Sharing-and-Visibility-Architect Sample Questions Answers

To improve performance when a dummy user owns more than 10,000 lead records, it is recommended to assign ownership to a small number of users and do not assign a role to the dummy user. Assigning ownership to a small number of users reduces the number of sharing calculations and recalculations that occur when role hierarchy changes. Not assigning a role to the dummy user prevents the dummy user from granting access to other users in the role hierarchy

To store sensitive invoice data in Salesforce, the architect should consider using a master-detail relationship between accounts and invoices, and setting the organization-wide default sharing for invoices to private. This would ensure that only the owners of the invoices and their subordinates can see them, and that the invoices inherit the sharing settings of the accounts. A workflow that populates the invoice sharing object upon insert is not necessary if the master-detail relationship is used. A lookup relationship between accounts and invoices would not enforce the same level of security and visibility as a master-detail relationship3

 Enterprise Territory Management is a feature that allows you to assign accounts to territories based on criteria such as geography, industry, revenue, etc. With Enterprise Territory Management, you can1:

Use the Metadata API to create, update, and delete territory models, territories, and account assignments.

Integrate with Collaborative Forecasting to forecast sales revenue by territory.

Assign opportunities to territories based on the account assignment or other criteria.

The two different approaches that the architect should consider when designing this enhancement are A and B. Option A ensures that the custom account team object data is consistent with the standard account team member object data, which is used for implicit sharing. Option B ensures that the account share object, which stores the sharing records for accounts, is updated based on the custom account team object data. The other options are either not necessary or not possible.

The two settings that are available in profiles, but not permission sets are C and D. Page layout assignments and login hours are profile-specific settings that control the user interface and the time range that users can log in to Salesforce. The other options are either available in both profiles and permission sets, or not related to either.

 Adding the user to the Sales Team for the Presentation record will not work, as Sales Teams are only available for standard objects, not custom objects. Giving Edit rights to the Presentation record via a Permission set will not work, as Permission sets are assigned to users, not records. The best option is to use a trigger on Presenter junction object that uses Apex Managed sharing to add or remove access to the related Presentation record based on the junction object records.

The Internal Default sharing settings for a custom object can be either Public Read/Write or Public Read Only if the External Default sharing setting is set to Public Read Only1. Controlled by Parent and Private are not valid options because they would not allow external users to access the custom object records.

The three options that can change the owner of the opportunity are B, C, and E. The current opportunity owner can transfer the ownership to another user by editing the record or using the change owner button. The system administrator or a user with the “Transfer Records” permission can also change the owner of any record, regardless of the sharing settings. Someone above the opportunity owner in the role hierarchy can also change the owner, as they have full access to the records owned by users below them in the hierarchy. The other options are either incorrect or not possible.

The access that has to be given to partner users to access records belonging to users in their account at their same role or lower in the role hierarchy, for Cases, Leads, Opportunities and Custom Objects is Super User Permission2. Super User Permission is a profile permission that enables partner users to act as super users for their accounts2. Super users can view, edit, and delete records that they do not own within their account.

To share a report or dashboard folder with other users in the organization, you can use Public Groups or Roles4. Profiles and Teams are not available options for sharing folders.

 Using a visualforce override or a custom LWC override for Opportunity view action will require additional development and maintenance, and may not be compatible with all devices. The best option is to use Dynamic Form to define different field sections applicable for different form factors of devices, as Dynamic Form is a declarative feature that allows admins to customize record detail pages without writing code.

Creating a protected custom metadata type that stores the encryption key and packaging it with its associated records in a managed package is the best way to securely store the confidential key, as protected custom metadata types are only accessible within the package namespace and cannot be viewed or modified by subscribers2. Creating a protected custom metadata type and packaging it in an unlocked package will not work, as unlocked packages do not support protected custom metadata types3. Creating a custom metadata type and restricting access to the admin profile will not work, as users with View Setup permission can still view the custom metadata type and its records.

