Salesforce Advanced-Administrator Salesforce Certified Advanced Administrator (SU24) Exam Practice Test

Delegated administrators in Salesforce are designated users who are given limited administrative privileges to assist system administrators without having full access to all administrative functions. The two functions they can typically perform, which align with the permissions available to delegated admins, are:

Set up users and password management:

Delegated administrators can create and manage user accounts, which includes setting up new users, resetting passwords, and updating user details.

This is particularly useful for helping with user management tasks without providing full system administrator access.

Configure updates to sharing rules:

Delegated administrators can manage sharing rules within their specific groups or roles, which helps control access to records based on criteria set within the organization.

This level of access allows them to modify sharing rules to ensure appropriate data access without requiring full administrative control over all settings.

The other options listed are not within the scope of delegated administrator capabilities:

Manage custom objects and customize nearly every aspect: Delegated administrators do not have the ability to manage custom objects or perform extensive customization. These functions are reserved for system administrators with broader privileges.

Make updates to permission set configurations: Delegated administrators cannot create or modify permission sets. This is also restricted to full administrators, as it involves controlling access at a granular level across the org.

By utilizing delegated administrators for user and sharing rule management, organizations can maintain security and control while also sharing some administrative workload.

One possible reason for the changes to case routing is the difference in the order of execution between before save flow triggers and workflow rules. Before save flow triggers run before assignment rules, which means that any field updates made by the flow can affect how the assignment rules assign the case. Workflow rules run after assignment rules, which means that any field updates made by the workflow do not affect how the assignment rules assign the case. Therefore, replacing workflow rules with before save flow triggers can change the case routing logic. References: https://help.salesforce.com/s/articleView?id=sf.flow_concepts_trigger.htm &type=5 https://help.salesforce.com/s/articleView?id=sf.order_of_execution.htm &type=5

Configuring one app per department and activating record pages for each app will ensure that users view records in a way that makes sense for each department. An app is a collection of items that work together to serve a particular function. An app can have different record pages for different objects and profiles. By activating record pages for each app, the administrator can customize what users see based on their app context. References: https://help.salesforce.com/s/articleView?id=sf.app_manager_overview.htm &type=5 https://help.salesforce.com/s/articleView?id=sf.app_builder_customize_lex_pages_assign.htm &type=5

The order of execution for flows that are configured to run before the record is saved on the same object is unpredictable and may vary depending on factors such as flow version, flow name, or flow creation date. Therefore, it is recommended to avoid creating multiple flows with the same trigger conditions and instead consolidate them into a single flow.

Flows are tools that automate business processes by collecting data and performing actions in your org or an external system. Flows can be triggered by various events such as record creation, updates, or invocations from other processes or flows. Flows can also have decision elements that evaluate conditions and determine which path to follow in the flow. By combining the two flows into one with decision elements, the administrator can ensure that the flow runs in the correct order and updates the field on the child record after it is created by the first flow. References: https://help.salesforce.com/s/articleView?id=sf.flow_concepts.htm &type=5 https://help.salesforce.com/s/articleView?id=sf.flow_ref_elements_decision.htm &type=5

A roll-up summary field is used to display a value in a master record based on the values of a set of related detail records. In this case, the administrator can create a roll-up summary field on the Properties object that counts the number of Open House records in a Pending status. References: https://help.salesforce.com/s/articleView?id=sf.fields_about_roll_up_summary_fields.htm &type=5

UESTION NO: 92

Sales management wants a small subset of users with different profiles and roles to be able to

view all data for compliance purposes. How can an administrator meet this requirement?

A. Assign delegated administrator to the subset of users to View All Data.

B. Create a new profile and role for the subset of users with the View All Data permission.

C. Enable the View All Data permission for the roles of the subset of users.

D. Create a permission set with the View All Data permission for the subset of users.

Answer: D

A permission set is a collection of settings and permissions that give users access to various tools and functions. The View All Data permission allows users to view all data, regardless of sharing settings. By creating a permission set with this permission and assigning it to the subset of users, the administrator can meet the requirement without changing their profiles or roles. References: https://help.salesforce.com/s/articleView?id=sf.perm_sets_overview.htm &type=5 https://help.salesforce.com/s/articleView?id=sf.admin_general_permissions.htm&type=5

