/Write/Transfer would go too far in the opposite direction by allowing broader modification or reassignment than the requirement permits. The organization can complement the OWD with Duplicate Rules and Matching Rules for stronger prevention and warning behavior, but the OWD still establishes the right record-visibility baseline. Study Guide reference: Access to Records - Lead OWD, Public Read-Only, record ownership, duplicate prevention, and least-privilege access. The implementation should also be validated with representative users so effective permissions, sharing inheritance, and any cross-object access behave exactly as designed before production release.

The reporting permissions represented by the answer are Manage Reports in Public Folders and Edit My Reports. Under Salesforce ' s enhanced folder-sharing model, Manage Reports in Public Folders is a broad reporting permission that includes the ability to create and manage public report content and encompasses several lower-level reporting capabilities. The question is testing the permission combination required to create, organize, and share report-folder content with other coaches rather than merely run reports. Architects should still apply least privilege: if a user needs management rights only to one specific folder, granting Manager access to that folder can be safer than assigning an organization-wide reporting management permission. The key distinction is that report-folder permissions govern analytics assets, while access to the underlying business records remains controlled by the normal object, field, and record-security model. Study Guide reference: Access to Other Data - report-folder permissions, enhanced folder sharing, Manage Reports in Public Folders, Edit My Reports, and least-privilege analytics administration.

The requirement is a many-to-many external relationship: one part-time agent can work for several distributor Accounts. Contacts to Multiple Accounts can model those relationships through Account Contact Relationships, and a Sharing Set can use the related-account relationship to grant the Experience Cloud user access to the appropriate distributor Accounts. This is substantially more scalable than maintaining Apex share rows or manual sharing rules every time an agent begins or stops working for a distributor. The user ' s access follows the underlying relationship data instead of a separate custom sharing-maintenance process. Customer Community Plus supports the richer external sharing architecture needed for this scenario. The architect should ensure the Sharing Set mapping uses the eligible Account/Contact relationship field and grants only the required access level. Study Guide reference: Access to Records - Sharing Sets, Contacts to Multiple Accounts, Account Contact Relationships, Customer Community Plus, and scalable external record sharing. The implementation should also be validated with representative users so effective permissions, sharing inheritance, and any cross-object access behave exactly as designed before production release.

The record must be shared with a dynamically determined user: the manager of the person identified on the Case. A criteria-based sharing rule can evaluate Case fields, but its recipient is a fixed role, group, or other supported target; it cannot resolve a different manager for every record and share only to that person. Programmatic sharing is therefore the appropriate pattern. A trigger can inspect the Legal SME or complaint-agent field, determine the required manager or specialist, create the corresponding Case share, and remove or replace that share when the relationship changes. Making the subject of the complaint the owner would expose the sensitive Case to exactly the person who must not see it, while removing Case object permission from the entire support-agent population would be far broader than required. The design should keep the Case baseline restrictive and grant access only to the HR owner plus the dynamically determined authorized user. Study Guide reference: Access to Records - programmatic Case sharing, dynamic recipients, user lookup relationships, sensitive-record isolation, and least privilege.

Site User Visibility controls whether authenticated Experience Cloud users can discover other users who participate in the same site. Turning the setting off therefore affects searching for and seeing other external site users. The setting is part of the broader User-object sharing model, which is distinct from sharing business records such as Accounts, Cases, and Opportunities. It does not primarily control whether a user can edit the user ' s own profile, and it should not be interpreted as a general switch for internal-user search. Experience Cloud architects must treat user visibility as its own privacy problem because exposing the User directory can reveal names and other profile information even when business data is correctly isolated. The organization should therefore combine the User object ' s OWD and site/portal visibility settings with any required user-sharing rules according to the collaboration experience it intends to provide. Study Guide reference: Access to Other Data - User sharing, Site User Visibility, Experience Cloud user discovery, external-user privacy, and User-object access controls.

For custom objects, Salesforce allows the administrator to disable automatic upward access through the role hierarchy by clearing Grant Access Using Hierarchies. With the NPS object ' s OWD set to Private and hierarchy access disabled, a manager does not gain access simply because the manager occupies a role above the record owner. This is the correct pattern for sensitive employee information when the reporting hierarchy itself must not imply visibility. Apex sharing should not be used to subtract access that is granted by another mechanism; Salesforce sharing is fundamentally additive. Removing all object permissions from managers would be too broad because it would block every NPS record, including records a manager might legitimately need through another explicit authorization process. The secure design establishes a restrictive baseline and then opens only the records that a specific business requirement justifies. Study Guide reference: Access to Records - Private OWD, Grant Access Using Hierarchies, custom-object hierarchy behavior, sensitive-record isolation, and least-privilege sharing.