The user will not be able to see the junction object records or the field values if their profile allows access to the Job object but not to the Production Facility object. This is because junction objects inherit the sharing and security settings from both master objects, and users need access to both master objects to access the junction object records. If a user does not have access to one of the master objects, they will not see any records or fields from the junction object

The feature in Salesforce that is needed to restrict access to a custom object that has public read/write access is profile. Profile settings can control the create, read, edit, and delete permissions for a custom object at the user level, regardless of the organization-wide default settings. The other options are either not related to object access or not restrictive enough.

According to this source, creating a lookup relationship from the Loan object to the User object and using a trigger on the Loan object to create the corresponding record in the Loan share object is the best way to meet the requirements. The other options will not work as expected or will not be scalable.

 To make sure service reps have access to all relevant information to attend to customer requests, the architect should consider that service reps will be able to access contact records if they are controlled by parent or due to implicit sharing. If contact records are controlled by parent, their access level is determined by the access level of their parent account. If service reps have View All permission on Case object, they also have implicit Read access to the accounts and contacts associated with cases that they can access3. Service reps will not be able to access contact records if account OWD is private and contact records are not controlled by parent, as they will need explicit sharing or permission to access them. Service reps will not be able to access contact records if they are controlled by parent and they do not have access to the parent account.

Programmatic sharing is the best option to share accounts automatically based on a lookup field, as it allows for more flexibility and scalability than manual sharing, account teams, or criteria-based sharing. Manual sharing is not automatic and requires user intervention. Account teams are not suitable for large numbers of users and accounts. Criteria-based sharing does not support lookup fields as criteria

 When using the runAs() method to design Apex unit tests, the architect should consider that runAs() does not enforce user permissions or field-level permissions in test classes, runAs() can be used inside of test classes to validate record-level security, and runAs() counts towards total DML statements issued within transaction. These are important considerations to ensure that the test classes cover all possible scenarios and do not exceed governor limits. runAs() cannot be used outside of test classes to bypass record-level security, and runAs() cannot be used inside of test classes to validate field-level permissions

 To mitigate the risks of import failures associated with large-volume bulk data loads, two options that can help are deferring sharing calculation and grouping records by ParentID within a batch. Deferring sharing calculation allows the data load to complete without triggering any sharing recalculation, which can be done later when the system is less busy. Grouping records by ParentID within a batch ensures that all child records of the same parent are in the same batch, which reduces the chances of locking errors

Deferred Sharing Recalculation is a feature that allows admins to postpone the recalculation of sharing rules until a scheduled maintenance window, which can improve performance and avoid locking issues when making changes to roles or account owners3. This is the best feature to recommend to avoid problems with this operation. Skinny table is a feature that improves performance by storing frequently used fields in a separate table, but it does not affect sharing recalculation. Partition data using Divisions is a feature that allows admins to segment data into logical subsets for reporting and searching purposes, but it does not affect sharing recalculation.

To ensure the data security of the custom web service, the Architect should consider the following design elements:

Query the Orders object with Dynamic SOQL based on the fulfillment ID: This will allow the web service to filter the orders based on the input parameter and return only the relevant records to the business partner.

Set the Orders object’s sharing settings to Private in the Org-Wide Defaults: This will restrict access to the Orders object to only the owner and users above them in the role hierarchy by default, and prevent unauthorized access from other internal or external users.

Develop a custom Apex web service using the “With Sharing” keyword: This will enforce the sharing rules defined for the Orders object and respect the record-level access of the web service user.

Public groups are used to grant access to a set of users who do not have a predefined relationship in the role hierarchy or territory hierarchy. Sharing sets are used for community users, not internal users. Role hierarchy is used to grant access based on the user’s position in the organization.

Sharing the folders with the Sales Managers profile is the best way to grant access to sales managers to automate access to these Public Reports and Dashboard folder, as it allows admins to share folders with users who have a specific profile4. Sharing the folders with a “Sales Managers” Public Group will work, but it will require manual maintenance and may not reflect changes in roles or positions. Sharing the folders with the lowest rates in the Role Hierarchy will not work, as folders cannot be shared with roles or subordinates.

The best practice for testing sharing and visibility changes is to use the login as feature for a sample user in each role and profile. This allows the tester to see exactly what the user can see and do in the org, and verify that the sharing settings are working as expected. The other options are either not comprehensive or not relevant.

