Security and Access20% of the exam
Sharing model, folder access and territory visibility
Predict who can see and change a record from org-wide defaults, Controlled by Parent, the role hierarchy and sharing rules, then apply the same reasoning to price books, report, dashboard and email template folders, and Sales Territories access and permissions.
Given a scenario, determine the implications to record and field data access (Sharing model, controlled by parent, grant access by hierarchies, dashboard and report folders access, email folder access, Territory Management).
~8 min read · 20 practice questions ·
What the exam expects
- Predict record access from org-wide defaults, including Controlled by Parent for contacts, detail records and activities.
- Decide when Grant Access Using Hierarchies can be deselected and what that changes.
- Explain sharing rule behaviour: implicit account access, queues, lead conversion, criteria fields.
- Choose the price book default that hides or exposes price books.
- Diagnose report, dashboard and Lightning email template folder access.
- Configure Sales Territories record access and permissions.
Key terms: org-wide default (baseline access to others' records); Controlled by Parent (access follows the associated record); implicit sharing (a child rule also opening the account); Who Can Access (a folder's share entries); territory model (one complete territory structure).
Key facts
Sharing features vs default
- Detail
- Only add access; can't restrict below the default
Public Read/Write
- Detail
- Only the owner (and hierarchy) can delete or change sharing
Activity, Controlled by Parent
- Detail
- Editing needs edit on every associated record
Grant Access Using Hierarchies
- Detail
- Deselectable only on custom objects not Controlled by Parent
Sharing rule limit
- Detail
- 300 per object, up to 50 criteria-based or guest user
Criteria fields
- Detail
- No lookup, formula, encrypted or derived fields
Price book No Access
- Detail
- Hides price books; share manually with chosen users
Folder share entries
- Detail
- 25 in the UI, 500 via the folder sharing REST API
Email template folder creation
- Detail
- Create Folders for Lightning Email Templates permission
Territory contact and case access
- Detail
- Settable only when their internal default is Private
Sources for this section (8)
- OWD Overviewhelp.salesforce.com (opens in a new tab)
- OWD Access Settingshelp.salesforce.com (opens in a new tab)
- Set Internal OWDshelp.salesforce.com (opens in a new tab)
- Sharing Ruleshelp.salesforce.com (opens in a new tab)
- Sharing Rule Considerationshelp.salesforce.com (opens in a new tab)
- Share a Folderhelp.salesforce.com (opens in a new tab)
- Enable Template Foldershelp.salesforce.com (opens in a new tab)
- Territory Default Accesshelp.salesforce.com (opens in a new tab)
- Why does Controlled by Parent on Contact remove the need for separate contact sharing?
- When does a lead sharing rule stop giving access to the business it describes?
- When can a user see a report folder but still fail to open its reports?
- Which permissions does a non-admin need to create account assignment rules?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Platform Administrator II pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 29 lessons of the Platform Administrator II guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (20 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams