Sharing-and-Visibility-Architect Salesforce Certified Sharing and Visibility Architect (SU24) Questions and Answers

According to this source, Apex managed sharing is the best way to share records based on complex logic that can’t be handled by declarative sharing. In this case, the architect can use Apex code to create a trigger on the Job Interview object that will create a share record for the interviewer user when the lookup field is populated. The other options are not feasible or scalable.

The two reasons that the architect should consider regarding the use of Apex sharing reasons are A and B. Option A allows the developer to more easily troubleshoot programmatic sharing, as they can identify which sharing records are created by which Apex code. Option B prevents the share record from being deleted upon ownership change, as Apex sharing reasons are not subject to recalculation by Salesforce. The other options are either incorrect or irrelevant.

Updates to child records that have the same parent records being processed simultaneously in separate transactions and updates to parent records and their child records being processed simultaneously in separate threads may pose a risk of producing locking errors. These situations may cause concurrency issues and result in record locking exceptions. Updates to parent and child records being processed in the same batch or synchronously in the same thread are less likely to cause locking errors as they are processed sequentially.

Using a trigger on Case to lookup and share to the manager of an Assigned Agent custom field using Apex Managed Sharing would allow the HR representative to control the visibility of the case based on the subject of the complaint. Criteria-based sharing rules cannot be used to exclude a specific user from seeing a record. Changing the owner of the case would affect other aspects of data visibility and security.

Creating a protected custom metadata type that stores the encryption key and packaging it with its associated records in a managed package is the best way to securely store the confidential key, as protected custom metadata types are only accessible within the package namespace and cannot be viewed or modified by subscribers2. Creating a protected custom metadata type and packaging it in an unlocked package will not work, as unlocked packages do not support protected custom metadata types3. Creating a custom metadata type and restricting access to the admin profile will not work, as users with View Setup permission can still view the custom metadata type and its records.

To support the requirements with the minimum amount of effort, three platform security features that are required are criteria-based sharing rules, role hierarchy, and permission sets. Criteria-based sharing rules can be used to share all accounts with the custom field “Kay Customer” to all senior account managers based on a filter condition. Role hierarchy can be used to grant access to accounts that users or their subordinates own based on the ownership and role level. Permission sets can be used to grant view and edit access to the custom field that contains sensitive information to the three designated users, regardless of their user groups or profiles

The expected behavior if a user without FLS accesses the VF page is that the field is automatically removed from the page. This is because apex:outputField respects FLS settings and will not render any field that the user does not have read access to. The user will not encounter any error, see the output field, or enter any value into the phone field

The two options that the Architect should consider when designing the solution are B and D. Option B ensures that the national accounts are only visible to the sales directors and above in the role hierarchy, as they inherit access from the owner. Option D ensures that the sales reps who are added to the opportunity team for a national account can access the account data, as they are granted access through implicit sharing

The sharing access options if OWD is Public Read Only are Read and Read/Write3. These are the options that you can choose when creating sharing rules or manual sharing for an object that has Public Read Only as its organization-wide default access level3. Public Read Only means that all users can view all records, but only the owners and users above them in the role hierarchy can edit those records.

The best practice for testing sharing and visibility changes is to use the login as feature for a sample user in each role and profile. This allows the tester to see exactly what the user can see and do in the org, and verify that the sharing settings are working as expected. The other options are either not comprehensive or not relevant.

Profile-based login hour restrictions and profile-based IP restrictions are two features that Salesforce provides for restricting login access to the application. These features allow administrators to specify when and from where users can log in to Salesforce based on their profiles. Role-based IP restrictions and organization-wide login hour restrictions are not valid features in Salesforce.

Content delivery is a feature that allows users to share files with customers and protect them with a password. Setting up an experience cloud site would require additional configuration and licensing. Utilizing an AppExchange product would introduce a dependency on a third-party solution.

The two different approaches that the architect should consider when designing this enhancement are A and B. Option A ensures that the custom account team object data is consistent with the standard account team member object data, which is used for implicit sharing. Option B ensures that the account share object, which stores the sharing records for accounts, is updated based on the custom account team object data. The other options are either not necessary or not possible.