Email logs are files that provide information about email delivery and activity in your Salesforce org. Email logs contain details such as sender, recipient, subject, date, status, error code, and more for each email sent or received within a specified time range. You can use email logs to investigate issues with email delivery or performance in your org. In this case, you can use email logs to check if the status update emails were sent successfully or if there were any errors or failures. References: https://help.salesforce.com/s/articleView?id=sf.email_logs.htm &type=5 https://help.salesforce.com/s/articleView?id=sf.email_logs_format.htm &type=5

Opening the flow in Debug mode and running it as another user allows simulating how the flow behaves for different users with different permissions and settings. This can help identify any issues related to user

record types allow administrators to offer different business processes, picklist values, and page layouts to different users based on their profiles. By using record types for accounts and contacts at AW Computing, administrators can track their accounts and competitors on different record types with different fields on their page layouts. For partner accounts, they can also use record types to specify different values in the Industry picklist field. References: https://help.salesforce.com/s/articleView?id=sf.customize_recordtype.htm &type=5

The user profile permissions on the Opportunity object is the item that the administrator should review to find out why the user is unable to delete the duplicate record. The user profile permissions determine what users can do with records and objects in Salesforce, such as creating, editing, deleting, viewing, or sharing. In this case, the administrator should check if the user has the Delete permission on the Opportunity object, which allows them to delete opportunity records that they own or have access to. If not, the administrator can either grant them this permission or delete the record for them. References: https://help.salesforce.com/s/articleView?id=sf.admin_general_permissions.htm &type=5 https://help.salesforce.com/s/articleView?id=sf.admin_object_permissions.htm &type=5

Knowledge is a feature that allows administrators to create, manage, and share articles that provide information and solutions for common issues or questions. Knowledge articles can be searched by users using keywords or phrases.

To improve its customers’ ability to search for knowledge articles, UMS can use two options:

B) Create synonyms for specific search terms.

Synonyms are words or phrases that have the same or similar meanings, such as “TV” and “television” or “fix” and “repair”. By creating synonyms for specific search terms, administrators can ensure that customers can find relevant articles even if they use different words or spellings than the ones used in the articles. References: https://help.salesforce.com/s/articleView?id=sf.knowledge_search_synonyms.htm &type=5

D) Promote specific search terms for specific articles.

Promoted search terms are keywords or phrases that administrators can associate with specific articles to boost their relevance and ranking in search results. By promoting specific search terms for specific articles, administrators can ensure that customers can find the most helpful or popular articles for their queries. References: https://help.salesforce.com/s/articleView?id=sf.knowledge_search_promotion.htm &type=5

Modify All is the level of access that the sales user will have on the Account object after being assigned to a muting permission set that mutes Delete access on Account. Muting permissions are a way to reduce or remove access to objects or fields for users who are assigned to permission set groups. Muting permissions can only mute object-level permissions, such as Create, Read, Edit, Delete, View All, or Modify All, but not field-level permissions or other permissions. Muting permissions can only reduce or remove access that is granted by other permission sets or permission set groups within the same permission set group, but not by profiles or other sources of access. Therefore, in this case, the muting permission set will only mute the Delete access on Account that is granted by the permission set group, but not the Modify All access that is also granted by the permission set group.

Entitlement management lets you create and maintain service contracts that specify the support terms for each account. You can use entitlement processes to automatically apply the correct service contract to a case based on criteria you define. References: https://trailhead.salesforce.com/en/content/learn/modules/entitlements/entitlements_overview

Data Import Wizard is a tool that allows administrators to import data for standard and custom objects in Salesforce using CSV files. Data Import Wizard can handle up to 50,000 records at a time and supports simple data transformations and validations. Data Import Wizard can be used to upload records for a custom object when the number of records is small and the import frequency is low.

Deselecting disable session timeout warning popup enables a warning message to appear before a user’s session expires due to inactivity. This gives the user a chance to extend their session or save their work before being logged out. This can help prevent users from being logged out of Salesforce without notice

Using a Get Record component allows the flow to dynamically retrieve records based on criteria or record IDs without hard coding them. This makes the flow more flexible and maintainable. Updating record elements outside the flow loop prevents unnecessary DML operations and reduces the risk of hitting governor limits.

