Sharing-and-Visibility-Architect Salesforce Certified Sharing and Visibility Architect (SP23) Questions and Answers

Two methods that will allow the architect to meet the requirements for creating a custom team solution on the custom Loan object are creating a custom trigger on the Custom Team object that inserts or updates records in the Loan_share object, and creating Apex Sharing Reasons on the Loan object to identify the reason the Loan record was shared. The custom trigger can use Apex Managed Sharing to grant Read Only or Read/Edit access to the Custom Team members based on the Primary field value. The Apex Sharing Reasons can be used to distinguish between different types of sharing and provide more granular control over access

The two reasons that the architect should consider regarding the use of Apex sharing reasons are A and B. Option A allows the developer to more easily troubleshoot programmatic sharing, as they can identify which sharing records are created by which Apex code. Option B prevents the share record from being deleted upon ownership change, as Apex sharing reasons are not subject to recalculation by Salesforce. The other options are either incorrect or irrelevant.

 To optimize the process of managed sharing recalculations for the custom Job object, the architect can create public groups for each team and share the jobs with the groups instead of users. This way, the architect can avoid updating the sharing records every time a team member changes, and only update the public group membership instead. This reduces the number of sharing recalculations and improves performance

The best practice for testing sharing and visibility changes is to use the login as feature for a sample user in each role and profile. This allows the tester to see exactly what the user can see and do in the org, and verify that the sharing settings are working as expected. The other options are either not comprehensive or not relevant.

 Instituting a business process that calls for the account manager to be added to the account team once the account becomes a customer, and creating a criteria-based sharing rule that shares the account to the account management group when the type is customer are two methods that could be used to enable this sharing requirement, assuming a private sharing model for accounts. These methods would ensure that only accounts with type customer are shared with the account management users, and only when they are involved in the account team. Creating a public list view, where accounts of type customer are included and share the list view with account management public group is not a method to enable sharing, as it only filters the records that are already visible to the users, not grant access to new ones. Creating an account sharing rule that shares all accounts owned by sales to be shared with account management roles and subordinates is not a method to enable this sharing requirement, as it would share all accounts regardless of their type

The best option for the architect to make sure Universal Health stays compliant is B. Enabling Salesforce Shield Platform Data Encryption and marking the patient notes field as encrypted will ensure that the data is encrypted at rest as well as in transit, using a tenant secret that only Universal Health can access. This will also allow them to use standard Salesforce features and functionality with the encrypted data. The other options are either incorrect or not optimal.

Implementing a third-party proxy server is the best technology to achieve the requirement of accessing on-premise information from Salesforce. A proxy server acts as an intermediary between Salesforce and the on-premise database, and it can handle authentication, encryption, and data transformation. Option A is incorrect, as tokenization is a technique to replace sensitive data with tokens, not to access on-premise data. Option B is incorrect, as it does not specify how Salesforce can connect to the on-premise database. Option D is incorrect, as Salesforce Shield is a set of tools to enhance data security and compliance in Salesforce, not to access external data sources.

According to this source, users with the View All Data permission can view any file in the org, and users with access to the record can view files posted to that record’s Chatter feed. The other options are not accurate.

 Criteria-based sharing rules are used to share records based on field values, not ownership. This is the best option to grant access to accounts of the same segment in other countries, regardless of who owns them. Owner-based sharing rules are based on the owner of the record, not the segment. Changing the role hierarchy would affect other aspects of data visibility and security. Creating a public group and a permission set would require manual maintenance and would not be scalable.

Reviewing the Account structure to split the United Automotive account into multiple branch accounts is the option that the Architect should recommend. This way, the number of child cases under one parent account will be reduced, and the locking errors will be avoided. The locking errors occur when multiple transactions try to access or modify records that are related to a single parent record. The other options do not address the root cause of the locking errors, which is the high number of child cases under one parent account.