A new AccountShare record is created with Row Cause as “Manual” and Access Level as “Read/Write” when Paul manually shares the record with John. This record grants John edit access to the account owned by Paul. Option B is incorrect, since an existing AccountShare record is not updated, but a new one is created. Option C is incorrect, since the Row Cause is not “Owner”, but “Manual”. Option D is incorrect, since an existing AccountShare record is not updated, but a new one is created.

The employees who will have access to the NewWorld account are A, Bob and Phil. Bob will have access because he is above Phil in the role hierarchy, and Phil will have access because he is the new owner of the account. Richard and Kevin will not have access because they are not related to Phil by role or account team, and Karen will not have access because she has moved to a new role and lost her manual sharing access.

To give users in the partner user role access to all Case and Container records owned by any user at the same distributor, an Architect can give super user permission to the individual partner users. Super user permission allows partner users to access data owned by other partner users belonging to the same account or below them in the role hierarchy. Creating an ownership-based sharing rule will not work, as it will share records based on the owner’s role or territory, not their account. Creating sharing sets will not work, as they are only available for Customer Community licenses, not Partner Community licenses. Creating a Permission Set granting “View All” permission to Case and Container records will not work, as it will give access to all records in those objects, regardless of their owner or account.

 Deferred Sharing Recalculation allows the admin to postpone the recalculation of sharing rules until a later time, which can improve performance and avoid locking issues when changing role hierarchy or ownership. Parallel Sharing Rule Recalculation allows the admin to run multiple sharing rule recalculations at the same time, which can also improve performance and reduce downtime. Granular Locking enables finer-grained locking for certain operations that affect large data sets, such as bulk loading or updating. These features can help avoid problems when reorganizing roles and reassigning account owners. Therefore, the answer B, C, and E are correct and the other options are incorrect

 Account records can be accessed due to implicit sharing from Opportunity and Account records can be accessed due to role hierarchy are two reasons that could be causing this issue. Implicit sharing grants access to parent records when a user has access to a child record. For example, if a user has access to an opportunity, they also have access to its related account and contract records. Role hierarchy grants access to records owned by or shared with users who are below in the hierarchy. For example, if a user is above another user in the role hierarchy, they can access any records that the lower user can access. Option A is incorrect, since contact records cannot be accessed due to implicit sharing from account, as implicit sharing does not grant access to child records. Option C is incorrect, since contact records cannot be accessed due to implicit sharing from opportunity, as implicit sharing does not grant access to child records.

Reviewing the user provisioning process to not automatically create a user role for any new user and contacting Salesforce support and requesting to increase the number of users’ roles allowed are two recommendations that could solve this problem. Salesforce has a limit on the number of roles that can be created in an organization, which depends on the edition and the number of licenses. If this limit is reached, no more roles can be created unless the limit is increased by Salesforce support. Therefore, it is not advisable to create a new role for every new user, as this would quickly exhaust the limit and cause the “User Role Limit Exceeded” error. Option B is incorrect, since removing role hierarchy from Salesforce org and controlling the record access using Apex managed sharing would be a complex and custom solution that would not address the root cause of the problem. Option D is incorrect, since creating an Apex class to replace the User Roles by generic one as soon as they are created would be unnecessary and inefficient.

The best way to troubleshoot this issue is to view Field Accessibility in the Object Manager. This will allow the admin to see how the field-level security settings affect the visibility of the field for different profiles and record types. The other options are not helpful, because:

Reviewing changes to Account record types will not show why a field has disappeared from the Account page, unless the field is dependent on a record type that has been deactivated or modified.

Logging in as user and checking several Accounts will not isolate the problem records, because the issue is related to field visibility, not record access.

Running a Who Sees What report will not help, because this report only shows how sharing settings affect record access, not field visibility.