Salesforce’s Data Export Service is a tool that allows you to export your organization’s data to a set of comma-separated values (CSV) files and store them in a backup location of your choice. You can schedule this service to run weekly or monthly and receive an email notification when your files are ready to download. This is one way to back up your data daily without using any external tools or services. References: https://help.salesforce.co m/s/articleView?id=sf.data_export.htm&type=5

Permission sets are collections of settings and permissions that give users access to various tools and functions without changing their profile or requiring multiple profiles for users who perform different tasks across apps in your org. By assigning a permission set that has View All on Leads to the contractor, Cloud Kicks can grant them view access to all lead records without modifying their profile or creating a new one. References: https://help.salesforce.com/s/articleView?id=sf.perm_sets_overview.htm&type=5

Sharing rules are automatic exceptions to organization-wide sharing settings that grant additional access to records based on record ownership or criteria. By creating a sharing rule on the Account object for all members of the account services role to have Read/Write access, the administrator can allow users in that role to edit and change ownership of Accounts owned by any of their team members, regardless of the organization-wide sharing setting for Account. References: https://help.salesforce.com/s/articleView?id=sf.security_sharing_rules.htm &type=5

When a currency is added to an organization’s list of supported currencies, it cannot be deleted and once enabled, advanced currency management cannot be disabled are two considerations that AW Computing should be aware of prior to implementing this change to the existing system. Adding a currency to an organization’s list of supported currencies is an irreversible action that allows users to enter and view amounts in that currency for standard and custom objects that have currency fields. Enabling advanced currency management is also an irreversible action that allows administrators to define dated exchange rates for opportunities and opportunity products based on close dates or product dates instead of using static conversion rates

Upsert is an operation that can either update existing records or insert new records based on the External Id field. This way, the administrator can match existing leads and add new ones with Data Loader. References: https://help.salesforce.com/s/articleView?id=sf.data_loader_upsert.htm &type=5

The fields that display in the details of the record page are controlled by the page layout assigned to the user’s profile and record type. The administrator can edit the page layout to add, remove, or reorder fields on the record page. References: https://help.salesforce.com/s/articleView?id=sf.customize_layouts.htm &type=5

The Highlights Panel is a Lightning component that displays key information about a record at the top of the page. You can customize the Highlights Panel to show different actions based on the record type or other criteria. In this case, you can define dynamic action buttons for the Planet object that appear only if the gaseous field is true or false. This way, you can show different actions for different types of planets. References: https://help.salesforce.com/s/articleView?id=sf.lex_page_layouts_highlights_panel.htm &type=5 https://help.salesforce.com/s/articleView?id=sf.dynamic_actions_considerations.htm &type=5

As explained in question 3, a price book is a list of products and their prices for a specific segment of customers or market. By creating a new price book for the U.K product pricing, Northern Trail Outfitters (NTO) can offer different prices for their products in the U.K market due to shipping and raw material cost differences. The price book can also specify which currency is used for the prices, such as pounds or euros. References: https://help.salesforce.com/s/articleView?id=sf.products_pricebooks_def.htm &type=5

 Omni-Channel is a feature that allows service reps to receive work assignments based on their availability, capacity, and skills. It also allows administrators to define routing rules and priorities for different types of work items, such as cases, chats, or leads. Omni-Channel can help reduce the wait time for customers and improve the efficiency of service reps.

Delegated Administration is a feature that allows administrators to delegate some administrative tasks to other users without giving them full access to Setup. Delegated administrators can manage users and assign permissions for specific custom objects, tabs, apps, and fields. This can help reduce the workload of the system administrator and empower power users to make configuration changes to a specific custom object

To ensure that secure fields remain protected in email templates, administrators should remove the fields from the email. Email templates can expose sensitive information if they contain fields with secure data. By excluding these fields, administrators can prevent unauthorized access to sensitive information through email communication.

Removing Secure Fields from Email Templates:

When creating or updating email templates, administrators should carefully assess the fields included and remove any that contain sensitive information, such as encrypted fields or fields that contain Personal Identifiable Information (PII).

This approach ensures that secure information is not unintentionally shared via email, aligning with best practices for data security and minimizing exposure risks.

Implications of Including Secure Data in Emails:

Secure fields, particularly those that contain sensitive or confidential information, should be restricted from emails to avoid potential data breaches.

Email communication often lacks the same security controls as the Salesforce platform, making it essential to limit the sharing of sensitive data.

Incorrect options:

Implement GDPR: While GDPR compliance ensures proper data handling practices, it does not directly prevent secure fields from being included in emails.

Set up an approval process for email alerts: An approval process can control the sending of email alerts but does not inherently protect secure fields within the email content.

Use classic encrypted fields: Encrypted fields add a layer of security for data at rest within Salesforce but do not provide specific protections for data included in email templates. Moreover, encrypted fields cannot be referenced in email templates.

In conclusion, the most effective way to ensure that secure fields are not exposed through email templates is to remove these fields from the template altogether, avoiding the inclusion of sensitive data in email communications.

