Encryption, Event Monitoring and transaction security policies
How to layer controls around PCI, PII and HIPAA data: data classification labels, Classic Encryption with masking, Shield Platform Encryption schemes and their tradeoffs, Event Monitoring and field history for evidence, and transaction security policies that block risky activity in real time.
Given a scenario, determine the appropriate access controls to protect sensitive data (e.g. PCI, PII, or HIPAA).
~8 min read · 19 practice questions ·
What the exam expects
- Combine controls for sensitive data: who may read it (field-level security, sharing), how it is stored (encryption), and what evidence and real-time enforcement exist (Event Monitoring, transaction security).
- Choose between Classic Encryption and Shield Platform Encryption, and between probabilistic and deterministic schemes, given filtering, uniqueness and licence constraints.
- Predict encryption tradeoffs: criteria-based sharing rules, sorting, unencrypted copies, field types that can't be encrypted.
- Pick Event Monitoring over field history when the question is who viewed data, and a transaction security policy when activity must be stopped as it happens.
- Explain what protects data in transit, at rest and once it leaves Salesforce.
Key terms: data classification (sensitivity and compliance labels on fields); Classic Encryption (encrypted custom text fields with masking); Shield Platform Encryption (encryption at rest by Database Encryption or field-level encryption); deterministic encryption (scheme that keeps encrypted data filterable); transaction security policy (conditions on a real-time event plus an action).
Key facts
- Detail
- Use field-level security and sharing to control who sees data
- Detail
- Enterprise, Performance, Unlimited with Shield or Shield Platform Encryption; free in Developer
- Detail
- Supports WHERE clauses, unique and External ID fields
- Detail
- Encrypted fields can't be used in criteria-based sharing rules
- Detail
- Currency and Number fields can't be encrypted
- Detail
- Encrypted text fields limited to 175 characters
- Detail
- 18 months (24 via API) without Field Audit Trail
- Detail
- Customize Application and Modify Transaction Security Policy
Sources for this section (7)
- Shield Platform Encryption Best Practiceshelp.salesforce.com (opens in a new tab)
- Shield Platform Encryption overviewhelp.salesforce.com (opens in a new tab)
- Filter Encrypted Data with Deterministic Encryptionhelp.salesforce.com (opens in a new tab)
- General Shield Platform Encryption Considerationshelp.salesforce.com (opens in a new tab)
- Classic Encryption for Custom Fieldshelp.salesforce.com (opens in a new tab)
- Field History Tracking Overviewhelp.salesforce.com (opens in a new tab)
- Build a Transaction Security Policy with Condition Builderhelp.salesforce.com (opens in a new tab)
- Why can't a Classic encrypted text field serve as an upsert key?
- When can encrypted values end up stored unencrypted?
- Which feature answers "who viewed this data and from where"?
- Why do partner users with View Encrypted Data still not see a Classic encrypted field?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Platform Sharing and Visibility Architect pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 21 lessons of the Platform Sharing and Visibility Architect guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (19 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams