CRT-101 · Question #208
An analytics user at Cloud Kicks needs Read, Create, and Edit access for objects and Should be restricted from deleting any records. What should the administrator do to meet this requirement?
The correct answer is C. Create and assign a custom profile with Delete access removed for each object. A custom profile is required to grant specific object permissions while explicitly withholding Delete access, since profiles define the baseline CRUD permissions for a user.
Question
An analytics user at Cloud Kicks needs Read, Create, and Edit access for objects and Should be restricted from deleting any records. What should the administrator do to meet this requirement?
Options
- AAssign the standard System Administrator profile to the analytical user.
- BGive the user View all access and assign them to the highest role in the role hierarchy.
- CCreate and assign a custom profile with Delete access removed for each object.
- DCreate and assign a permission set that includes Read, Create, and Edit access
How the community answered
(56 responses)- A4% (2)
- B16% (9)
- C71% (40)
- D9% (5)
Why each option
A custom profile is required to grant specific object permissions while explicitly withholding Delete access, since profiles define the baseline CRUD permissions for a user.
The System Administrator profile grants full permissions including Delete access on all objects, which directly violates the requirement to restrict deletion.
View All access grants the ability to see all records regardless of sharing rules but does not control CRUD permissions like Delete, and the highest role in the hierarchy does not restrict object-level permissions.
Profiles define object-level permissions including Create, Read, Edit, and Delete. By creating a custom profile with Delete access unchecked for each relevant object and assigning it to the analytics user, the administrator enforces the exact permission set required - granting Read, Create, and Edit while preventing record deletion.
Permission sets can only add permissions on top of what a profile grants - they cannot remove or restrict permissions, so a permission set alone cannot prevent Delete access if the user's profile already allows it.
Concept tested: Custom profile to restrict Delete object permissions
Source: https://help.salesforce.com/s/articleView?id=sf.admin_userprofiles.htm&type=5
Topics
Community Discussion
No community discussion yet for this question.