I85PREP
⌘ K
Salesforce Advanced Admin study materials
Salesforce Advanced Admin study resources

Salesforce Advanced Admin practice questions

One question at a time. Build your Salesforce Advanced Admin understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security and Access

An administrator sets the organization-wide default for Opportunities to Private. Which record access does this baseline grant to internal users?

  1. Users can view, edit, and transfer every opportunity record.
  2. Users can view all opportunities but edit only the ones they own.
  3. Every internal user can view and edit all opportunity records.
  4. Users can view only the records they own or that are shared with them. Correct answer.

Explanation

A Private organization-wide default is the most restrictive internal baseline: it grants access only to the record owner and to anyone given access through the role hierarchy, sharing rules, teams, or manual sharing. Object permissions such as Read or Edit are required but do not widen record access on their own.

Question 2Security and Access

Which statement about profiles and permission sets is accurate for a single user?

  1. Permission sets replace the profile for all object-level permissions.
  2. A permission set can remove access that the assigned profile grants.
  3. A user holds one profile and can be assigned many permission sets. Correct answer.
  4. A user can hold several profiles, and their permissions combine additively.

Explanation

Each user has exactly one profile, which supplies the baseline permissions, and any number of permission sets, which only add permissions. Nothing in a permission set can subtract access granted by the profile.

Question 3Security and Access

A profile has login IP ranges that exclude the network a traveling user is currently on. What happens when that user tries to log in?

  1. The user is admitted with read-only access for that session.
  2. The login is rejected until an administrator adds the new IP range.
  3. The user must pass an identity verification challenge to continue. Correct answer.
  4. The user is forced to change the password before signing in.

Explanation

Login IP ranges restrict where credentials may be used, but logins from outside the range are not automatically blocked; Salesforce challenges the user to verify identity, typically with a code sent by email. Trusted IP ranges, by contrast, exempt users from such challenges.

Question 4Security and Access

At which level are password composition, expiration, and lockout settings configured?

  1. At the org level, applying to every user in the org. Correct answer.
  2. On each profile, so rules vary by user type.
  3. On each user record, so rules can differ per person.
  4. On each permission set, so rules follow job function.

Explanation

Password policies are org-wide and apply to every user regardless of profile or permission set assignments. Profiles can control login hours and login IP ranges, but they do not control password length, complexity, or expiration.

Question 5Security and Access

An object's organization-wide default is Public Read/Write, and a field on that object is hidden by field-level security. What is the result for a standard user?

  1. The user cannot open any records of that object.
  2. The user can view and edit all records but not that field. Correct answer.
  3. The user can edit the field through any permission set assignment.
  4. The user can view the field but only on records they own.

Explanation

Field-level security operates independently of record-level access: it hides the field even when the record itself is fully editable. Object permissions and organization-wide defaults decide which records and actions are available, while field-level security decides which fields appear.

Question 6Security and Access

Who can manually share a record with another user from the record's Sharing button?

  1. Only users holding a permission set with Modify All Data.
  2. The owner, users above the owner in the hierarchy, and admins. Correct answer.
  3. Only system administrators and delegated administrators.
  4. Any user in the organization who has read access to the object.

Explanation

Manual sharing is available to the record owner, to users above the owner in the role hierarchy when Grant Access Using Hierarchies is enabled, and to administrators. Delegated administrators gain this ability only when the related user permissions are delegated to them.

Question 7Security and Access

A user needs to edit a field that is read-only on the assigned profile. What is the recommended change?

  1. Set the organization-wide default for the object to Public Read/Write.
  2. Clone the profile, set the field to editable, and reassign the user.
  3. Assign a permission set that grants edit access to the field. Correct answer.
  4. Add the user to a public group that has edit access to the field.

Explanation

Field permissions granted by permission sets are additive with the profile, so a permission set granting edit on the field raises that user's access. Public groups carry no field permissions, and organization-wide defaults affect records rather than fields.

