Free Salesforce Platform Administrator II practice questions

Question 1

Cumulus Financial uses Sales Territories (formerly Enterprise Territory Management). A sales operations analyst who has no admin rights must create and edit account assignment rules for the active model, working in Setup. Which three permissions does the analyst need? Choose 3 answers.
A. View All Records on Account
B. Manage Territories
C. View Setup and Configuration
D. Modify All Data
E. Manage Profiles and Permission Sets

Accepted Answer

Correct answer: A. View All Records on Account | B. Manage Territories | C. View Setup and Configuration
Creating or editing account assignment rules requires View All Records on Accounts and Manage Territories, plus View Setup and Configuration or Customize Application; Setup-based territory operations that need Manage Territories also need View Setup and Configuration. Modify All Data is far broader than the job needs and isn't required. Manage Profiles and Permission Sets lets a user edit profiles and permission sets, which isn't part of creating territory assignment rules.

Question 2

At Northern Trail Outfitters, the Quote Approver permission set is included in three permission set groups: Sales Manager, Deal Desk and Regional Director. The release manager adds Read access to a new Discount Reason field to the Quote Approver permission set. Which users receive the new field access?
A. Only users assigned the Quote Approver permission set directly, until each group is edited to include the change
B. Users assigned the permission set directly and users assigned any of the three permission set groups that include it
C. Only users of the first permission set group that the Quote Approver permission set was added to by an administrator
D. No users, because a permission set can't belong to more than one permission set group at a time in the same org

Accepted Answer

Correct answer: B. Users assigned the permission set directly and users assigned any of the three permission set groups that include it
A permission set can be included in more than one permission set group, and updates to a permission set propagate to every group that includes it, so users assigned any of the three groups receive the field access once the groups recalculate, along with users assigned the set directly. No group needs editing to pick up the change. Groups aren't ranked by the order in which the set was added. The claim that a permission set can belong to only one group contradicts the documented behavior.

Question 3

Universal Containers uses Contacts to Multiple Accounts. Sales operations wants to capture more detail on each account-contact relationship and asks the admin what can be customized on the Account Contact Relationship object. Which two customizations can the admin make? Choose 2 answers.
A. Create a custom action on the object that updates fields on the relationship record.
B. Create two record types so that board relationships and employment relationships use different picklist values.
C. Add a lookup field to a custom Board Seat object to record which seat the contact holds on the account's board.
D. Turn on field history tracking for the Roles field so changes to a contact's role on the account are audited.
E. Add a custom picklist field for the best time to call and put it on the relationship page layout.

Accepted Answer

Correct answer: A. Create a custom action on the object that updates fields on the relationship record. | E. Add a custom picklist field for the best time to call and put it on the relationship page layout.
Custom fields can be added to the Account Contact Relationship object to capture details such as the best time to call, except for unsupported types like lookup, master-detail, roll-up summary and long or rich text areas. Custom actions specific to the object are supported if they update records or invoke components, though they can't create records. A lookup field to a custom object is one of the unsupported field types. Record types and field history aren't supported on this object, so neither can be used.

Question 4

Employees at Get Cloudy Consulting log in through SAML single sign-on, and the identity provider makes every employee complete MFA. The admin set the Manage Connected Apps session security level policy to require High Assurance, and admins who signed in through SSO are now asked by Salesforce to verify their identity again when they open App Manager. The security officer wants the identity provider's MFA to count. What should the admin do?
A. Change the policy action from raising the session level to blocking, so admins aren't prompted again in App Manager.
B. Have the identity provider include the SessionLevel attribute with the value HIGH_ASSURANCE in the SAML assertions it sends.
C. Add the identity provider's IP addresses to the trusted IP ranges so that SSO sessions are treated as High Assurance.
D. Assign the admins the Waive Multi-Factor Authentication for Exempt Users permission so the policy skips them.