According to this source, if an object is set to Controlled by Parent in its organization-wide default settings, then access to its records is determined by the parent record. In this case, since Case object has View All permission for service reps, they will be able to access all contact records related to those cases, regardless of their ownership or sharing rules. However, they will not be able to access all account records, since account object has Private OWD and no other sharing mechanism is mentioned. The other options are not correct.

Two platform features that can be used to support the requirements for granting access to Job records are “View All” profile settings and manual sharing. The “View All” profile setting can be enabled for the Delivery profile to grant them View access to all Job records regardless of ownership or role hierarchy. The manual sharing feature can be used by the Delivery user who owns a job to grant access to a Product Development user on a case-by-case basis

The Internal Default sharing settings for a custom object can be either Public Read/Write or Public Read Only if the External Default sharing setting is set to Public Read Only1. Controlled by Parent and Private are not valid options because they would not allow external users to access the custom object records.

Creating a territory is an activity that can happen in parallel to changing a community account owner without risking group membership lock errors, assuming granular locking is enabled. Granular locking is a feature that allows for concurrent sharing operations on different objects or groups, reducing lock contention and improving performance. Deletion or creation of a role is an activity that can cause group membership lock errors, as it affects the role hierarchy and all the groups that are associated with it. Deletion of a territory is also an activity that can cause group membership lock errors, as it affects the territory hierarchy and all the groups that are associated with it

 To prevent orders from being deleted in the future, a Salesforce Architect should recommend removing Order delete permission from profiles and permission sets, and changing the record type/page layout assignment for orders to be read only. Removing Order delete permission will prevent users from deleting any order records, regardless of their ownership or sharing. Changing the record type/page layout assignment will prevent users from editing any order fields, regardless of their field-level security. Implementing a sharing rule that changes access for order to read will not work, as it will only affect the record-level access, not the field-level access or the delete permission. Removing the Delete button from the order page layout will not work, as it will only affect the user interface, not the API or other ways of deleting records.

To give access to a report folder to someone else in the organization, the user needs to have the “Manage Reports in Public Folders” profile permission and the “Manager” report folder permission. The “Viewer” and “Editor” report folder permissions only allow the user to view or edit the reports in the folder, but not to share the folder with others

The potential vulnerabilities in the code snippet are SOQL Injection and Data Access Control. SOQL Injection is a technique that exploits a security vulnerability in a database layer of an application. It occurs when user input is directly appended to a SOQL query string, which allows attackers to execute arbitrary SOQL commands2. Data Access Control is a mechanism that ensures that users have appropriate permissions to access data in Salesforce. It involves checking the object-level, field-level, and record-level access of the user before performing any data operation3. The code snippet does not perform any FLS check or data access control check, which could expose sensitive data to unauthorized users or allow them to modify data without proper permissions3. Arbitrary Redirects are not a vulnerability in this code snippet, as they occur when a web application accepts untrusted input that could cause the web browser to redirect the user to a malicious website

 Adding the user to the Sales Team for the Presentation record will not work, as Sales Teams are only available for standard objects, not custom objects. Giving Edit rights to the Presentation record via a Permission set will not work, as Permission sets are assigned to users, not records. The best option is to use a trigger on Presenter junction object that uses Apex Managed sharing to add or remove access to the related Presentation record based on the junction object records.

To ensure the data security of the custom web service, the Architect should consider the following design elements:

Query the Orders object with Dynamic SOQL based on the fulfillment ID: This will allow the web service to filter the orders based on the input parameter and return only the relevant records to the business partner.

Set the Orders object’s sharing settings to Private in the Org-Wide Defaults: This will restrict access to the Orders object to only the owner and users above them in the role hierarchy by default, and prevent unauthorized access from other internal or external users.

Develop a custom Apex web service using the “With Sharing” keyword: This will enforce the sharing rules defined for the Orders object and respect the record-level access of the web service user.

Profile-based login hour restrictions and profile-based IP restrictions are two features that Salesforce provides for restricting login access to the application. These features allow administrators to specify when and from where users can log in to Salesforce based on their profiles. Role-based IP restrictions and organization-wide login hour restrictions are not valid features in Salesforce.

Using a lightning component as an override for the “Edit” action on mobile view would allow field consultants to capture images while editing the case record, without affecting the desktop users. Using a lightning component as an override for the “Edit” action on lightning experience would affect both mobile and desktop users, which is not desirable. Creating a separate button for “Edit in Mobile” would require additional customization and user training.

Removing the “Opportunity Delete” permission from the sales team’s user profile in the object permissions is the best way to prevent a certain set of users from deleting opportunities, as it controls whether they can delete any opportunity record in Salesforce. Removing the delete button from the opportunity page layout and record type settings is not effective, as it only removes the button from the user interface, not from other access points such as API or reports. Creating a validation rule that checks the user’s profile before allowing the Is Deleted flag to be set to True is not possible, as validation rules cannot reference system fields such as Is Deleted. Overriding the standard button with a Visualforce page that warns them that they do not have permission to delete is not advisable, as it requires custom code and does not prevent deletion from other access points

The three options that can change the owner of the opportunity are B, C, and E. The current opportunity owner can transfer the ownership to another user by editing the record or using the change owner button. The system administrator or a user with the “Transfer Records” permission can also change the owner of any record, regardless of the sharing settings. Someone above the opportunity owner in the role hierarchy can also change the owner, as they have full access to the records owned by users below them in the hierarchy. The other options are either incorrect or not possible.

According to this source, the runAs system method in test classes can be used to test using different users and profiles, and the with sharing keyword in Apex classes can be used to enforce record visibility rules. The other options are not valid keywords in Apex

The user can filter by owner using Queue or My Case Teams options when creating a list view on the Case object, as these are related to the Case team feature

Validation rules and page layout settings are two options that the architect can use to prevent users from editing encrypted fields, assuming no customizations are implemented. Validation rules can be used to display an error message when a user tries to edit an encrypted field, and page layout settings can be used to make an encrypted field read-only or hidden from the user interface. Apex triggers and workflow rules are not options to prevent users from editing encrypted fields, as they are executed after the user has already modified the field

The correct format for creating share objects for custom objects in Apex code is MyCustomObject__Share. Share objects are used to grant access to individual records that are owned by another user or queue. For standard objects, the share object name is ObjectNameShare, such as AccountShare or ContactShare. For custom objects, the share object name is ObjectName__Share, such as MyCustomObject__Share or Project__Share.

 Enforcement of a user’s record sharing is the functionality that is verified by the system method “runAs()”. This method allows test methods to run in the context of a specific user and verify whether that user has access to the records based on the sharing settings. The other options are not verified by the runAs() method.

The two options that the Architect should consider when designing the solution are B and D. Option B ensures that the national accounts are only visible to the sales directors and above in the role hierarchy, as they inherit access from the owner. Option D ensures that the sales reps who are added to the opportunity team for a national account can access the account data, as they are granted access through implicit sharing

 According to this source, the Manage Dashboards permission allows users to create, edit, and delete dashboards in any folder they have access to, and the View All Data permission allows users to view all data in the org regardless of sharing settings. The other options are not necessary for creating a dashboard to compare sales numbers.

SOQL injection is a vulnerability that can exist when controllers use dynamic rather than static queries and bind variables. SOQL injection is a technique that exploits a security vulnerability by inserting malicious SOQL statements into an existing query. This can result in data loss, data exposure, or unauthorized access1. Buffer overflow attacks, cross-site scripting, and record access override are not vulnerabilities related to dynamic queries and bind variables.

A sharing set is the best way to share cases with partner users based on a common account. Sharing sets are available for Partner Community licenses and can grant access to related records using predefined criteria1. Option A is incorrect, since changing the external OWD to public read only would give access to all cases to all partner users, not just the ones related to their account. Option B is incorrect, since sharing rules are not available for partner users. Option C is incorrect, since the role hierarchy does not apply to partner users

 Partner super user is the only feature that supports the requirement of granting specific community users (agents) to view cases submitted by other agents of the same distributor. Partner super users are community users who can access and edit data owned by other partner users in their account. They can also access reports and dashboards that display data from their account1. Permission set to grant community admin permission, delegate external user, and partner community admin are not features that can achieve the same result.

