Encryption, Field Audit Trail and sandbox data masking
How to meet a compliance requirement for sensitive data: Field Audit Trail for long-term field history, Shield Platform Encryption (probabilistic or deterministic, with your own keys) alongside field-level security, data classification fields, and Data Mask & Seed for sandboxes.
Explain how to ensure sensitive data is set up to support a business/legal/compliance use case in production and sandbox environments.
~8 min read · 11 practice questions ·
What the exam expects
- Choose Field Audit Trail when field history must be kept beyond standard retention, and explain where archived history lives.
- Protect sensitive fields at rest with Shield Platform Encryption, pick probabilistic or deterministic encryption, and pair it with field-level security.
- Label fields with data classification metadata for compliance reporting.
- Keep production data unreadable in sandboxes with Data Mask & Seed (formerly the Data Mask managed package).
Key terms: Field Audit Trail (Shield add-on that keeps field history until deleted); FieldHistoryArchive (the big object holding archived history); deterministic encryption (a scheme that still allows filtering); tenant secret (org-specific key material you control); data masking (irreversibly replacing sensitive values in a sandbox).
Key facts
- Detail
- Shield or Field Audit Trail; Enterprise, Performance, Unlimited
- Detail
- 18 months in production; one month in sandboxes
- Detail
- HistoryRetentionPolicy, deployed with Metadata API
- Detail
- Neither tracking nor Field Audit Trail counts against data storage
- Detail
- Free in Developer Edition; sandboxes only after production is provisioned
- Detail
- Probabilistic; no filtering on encrypted values
- Detail
- Case-sensitive or exact-match case-insensitive, per field
- Detail
- All editions; labels only
- Detail
- Support ended July 9, 2026; read-only from December 31, 2026
- Detail
- Sandboxes only; irreversible
Sources for this section (6)
- Field Audit Trailhelp.salesforce.com (opens in a new tab)
- Shield Platform Encryptionhelp.salesforce.com (opens in a new tab)
- Deterministic Encryptionhelp.salesforce.com (opens in a new tab)
- Data Classificationhelp.salesforce.com (opens in a new tab)
- Data Mask Retirementhelp.salesforce.com (opens in a new tab)
- Data Mask (Legacy)help.salesforce.com (opens in a new tab)
- Why does an auditor not see three-year-old history on the History related list in an org with Field Audit Trail?
- When does archived field history stay unencrypted after Platform Encryption is turned on?
- Why does filtering on a probabilistically encrypted field fail?
- Which classification field records that a field falls under GDPR?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Platform Administrator II pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 29 lessons of the Platform Administrator II guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (11 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams