ADM-201 · Question #5
Ursa Major Solar's default, organization-wide sharing for accounts is set to public read/write. The administrator needs to ensure that marketing never modifies an account record. Which action should…
The correct answer is B. Remove edit access on accounts from the custom marketing profile. To prevent marketing users from modifying Account records while the organization-wide default is public read/write, the administrator should remove the edit access on the Account object from the marketing users' profile.
Question
Ursa Major Solar's default, organization-wide sharing for accounts is set to public read/write. The administrator needs to ensure that marketing never modifies an account record. Which action should the administrator take to accomplish this goal?
Options
- ASwitch organization-wide default sharing to public read only.
- BRemove edit access on accounts from the custom marketing profile.
- CAssign a permission set to marketing users which removes edit permission.
- DSeparate the marketing role hierarchy from the sales role hierarchy.
How the community answered
(25 responses)- B92% (23)
- C4% (1)
- D4% (1)
Why each option
To prevent marketing users from modifying Account records while the organization-wide default is public read/write, the administrator should remove the edit access on the Account object from the marketing users' profile.
Switching organization-wide default sharing to 'Public Read Only' would restrict *all* users from editing accounts by default, necessitating additional grants for sales users who still need edit access, which is an unnecessary broader change for a specific group's restriction.
Profiles define the fundamental object-level permissions (Create, Read, Update, Delete) for users assigned to them. By removing the 'Edit' permission for the Account object from the custom marketing profile, marketing users will be prevented from modifying any Account records, irrespective of the organization-wide default settings.
Permission sets are used to *extend* permissions beyond what a profile grants; they cannot be used to *remove* or restrict permissions that are already granted by a user's profile.
Separating role hierarchies primarily impacts record visibility and access through sharing rules and data hierarchy, but it does not control object-level Create, Read, Update, Delete (CRUD) permissions for specific user groups.
Concept tested: Profile Object Permissions vs. OWD and Permission Sets
Source: https://help.salesforce.com/s/articleView?id=sf.users_profiles_object_perms.htm&type=5
Topics
Community Discussion
No community discussion yet for this question.