The field has been configured for encryption, which might cause it to not show up on the list of available fields for creating a criteria-based sharing rule. Encrypted fields are not available for sharing rules, as they may contain sensitive data that should not be exposed. Option B is incorrect, since the architect does not need permission to Compliance fields to create a sharing rule. Option C is incorrect, since the architect’s profile does not need field-level security for this field to create a sharing rule. Option D is incorrect, since fields with validation rules are available for sharing rules.

The architect can design the solution to federate user setup to the partners by assigning delegated external administrators at each partner and allowing external users to self-register. A delegated external administrator is a user who can create and manage users in their own partner account. This way, the partners can have more control over their seasonal workers and reduce the administrative burden on UC. Allowing external users to self-register is another way of simplifying user creation and management for partners, as they can enable their workers to create their own accounts and log in to the community. Granting the Modify Users permission to the partner managers is not a good practice, as it would give them too much power over all users in the org. Creating a permission set giving Read/Write to the User object to partner manager is also not advisable, as it would expose sensitive user data and allow unauthorized changes.

Lead and Case are two objects that support creating queues. Queues are used to route records to a group of users who share workloads. Queues are available for standard objects such as Lead and Case, and custom objects that have a queue-supported lookup field. Option A is incorrect, since Account does not support creating queues. Option B is incorrect, since Opportunity does not support creating queues.

Profiles and Permission Sets can be used to control the object-level and field-level access for different types of users. For example, sales reps can have read/write access to Account object but not to the segment field, while service reps can have read-only access to Account object and all fields. Role Hierarchy can be used to control the record-level access for users based on their position in the organization. For example, sales managers can access and modify any account of reps reporting to them, while service managers can access and modify any account regardless of ownership. Field-Level Security can be used to override the profiles and permission sets for specific fields on specific records. For example, service managers can edit the segment field on any account, even if their profile does not allow it. Therefore, the answer D is correct and the other options are incorrect3

 Adding the product specialist and solution engineer to the opportunity team is the optimal way for the junior account manager to share the opportunity, given the private sharing model. Opportunity teams are groups of users who work together on sales opportunities. Adding users to an opportunity team grants them access to the opportunity and related records. This way, the junior account manager can collaborate with the product specialist and solution engineer on the complex deal, and when the account is reassigned to a senior account manager, the opportunity team members will retain their access. Option A is incorrect, since manual sharing on the opportunity would be removed when the account owner changes. Option C is incorrect, since manual sharing on the account would not grant access to the opportunity, as it does not roll up from account to opportunity. Option D is incorrect, since creating an owner-based sharing rule would be unnecessary and inefficient.

 A sharing set is the best way to share cases with customer community users based on a common account. Sharing sets are available for Customer Community licenses and can grant access to related records using predefined criteria1. Option A is incorrect, since writing an Apex class to create manual shares for these users would be complex and unnecessary. Option B is incorrect, since criteria-based sharing rules are not available for customer community users. Option D is incorrect, since upgrading the licenses to Customer Community Plus would be costly and not required in this scenario

Creating a Share Group based on the sharing set created for the Customer Community User Profile is the best way to give support representatives access to Container and Case records owned by Customer Community users. Share Groups are groups of users who have access to records based on a sharing set. Sharing sets are settings that grant community users access to records that have a lookup relationship to their user record1. Creating an ownership-based sharing rule, creating a criteria-based sharing rule, and relying on the role hierarchy are not options that can achieve the same result.

The two options to propose a solution to meet the requirements are Scheduled Apex job to remove access and Opportunity team to share opportunities with sales managers. Scheduled Apex job allows developers to run Apex code at a specified time, which can be used to revoke the sharing access after two weeks. Opportunity team allows users to grant access to other users who work on the same opportunity1. Apex Sharing and Sharing Rules are not suitable options because they do not support automatic expiration of sharing.

Price books are a way to store different prices for products that can be added to opportunities. Price books can have different organization-wide defaults (OWD) settings that control the baseline level of access for users. To allow only specific branch staff to sell high risk products, the architect can recommend setting the price book OWD to View Only and sharing the high risk price book with the trained staff via manual sharing or sharing rules. Manual sharing allows the owner or anyone with Full Access to a record to share it with another user or group of users. Sharing rules allow the admin to automatically grant access to records based on certain criteria. Therefore, the answer A and C are correct and the other options are incorrect.