Another quote is already synced with the opportunity will prevent a user from syncing a quote with an opportunity. Only one quote can be synced with an opportunity at a time. If a user tries to sync another quote, they will get an error message saying that the opportunity already has a synced quote. References: https://help.salesforce.com/s/articleView?id=sf.quotes_syncing.htm &type=5

Data Categories are a way to organize and classify knowledge articles into a hierarchical structure based on topics or criteria. Data Categories can help service reps quickly narrow down the number of articles by filtering or browsing by category. Data Categories can also be used to control the visibility and access of articles for different users or roles.

Setup Audit Trail is a tool that tracks the recent setup changes made by anyone in an org. It can help identify who made what changes and when, as well as any errors or failures that occurred during the changes. Setup Audit Trail can help troubleshoot deployment issues by comparing the changes made in production with those made in sandbox

The Data Import Wizard is a tool that allows you to import data for standard and custom objects, including person accounts, into Salesforce. You can access it from the Setup menu and use it to import up to 50,000 records at a time. You can also use it to update, upsert, or delete existing records. The Data Import Wizard can help you match your data with Salesforce fields, prevent duplicates, and run import jobs in the background. References: https://help.salesforce.com/s/artic leView?id=sf.data_importer.htm&type=5

Use an Insert operation to load data because the data is not already in Salesforce and does not need to be updated or deleted3. Map an External ID data value to the object because External IDs are used to create relationships between records that are being imported and records that already exist in Salesforce4. References: 3 https://help.salesforce.com/s/articleView?id=sf.data_loader_insert.htm &type=5 4 https://help.salesforce.com/s/articleView?id=sf.data_loader_relationships.htm &type=5

Allow Forecasting is what the administrator should review to solve this issue. Allow Forecasting is a user permission that enables users to access and edit forecasts. If a user does not have this permission, they will not be able to see their own forecast or any forecasts below them in the role hierarchy. Therefore, the administrator should make sure that the sales rep has this permission enabled on their profile or permission set.

A cross-filter lets you filter records based on related objects and their fields. For example, you can filter accounts that have at least one opportunity from this year and at least one completed activity in the last 30 days. References: https://help.salesforce.com/s/articleView?id=sf.reports_cross_filters.htm &type=5

An authentication app is a mobile app that generates verification codes for logging in to Salesforce or other services that require multi-factor authentication (MFA). A username and password are also required for logging in to Salesforce, but they are not sufficient for MFA. References: https://help.salesforce.com/s/articleView?id=sf.identity_auth_apps.htm &type=5

A custom summary formula is a formula that calculates values from summary fields in reports such as sum, average, min, max, etc. Custom summary formulas can use functions such as PREVGROUPVAL to compare values from different groups in reports. For example, to calculate the year-over-year change in dollar amount of opportunities, an administrator can create a custom summary formula that uses PREVGROUPVAL to compare the sum of amount from this year’s group with the sum of amount from last year’s group, and divide it by last year’s sum of amount. References: https://help.salesforce.com/s/articleView?id=sf.reports_builder_fields_summary_formulas.htm &type=5 https://help.salesforce.com/s/articleView?id=sf.reports_formulas_prevgroupval.htm &type=5

The equivalent field is the field that matches the dashboard filter field on the source report object. For example, if the dashboard filter is on Account Owner, then the equivalent field on the Opportunity object is Opportunity Owner. Changing the equivalent field ensures that the dashboard filter applies correctly to the Opportunity components. References: https://help.salesforce.com/s/articleView?id=sf.dashboard_filters.htm &type=5

Delegated administration allows administrators to delegate certain user management tasks to other users without granting them full administrative privileges. Delegated administrators can create and manage users only within specified roles or public groups. This option will meet the requirement of allowing each division to create and manage users only within their division. References: https://help.salesforce.com/articleView?id=delegated_administration_overview.htm &type=5

IP ranges are settings that restrict login access to Salesforce from specific IP addresses. Administrators can set IP ranges at the org level or at the profile level. If a user tries to log in from an IP address that is outside the allowed range for their profile or their org, they will not be able to access Salesforce. Therefore, if a user started to work remotely and is having an issue logging in, it could be because they are not in the IP range for their profile or their org. References: https://help.salesforce.com/s/articleView?id=sf.security_networka ccess.htm&type=5

Data Loader is a tool that allows administrators to import, export, insert, update, delete, or upsert records in Salesforce using CSV files. Data Loader can handle large data sets and complex data transformations. Data Loader can be used to import records for a custom object from a spreadsheet. Lightning Object Creator is a tool that allows administrators to create custom objects in Salesforce from spreadsheets. Lightning Object Creator can automatically map spreadsheet columns to fields and create relationships between objects. Lightning Object Creator can be used to create a custom object from a spreadsheet and import records at the same time.