A sharing rule is missing to share Accounts to the AR team, which could be the issue preventing AR team members from seeing invoices. Since invoice is a custom object with a master-detail relationship to account, its sharing settings are controlled by its parent account. If AR users do not have access to account records, they will not be able to see or query invoice records either. Option A is incorrect, since a sharing rule to share invoices to the AR team would not work, as invoice inherits its sharing settings from account. Option B is incorrect, since assigning an invoice page layout to the AR team profile would not affect their visibility of invoice records. Option D is incorrect, since giving read permission to the invoice object to the Accounts receivable profile would not grant access to invoice records that are owned by other users.

To mitigate the risk of improper access to records when using Apex managed sharing, the Salesforce architect should recommend using runAs system method in test classes and with Sharing keyword in Apex classes. The runAs system method allows testing the code as different users with different profiles and permissions, which can help verify that the sharing logic is working as expected2. The with Sharing keyword enforces the record visibility rules for the current user context, which can help prevent unauthorized access to records that are not shared with the user

 Adding the product specialist and solution engineer to the opportunity team is the optimal way for the junior account manager to share the opportunity, given the private sharing model. Opportunity teams are groups of users who work together on sales opportunities. Adding users to an opportunity team grants them access to the opportunity and related records. This way, the junior account manager can collaborate with the product specialist and solution engineer on the complex deal, and when the account is reassigned to a senior account manager, the opportunity team members will retain their access. Option A is incorrect, since manual sharing on the opportunity would be removed when the account owner changes. Option C is incorrect, since manual sharing on the account would not grant access to the opportunity, as it does not roll up from account to opportunity. Option D is incorrect, since creating an owner-based sharing rule would be unnecessary and inefficient.

The architect can achieve this requirement by using a permission set. A permission set is a collection of settings and permissions that give users access to various tools and functions3. The architect can create a permission set that grants edit access to the flag field on the case object, and assign it to the users who are assigned as case assessors. Object permissions control the access level that users have to records, not fields. A custom lightning component is not necessary for this requirement, as it can be done declaratively. Field-level security controls the visibility of fields on page layouts and reports, not the editability.

Storing the value in a text field on a protected custom setting in the package is the best way to support this requirement. Protected custom settings are not visible to subscribers, but they can be accessed by the package code and support representatives. The other options either expose the value to subscribers (B and C) or do not allow support representatives to access it (D).

Susan and users with the View All Data permission and Susan and users with access to the record are two statements that accurately describe who can view the file by default. When a file is posted to a record’s feed, it inherits the sharing settings of that record. Therefore, only users who can view the record can view the file. Users with the View All Data permission can view all records and files in the organization. Option C is incorrect, since users with a shared chatter post link to the file can only view the file if they have access to the record as well. Option D is incorrect, since Susan is not the only one who can view the file, but also users who have access to the record or the View All Data permission.

 Searching for external users is the community functionality that is impacted by having the customer user visibility turned off. When customer user visibility is turned off, community users cannot find or interact with other community users in global search, people search, or chatter. Option B is incorrect, since updating their user profile is not affected by customer user visibility. Option C is incorrect, since creating new customer community users is not affected by customer user visibility. Option D is incorrect, since searching for internal users is not affected by customer user visibility.

Setting the External OWD to Private for the Delivery object is the best approach to limit the records a distributor can see, since it will restrict the access to only the records they own or are shared with them. Option A is incorrect, since ownership-based sharing rules are not available for partner community users. Option B is incorrect, since removing Read permission from the distributor profile would prevent them from accessing any delivery records. Option D is incorrect, since criteria-based sharing rules are not available for partner community users.

Role hierarchy is a way to grant access to records based on the user’s position in the organization. Users higher in the role hierarchy can access and edit records owned by users lower in the role hierarchy, unless the Grant Access Using Hierarchies option is disabled for a specific object. In this case, the Operations manager can access and edit all scheduled courses owned by the Operations Users team members who report to them in the role hierarchy. Therefore, the answer B is correct and the other options are incorrect

 Setting the case organization-wide default to Private and adding the specialized marketing consultants to the account team with Read/Edit permission are the best recommendations to allow this scenario. This way, only the support rep who owns the case and the marketing consultants who are related to the account can see and edit the case records of VIP customers. Option B is incorrect, since setting the case organization-wide default to Public Read Only would give access to all cases to all users. Option C is incorrect, since using a role hierarchy and a read-only ownership-based sharing rule would not give edit access to the marketing consultants. Option D is incorrect, since adding the marketing consultants to the case team would require manual configuration and maintenance.

Only Bob can view the file that he uploads to his Files Home private library. Users above Bob in the role hierarchy, users with View All Data permission, or users with Modify All Data permission cannot access the file unless Bob explicitly shares it with them

Reviewing the user provisioning process to not automatically create a user role for any new user and contacting Salesforce support and requesting to increase the number of users’ roles allowed are two recommendations that could solve this problem. Salesforce has a limit on the number of roles that can be created in an organization, which depends on the edition and the number of licenses. If this limit is reached, no more roles can be created unless the limit is increased by Salesforce support. Therefore, it is not advisable to create a new role for every new user, as this would quickly exhaust the limit and cause the “User Role Limit Exceeded” error. Option B is incorrect, since removing role hierarchy from Salesforce org and controlling the record access using Apex managed sharing would be a complex and custom solution that would not address the root cause of the problem. Option D is incorrect, since creating an Apex class to replace the User Roles by generic one as soon as they are created would be unnecessary and inefficient.

The architect can configure the system to support the requirements by using a sharing rule. A sharing rule is a declarative way of extending record access to users or groups of users based on criteria such as ownership, role, or field values3. In this case, the architect can create a sharing rule that grants read or read/write access to all records owned by customer community users to UC users in the customer support role. A sharing set is used to grant access to community users based on a common account or contact, not to internal users. A share group is used to share records with groups of community users who have Customer Community Plus or Partner Community licenses, not with internal users. Apex sharing is used to programmatically share records when declarative sharing cannot fulfill complex requirements, but it is not necessary in this case.

Disabling Grant Access Using Hierarchies and setting an Owner-Based Sharing rule for Strategic Deals team is the best way to design for this requirement. This will ensure that only the owner and the strategic team can access the confidential proposals, regardless of the role hierarchy. Setting the Proposal Owner to the Strategic Deals Team Queue will not work, because queues can only own leads, cases, orders, and custom objects. Setting a Criteria-Based Sharing rule for Strategic Deals team will not work, because criteria-based sharing rules can only grant access, not restrict it.

A sharing set is the best way to share cases with community users based on a common account. Sharing sets are available for Customer Community licenses and can grant access to related records using predefined criteria. Option A is incorrect, since sharing rules are not available for community users. Option B is incorrect, since there is no such thing as a share group in Salesforce. Option D is incorrect, since Apex sharing is complex and requires code maintenance

List views are a way to filter and display records of a specific object based on certain criteria. List views can be shared with all users, a group of users, or only the owner of the list view. To share a list view with a group of users, such as sales executives who specialize in closing problematic deals, the architect can recommend creating a public group that includes those users and sharing the list view with that public group. Therefore, the answer B is correct and the other options are incorrect 

 Creating an ownership-based sharing rule is the best way to achieve the requirements. Ownership-based sharing rules allow administrators to automatically grant access to records owned by certain users or roles to other users or roles2. This way, the sales manager in Australia can access the deals owned by the sales manager in Japan. Using sharing set, using opportunity teams, and assigning View All on the opportunity object are not options that can achieve the same result.