Accepted Answer

Correct answer: B. Have the identity provider include the SessionLevel attribute with the value HIGH_ASSURANCE in the SAML assertions it sends.
SAML logins default to a Standard session security level, but the identity provider can set the level with the SessionLevel attribute in the assertion, using STANDARD or HIGH_ASSURANCE, so sending HIGH_ASSURANCE lets the policy pass without another challenge. Trusted IP ranges affect identity verification at login and don't change a session's security level. The MFA waiver permission doesn't exempt users from session security level policies, and after MFA enforcement it no longer exempts users at all. Switching to Block would deny admins access to App Manager instead of accepting the identity provider's MFA.

Question 5

Bloomington Caregivers uses a custom org theme in Themes and Branding. The admin is building a Visit Scheduling Lightning app and wants it to show its own logo and navigation bar color even though the org theme is active, and only users with the Scheduler profile should see it in the App Launcher. Which two settings should the admin configure for the app in App Manager? Choose 2 answers.
A. Select the option to override the org theme with the app's brand image and navigation bar color.
B. Assign the app to the Scheduler profile in the app's user profile assignments.
C. Create and activate a second custom theme in Themes and Branding with the scheduling colors.
D. Clear the Visible in Lightning Experience checkbox for every profile except the Scheduler profile.
E. Add the app's logo to a utility bar item so it shows at the bottom of each scheduling page.

Accepted Answer

Correct answer: A. Select the option to override the org theme with the app's brand image and navigation bar color. | B. Assign the app to the Scheduler profile in the app's user profile assignments.
From the App Settings tab in the Lightning App Builder, reached by editing the app in App Manager, an admin can override the org theme with the app's brand image and navigation bar color and manage the user profiles that the app is assigned to. Activating a different org theme would rebrand every app for every user, not just the scheduling app. The Visible in Lightning Experience column applies to Classic apps and isn't a per-profile control. A utility bar holds productivity tools like Notes and Recent Items and isn't where app branding is set.

Question 6

Cumulus Financial tracks field history on the Custodian Bank field of its custom Client Portfolio object. Custodian Bank is an optional lookup to the custom Custodian object with the default Clear the value of this field option. After a custodian record was deleted, dozens of portfolios show a blank Custodian Bank, but their history related list shows no change for that field. The compliance officer asks why. What should the administrator explain?
A. Field history tracking doesn't support lookup relationship fields, so changes to Custodian Bank are never recorded.
B. The history entry is written only after the custodian is purged from the Recycle Bin, so it appears within 15 days.
C. When the parent record in a lookup relationship is deleted, field history on the child doesn't record that change.
D. The entry was suppressed because the user who deleted the custodian didn't have edit access to those portfolios.

Accepted Answer

Correct answer: C. When the parent record in a lookup relationship is deleted, field history on the child doesn't record that change.
Salesforce documents that if the parent record in a lookup relationship is deleted, field history tracking for the child record doesn't record the deletion, so the blanked lookup leaves no history entry. Lookup fields can be tracked, so ordinary edits to Custodian Bank are recorded. No delayed history entry is written when the Recycle Bin is purged. The deleting user's access to child records doesn't decide whether history is written.

Question 7

Ursa Major Solar's installers use the Site Survey record page on phones and desktops. When the admin runs Analyze for the phone form factor, the page scores poorly because twelve components are visible when it loads, but office staff on desktop need all twelve. The admin must improve the phone experience without removing anything from the desktop view or building a second page. What should the admin do?
A. Switch the page to a template that doesn't support the phone form factor, so Analyze skips the phone assessment and installers get the desktop layout.
B. Rebuild the four heaviest components as custom Lightning web components, because Analyze includes only standard components in the phone score.
C. Run Analyze in a full sandbox instead, because sandbox metrics exclude mobile sessions and give a more representative score for the page.
D. Add a Device visibility filter so several components show only on desktop, since desktop-restricted components aren't included in the phone assessment.

