Salesforce Security Interview Questions for Admins (Part 5)

Salesforce Security Interview Questions check who can see and change what in your org, the topic interviewers care about most. This is Part 5 of our 25-part series, with questions on profiles, permission sets, sharing, auditing, encryption and single sign-on.

In Part 4, we covered Sales Cloud. Security mistakes can expose customer data, so expect deep follow-up questions here. For real situations, also see our security scenario questions.

How to Use These Salesforce Security Interview Questions

First, learn the layers: org access, object access, field access and record access. Next, explain each layer with one example from the Bright Path Tutors org. Then practise the “user cannot see a record” questions, because they come up in almost every interview. Our sharing guide is a good place to start.

Salesforce Security Interview Questions on The Security Model

Study with Profiles and Permission Sets.

1. What are the layers of the Salesforce security model?
2. What is the difference between object access and record access?
3. Define org-level security.
4. Why should you give the least access needed?
5. Which comes first: object access or record access?
6. Can sharing give access to an object the profile blocks?
7. Scenario: a new team needs access to one custom object only. Where do you start?
8. Scenario: an auditor asks you to explain your org security in two minutes. What do you say?

Profiles Questions

Study with Profiles and Permission Sets.

9. What is a profile?
10. What does a profile control?
11. How many profiles can a user have?
12. What is the difference between standard and custom profiles?
13. What is the Minimum Access profile?
14. Why does Salesforce recommend fewer profiles?
15. What are page layout assignments on a profile?
16. What are tab settings, and do they control record access?
17. Briefly, what are Read, Create, Edit, Delete, View All and Modify All?
18. What are View All Data and Modify All Data?
19. Can you edit a standard profile?
20. What is the System Administrator profile?
21. What are profile session settings?
22. Describe app visibility settings on a profile.
23. Scenario: twenty custom profiles differ by one checkbox each. How do you clean this up?
24. Scenario: a user can see the Account tab but gets an error opening a record. What do you check?

Salesforce Security Interview Questions on Permission Sets and Groups

Study with Permission Set Groups.

25. What is a permission set?
26. How many permission sets can a user have?
27. Can a permission set remove access?
28. What is a permission set group?
29. What is a muting permission set?
30. Define a permission set license.
31. What is a custom permission?
32. Can you set an expiry date on a permission set assignment?
33. What are User Access Policies?
34. How do you see all permissions a user has?
35. How do you compare two permission sets?
36. What is a session-based permission set?
37. What is the default permission set group status?
38. Scenario: junior agents need the same access as seniors, except Delete on cases. How do you build it?
39. Scenario: every new support hire needs four permission sets. How do you make it automatic?

Field-Level Security Questions

Study with Field-Level Security.

40. What is field-level security?
41. Where can you set field-level security?
42. What is the difference between hiding a field on a layout and with field-level security?
43. If a field is hidden by field-level security, can users find it in reports?
44. Can users see a hidden field in search results?
45. What does “Read-Only” field access mean?
46. How do you check which users can see a field?
47. Do formula fields follow field-level security?
48. Scenario: only two people in finance may edit the Fee field. How do you set it up?
49. Scenario: salary data shows in a report for the wrong people. What do you fix?

Salesforce Security Interview Questions on Organization-Wide Defaults

Study with Sharing Rules, Roles and OWD.

50. What are organization-wide defaults (OWD)?
51. What OWD options exist?
52. Briefly, what does Controlled by Parent mean?
53. What is Public Read/Write/Transfer?
54. What is Public Full Access?
55. Why are internal and external OWD separate?
56. Why should you start with the most restrictive OWD?
57. What happens when you change OWD on a large object?
58. What is the default external access for new objects?
59. Can you set OWD for a detail object in master-detail?
60. Scenario: reps should see only their own opportunities. Which OWD do you set?
61. Scenario: everyone should see courses, but only owners should edit them. Which OWD do you set?

Role Hierarchy Questions

Study with Role Hierarchy.

62. What is a role hierarchy?
63. How is a role different from a profile?
64. Can a user exist without a role?
65. What does Grant Access Using Hierarchies do?
66. Can you turn off Grant Access Using Hierarchies?
67. How many roles should you create?
68. What happens to access when a user changes role?
69. What are portal roles?
70. Scenario: managers must see their team deals, but not other teams. How do you design roles?
71. Scenario: two regional managers report to one director but must not see each other deals. What do you do?