The Grant Access Using Hierarchies option on Shipment Sharing Settings allows users above the owner in the role hierarchy to have the same level of access as the owner. If this option is disabled, the role hierarchy will not grant access to the Shipment records, even if it is configured correctly. Therefore, the answer A is correct and the other options are incorrect

Apex sharing is a way to programmatically grant access to records for users or groups of users. Apex sharing can be used to share records with Customer Community Plus users, who are not supported by other declarative sharing options such as sharing sets or sharing rules. Apex sharing uses the Account__Share table to store the sharing information for the Account object. Therefore, the answer A is correct and the other options are incorrect

 Partner super user is the only feature that supports the requirement of granting specific community users (agents) to view cases submitted by other agents of the same distributor. Partner super users are community users who can access and edit data owned by other partner users in their account. They can also access reports and dashboards that display data from their account1. Permission set to grant community admin permission, delegate external user, and partner community admin are not features that can achieve the same result.

The license recommendation that will meet distributor needs is Partner Community. Partner Community licenses are designed for users who are not employees of UC, but are part of their partner ecosystem, such as distributors, resellers, or suppliers. Partner Community users can access standard CRM objects such as accounts, contacts, leads, opportunities, cases, and campaigns. They can also collaborate with other partners and UC employees using Chatter and Communities. Sales Cloud licenses are for internal sales users who need full access to standard CRM and custom objects. Customer Community Plus licenses are for high-volume customers who need access to standard CRM objects and custom objects, but not opportunities. Customer Community licenses are for low-volume customers who need access only to custom objects and a subset of standard CRM objects.

 Ownership-based sharing rules are a way to grant access to records based on the record owner’s role or public group membership. Ownership-based sharing rules can be used to share records with Partner Community users, who are not supported by sharing sets. In this case, ownership-based sharing rules can be used to share Case and Container records owned by partner managers and partner users with other partner managers at the same distributor. Therefore, the answer D is correct and the other options are incorrect .

The architect can configure the system to support the requirements by using a sharing rule. A sharing rule is a declarative way of extending record access to users or groups of users based on criteria such as ownership, role, or field values3. In this case, the architect can create a sharing rule that grants read or read/write access to all records owned by customer community users to UC users in the customer support role. A sharing set is used to grant access to community users based on a common account or contact, not to internal users. A share group is used to share records with groups of community users who have Customer Community Plus or Partner Community licenses, not with internal users. Apex sharing is used to programmatically share records when declarative sharing cannot fulfill complex requirements, but it is not necessary in this case.

The runAs() method can be used to verify the enforcement of a user’s record sharing, which determines what records they can view and edit. Option A is incorrect, since public group assignments are not enforced by runAs(). Option B and C are incorrect, since field-level security and permissions are not affected by runAs()

The architect can achieve this requirement by using a permission set. A permission set is a collection of settings and permissions that give users access to various tools and functions3. The architect can create a permission set that grants edit access to the flag field on the case object, and assign it to the users who are assigned as case assessors. Object permissions control the access level that users have to records, not fields. A custom lightning component is not necessary for this requirement, as it can be done declaratively. Field-level security controls the visibility of fields on page layouts and reports, not the editability.

Master-Detail relationships enforce the sharing and security settings of the parent object on the child object. This means that if a user has access to an Account record, they will also have access to any Invoice records that are related to that Account. To prevent this, the architect can recommend replacing the Master-Detail relationship with a Lookup relationship, which allows the child object to have its own sharing and security settings independent of the parent object. Then, the architect can remove the Invoice access from the unauthorized profiles or use other mechanisms such as sharing rules or permission sets to restrict or grant access to the Invoice object. Therefore, the answer C is correct and the other options are incorrect