Question 8Security and Access

What does a record type control for a given object?

  1. Which records a user can view based on ownership and sharing.
  2. Which users may sign in during specified business hours.
  3. Which fields a user can see across every object in the org.
  4. Which picklist values and page layouts are available. Correct answer.

Explanation

Record types let one object support several business processes by exposing different picklist values and different page layouts per profile. Record access and field-level security are configured through sharing and profiles or permission sets instead.

Question 9Security and Access

A criteria-based sharing rule can share records with which of the following recipients?

  1. An individual user selected by name.
  2. A profile.
  3. A public group. Correct answer.
  4. A permission set.

Explanation

Sharing rule recipients are limited to public groups, roles, roles and internal subordinates, portal roles and subordinates, and territories in Enterprise Territory Management. Individual users, permission sets, and profiles cannot serve as sharing rule recipients.

Question 10Security and Access

An administrator clears the Grant Access Using Hierarchies option on a custom object. What is the effect?

  1. Managers stop inheriting records owned by subordinates. Correct answer.
  2. Users above the owner keep access only if they have Modify All Data.
  3. The role hierarchy keeps granting access, but only at read-only level.
  4. All sharing rules defined for the object are deleted.

Explanation

Grant Access Using Hierarchies controls whether users above a record owner in the role hierarchy inherit access to that record. When the option is disabled for an object, only the owner and explicit sharing mechanisms grant access.

Question 11Security and Access

What does a muting permission set do inside a permission set group?

  1. It hides the permission set group from the assignment list.
  2. It blocks assigned users from logging in outside their login IP range.
  3. It removes selected permissions granted by other sets. Correct answer.
  4. It prevents the profile from granting any object permissions.

Explanation

A permission set group aggregates the permissions of its member permission sets, and a muting permission set subtracts specific permissions such as a user permission or object permission. It does not affect profiles, authentication, or visibility of the group.

Question 12Security and Access

What is the purpose of a sharing set for an Experience Cloud site?

  1. It auto-assigns a permission set when a user registers.
  2. It replaces the organization-wide defaults for internal users.
  3. It lets external users see records owned by the site administrator.
  4. It shares records tied to the user's account or contact. Correct answer.

Explanation

Sharing sets grant partner or customer community users access to records associated with their account or contact, within the limits of the object's external organization-wide default. They never widen access for internal users.

Question 13Security and Access

Which setting establishes the record access baseline for users with external licenses?

  1. The Default External Access column in Sharing Settings. Correct answer.
  2. The login IP ranges on the external user's profile.
  3. The license type assigned to the user's profile.
  4. Sharing rules configured to a portal access level.

Explanation

Each object has separate internal and external organization-wide defaults, and external users start from the Default External Access value. Sharing rules, sharing sets, and manual sharing can extend that baseline but cannot reduce it.

Question 14Security and Access

An administrator wants a connected app to expose sensitive data only when the user authenticated recently, even if the standard session is still active. Which configuration achieves this?

  1. Enable login forensics for the connected app.
  2. Set the connected app's session timeout to zero seconds.
  3. Enable high assurance sessions in Session Settings. Correct answer.
  4. Add the user's network to trusted IP ranges.

Explanation

High assurance sessions require users to re-authenticate before reaching high-assurance resources and expire independently of the normal session. Connected apps and components can then require a high assurance session to be accessed.

Question 15Security and Access

An administrator must allow only users holding a specific permission set to authorize a connected app. Which configuration accomplishes this?

  1. Enable refresh token rotation for the connected app.
  2. Set the OAuth policy to All users may self-authorize and restrict by profile.
  3. Set Admin approved users are pre-authorized and assign the permission set. Correct answer.
  4. Enable IP relaxation on the connected app and add trusted ranges.

Explanation

The Admin approved users are pre-authorized OAuth policy means only users granted the connected app through a profile or permission set may authorize it. Self-authorize policies allow any user in the org to approve the app individually.

Question 16Security and Access

Which action is a delegated administrator able to perform?