One of the IDs in the batch referenced a record that was in the recycle bin because deleting records with Bulk API does not delete records permanently but moves them to the recycle bin. Therefore, if a record ID in the batch matches an existing record ID in the recycle bin, an ‘entity is deleted’ error will occur.

Two combined automation tools that the administrator can use to create the task record and assign based on date criteria are:

Create a formula field to capture the MAX date. A formula field is a custom field that calculates a value based on other fields or expressions. In this case, a formula field can be used to capture the maximum value between Estimated Shipping Date and Client Need By Date fields and store it as a date value.

Make a Process Builder to create the task. A Process Builder is an automation tool that allows you to create processes that perform actions based on certain criteria. In this case, a Process Builder can be used to create a task record when a certain condition is met and assign its due date based on the formula field value.

The other two options are incorrect because:

An approval process is an automation tool that allows you to route records for approval based on certain criteria and approval steps. It does not create or assign tasks based on date criteria.

A workflow rule is an automation tool that allows you to perform actions based on certain criteria and evaluation time. It does not create or assign tasks based on date criteria.

References: https://help.salesforce.com/s/articleView?id=sf.customize_functions.htm &type=5 https://help.salesforce.com/s/articleView?id=sf.process_overview.htm &type=5

A cross filter with WITHOUT logic is a method for creating a report that shows accounts that are missing certain related records. A cross filter is a filter that lets you include or exclude records in your report based on related objects and their fields. You can use cross filters to create reports on accounts with or without opportunities, contacts, cases, or other related objects. In this case, you can use a cross filter with WITHOUT logic to show accounts without assets that have a certain product name or code. This way, you can identify customers that need to install a new solar panel monitor system. References: https://help.salesforce.com/s/articleView?id=sf.reports_cross_filters.htm &type=5 https://help.salesforce.com/s/articleView?id=sf.reports_examples_cross_filters.htm &type=5

A phone field that provides the full phone number of the seller, a number field that designates the square footage of the listing, and a picklist field that designates the county of the listing should be used as filter criteria because they are fields that can be used to narrow down the report results based on specific values or ranges. A multi-select picklist field that designates features of the listing and a formula field that calculates a price for the listing should not be used as filter criteria because they are fields that cannot be filtered on in reports. References: https://help.salesforce.com/s/articleView?id=sf.reports_filtering.htm &type=5 https://help.salesforce.com/s/articleView?id=sf.reports_fields_unavailable.htm &type=5

Shield Platform Encryption is a Salesforce feature that allows you to encrypt sensitive data at rest while preserving critical platform functionality. It uses a combination of tenant secrets, encryption keys, and masking policies to protect your data. A field encryption policy is a set of rules that defines which fields are encrypted and how they are masked when displayed. A field encryption policy can be used to encrypt and mask the identification number field, except for the last two digits. References: https://help.salesforce.com/s/articleView?id=sf.security_pe_overview.htm &type=5 https://help.salesforce.com/s/articleView?id=sf.security_pe_field_encryption_policies.htm &type=5

Product schedules are features that allow administrators to track revenue or quantity over time for products in opportunities or orders. Product schedules can be either revenue schedules or quantity schedules, depending on whether the product is sold by amount or by quantity. Product schedules can be either standard or customizable, depending on whether they use predefined settings or custom settings.

Line item schedules are records that represent each installment of revenue or quantity for a product over time. Line item schedules are created automatically when a product with a product schedule is added to an opportunity line item or an order product.

