Key details for this exam, checked against the published exam outline
Each question shows the correct answer and an explanation of why it is right
Universal Containers (UC) wants to reduce the amount of redundant leads entered into the system. UC also wants to ensure that leads are only edited/reassigned by the lead owner. Which organization-wide default (OWD) approach should be recommended to help UC implement these requirements?
Comprehensive and Detailed 150 to 250 words of Explanation From Platform Sharing and Visibility Architect/Course Guide/topics:
Public Read-Only is the correct Lead OWD because it balances duplicate prevention with ownership-based editing. Users can see existing Lead records across the organization, which helps them identify whether a prospect already exists before creating another Lead, but they cannot edit another user's Lead merely because they can view it. A Private OWD would protect ownership more strictly but would undermine the duplicate-reduction objective because users might not be able to discover Leads owned elsewhere. Public Read/Write/Transfer would go too far in the opposite direction by allowing broader modification or reassignment than the requirement permits. The organization can complement the OWD with Duplicate Rules and Matching Rules for stronger prevention and warning behavior, but the OWD still establishes the right record-visibility baseline. Study Guide reference: Access to Records - Lead OWD, Public Read-Only, record ownership, duplicate prevention, and least-privilege access. The implementation should also be validated with representative users so effective permissions, sharing inheritance, and any cross-object access behave exactly as designed before production release.
Universal Containers (UC) would like to store an encryption key within Salesforce for use in Apex code, but it does not want users to be able to see this confidential key. Users require the view setup permission. How can UC securely store the confidential key?
Comprehensive and Detailed 150 to 250 words of Explanation From Platform Sharing and Visibility Architect/Course Guide/topics:
Among the supplied choices, a protected custom metadata type delivered in a managed package provides the applicable package-level confidentiality boundary. Protected custom metadata records in the managed-package context can be hidden from subscriber-side access in ways that ordinary public custom metadata cannot, which is why this pattern has historically been used for package-controlled sensitive configuration. An unlocked package does not provide the same protection model, and relying only on an administrator profile restriction for a public custom metadata type does not create an equivalent boundary for users who require broad Setup visibility. The architecture should also distinguish configuration from secrets: on the current platform, dedicated credential mechanisms such as Named Credentials or other appropriate secret-storage facilities are generally preferable for passwords, tokens, and cryptographic credentials. Nevertheless, within the answer choices, the managed-package protected metadata design is the one that represents the intended confidentiality model. Study Guide reference: Access to Other Data - protected custom metadata, managed packages, Setup visibility, secret-management considerations, and package security boundaries.
Universal Containers implemented Sales Cloud and requested that sales agents have access to products and prices the company sells, and to be able to create opportunities for its customers. What should the organization-wide defaults be for pricebook?
Comprehensive and Detailed 150 to 250 words of Explanation From Platform Sharing and Visibility Architect/Course Guide/topics:
Price Books have specialized organization-wide access levels. Use is the appropriate level when sales agents must not only view products and pricing but also select the Price Book and add its products to Opportunities. View Only supports inspection and reporting but does not represent the same ability to transact with the Price Book during the sales process. Salesforce therefore distinguishes Use, View Only, and No Access so organizations can separate catalog visibility from sales usability. If UC later needs to restrict specialized Price Books, it can establish a more restrictive baseline and explicitly share those Price Books with selected users, roles, or groups at the Use level. The Price Book security model must also be combined with normal Product, Opportunity, and object permissions because each layer controls a different part of the process. Study Guide reference: Access to Other Data - Price Book security, Use access, View Only, product pricing, and Opportunity product access.
Universal Containers has a Performance Feedback custom object (Private organization- wide default) used by customers to report any issues with delivery drivers. Feedback should not be visible to the driver, but any feedback records should be accessible to people above them in the Role Hierarchy, even when the driver changes managers. Assuming managers have Read access to the Feedback object, which three steps are necessary to solve these requirements?
Comprehensive and Detailed 150 to 250 words of Explanation From Platform Sharing and Visibility Architect/Course Guide/topics:
The durable design is to anchor the feedback record to the driver for hierarchy purposes, remove the driver's object-level Read permission, and allow managers above the driver to inherit record access through the role hierarchy. Ownership by the driver means that when the driver moves to a different manager or branch in the hierarchy, the access path can follow the updated hierarchy instead of remaining tied to a specific former manager. Removing Read permission prevents the driver from opening the Performance Feedback object even though the driver is used as the ownership anchor. Managers are stated to have Read permission, so hierarchy-derived record access can be effective for them. Transferring ownership to the current manager would make the design brittle when management changes, and an additional ownership-based sharing rule is unnecessary when the hierarchy already expresses the upward-access relationship. Study Guide reference: Access to Records - role hierarchy, record ownership, custom-object hierarchy access, object permissions, Private OWD, and management realignment.
Sales reps at Universal Containers sometimes create large files as a part of the sales process that are too large to share over email. They would like users to be able to share files with customers, but the CISO has requested that any file links shared must be password-protected. How can this be accomplished?
Comprehensive and Detailed 150 to 250 words of Explanation From Platform Sharing and Visibility Architect/Course Guide/topics:
Salesforce Content Deliveries are designed to distribute files externally through generated links and include an option to require a password before the recipient can access the content. That directly satisfies the CISO's requirement without adding a third-party product or building an Experience Cloud site solely for file delivery. A content delivery can provide a controlled external URL while the password is communicated separately to the customer. Administrators can also establish organization-level policies for content-delivery password behavior so the security requirement is applied consistently. An Experience Cloud site would introduce identity, licensing, and site-management overhead that is unnecessary when the business simply needs to send a protected file link. The architect should still consider the sensitivity of the content, expiration requirements, and broader information-governance policy when deciding whether content delivery is appropriate for a particular file. Study Guide reference: Access to Other Data - Salesforce Files, Content Deliveries, external file access, password protection, and secure content distribution.
95 questions covering all exam domains
Exam domains verified against: Official Salesforce Plat-Arch-205 exam guide, last checked September 2026.
You need to assess scenarios and recommend appropriate object-level and field-level permissions for users with varying access needs. This includes techniques to hide data at the UI level and controls for protecting sensitive data like PCI and PII under regulations such as HIPAA, plus programmatic solutions that enforce security settings automatically.
Sample question from this domain above: Q2
You design record-level access using organization-wide defaults, role hierarchies, sharing rules, groups, teams, object relationships, and programmatic sharing. External user sharing mechanisms and record access overrides are key tools. This is the largest domain and covers the most complex scenarios in the exam.
You determine appropriate access controls for data beyond standard and custom objects. This includes data stored in documents, reports, dashboards, and other Salesforce features that fall outside the traditional object model.
Sample question from this domain above: Q5
You evaluate the scalability impact of a sharing solution, understand how license types constrain your choices, and plan how to test the sharing model to ensure it works at scale. Performance and compliance are central here.
Common questions about the exam itself