Accepted Answer

Correct answer: D. Add a Device visibility filter so several components show only on desktop, since desktop-restricted components aren't included in the phone assessment.
Salesforce recommends a maximum of eight visible components on a phone page and suggests hiding extra components for mobile with a visibility filter; components restricted to the desktop form factor through a visibility rule aren't included in the phone performance assessment, so desktop users keep everything. Choosing a template without phone support doesn't fix the experience, because phone analysis is available only for templates that support the phone form factor and the page would no longer serve phone users. Analyze assesses visible standard and custom components alike, so rebuilding components as custom ones doesn't remove them from the score. Sandbox metrics can differ from production, but they don't exclude mobile sessions and wouldn't change what installers experience.

Question 8

Bloomington Caregivers plans a partial copy sandbox where outside contractors will test a new scheduling app. Testers need production record volumes and relationships, but patient names, phone numbers and addresses must never be readable in that sandbox. Data Mask & Seed is available in the org. What should the senior administrator recommend?
A. Use Data Mask & Seed, which replaces the legacy Data Mask package, to mask the patient fields in the sandbox
B. Encrypt the patient fields with Shield Platform Encryption before refreshing, so the copied values are unreadable
C. Remove field-level security for the patient fields in the sandbox and rely on contractors not changing profiles
D. Mark the patient fields as Restricted in Data Sensitivity Level so the sandbox copy excludes those values

Accepted Answer

Correct answer: A. Use Data Mask & Seed, which replaces the legacy Data Mask package, to mask the patient fields in the sandbox
Data Mask & Seed is the current core app that replaces the legacy Data Mask managed package, which becomes read-only on December 31, 2026, and masking replaces sensitive values in the sandbox while production stays untouched (the legacy package's documentation describes masking as sandbox-only and irreversible). Encryption protects data at rest, but users with field access still see decrypted values, so contractors could still read patient data. Field-level security in a sandbox depends on who administers that sandbox and does not change the underlying data. Data Sensitivity Level is a label and does not exclude data from a sandbox copy.

Question 9

Get Cloudy Consulting's release manager learns that Salesforce is enforcing several security controls, including MFA for all employee users and step-up authentication for report actions, and that the published enforcement dates have moved more than once. Some sales reps log in with SSO and have never registered a Salesforce MFA method. How should the release manager prepare so that access isn't disrupted? Choose 2 answers.
A. Track the Security-Related Product Updates article and Release Updates in Setup instead of relying on one fixed date
B. Wait for the first lockouts in production, then switch MFA off for affected users from the Release Updates page
C. Upload a custom Health Check baseline that marks MFA as optional, which exempts the org from the enforcement
D. Have reps register a Salesforce MFA method, since a non-Salesforce SSO method can't be used for step-up auth
E. Remove the reports tab from rep profiles, because step-up authentication applies only to users with that tab

Accepted Answer

Correct answer: A. Track the Security-Related Product Updates article and Release Updates in Setup instead of relying on one fixed date | D. Have reps register a Salesforce MFA method, since a non-Salesforce SSO method can't be used for step-up auth
Salesforce's Security-Related Product Updates article is an evolving roadmap whose change log shows enforcement dates moving, so following it alongside Release Updates is safer than planning around one date. The article also states that users who log in with SSO and a non-Salesforce MFA method cannot use it for step-up authentication; they need a Salesforce MFA method or a verification code by phone or email. Waiting for lockouts and then turning MFA off is not a documented option and would leave users locked out. A custom Health Check baseline only changes how the org is scored, not what Salesforce enforces. Step-up authentication is tied to viewing and exporting reports, not to whether a profile shows the reports tab.

Question 10

Ursa Major Solar's Products category group is All Products > Inverters > Hybrid Inverters > HX-200. Inverters also has a child String Inverters, and All Products has a child Batteries. A support agent who can see every category filters the knowledge base by Hybrid Inverters. Which articles does the filter return?
A. Only articles classified exactly as Hybrid Inverters, because a category filter matches a single category in the group.
B. Articles in Hybrid Inverters and HX-200 only, because a category filter adds a category's children but never its parents.
C. Articles in Hybrid Inverters, its parents and its sibling String Inverters, because siblings share the parent Inverters.
D. Articles in Hybrid Inverters, HX-200, Inverters and All Products, but none in String Inverters or Batteries.