One limitation of product schedules is that line item schedules are unavailable in Process Builder and Workflow. This means that administrators cannot use these tools to automate actions based on line item schedules, such as sending email alerts, creating tasks, updating fields, or invoking flows. References: https://help.salesforce.com/s/articleView?id=sf.forecasts3_product_schedules.htm &type=5 https://help.salesforce.com/s/articleView?id=sf.orders_line_item_schedules.htm &type=5 https://help.salesforce.com/s/articleView?id=sf.product_schedule_considerations.htm &type=5

Role hierarchy is a sharing mechanism that should be used to open up opportunity sharing to directors who oversee regional managers so they can access records to assist regional managers. Role hierarchy is a way to grant access to records based on the user’s position in an organization’s hierarchy of roles. Role hierarchy can grant users access to records owned by or shared with users below them in the hierarchy for objects that have organization-wide defaults set to Private or Public Read Only. By using role hierarchy, the administrator can ensure that directors can access opportunities owned by or shared with regional managers who report to them

A junction object is a custom object with two master-detail relationships that allows you to create many-to-many relationships between two objects. In this case, the Job Application object can be used as a junction object to link the Application object and the Job Posting object, so that each application can be related to one or more job postings, and each job posting can have one or more applications. References: https://help.salesforce.com/s/articleView?id=sf.relationships_manytomany.htm &type=5

Debug logs capture database operations, system processes, and errors that occur when executing a transaction or running unit tests. Debug logs can help identify the cause of Apex CPU time limit exceeded errors by showing the execution time of each Apex statement and trigger. References: https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_debugging_debug_logs.htm

A validation rule can enforce data quality by preventing users from saving records that do not meet certain criteria. In this case, the validation rule can check if both the Sales Engineer and the Account Executive lookup fields are blank, and display an error message if so. This way, the director of sales can ensure that every opportunity has either a sales engineer or an account executive assigned to the deal. References: https://help.salesforce.com/s/articleView?id=sf.validation_rules_overview.htm &type=5

Chat must be routed with Omni-Channel in Lightning Experience because Omni-Channel is the only way to route chats to agents in Lightning Experience1. Chat can only be added to Console navigation Lightning apps because Chat is a console app feature and requires a console app with a console navigation style2. References: 1 https://help.salesforce.com/s/articleView?id=sf.live_agent_chat_omnichannel.htm &type=5 2 https://help.salesforce.com/s/articleView?id=sf.live_agent_chat_app.htm &type=5

An after save flow is a type of flow that runs in the background after a record is saved and performs actions based on the record data or changes. An after save flow does not require user input or interaction and can be triggered by a record-triggered flow element or by an Apex trigger. In this case, you can create an after save flow that runs when a case record is updated and delivers status update email to customers based on certain criteria or conditions. References: https://help.salesforce.com/s/articleView?id=sf.flow_trigger_types.htm &type=5 https://help.salesforce.com/s/articleView?id=sf.flow_concepts_trigge r.htm&type=5

Manual sharing is a way of granting access to individual records by manually sharing them with other users, roles, or groups. Manual sharing can override the organization-wide default and role hierarchy settings and give additional access to specific records. In this case, manual sharing could be the reason why only one user can see the account record, even though they have the same profile and role as another user who cannot see it. References: https://help.salesforce.com/s/articleView?id=sf.security_sharing_manual.htm &type=5

Email logs provide information about email delivery, such as the sender, recipient, date and time, delivery status, and any error messages. The administrator can use email logs to troubleshoot why users are missing expected email alerts and identify which emails are hitting the daily limit. References: https://help.salesforce.com/articleView?id=email_logs.htm &type=5

Dynamic actions are actions that appear on Lightning record pages based on criteria such as field values or user profiles. Dynamic actions allow administrators to customize which actions are available for users on different record types or page layouts without creating multiple page layouts for each scenario. By using dynamic actions and conditional visibility for accounts at AW Computing, administrators can show only relevant actions for customer service and sales users based on their situation. References: https://help.salesforce.com/s/articleView?id=sf.dynamic_actions_overview.htm &type=5

The most suitable tool to identify potential security risks associated with Lightning Web Components is the Health Check. Health Check allows Salesforce administrators to evaluate and monitor the security posture of their Salesforce org by comparing its settings against Salesforce's recommended security baseline. This feature provides visibility into settings like session security, password policies, and more, which can directly impact the security of custom apps using Lightning Web Components.

Health Check:

Salesforce Health Check examines various security settings in your Salesforce org and provides a score based on how closely your settings align with Salesforce's recommended security baseline.

By using this tool, administrators can identify vulnerabilities and see specific actions to remediate any security gaps found within the org.

Health Check is especially relevant when evaluating new custom applications and components since it can highlight areas that require tightening security to meet organizational standards.

Other options listed:

Master Encryption Keys is relevant for managing encryption but not directly for identifying security risks.

Salesforce Optimizer is used for overall performance and usage insights and doesn’t specifically focus on security assessments.

Self-signed Certificates are primarily used for secure communications and do not serve as a tool for security risk assessment.