Granular locking is an advanced tool that Salesforce can enable for large-scale role hierarchy realignments. Granular locking allows finer-grained locking for certain operations that affect large data sets, such as bulk loading or updating. Granular locking can reduce the locking time and avoid performance issues when changing role hierarchy or ownership. Therefore, the answer C is correct and the other options are incorrect

The most likely reason why some users cannot see the accounts shared with the public group is that their profiles do not have access to the account object. Sharing rules and public groups cannot grant access to an object that is not enabled by the profile. Option A is incorrect, since permission sets do not control record status. Option B is incorrect, since the role hierarchy does not affect sharing rules. Option D is incorrect, since page layouts do not affect visibility

 Using the IsUpdateable() Apex method to test each field prior to allowing updates is the best way to fix this problem. This method returns true if the user has permission to edit a specific field on a specific object, and false otherwise. Option A is incorrect, since putting the code in a class that uses the With Sharing keyword would not affect field-level security permissions, but rather record-level access based on sharing rules. Option C is incorrect, since using the with SECURITY_ENFORCED keyword in the SOQL statement would not prevent updates on fields that are read-only for certain profiles, but rather enforce field- and object-level data protection. Option D is incorrect, since adding with Sharing keyword to the class would have the same effect as option A.

A sharing set is the best way to share cases with partner users based on a common account. Sharing sets are available for Partner Community licenses and can grant access to related records using predefined criteria1. Option A is incorrect, since changing the external OWD to public read only would give access to all cases to all partner users, not just the ones related to their account. Option B is incorrect, since sharing rules are not available for partner users. Option C is incorrect, since the role hierarchy does not apply to partner users

The territory with the highest territory type priority is automatically assigned to the opportunity when an account meets criteria for multiple territories4. Option A is incorrect, since creating a process builder process to update the territory field on the opportunity would be unnecessary and complex. Option C is incorrect, since creating an Apex class that implements Filter-Based Opportunity Territory Assignment would be an advanced and custom solution that is not required in this scenario. Option D is incorrect, since creating a criteria-based sharing rule on the opportunity to assign it to a territory would not work, as sharing rules do not assign territories5.

 Creating a specific Sharing Reason for the custom object is the best way to make sure that users that gained access to a custom object do not lose access to it when its owner is changed. Sharing Reasons are labels that identify why users or groups have access to records. They are used in Apex managed sharing, which allows developers to programmatically create and maintain sharing rules1. Using ‘‘runAS’’ system method in Apex classes to enforce record visibility, creating a new record in_Share object with RowCause ‘‘Manual’’, and using ‘‘With Sharing’’ keyword to make sure record visibility will be considered are not ways to prevent losing access when the owner changes.

The OWD for pricebook should be set to Use, which means that users can only view and use price books that are shared with them. This way, sales agents can have access to products and create opportunities for their customers. Option A is incorrect, since Public Read Only would give access to all price books to all users. Option B is incorrect, since Public Read Write would give access and edit rights to all price books to all users. Option C is incorrect, since View is not a valid OWD setting for pricebook.

Cloning the Sales Rep profile, adjusting settings, and assigning the pilot users the new profile is the optimal way to grant only this Sales Reps access to the new functionality, while hiding it from other users. This way, the pilot users can have different permissions and access than the other Sales Reps who are not part of the pilot. Option B is incorrect, since revoking access to legacy function in the Sales Rep profile and creating a permission set for the new functionality would affect all Sales Reps, not just the pilot users. Option C is incorrect, since creating a permission set to grant access to the new functionality and hide the old functionality would not work, as permission sets cannot revoke access. Option D is incorrect, since creating new user records for the pilot user that they will use for the pilot would be unnecessary and inefficient.

 Searching for external users is the community functionality that is impacted by having the customer user visibility turned off. When customer user visibility is turned off, community users cannot find or interact with other community users in global search, people search, or chatter. Option B is incorrect, since updating their user profile is not affected by customer user visibility. Option C is incorrect, since creating new customer community users is not affected by customer user visibility. Option D is incorrect, since searching for internal users is not affected by customer user visibility.