 Controlling the invoices object permission on the sales manager’s profile is how the architect can grant the sales managers access to the customer invoices data. Object permissions determine whether a user can create, read, edit, or delete any record of that object. Since invoice data is surfaced in Salesforce using external objects, sales managers need to have at least read permission on the invoice object to view the customer invoices data. Option A is incorrect, since sharing rules are not available for external objects. Option B is incorrect, since manual sharing is not available for external objects. Option D is incorrect, since sharing sets are not available for external objects.

 Profiles can control the login hours for users, which can restrict their access to Salesforce based on their time zone. Option A is incorrect, since login hours are not set on user records. Option B and C are incorrect, since permission sets and custom permissions do not control login hours

The impact of these sharing settings is that Sales Engineers Managers and their managers in the role hierarchy will also have access to these records. This is because sharing rules extend access to users in public groups, roles, or territories. The access granted by a sharing rule is inherited by users above those users in the role hierarchy1. Subordinates of Managers who have Sales Engineers in the public group, Sales Engineers that have a similar role of the Sales Engineers of the public group, and Sales Engineers direct reports will not have access to these records unless they are explicitly granted by other means.

The best way to troubleshoot this issue is to view Field Accessibility in the Object Manager. This will allow the admin to see how the field-level security settings affect the visibility of the field for different profiles and record types. The other options are not helpful, because:

Reviewing changes to Account record types will not show why a field has disappeared from the Account page, unless the field is dependent on a record type that has been deactivated or modified.

Logging in as user and checking several Accounts will not isolate the problem records, because the issue is related to field visibility, not record access.

Running a Who Sees What report will not help, because this report only shows how sharing settings affect record access, not field visibility.

Price books are a way to store different prices for products that can be added to opportunities. Price books can have different organization-wide defaults (OWD) settings that control the baseline level of access for users. To allow only specific branch staff to sell high risk products, the architect can recommend setting the price book OWD to View Only and sharing the high risk price book with the trained staff via manual sharing or sharing rules. Manual sharing allows the owner or anyone with Full Access to a record to share it with another user or group of users. Sharing rules allow the admin to automatically grant access to records based on certain criteria. Therefore, the answer A and C are correct and the other options are incorrect.

The Referral object OWD is public Read/Write, which could be the technical reason for the recruiter not finding the share button. When an object’s OWD is public Read/Write, all users can view and edit all records of that object, so there is no need for manual sharing. The share button only appears when an object’s OWD is private or public Read Only. Option A is incorrect, since the Referral object OWD is not private. Option C is incorrect, since the Referral object OWD is not public Read Only. Option D is incorrect, since public Full Access is not a valid OWD setting.

The territory with the highest territory type priority is automatically assigned to the opportunity when an account meets criteria for multiple territories4. Option A is incorrect, since creating a process builder process to update the territory field on the opportunity would be unnecessary and complex. Option C is incorrect, since creating an Apex class that implements Filter-Based Opportunity Territory Assignment would be an advanced and custom solution that is not required in this scenario. Option D is incorrect, since creating a criteria-based sharing rule on the opportunity to assign it to a territory would not work, as sharing rules do not assign territories5.

 Cross-Site Scripting (XSS) and SOQL Injection are two common types of security vulnerabilities that can affect Salesforce applications. XSS occurs when malicious code is injected into a web page that can execute in the browser of a user who visits that page6. SOQL Injection occurs when user input is used to construct a SOQL query without proper validation or escaping, which can allow an attacker to manipulate the query and access unauthorized data7. To prevent XSS, developers should use appropriate encoding methods when displaying user input on custom pages8. To prevent SOQL Injection, developers should use bind variables or the escapeSingleQuotes() method when building SOQL queries with user input9. Option A is incorrect, since Apex queries are not vulnerable to XSS. Option D is incorrect, since testing for invalid user access attempts is not related to security vulnerabilities within the Salesforce organization.

The error occurred because the trigger handler class is using ‘‘with sharing’’ and the user does not have access to the orders related to the opportunity. The ‘‘with sharing’’ keyword enforces the sharing rules that apply to the current user. This means that if the user does not have access to a record, they will get a permission error when trying to create or update it1. The trigger should use ‘‘without sharing’’ keyword instead, which ignores the sharing rules that apply to the current user. The trigger should not use RunAs(), IsCreateable(), or no sharing keywords as they will not prevent the error from occurring.