Salesforce Security Interview Questions on Sharing Rules and Groups

Study with Queues and Public Groups.

72. What is a sharing rule?
73. What are owner-based and criteria-based sharing rules?
74. Can sharing rules restrict access?
75. What is a public group?
76. What can a public group contain?
77. How many sharing rules can an object have?
78. When do sharing rule changes apply?
79. What is guest user sharing?
80. What is a share group?
81. Define a guest user sharing rule.
82. Scenario: the Pune team needs read access to all Pune accounts. Which rule do you create?
83. Scenario: a sharing rule change is taking hours to apply. Why?

Manual, Team and Implicit Sharing Questions

Study with Account Teams.

84. What is manual sharing?
85. Who can share a record manually?
86. What happens to manual shares when the owner changes?
87. What are account teams?
88. Describe opportunity teams.
89. What is implicit sharing?
90. How do you see why a user has access to a record?
91. What is the Sharing Hierarchy button?
92. Scenario: a partner consultant must see one opportunity only. How do you do it?
93. Scenario: a user cannot see a record that a colleague can see. How do you troubleshoot?

Salesforce Security Interview Questions on Restriction and Scoping Rules

Study with Restriction Rules and Scoping Rules.

94. What is a restriction rule?
95. Which objects support restriction rules?
96. What is a scoping rule?
97. How is a scoping rule different from a restriction rule?
98. Do restriction rules affect reports and search?
99. Can a user with View All Data bypass a restriction rule?
100. Scenario: agents must see only cases from their region, even though OWD is Public Read Only. What do you use?
101. Scenario: a user sees a record in a report but not in a list view. What could cause it?

Delegated Administration Questions

Study with Delegated Administration.

102. What is delegated administration?
103. What can a delegated admin do?
104. Briefly, what can a delegated admin not do?
105. How do you limit which users a delegated admin can manage?
106. Scenario: a team lead must reset passwords for their team only. How do you set it up?
107. Scenario: regional leads want to create users but not change profiles. What do you allow?

Salesforce Security Interview Questions on Auditing and Monitoring

Study with Audit Trail and Event Monitoring.

108. What is Setup Audit Trail?
109. How far back does Setup Audit Trail go?
110. What is field history tracking?
111. How many fields can you track per object?
112. How long is field history kept?
113. What is Login History?
114. What is Event Monitoring?
115. Define Health Check.
116. What is Security Center?
117. What is Field Audit Trail?
118. Briefly, what is the Login Forensics feature, at a high level?
119. Scenario: a field value changed and nobody knows who changed it. How do you find out?
120. Scenario: Health Check shows a low score. What do you fix first?

Encryption and Data Protection Questions

Study with Platform Encryption and Data Mask.

121. What is Classic Encryption?
122. What is Platform Encryption?
123. Explain the difference between them.
124. What is a tenant secret?
125. What is data masking in sandboxes?
126. Why should you avoid storing full ID numbers like Aadhaar in a CRM?
127. Scenario: legal wants student phone numbers encrypted at rest. What do you check first?
128. Scenario: developers use a Full sandbox with real customer data. What do you do?

Salesforce Security Interview Questions on Single Sign-On and App Access

Study with Single Sign-On and External Client Apps.

129. What is single sign-on (SSO)?
130. What is an identity provider?
131. Define a Federation ID.
132. What is SAML?
133. What is OAuth, in simple words?
134. Describe External Client Apps.
135. Why are new connected apps disabled by default now?
136. Why should integrations use a dedicated integration user?
137. Scenario: staff must log in with their Microsoft account. What do you set up?
138. Scenario: a billing system needs read access to two objects only. How do you secure it?

Salesforce Security Interview Questions FAQ

Which security topic is asked most?

Record access: OWD, roles and sharing rules. Practise explaining why a user can or cannot see a record.

Do freshers get encryption questions?

Rarely in depth. Know what it is and when to use it, and spend more time on sharing.

Official Resources

• Data Security (Trailhead)
• Salesforce Platform Administrator Credential (Trailhead)

Quick Recap

• These Salesforce Security Interview Questions cover profiles, permission sets, OWD, roles, sharing, auditing and SSO.
• Learn the four access layers in order.
• Practise the “cannot see a record” troubleshooting steps.
• Each section ends with two scenario questions.
• Part 6 covers Service Cloud.

What’s Next?

Continue with the next part. Read Service Cloud Interview Questions for Salesforce Admins (Part 6).