Deleting the public link is the best way to ensure that the potential customers do not have access to the file after the meeting. Renaming the file, deleting the file, or moving the file to another folder will not affect the public link, which will still point to the file

 By default, three roles are created when the first external user is created on a partner account. These roles are Executive, Manager, and User. They form a role hierarchy that determines the level of access to data for the partner users

The most likely cause of this problem is that the sales rep was manually removed from the Opportunity team. This would revoke the access to the opportunity record that the sales rep was helping with. The other options are not valid causes, because:

The Account team does not affect the Opportunity team members, unless the account owner changes and the opportunity owner is set to match2.

The Opportunity team is specific to each opportunity record, so removing the sales rep from one opportunity team does not affect the access to another opportunity record of the same account3.

The opportunity owner cannot enable/disable if the “Default Opportunity team” is able to access the record. The default opportunity team is a template that can be applied when creating or editing an opportunity, but it does not override the existing opportunity team members.

According to this source, users with access to a child case have read-only access to the parent account by default, and owners of a parent account have access to child opportunities by default. The other options are not implicit record access mechanisms.

Named Credentials, Protected Custom Metadata, and Protected Custom Settings are three options to secure the credentials for the external system. They allow the developer to store the credentials in a secure way that is not exposed to other users or packages. Storing the credentials in a custom object using encrypted fields or in the apex code are not secure options

Creating and customizing Reports and Report Folders and Manage Reports in Public Folders are two permissions that are required to accomplish this task, as they allow users to create reports and folders and share them with other users or groups. Editing My Reports is not a permission that is required to accomplish this task, as it only allows users to edit reports in their personal folders. Creating Report Folders is not a permission that exists in Salesforce.

Implementing a third-party proxy server is the best technology to achieve the requirement of accessing on-premise information from Salesforce. A proxy server acts as an intermediary between Salesforce and the on-premise database, and it can handle authentication, encryption, and data transformation. Option A is incorrect, as tokenization is a technique to replace sensitive data with tokens, not to access on-premise data. Option B is incorrect, as it does not specify how Salesforce can connect to the on-premise database. Option D is incorrect, as Salesforce Shield is a set of tools to enhance data security and compliance in Salesforce, not to access external data sources.

 Two options that Universal Health has to maintain compliance are updating the field type of each of the 12 fields to “Text (Encrypted)” so that they are encrypted at rest, and enabling Salesforce Platform Encryption and selecting the 12 contact fields to be encrypted. Both options allow Universal Health to encrypt PII data while it is at rest in Salesforce, and keep the fields accessible in Salesforce. The difference is that text (encrypted) fields have some limitations, such as not being searchable, filterable, or reportable, while platform encryption fields have fewer limitations but require additional licenses and setup

Using Apex Managed sharing in a case Trigger that shares the record to the user identified in the Legal SME field is the best way to grant a lawyer access to a specific case when their assistance is needed, as it allows the case owner to dynamically share the case with a specific user based on a custom field value1. Creating a Criteria Based Sharing Rule that shares to the Corporate Legal Team Role when the ‘’legal assistance needed? Field is checked will not work, as it will share the case with all users in that role, not just the lawyer in the Legal SME field. Creating a Criteria Based Sharing Rule that shares to the Legal Public Group when the ‘’legal assistance needed?’’ field is checked will not work, as it will share the case with all users in that group, not just the lawyer in the Legal SME field.

According to this source, if an object is set to Controlled by Parent in its organization-wide default settings, then access to its records is determined by the parent record. In this case, since Case object has View All permission for service reps, they will be able to access all contact records related to those cases, regardless of their ownership or sharing rules. However, they will not be able to access all account records, since account object has Private OWD and no other sharing mechanism is mentioned. The other options are not correct.

Creating a reusable SOQLQueries class without specifying “With” or “Without Sharing” on the class or specifying “With Sharing” or “Without Sharing” on the methods are two ways to meet the requirements. The sharing mode of the class or method will depend on the context of the calling code, which can be either “With Sharing” or “Without Sharing”. Option B is incorrect because the runAs() method is only available in test methods and does not change the sharing mode. Option D is incorrect because it requires creating two separate classes for different sharing modes, which is not reusable.

