Configuration and Setup15% of the exam
Org security controls, login restrictions and sessions
The org-level controls that protect logins and sessions and record who changed what: MFA and identity verification, trusted IP ranges versus profile login IP ranges, login hours, session settings, the Setup Audit Trail, Health Check and password policies, and why an agent user's access is a data-access question.
Explain the various organization Security Controls (for example: Identity verification, Setup Audit Trail, Login Hours, Session Settings, agent access).
~8 min read · 10 practice questions
What the exam expects
- Explain MFA and identity verification, and recover a user who lost their verification method without weakening security for others.
- Choose between trusted IP ranges (skip the challenge) and profile login IP ranges (deny other logins).
- Restrict when users can log in with profile login hours, and predict what happens when the window closes.
- Pick the session settings that limit the damage from an unattended or hijacked session.
- Use the Setup Audit Trail to answer "who changed this setting, and when".
- Read a Health Check score, and set password expiry, complexity and lockout.
- Explain what governs an agent's data access: the agent user's permissions and record access.
Key facts
Trusted IP ranges
- Detail
- No verification challenge inside the range; challenged outside
Profile login IP ranges
- Detail
- Logins from any other IP address are denied
Change network access
- Detail
- Requires Manage IP Addresses
Login hours
- Detail
- Set per profile, per day of the week
Login hours end mid-session
- Detail
- User can view the current page but can't take further action
Lock sessions to originating IP
- Detail
- Helps prevent session hijacking
Force logout on session timeout
- Detail
- Redirects the browser to the login page at timeout
Setup Audit Trail on screen
- Detail
- 20 most recent setup changes
Setup Audit Trail download
- Detail
- Complete history for the past 180 days
Health Check
- Detail
- Score against the Salesforce Baseline Standard or up to five custom baselines
Password policy defaults
- Detail
- Expire in 90 days, 8 characters, 3 remembered, 15-minute lockout
MFA per user
- Detail
- Multi-Factor Authentication for User Interface Logins permission
Lost verification method
- Detail
- Admin generates a temporary verification code
Agent user access
- Detail
- Profile, permission sets, field-level security and sharing
Sources for this section (8)
- Trusted IP Rangeshelp.salesforce.com (opens in a new tab)
- Login Hourshelp.salesforce.com (opens in a new tab)
- Session Settingshelp.salesforce.com (opens in a new tab)
- Setup Audit Trailhelp.salesforce.com (opens in a new tab)
- Health Checkhelp.salesforce.com (opens in a new tab)
- Password Policieshelp.salesforce.com (opens in a new tab)
- MFA Enforcementhelp.salesforce.com (opens in a new tab)
- Service Agent Accesshelp.salesforce.com (opens in a new tab)
- Why do you enter the same address in both fields to trust one IP address?
- What does a user experience when their login hours end while they're working?
- Which permission does an admin need to change the org's trusted IP ranges?
- When do you download the Setup Audit Trail instead of reading it on screen?
- In which time zone do login hours appear on the profile detail page, and in which on the Login Hours edit page?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Platform Administrator pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 28 lessons of the Platform Administrator guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Practice exams purchase adds inline bank questions and topic practice (10 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Choose guide-only, practice-only, or save $4 with both