Therefore, Health Check is the best tool to help the administrator expose potential security risks within the custom Lightning Web Components.

A custom summary formula is a formula that calculates values from summary fields in reports such as sums, averages, counts, etc. Custom summary formulas can use functions such as PREVGROUPVAL which returns the value of a field from the previous row at the same grouping level. By using a custom summary formula with the PREVGROUPVAL function, an administrator can create a report to calculate the year-over-year change in the dollar amount of a company’s opportunities by subtracting the amount from the previous year from the amount from the current year and dividing by the amount from the previous year. References: https://help.salesforce.com/s/articleView?id=sf.reports_builder_summary_formulas.htm &type=5 https://help.salesforce.com/s/articleView?id=sf.reports_builder_functions.htm &type=5

One possible cause of unexpected changes to record values is having multiple automation tools that update the same field on the same object. This can create conflicts and overwrite each other’s values. To resolve this issue, the administrator should consolidate automation tools and use only one tool per object and field combination. This can help avoid confusion and ensure consistent results. References: https://help.salesforce.com/s/articleView?id=sf.process_which_tool.htm &type=5 https://trailhead.salesforce.com/en/content/learn/modules/business_process_automatio n/automation_considerations

Person Account cannot be disabled is something that the administrator should consider before enabling Person Accounts. Person Accounts are a special type of accounts that allow storing information about individual people who are not associated with an organization or business account. Once Person Accounts are enabled, they cannot be disabled or removed from the org without contacting Salesforce support

To use outbound change sets, a user needs to have the Create and Upload Change Sets permission on their profile or permission set. This permission allows users to create change sets in a sandbox or Developer Edition organization and upload them to another organization. References: https://help.salesforce.com/s/articleView?id=sf.changesets_create_upload_perm.htm &type=5

To add a user to an opportunity team, you need Edit access on the account associated with the opportunity and either own the opportunity or be above the owner in the role hierarchy. References: https://help.salesforce.com/s/articleView?id=sf.teams_adding.htm &type=5

A session security level is a setting that determines how secure a user’s session is based on factors such as their login method, their IP address, their browser, or their device. Administrators can configure different session security levels for different user profiles and assign different actions or permissions to each session security level.

Multi-factor authentication (MFA) is a feature that requires users to verify their identity using two or more factors of authentication when they log in to Salesforce, such as their username and password plus a verification code or an app-generated token. MFA can enhance the security of user sessions and prevent unauthorized access.

If an administrator recently implemented MFA with a standard security level selected and is receiving cases that users are unable to log in, they should check the session security level required at login on the user profile. This setting determines what session security level users need to have when they log in based on their profile. If this setting is higher than the standard security level, users may not be able to log in with MFA alone and may need additional factors of authentication. References: https://help.salesforce.com/s/articleView?id=sf.security_sessions.htm &type=5 https://help.salesforce.com/s/articleView?id=sf.identity_mfa.htm &type=5

An entitlement process is a feature that allows you to define and enforce service-level agreements (SLAs) for your customers based on certain criteria and timelines. An entitlement process consists of milestones and actions that represent required steps and time limits for resolving customer issues. You can use entitlement processes to track if your support team is meeting your SLAs and provide consistent service quality to your customers. In this case, you can set up and configure entitlement processes for different types of cases and assign them to accounts or contacts based on their service contracts or warranties. References: https://help.salesforce.com/s/articleView?id=sf.entitlements_overview.htm &type=5 https://help.salesforce.com/s/articleView?id=sf.entitlements_proce ss.htm&type=5

The Dev Console Log Inspector is a tool that allows you to view and analyze debug logs in a graphical interface. Debug logs contain information about database operations, system processes, and errors that occur when executing a transaction or running unit tests. To troubleshoot a process builder, the administrator should look for event types beginning with FLOW in the event column. These event types indicate the start and end of a flow interview, as well as any flow elements, faults, or decisions that occur during the execution. References: https://help.salesforce.com/s/articleView?id=sf.code_dev_console_log_inspector.htm &type=5 https://help.salesforce.com/s/articleView?id=sf.code_debug_log_event_types.htm &type=5

Salesforce Authenticator is an app that adds an extra layer of security for logging into Salesforce by requiring users to verify their identity using their mobile device after entering their username and password on Salesforce login page. To see how many users have successfully used Salesforce Authenticator since it was rolled out, an administrator can use two methods:

A) Create a new view In Identity Verification History, specifying Method.