Accepted Answer

Correct answer: D. Articles in Hybrid Inverters, HX-200, Inverters and All Products, but none in String Inverters or Batteries.
Filtering by a category is expansive: it returns articles in that category, its children and its parents up to the top level, so Hybrid Inverters, HX-200, Inverters and All Products all appear. Sibling and cousin categories such as String Inverters and Batteries are excluded. A filter is never limited to the exact category or to its children only. Siblings are the one relative the filter deliberately leaves out.

Question 11

Cloud Kicks has Chatter turned on and the site case feed enabled for its Aura customer site, so customers see case posts and case emails in one feed. An agent working in the Agentforce Service Console (formerly Service Console) accidentally published an internal email about a refund exception, and the customer can now see it in the site case feed. The support manager wants the email kept on the case for the internal record but removed from the customer's view. What should the agent do?
A. Delete the email from the case, because emails in the site case feed can't be hidden from external users once published.
B. Use the case feed action in the console to hide the published email from external users, which keeps it on the case.
C. Turn off the site case feed in the site's settings so that external users stop seeing any emails on their cases.
D. Change the customer's access to the case to Read Only, so posts and emails added before the change are hidden.

Accepted Answer

Correct answer: B. Use the case feed action in the console to hide the published email from external users, which keeps it on the case.
Site Case Feed lists what agents can do once the feed is enabled, including exposing or hiding a published post or email in the site case feed of external users, so the agent can hide this email while it stays on the case for internal users. Deleting the email loses the internal record the manager wants to keep, and hiding it is supported. Turning off the site case feed changes the experience for every site user and every case instead of fixing one email. Lowering the customer's case access doesn't change which feed items external users see; visibility of a single published item is controlled by exposing or hiding it.

Question 12

Bloomington Caregivers runs Enterprise Edition. Its billing system holds about 80 million invoice rows that change throughout the day. Front-desk staff occasionally need to see a patient account's latest invoices on the account record, and IT refuses to copy invoice data into Salesforce because it goes stale. What should the senior administrator recommend?
A. Load the invoices nightly into a custom object with Data Loader and add that object as a related list on the account page layout.
B. Store the invoices in a custom big object that an integration refreshes every hour and show it on the account with a related list.
C. Buy Salesforce Connect, define an external data source for the billing system and relate the resulting external object to the account.
D. Schedule the Data Import Wizard to refresh a custom Invoice object every morning so the account page shows that day's invoices.

Accepted Answer

Correct answer: C. Buy Salesforce Connect, define an external data source for the billing system and relate the resulting external object to the account.
Salesforce Connect, an extra-cost add-on in Enterprise Edition, maps external objects to tables in the external system and reads the data on demand and in real time, which Salesforce recommends when the data set is large, users need small amounts at a time and they want the latest values. A nightly Data Loader copy into a custom object is the traditional ETL approach the stem rules out, because it copies data that quickly becomes stale. An hourly big object refresh still copies the data into Salesforce and would lag behind the billing system. The Data Import Wizard cannot be scheduled, and a daily refresh would still be a stale copy.

Question 13

At AW Computing, the custom Inspection object has a lookup to the custom Facility object. The operations director wants a report built on a custom report type (created in the legacy custom report type builder) with Inspection as the primary object, where each inspection row also shows its facility's Region and Site Manager fields. Inspections without a facility must still appear. What should the senior admin do?
A. Add Facility as a related object B in the report type with the may-or-may-not relationship option selected.
B. Use Edit Layout on the report type and choose Add fields related via lookup to add the Facility fields.
C. Build a joined report with an Inspection block and a Facility block that share Facility Name as a common field.
D. Add a cross filter of Inspections with Facilities and then add Region and Site Manager as subfilters on that cross filter.