Named Credentials, Protected Custom Metadata, and Protected Custom Settings are three options to secure the credentials for the external system. They allow the developer to store the credentials in a secure way that is not exposed to other users or packages. Storing the credentials in a custom object using encrypted fields or in the apex code are not secure options

The side effect of granting opportunity access to sales reps on the same team using ownership-based sharing rules is that all sales reps will have Read access to all accounts. This is because ownership-based sharing rules are based on the role or territory of the owner of the record, and they grant access to both the record and its parent account. Therefore, if a sharing rule grants Read access to opportunities owned by users in a certain role or below, it also grants Read access to the accounts of those opportunities4. Sales reps on the same team will not have Edit access to the accounts for opportunities owned by their peers, as sharing rules only grant Read or Read/Write access, not Edit access. Sales reps on the same team will not have Read access to the accounts for opportunities owned by their peers only, as sharing rules grant access to all accounts in the specified role or below, not just their peers. All sales reps will not have Read access to accounts for all opportunities, as sharing rules only grant access to accounts for opportunities owned by users in a certain role or below, not all opportunities.

Two options that the user can see while adding account team members to the account are case access and opportunity access. This is because these are the two objects that have public read only sharing settings and allow users to specify different levels of access for account team members. Contact access and activity access are not options because these objects have controlled by parent sharing settings and inherit their access from the account

Inherited access grants and group membership grants are two types of access grants that are stored in the group maintenance tables. These tables store information about which users belong to which groups (group membership grants) and which groups inherit access from which groups (inherited access grants). Explicit grants and implicit grants are not stored in the group maintenance tables, but in other tables such as share tables and role hierarchy tables.

 Two reasons why an object is excluded from the list of available objects in a sharing set are that the object’s organization-wide sharing setting is set to public read/write, or that the custom object does not have a lookup to accounts or contacts. A sharing set is used to grant access to records based on a user’s account or contact, and it only works for objects that have private or public read only sharing settings. Custom objects are available for a sharing set if they have a lookup to accounts or contacts

A workaround to ownership data skew is to minimize possible performance impacts by not assigning the user(s) to a role. Ownership data skew occurs when a single user owns a large number of records (more than 10,000) of an object, which can cause performance issues when sharing calculations are performed. By not assigning the user to a role, you can prevent the sharing rules from being applied to the records owned by that user, and reduce the number of rows in the sharing tables.

 Enabling opportunity teams and allowing users to add the product manager is the best way to accomplish the requirement, as it allows for granular and flexible sharing of opportunities with specific users who are involved in the deal. Creating a sharing rule to allow the product manager to access the opportunity is not feasible, as it would require a criteria or an owner-based rule that would apply to all product managers and opportunities, not just specific ones. Enabling account team and allowing users to add the product manager is not sufficient, as it would only grant access to the account, not the opportunity. Using similar opportunities to share opportunities related to the product manager is not relevant, as it is a feature that helps users find and update similar opportunities based on fields and filters

 To give access to the invoice records from an external object on the account page, the Sales Architect should recommend including the Invoice Related List on Account Page layout. This will allow the finance users to see the invoice records related to each account, as long as they have access to the account record and the external object4. Creating sharing rules or using Apex managed sharing are not applicable for external objects, as they do not support manual or programmatic sharing

Creating a Sharing set for the Distributor profile to grant access to the Delivery object is the correct way to share records with users in a partner community. Sharing sets allow you to share records based on a common account or contact2. Criteria-based sharing rules are not available for partner communities3.

Apex sharing is a way to programmatically grant access to records for users or groups of users. Apex sharing can be used to share records with Customer Community Plus users, who are not supported by other declarative sharing options such as sharing sets or sharing rules. Apex sharing uses the Account__Share table to store the sharing information for the Account object. Therefore, the answer A is correct and the other options are incorrect

The architect can achieve this requirement by using a permission set. A permission set is a collection of settings and permissions that give users access to various tools and functions3. The architect can create a permission set that grants edit access to the flag field on the case object, and assign it to the users who are assigned as case assessors. Object permissions control the access level that users have to records, not fields. A custom lightning component is not necessary for this requirement, as it can be done declaratively. Field-level security controls the visibility of fields on page layouts and reports, not the editability.