Identity Verification History is a tool that shows information about each identity verification event for users in your org, such as the date and time, the verification method used, the IP address, and the status of the verification. By creating a new view in Identity Verification History and specifying the method as Salesforce Authenticator, an administrator can see how many users have used the app to verify their identity when logging in. References: https://help.salesforce.com/s/articleView?id=sf.identity_verification_history.htm &type=5

D) Export Login History and filter based off of Authentication Method Reference.

Login History is a tool that shows information about each login attempt for users in your org, such as the date and time, the username, the source IP address, the login type, and the status of the login. By exporting Login History as a CSV file and filtering based on the Authentication Method Reference column, an administrator can see how many users have used Salesforce Authenticator as their authentication method when logging in. References: https://help.salesforce.com/s/articleView?id=sf.monitoring_login_history.htm &type=5

The issue is that the Company field is being populated on B2C Leads, which is causing the Lead Conversion Layout to only display Business Account record types. To correct this, the administrator should use a validation rule to ensure that the Company field is blank on B2C Leads. This will prevent the Lead Conversion Layout from displaying Business Account record types and will allow the administrator to select the B2C Customer record type.

To ensure that sales reps’ managers can view records containing customer’s credit information but their colleagues cannot, NTO should grant access using hierarchies via the sharing settings. This option allows users above another user in the role hierarchy to have access to records owned by or shared with users below them in the hierarchy. References: https://help.salesforce.com/s/articleView?id=sf.admin_sharing.htm &type=5

Identity Verification History stores up to 20,000 records of users’ identity verification attempts for various features that require MFA, such as logging in from an unknown browser or device, resetting a password, or changing personal information. The data is stored for up to 6 months and then deleted automatically. Therefore, if a user has been inactive for more than 6 months or if there are more than 20,000 records in total, their data may be missing from Identity Verification History. References: https://help.salesforce.com/articleView?id=sf.identity_verification_history.htm &type=5

A summary report with a cross-filter is a type of report that allows you to summarize data by grouping rows and columns and applying filters based on related objects and fields. A cross-filter is a filter that lets you include or exclude records in your report based on related objects and their fields. In this case, you can create a summary report that includes a cross-filter to the Account object with a sub-filter for credit card number equal to null. This will show you all B2C accounts that are missing the credit card number, regardless of whether it is encrypted or not. References: https://help.salesforce.com/s/articleView?id=sf.reports_summary_charts.htm &type=5 https://help.salesforce.com/s/articleView? id=sf.reports_cross_filters.htm&type=5

A primary account relationship is a feature that allows you to link a contact to a single account as its primary account. A primary account relationship is required on a contact regardless of the page layout settings or the contact to multiple accounts feature. This means that you cannot remove the primary account from a contact, but you can change it to another account. You can also add secondary accounts to a contact if you have enabled the contact to multiple accounts feature. References: https://help.salesforce.com/s/articleView?id=sf.contacts_multiple_accounts.htm &type=5 https://help.salesforce.com/s/articleView?id=sf.contacts_fields.htm &type=5

To limit data exports, especially for sensitive information, Export Data Settings in Salesforce are specifically designed to control user access to export data. These settings allow administrators to restrict who can export data from Salesforce, helping to protect sensitive information like bank accounts and Personal Identifiable Information (PII).

Export Data Settings:

Salesforce provides administrators with the ability to manage permissions related to data export functions. This includes restricting access to tools like Data Export, Data Loader, and Report Exports.

By limiting these permissions, administrators can control which users are allowed to export data, thereby reducing the risk of sensitive data, such as PII, being exported by unauthorized individuals.

This is particularly useful for ensuring that only designated roles or users can export data, as per the organization’s data security policies.

Specific Use Case for Sensitive Information:

In a scenario where the focus is on preventing unnecessary access to sensitive information, Export Data Settings directly target the ability to export data and can be customized based on the security needs of the organization.

By disabling or limiting export permissions for specific profiles or roles, AW Computing can better manage the risk associated with handling sensitive data.

Incorrect options:

Salesforce Platform Encryption: While it protects sensitive data at rest by encrypting fields and files, it does not control export capabilities or prevent users from exporting data.

Salesforce Shield: This suite includes event monitoring, encryption, and audit trail features, which enhance security but do not specifically limit export permissions.

Muted Permission Sets: These are used to restrict permissions in permission set groups but are not designed to manage or limit data export capabilities directly.

In conclusion, Export Data Settings offer the most precise control over data export capabilities in Salesforce, making it the best solution to meet the security department's requirement.