Governance
What to know
Governance is about controlling change and access across the platform lifecycle. A candidate should understand application lifecycle management: development, testing, and production environments with controlled deployments, plus object security that limits who can modify or deploy. Know the role of administrators (system and application), groups for access control, and audit capabilities that record changes. Understand that governance includes both technical controls (security roles, deployment packages, environment separation) and process controls (review, approval, change management).
Traps
Questions often conflate who can deploy with who can edit. Editing an object and deploying it to production are separate permissions. Another trap: assuming production data is available in lower environments - environment separation exists precisely to prevent that. Watch for questions about object dependencies during deployment: an incomplete package is a governance failure, not just a technical one. Also be careful with questions implying a single admin role covers everything; system administration and application administration differ.
Rule of thumb
For any governance question, identify the control (who/what/where) and the lifecycle stage (build, test, deploy, run). The answer usually names the control at the right stage.
Worked example
A team wants only senior developers to push to production. The control is deployment permission on the application, granted to a specific group; editing remains open to all developers. Separating these two permissions satisfies the governance requirement without blocking development.