Removing the Work Order Edit permission from the sales representative profile is the optimal approach to implement these requirements, as it will prevent sales representatives from changing virtual container work orders that are provisioned immediately by the system. Option B is incorrect, since removing the edit button from the work order page layout would not prevent sales representatives from editing work orders using other methods, such as inline editing or data loader. Option C is incorrect, since changing the record type/page layout assignment for Work Order to be Read Only would not affect the edit permission, but only the layout configuration. Option D is incorrect, since implementing a sharing rule that changes access for all Work Order to Read would not prevent sales representatives from editing work orders that they own.

The likely cause of this issue is that sales users profile does not have access to the remaining fields. Profile permissions determine what users can do with records, such as create, read, edit, or delete. If sales users profile does not have read permission for certain fields on the Invoice object, they will not be able to see those fields on the record detail page3. Page layout assigned to sales user profile, org-wide sharing settings, and role-based sharing are not likely causes of this issue.

The two actions that are required to achieve the requirement are setting up External Object to use OAuth to connect to the Accounting system and restricting access to data in the accounting system. OAuth is an authentication protocol that allows Salesforce to securely access data from an external system without storing the username and password of the external system user3. Restricting access to data in the accounting system is a way to ensure that only authorized users can view the invoice records from the external source. Creating an owner based sharing rule to grant visibility to the Invoice object and granting access to the External Object to only the Account Manager profile are not actions that can ensure that a user only accesses invoice records the user is authorized to see.

SOQL injection is a vulnerability that can exist when controllers use dynamic rather than static queries and bind variables. SOQL injection is a technique that exploits a security vulnerability by inserting malicious SOQL statements into an existing query. This can result in data loss, data exposure, or unauthorized access1. Buffer overflow attacks, cross-site scripting, and record access override are not vulnerabilities related to dynamic queries and bind variables.

Assigning users profiles and unlocking users are two capabilities that the delegated administrator permission provides. Delegated administrators are users who can perform certain administrative tasks on behalf of administrators. These tasks include assigning users to specified profiles or permission sets, creating and editing users in specified roles or groups, unlocking users who have exceeded their login attempts limit, resetting passwords for users in specified roles or groups, logging in as users who have granted login access to administrators. Option C is incorrect, since setting OWD is not a capability that delegated administrators have. Option D is incorrect, since creating profiles is not a capability that delegated administrators have.

Roles and Public Groups are two options that can be selected to share data with when creating a sharing rule. Sharing rules can grant additional access to records based on the owner’s role or public group membership. Option C is incorrect, since Users are not an option for sharing rules. Option D is incorrect, since Profiles are not an option for sharing rules.

Profiles and Permission Sets can be used to control the object-level and field-level access for different types of users. For example, sales reps can have read/write access to Account object but not to the segment field, while service reps can have read-only access to Account object and all fields. Role Hierarchy can be used to control the record-level access for users based on their position in the organization. For example, sales managers can access and modify any account of reps reporting to them, while service managers can access and modify any account regardless of ownership. Field-Level Security can be used to override the profiles and permission sets for specific fields on specific records. For example, service managers can edit the segment field on any account, even if their profile does not allow it. Therefore, the answer D is correct and the other options are incorrect3

A sharing set is the best way to share cases with partner users based on a common account. Sharing sets are available for Partner Community licenses and can grant access to related records using predefined criteria1. Option A is incorrect, since changing the external OWD to public read only would give access to all cases to all partner users, not just the ones related to their account. Option B is incorrect, since sharing rules are not available for partner users. Option C is incorrect, since the role hierarchy does not apply to partner users

The best way to troubleshoot this issue is to view Field Accessibility in the Object Manager. This will allow the admin to see how the field-level security settings affect the visibility of the field for different profiles and record types. The other options are not helpful, because:

Reviewing changes to Account record types will not show why a field has disappeared from the Account page, unless the field is dependent on a record type that has been deactivated or modified.

Logging in as user and checking several Accounts will not isolate the problem records, because the issue is related to field visibility, not record access.

Running a Who Sees What report will not help, because this report only shows how sharing settings affect record access, not field visibility.