 Using a visualforce override or a custom LWC override for Opportunity view action will require additional development and maintenance, and may not be compatible with all devices. The best option is to use Dynamic Form to define different field sections applicable for different form factors of devices, as Dynamic Form is a declarative feature that allows admins to customize record detail pages without writing code.

To troubleshoot why staff members can see accounts that they do not own and should not have access to after a change in the role hierarchy, the architect should log in as one of the staff members, navigate to a sample account, and use the sharing button to determine who has access. The sharing button shows all the reasons why a user has access to a record, such as role hierarchy, sharing rules, manual sharing, teams, etc. The architect can then identify which sharing mechanism is causing the issue and fix it accordingly

 To mitigate the risks of import failures associated with large-volume bulk data loads, two options that can help are deferring sharing calculation and grouping records by ParentID within a batch. Deferring sharing calculation allows the data load to complete without triggering any sharing recalculation, which can be done later when the system is less busy. Grouping records by ParentID within a batch ensures that all child records of the same parent are in the same batch, which reduces the chances of locking errors

The side effect of granting opportunity access to sales reps on the same team using ownership-based sharing rules is that all sales reps will have Read access to all accounts. This is because ownership-based sharing rules are based on the role or territory of the owner of the record, and they grant access to both the record and its parent account. Therefore, if a sharing rule grants Read access to opportunities owned by users in a certain role or below, it also grants Read access to the accounts of those opportunities4. Sales reps on the same team will not have Edit access to the accounts for opportunities owned by their peers, as sharing rules only grant Read or Read/Write access, not Edit access. Sales reps on the same team will not have Read access to the accounts for opportunities owned by their peers only, as sharing rules grant access to all accounts in the specified role or below, not just their peers. All sales reps will not have Read access to accounts for all opportunities, as sharing rules only grant access to accounts for opportunities owned by users in a certain role or below, not all opportunities.

 The Sharing button will appear on the Defect page layout if the sharing model is either Private or Public Read Only. This is because these are the only two settings that allow manual sharing of records. If the sharing model is Public Read/Write or Public Read/Write/Transfer, then manual sharing is not possible and the Sharing button will not appear

Using a lightning component as an override for the “Edit” action on mobile view would allow field consultants to capture images while editing the case record, without affecting the desktop users. Using a lightning component as an override for the “Edit” action on lightning experience would affect both mobile and desktop users, which is not desirable. Creating a separate button for “Edit in Mobile” would require additional customization and user training.

The three options that can change the owner of the opportunity are B, C, and E. The current opportunity owner can transfer the ownership to another user by editing the record or using the change owner button. The system administrator or a user with the “Transfer Records” permission can also change the owner of any record, regardless of the sharing settings. Someone above the opportunity owner in the role hierarchy can also change the owner, as they have full access to the records owned by users below them in the hierarchy. The other options are either incorrect or not possible.

 The optimal solution for an architect to recommend is to grant super user access to the lead agents as part of the community user setup. Super user access allows community users to access records that they do not own within their account or role hierarchy. This way, the lead agents can see the opportunities for all of the other agents at the dealer without changing the organization-wide defaults or creating any sharing rules

Public groups are used to grant access to a set of users who do not have a predefined relationship in the role hierarchy or territory hierarchy. Sharing sets are used for community users, not internal users. Role hierarchy is used to grant access based on the user’s position in the organization.

Setting the Field Level Security for the Date of Birth field to be Visible to Customer Support Rep Profile, and set the Date of Birth Field Visible and Read-only to Banking Rep profile is the best approach to meet this requirement, as it allows admins to control who can see and edit a specific field on an object. Creating a Validation rule in the Data of Birth field so the rule returns true only when user.profilename matches Customer Support Rep will work, but it will require additional logic and error handling. Adding Date of Birth field to the Search layout of the Contact Object and modifying the Page layout assigned to Customer Support Rep and adding Date of Birth field as Required will not work, as it will only affect how the field is displayed and searched, not who can edit it.