Accepted Answer

Correct answer: B. Use Edit Layout on the report type and choose Add fields related via lookup to add the Facility fields.
In the legacy builder, Add fields related via lookup in the report type's field layout lets you bring in fields from an object that the primary object looks up to, without adding that object as a related object in the report type. Related objects in a custom report type are added as children of the object above them, and Facility is the lookup parent of Inspection, not its child. A joined report shows blocks side by side, not facility values on each inspection row. Cross filters include or exclude records; they don't add columns, and subfilters only refine the filter.

Question 14

Get Cloudy Consulting deployed an inbound change set to production that contains a record-triggered flow, which is active in the UAT sandbox. After deployment, the flow exists in production but doesn't run, and its new version is inactive. Which two actions should the senior administrator take? Choose 2 answers.
A. Activate the deployed flow version in production, because an active flow in a change set deploys as inactive.
B. In production, enable the setting that deploys new versions of processes and flows as active for later releases.
C. Add every version of the flow to a cloned change set so that the active version is carried along with the others.
D. Deactivate and reactivate the flow in the sandbox, then upload again so the change set captures its active status.
E. Redeploy the same inbound change set, because a second deployment of a flow keeps the version that is already active.

Accepted Answer

Correct answer: A. Activate the deployed flow version in production, because an active flow in a change set deploys as inactive. | B. In production, enable the setting that deploys new versions of processes and flows as active for later releases.
Salesforce states that an active flow in a change set is deployed as inactive and must be activated manually, and that production orgs can enable a setting to deploy a new active version of a process or flow through change sets or Metadata API. A change set can include only one version of a flow, so adding every version isn't possible. Toggling activation in the sandbox doesn't change how the flow deploys. Redeploying a flow creates another version in the destination and doesn't activate it.

Question 15

Get Cloudy Consulting has three record-triggered flows, on Project, Milestone and Timesheet, that must all block a save with the same message when the record's Billing Code is retired. To keep the check in one place, the admin plans an autolaunched subflow that looks up the code and contains a Custom Error element. What should the senior admin recommend?
A. Keep the Custom Error element in the subflow, because an error raised by a subflow is passed up to the triggering record's save.
B. Move the check into a screen flow with a Custom Error element, and call that screen flow from each of the three record-triggered flows.
C. Have the subflow return an output value saying whether the code is retired, and put a Custom Error element in each record-triggered flow.
D. Replace the three flows with one schedule-triggered flow that uses a Custom Error element to stop saves of records with retired codes.

Accepted Answer

Correct answer: C. Have the subflow return an output value saying whether the code is retired, and put a Custom Error element in each record-triggered flow.
The Flow Types page states that a Custom Error element can be added only in a record-triggered flow, and the Record-Triggered Automation decision guide notes that CustomError isn't available in all flow types, including subflows. So the reusable subflow can do the lookup and return a result, while each record-triggered flow raises its own Custom Error. A screen flow can't be called from a record-triggered flow, because autolaunched flows can't reference screen flows. A schedule-triggered flow runs later on a batch of records, so it can't stop a save that is happening now.

Question 16

An administrator at Get Cloudy Consulting is building a record-triggered flow on Project, optimized for fast field updates, to set the Risk Score field on the triggering record. The administrator planned to call an existing invocable Apex action but cannot add an Action element to the flow. The score can be expressed as a formula from fields on the Project. What should the administrator do?
A. Change the flow to run after save, call the invocable Apex action there, and then update the triggering Project with an Update Records element.
B. Calculate the score with a formula resource and an Assignment element inside the before-save flow, which updates the record without another save.
C. Wrap the invocable Apex action in an autolaunched flow and call that flow from a Subflow element inside the fast field update flow.
D. Add an asynchronous path to the fast field update flow and call the invocable Apex action from that path once the record is saved.