Setting the Request object’s OWD to Public Read/Write is the simplest and most efficient way to allow all employees to collaborate on requests. Option B is incorrect, since granting Modify All Data permission on all profiles would give too much access and affect other objects as well. Option C is incorrect, since creating a criteria-based sharing rule to share all records with all users would be redundant and inefficient. Option D is incorrect, since setting the OWD to Public Read Only would not allow users to edit requests3.

 To give access to the invoice records from an external object on the account page, the Sales Architect should recommend including the Invoice Related List on Account Page layout. This will allow the finance users to see the invoice records related to each account, as long as they have access to the account record and the external object4. Creating sharing rules or using Apex managed sharing are not applicable for external objects, as they do not support manual or programmatic sharing

Organization-wide defaults (OWD) are a way to set the baseline level of access for each object in the organization. OWD can be set to Private, Public Read Only, Public Read/Write, or Public Read/Write/Transfer for different objects. In this case, setting OWD to Public Read Only for Lead object will allow all full-time internal employees to view all leads, but not edit them. A subset of employees can be granted additional access to leads using other mechanisms such as profiles, permission sets, or sharing rules. Therefore, the answer B is correct and the other options are incorrect .

A new AccountShare record is created with Row Cause as “Manual” and Access Level as “Read/Write” when Paul manually shares the record with John. This record grants John edit access to the account owned by Paul. Option B is incorrect, since an existing AccountShare record is not updated, but a new one is created. Option C is incorrect, since the Row Cause is not “Owner”, but “Manual”. Option D is incorrect, since an existing AccountShare record is not updated, but a new one is created.

Master-Detail relationships enforce the sharing and security settings of the parent object on the child object. This means that if a user has access to an Account record, they will also have access to any Invoice records that are related to that Account. To prevent this, the architect can recommend replacing the Master-Detail relationship with a Lookup relationship, which allows the child object to have its own sharing and security settings independent of the parent object. Then, the architect can remove the Invoice access from the unauthorized profiles or use other mechanisms such as sharing rules or permission sets to restrict or grant access to the Invoice object. Therefore, the answer C is correct and the other options are incorrect

Creating a Share Group based on the sharing set created for the Customer Community User Profile is the best way to give support representatives access to Container and Case records owned by Customer Community users. Share Groups are groups of users who have access to records based on a sharing set. Sharing sets are settings that grant community users access to records that have a lookup relationship to their user record1. Creating an ownership-based sharing rule, creating a criteria-based sharing rule, and relying on the role hierarchy are not options that can achieve the same result.

The architect can design the solution to federate user setup to the partners by assigning delegated external administrators at each partner and allowing external users to self-register. A delegated external administrator is a user who can create and manage users in their own partner account. This way, the partners can have more control over their seasonal workers and reduce the administrative burden on UC. Allowing external users to self-register is another way of simplifying user creation and management for partners, as they can enable their workers to create their own accounts and log in to the community. Granting the Modify Users permission to the partner managers is not a good practice, as it would give them too much power over all users in the org. Creating a permission set giving Read/Write to the User object to partner manager is also not advisable, as it would expose sensitive user data and allow unauthorized changes.

 Account records can be accessed due to implicit sharing from Opportunity and Account records can be accessed due to role hierarchy are two reasons that could be causing this issue. Implicit sharing grants access to parent records when a user has access to a child record. For example, if a user has access to an opportunity, they also have access to its related account and contract records. Role hierarchy grants access to records owned by or shared with users who are below in the hierarchy. For example, if a user is above another user in the role hierarchy, they can access any records that the lower user can access. Option A is incorrect, since contact records cannot be accessed due to implicit sharing from account, as implicit sharing does not grant access to child records. Option C is incorrect, since contact records cannot be accessed due to implicit sharing from opportunity, as implicit sharing does not grant access to child records.