  1. Delete user records permanently from the org.
  2. Modify organization-wide defaults and sharing settings for any object.
  3. Assign any profile in the org to any user record.
  4. Create and edit users in the roles and profiles assigned to them. Correct answer.

Explanation

Delegated administrators manage users only within the roles and profiles delegated to them, and only for the administrative permissions explicitly granted. Setup configuration such as sharing settings and organization-wide defaults stays with system administrators.

Question 17Security and Access

A profile has login hours from 09:00 to 17:00, and a user is actively working at 17:05. What happens?

  1. Nothing happens; the login hours apply only to new sign-ins.
  2. The user is switched to read-only mode until the next day.
  3. The user stays signed in but loses access to records.
  4. The user is logged out until the next allowed login window. Correct answer.

Explanation

Login hours restrict both when users may sign in and how long an active session may last, and Salesforce ends sessions when the allowed window closes. The user cannot sign in again until the next permitted window begins.

Question 18Security and Access

An administrator must retain field change history for ten years for compliance. Which feature should be used?

  1. The Setup Audit Trail.
  2. Field History Tracking configured on the object.
  3. Login History downloaded on a schedule.
  4. Field Audit Trail with a retention policy. Correct answer.

Explanation

Field Audit Trail extends field history retention up to ten years through a retention policy and historically tracked fields. Standard field history tracking retains data for a much shorter period, and the Setup Audit Trail records configuration changes rather than record data.

Question 19Security and Access

Public site guest users can read records of an object based on which combination?

  1. Sharing rules defined for portal roles.
  2. The role hierarchy position assigned to the guest user.
  3. Manual sharing entries created by the site's administrator.
  4. Guest profile object permissions plus external default access. Correct answer.

Explanation

Guest user access comes from the site's guest user profile, which supplies object and field permissions, together with the object's Default External Access setting. Guests have no role, cannot own records, and cannot receive manual sharing.

Question 20Security and Access

A developer must share records programmatically with a sharing reason that appears in the UI. Which approach is required?

  1. A validation rule on the record owner field.
  2. A permission set that grants Modify All Data to the recipients.
  3. A criteria-based sharing rule written in Apex.
  4. Apex managed sharing using a sharing reason. Correct answer.

Explanation

Apex managed sharing inserts rows into the object's Share object, and an Apex sharing reason labels those rows in the user interface. Criteria-based sharing rules are declarative, while validation rules and permission sets do not share individual records.

Question 21Security and Access

In Enterprise Territory Management, what happens when an account is assigned to a territory?

  1. The organization-wide default for accounts is bypassed for all internal users.
  2. The account and its opportunities are shared with territory members. Correct answer.
  3. Every territory member receives a permission set automatically.
  4. The account owner changes to the territory's top-level user.

Explanation

Territory assignment shares the account, and the related opportunities if enabled, with the users assigned to that territory at the access level defined in the territory model. Ownership and organization-wide defaults are unaffected.

Question 22Security and Access

Which access levels can a sharing rule grant to its recipients?

  1. Read Only or Read/Write. Correct answer.
  2. Modify All Data on the object.
  3. Full Access to each matched record.
  4. View All Data across the object.

Explanation

Sharing rules grant either Read Only or Read/Write on the matched records. Full Access, View All Data, and Modify All Data are not sharing rule access levels; the last two are user permissions that apply to all records of an object.

Question 23Security and Access

A user's profile includes Modify All Data, and the object's organization-wide default is Private. What record access does the user have?

  1. Access only to records they own or that have been shared with them.
  2. Access that overrides field-level security on every field.
  3. Access only when the default is Public Read/Write.
  4. Access to all records of objects they can access, ignoring sharing. Correct answer.

Explanation

Modify All Data is a user permission that lets the holder view, edit, and delete all records, bypassing organization-wide defaults and sharing rules. It does not grant access to objects for which the user has no object permission, and field-level security still applies.

