Certified Sharing and Visibility DesignerDemo

Question

Cloud Kicks has several business partners that help fulfill products and needs to expose a web service to those partners.

Each business partner must be able to query Cloud Kicks’ Salesforce instance to obtain order statuses. In addition, every business partner must have access only to orders for which that partner is the fulfillment vendor.

The Architect does NOT want the business partners to use the standard APIs and prefers that a custom API be developed.

Which three design elements should the Architect consider to ensure the solution’s data security?

Choose three

A Create a custom Apex web service using the “With Sharing” keyword
B Give each partner their own Salesforce login set to API Enabled on the profile
C Create a custom Apex web service with a fulfillment ID input attribute
D Query the Orders object with Dynamic SOQL based upon the fulfillment ID
E Set the Orders object’s sharing settings to Private in the Org-Wide Defaults

Explanation

Apex declared with sharing applies the executing user’s record-level sharing rules. Giving each business partner a separate API-enabled Salesforce user establishes a distinct authenticated identity and sharing context. Setting Orders to Private as the organization-wide default establishes a least-privilege baseline, so access to each vendor’s orders must be granted selectively. A fulfillment ID supplied by the caller is a filter rather than authorization, and constructing Dynamic SOQL from it does not enforce tenant isolation.

Learn more

Certified Sharing and Visibility DesignerDemo

AstroTutor

Notes

Readiness

QuestionQ69

Community Discussion