Accepted Answer

Correct answer: B. Calculate the score with a formula resource and an Assignment element inside the before-save flow, which updates the record without another save.
Invocable actions are available only in after-save flows, and fast field update flows support only the Assignment, Decision, Get Records and Loop elements, so neither an Action nor a Subflow element can be added. The decision guide says same-record updates should use native elements in a before-save flow (or a before-context Apex trigger), so a formula and an Assignment is right. Moving to after-save and updating the same record adds a second DML operation that re-runs the save order. Asynchronous paths are not available on flows optimized for fast field updates.

Question 17

An admin at Cloud Kicks reviews a debug log for a single edit to an Order. The log shows the before-save flow, the Apex before update trigger and every custom validation rule on Order running twice. The only other automation is an after-save record-triggered flow that uses an Update Records element to set the order's own Fulfillment Status field. What is the cause?
A. The after-save flow's update to the triggering order starts a second save, which runs the save automation again; setting the field in a before-save flow avoids that.
B. Custom validation rules always run twice in Lightning Experience, once when the page sends the record to the server and again just before the commit.
C. The before-save flow and the Apex before trigger each run once for the old values and once for the new values on every update.
D. The debug log repeats every before-save event for each after-save flow on the object, even though the automation itself runs only once.

Accepted Answer

Correct answer: A. The after-save flow's update to the triggering order starts a second save, which runs the save automation again; setting the field in a before-save flow avoids that.
When an after-save flow updates the record that triggered it, it issues a new DML operation, and that second save re-runs the save order, including before-save flows, before triggers and validation rules. The Record-Triggered Automation decision guide recommends before-save updates for same-record field changes because they avoid a second DML operation and a recursive save cycle. Validation rules don't run twice by design in Lightning Experience. Before automation doesn't run separately for old and new values. The log is not duplicating entries: it is recording real repeated execution.

Question 18

Sales reps at AW Computing click Submit for Approval on some opportunities and see an error instead of starting a review, while the same button works on other opportunities. The org has three active classic approval processes on Opportunity. Which explanation should the administrator check first?
A. The opportunity is already locked by another approval process, and classic approval processes always unlock it again before the next process starts.
B. The record meets no active approval process's entry criteria, or the rep is not an allowed submitter for any process that it meets.
C. The approval processes on Opportunity have the same process order, so Salesforce cannot decide which one to start and returns an error.
D. The reps lack the Manage Flow permission, which classic approval processes require from submitters when more than one process is active.

Accepted Answer

Correct answer: B. The record meets no active approval process's entry criteria, or the rep is not an allowed submitter for any process that it meets.
Limits and Considerations for Classic Approval Processes explains that users cannot see which approval process their submission triggers, and Salesforce displays an error if the record does not meet the entry criteria of any process or the user is not an allowed submitter. The documented causes of this error are the entry criteria and the allowed submitters, not the process order or a lock from another process. Submitting a record for a classic approval does not require Manage Flow.

Free Salesforce Platform Administrator II
Practice Questions

What is the Platform Administrator II exam like?

Questions by exam section

Security and Access

Question 1 · Harder · Choose 3

Question 2 · Easier

Question 3 · Medium · Choose 2

Question 4 · Harder

Objects and Applications

Question 5 · Easier · Choose 2

Question 6 · Medium

Question 7 · Harder

Auditing and Monitoring

Question 8 · Easier

Question 9 · Harder · Choose 2

Cloud Applications

Question 10 · Easier

Question 11 · Medium

Data and Analytics Management

Question 12 · Easier

Question 13 · Easier

Environment Management and Deployment

Question 14 · Medium · Choose 2

Process Automation

Question 15 · Harder

Question 16 · Harder

Question 17 · Medium

Question 18 · Easier

Where to go after these 18 questions

Get Platform Administrator II exam updates by email

Ready for a full Platform Administrator II practice exam?

Free Salesforce Platform Administrator IIPractice Questions