Question 24Security and Access

An administrator encrypts a text field and needs exact-match filtering and uniqueness on it. Which encryption approach supports this?

  1. Field Audit Trail tracking.
  2. Classic encryption with a self-signed key.
  3. Probabilistic encryption.
  4. Deterministic encryption. Correct answer.

Explanation

Deterministic encryption produces the same ciphertext for the same input, which allows exact-match filters and unique or external ID constraints. Probabilistic encryption randomizes ciphertext, so filtering and uniqueness are unavailable for those fields.

Question 25Security and Access

What do restriction rules accomplish?

  1. They hide fields from users who lack field-level security.
  2. They prevent sign-ins from networks that are outside approved ranges.
  3. They block connected apps from calling the API.
  4. They limit which records a user group can see despite sharing. Correct answer.

Explanation

Restriction rules filter the records visible to specified users or groups out of the set they could otherwise see, without altering sharing itself. They cannot broaden access and do not affect field-level security or authentication.

Question 26Security and Access

An administrator wants to lock a user out after a set number of consecutive failed login attempts. Which configuration controls this behavior?

  1. Permissions assigned through permission sets
  2. Session settings in Setup
  3. Password policies in Setup Correct answer.
  4. Login IP ranges on the user's profile

Explanation

Password policies define the maximum number of invalid login attempts allowed before lockout, along with the lockout period, password complexity, and expiration rules. These settings apply org-wide rather than to a single user or profile.

Question 27Security and Access

A profile's Login IP Ranges list contains only a single corporate subnet. What does this produce for users assigned that profile?

  1. They bypass multi-factor authentication from any network.
  2. They can log in only from addresses inside that subnet. Correct answer.
  3. They must complete an identity verification challenge from any network.
  4. They are restricted to the subnet only when using the API.

Explanation

Login IP ranges on a profile restrict where users with that profile can authenticate; attempts from outside the listed ranges are denied. Trusted IP ranges are a separate concept and control whether a login verification challenge is required.

Question 28Security and Access

A group of auditors needs to read every record of a custom object regardless of sharing, but must not be able to change any of them. Which permission should be granted?

  1. View All Data
  2. View All Records Correct answer.
  3. Modify All Records
  4. Read on the organization-wide default

Explanation

View All Records grants read access to every record of that object regardless of organization-wide defaults and sharing, while leaving edit and delete rights to the object permissions. View All Data is broader because it applies across all objects and also permits exporting and running reports on all data.

Question 29Security and Access

A user is added to an account team with Read/Write access on the account but is not given opportunity access. The account has related opportunities owned by other users. What opportunity access does the team member have?

  1. No access to related opportunities by default. Correct answer.
  2. Read only on related opportunities, inherited from the account team membership.
  3. Read/Write on every related opportunity because they inherit it from the account team.
  4. Read/Write on related opportunities, but only for opportunities they personally own.

Explanation

Account team membership grants access to the account record only. Opportunity access must be granted explicitly through the Opportunity Access setting on the team member entry or through another sharing mechanism such as a sharing rule or role hierarchy.

Question 30Security and Access

An administrator removes a sensitive field from every page layout. Which statement about data exposure is accurate?

  1. The field is hidden from all users because layouts control visibility.
  2. Only users holding Modify All Data can view the field.
  3. The field becomes read-only for every user assigned those layouts.
  4. Users can still read it through reports and the API. Correct answer.

Explanation

Page layouts control only where a field appears in the user interface; they are not a security mechanism. Field-level security determines whether a user can view or edit a field across the UI, reports, list views, and the API.

Question 31Extending Custom Objects and Applications

A custom object must be deleted automatically when its related parent record is deleted. Which relationship type provides this behavior?

  1. Hierarchical
  2. External lookup
  3. Master-detail Correct answer.
  4. Lookup

Explanation

In a master-detail relationship the detail record cannot exist without its master, so deleting the master deletes its detail records. A lookup relationship leaves child records in place and only clears the lookup field.

Question 32Extending Custom Objects and Applications

Which field type stores a unique value from an external system and can be used to match records during a data import?

  1. Geolocation
  2. Text (Encrypted)
  3. Roll-up Summary
  4. External ID Correct answer.

Explanation

External ID fields are indexed fields that hold unique identifiers from external systems, so import tools and APIs can use them as match keys to update existing records. Other field types do not provide that matching behavior.

Question 33Extending Custom Objects and Applications

An admin wants a custom object to have its own tab in Lightning Experience. Which action is required?

  1. Create a permission set for the object
  2. Create a custom tab for the object Correct answer.
  3. Add the object to a page layout
  4. Create a custom report type for the object

Explanation

A custom object tab makes the object available from the navigation bar and is created from Setup under Tabs or from the object's settings. Layouts and permissions do not create a tab.

Question 34Extending Custom Objects and Applications

Which setting controls whether a user can edit the value of a field on a record, independent of page layout?

  1. Page layout
  2. Validation rule
  3. Field-level security Correct answer.
  4. Record type

Explanation

Field-level security determines read and edit access to fields for profiles and permission sets and overrides page layout settings. Page layouts control visibility and placement on the page but cannot grant edit access that field-level security denies.

Question 35Extending Custom Objects and Applications

Which field type calculates values from other fields on the same record at display time and cannot be edited directly?

  1. Roll-up Summary
  2. Formula Correct answer.
  3. Text
  4. Picklist

Explanation

Formula fields compute a value from other fields and expressions and are read-only to users. A roll-up summary aggregates child records rather than fields on the same record.

Question 36Extending Custom Objects and Applications

A junction object is used to implement which kind of data model relationship?

  1. A relationship between a custom object and an external data source
  2. A many-to-many relationship between two objects Correct answer.
  3. A self-relationship that links records of one object to each other
  4. A one-to-one relationship between two objects

Explanation

A junction object has two master-detail relationships, one to each of two objects, which creates a many-to-many relationship. It is not intended for one-to-one relationships or external data sources.

Question 37Extending Custom Objects and Applications

Which tool provides a drag-and-drop canvas for viewing and creating objects and relationships?

  1. Object Manager
  2. Schema Builder Correct answer.
  3. Workbench
  4. AppExchange

Explanation

Schema Builder is a graphical tool that shows objects and their relationships and lets an admin create objects, fields, and relationships on a canvas. Object Manager is a list-based interface rather than a relationship canvas.

Question 38Extending Custom Objects and Applications

Which statement about custom metadata type records is correct?

  1. They can only be created through the API
  2. They are only available in the org where they are created
  3. They count against the org's data storage limit
  4. They can be deployed from one org to another Correct answer.

Explanation

Custom metadata records are metadata, so they can be moved between orgs using change sets, packages, or the Metadata API. They do not consume data storage and can be created in the user interface.

Question 39Extending Custom Objects and Applications

Which field type can be used as the controlling field in a dependent picklist?

  1. Checkbox Correct answer.
  2. Text area
  3. Multi-select picklist
  4. Formula (Text)

Explanation

A controlling field must be a picklist or a checkbox, while the dependent field must be a picklist or multi-select picklist. Multi-select picklists, text areas, and formulas cannot control another picklist.

Question 40Extending Custom Objects and Applications

Users in two departments on the same object need different picklist values and different page layouts. What should the admin configure?

  1. Two validation rules
  2. Two record types Correct answer.
  3. Two field-level security profiles
  4. Two permission sets

Explanation

Record types let an admin present different picklist values and assign different page layouts per profile. Permission sets and field-level security do not change which picklist values appear on a layout.

Question 41Extending Custom Objects and Applications

Which statement about hierarchy custom settings is true?

  1. They must be queried with SOQL every time they are accessed
  2. They can store only one record for the entire organization and are read-only
  3. They can define values at organization, profile, and user levels Correct answer.
  4. They cannot be referenced in formula fields

Explanation

Hierarchy custom settings support an organization-wide default with profile-level and user-level overrides. They are cached and can be referenced in formula fields, validation rules, and other declarative tools.

Question 42Extending Custom Objects and Applications

An admin wants a validation rule to fire only when a record's Amount changes to a value greater than 10,000. Which function should be used to detect the change?

  1. ISBLANK
  2. ISCHANGED Correct answer.
  3. ISNEW
  4. PRIORVALUE

Explanation

ISCHANGED compares a field's current value with its prior value and returns true when the value has changed. PRIORVALUE returns the old value but does not by itself indicate that a change occurred.

Question 43Extending Custom Objects and Applications

Which feature grants access to custom objects, fields, and tabs without changing a user's profile?

  1. Custom setting
  2. Record type
  3. Delegated administrator
  4. Permission set Correct answer.

Explanation

Permission sets are additive and grant object, field, tab, and system permissions independently of the user's profile. Record types and custom settings do not grant object or field access.

Question 44Extending Custom Objects and Applications

An admin wants a group of users to be able to create and manage users in specified roles without having full admin rights. What should be configured?

  1. Permission set licenses
  2. Delegated administration Correct answer.
  3. Profile with Modify All Data
  4. Sharing rules

Explanation

Delegated administration lets selected users administer specified roles and their subordinates, including creating and managing users, without making them system administrators. Modify All Data affects record access rather than user administration.

Question 45Extending Custom Objects and Applications

Which relationship is required before a roll-up summary field can be created on the parent object?

  1. Lookup relationship
  2. Hierarchical relationship
  3. External lookup relationship
  4. Master-detail relationship Correct answer.

Explanation

Roll-up summary fields aggregate child records and are available only on the master side of a master-detail relationship. Lookup relationships require another automation tool, such as a trigger or Flow, to summarize children.

Question 46Extending Custom Objects and Applications

An admin is building a new Lightning app for recruiters. Which component determines the items shown in the app's navigation bar?

  1. The app's utility bar
  2. The app's navigation items setting Correct answer.
  3. The app's user profile
  4. The app's branding and color settings

Explanation

In Lightning Experience, the navigation items selected for an app define which tabs and items appear in its navigation bar. Branding controls the app's appearance, and the utility bar is a separate footer component.

Question 47Extending Custom Objects and Applications

An admin uses Lightning App Builder to create a record page and wants certain components visible only to users in a specific profile. Which feature should be used?

  1. Component visibility rules Correct answer.
  2. Page layout assignment for the profile
  3. Field-level security
  4. Record type assignment

Explanation

Lightning App Builder supports component visibility rules based on user, record, or device criteria, so a component can be shown or hidden for a profile. Page layouts do not control the visibility of Lightning components.

Question 48Extending Custom Objects and Applications

Which deployment method can move a custom object and its fields from a sandbox to production?

  1. Schema Builder
  2. Reports and Dashboards
  3. Change set Correct answer.
  4. Data Loader export

Explanation

Change sets package metadata such as custom objects, fields, and layouts for deployment between related orgs. Data Loader moves records rather than metadata.

Question 49Extending Custom Objects and Applications

Which sharing behavior applies to a child record in a master-detail relationship?

  1. It uses its own organization-wide default setting independent of the parent
  2. It is always private to the record owner
  3. It must be shared manually with each user
  4. It inherits the sharing settings of its parent record Correct answer.

Explanation

Detail records inherit the sharing and access of their master record, so users with access to the parent can access the child. Child records do not have an independent organization-wide default.

Question 50Extending Custom Objects and Applications

Which field type stores data in encrypted form and supports deterministic encryption for exact-match filtering?

  1. Text (Encrypted) Correct answer.
  2. External ID
  3. Rich Text Area
  4. Auto Number

Explanation

Encrypted text fields encrypt values at rest, and deterministic encryption allows exact-match filtering and unique constraints on those values. External IDs and auto-number fields are not encrypted field types.