The error occurred because the trigger handler class is using ‘‘with sharing’’ and the user does not have access to the orders related to the opportunity. The ‘‘with sharing’’ keyword enforces the sharing rules that apply to the current user. This means that if the user does not have access to a record, they will get a permission error when trying to create or update it1. The trigger should use ‘‘without sharing’’ keyword instead, which ignores the sharing rules that apply to the current user. The trigger should not use RunAs(), IsCreateable(), or no sharing keywords as they will not prevent the error from occurring.

To give users in the partner user role access to all Case and Container records owned by any user at the same distributor, an Architect can give super user permission to the individual partner users. Super user permission allows partner users to access data owned by other partner users belonging to the same account or below them in the role hierarchy. Creating an ownership-based sharing rule will not work, as it will share records based on the owner’s role or territory, not their account. Creating sharing sets will not work, as they are only available for Customer Community licenses, not Partner Community licenses. Creating a Permission Set granting “View All” permission to Case and Container records will not work, as it will give access to all records in those objects, regardless of their owner or account.

The architect can configure the system to support the requirements by using a sharing rule. A sharing rule is a declarative way of extending record access to users or groups of users based on criteria such as ownership, role, or field values3. In this case, the architect can create a sharing rule that grants read or read/write access to all records owned by customer community users to UC users in the customer support role. A sharing set is used to grant access to community users based on a common account or contact, not to internal users. A share group is used to share records with groups of community users who have Customer Community Plus or Partner Community licenses, not with internal users. Apex sharing is used to programmatically share records when declarative sharing cannot fulfill complex requirements, but it is not necessary in this case.

 Setting the OWD for internal users to Public Read Only is the simplest and most efficient way to give access to all internal employees to the ServiceFeedback object. Option A is incorrect, since creating a trigger on ServiceFeedback to change ownership to an internal employee would be complicated and affect the data quality. Option B is incorrect, since ensuring all the internal users are above the partners in the role hierarchy would not work, as the role hierarchy does not apply to partner users. Option C is incorrect, since creating an owner-based sharing rule for all ServiceFeedback records owned by partners would be redundant and inefficient

Using opportunity team and creating an assistant field, using Apex to share opportunities with the assistant agent is the optimum solution to meet the requirements. Opportunity teams are groups of users who work together on sales opportunities. By creating an assistant field on the opportunity object, the sales reps can specify an assistant agent who can help them with their deals. By using Apex, the system can automatically share the opportunity with the assistant agent based on the value of the assistant field, and remove access from the previous assistant if the field value changes. Option A is incorrect, since using share group to share opportunities with the assistant agent would require manual configuration and maintenance. Option C is incorrect, since using sharing rule to share opportunities with the assistant agent would not allow dynamic sharing based on the assistant field value. Option D is incorrect, since using Apex sharing to share and unshare opportunities with the assistant agent would be similar to option B, but without using opportunity teams.

 Creating a Permission Set that grants “View All” permission for Opportunity is the best approach to meet the requirements. This will allow the Sales Reporting team to view all Opportunity records without changing their profile or OWD settings. Creating a Permission Set that grants “View All Data” permission would give them access to all data in the org, which is not necessary. Making Opportunity OWD read-only would affect all users in the org, which may not be desirable. Giving “View All Data” permission to the Sales Reporting Profile would also give them access to all data in the org, which is not necessary

Only Bob can view the file that he uploads to his Files Home private library. Users above Bob in the role hierarchy, users with View All Data permission, or users with Modify All Data permission cannot access the file unless Bob explicitly shares it with them

Sharing the folders with the “VP of Sales” Role and Subordinates and sharing the folders with a “Sales Managers” Public Group are two ways that UC can grant access to sales managers to automate access to these Reports and Dashboards folders. Folder sharing allows users to share reports and dashboards with other users based on roles, subordinates, public groups, or individual users. Option A is incorrect, since sharing the folders with lowest roles in the role hierarchy would not give access to superiors automatically, but only to subordinates. Option C is incorrect, since sharing the folders with a queue is not possible.

The most likely reason why some users cannot see the accounts shared with the public group is that their profiles do not have access to the account object. Sharing rules and public groups cannot grant access to an object that is not enabled by the profile. Option A is incorrect, since permission sets do not control record status. Option B is incorrect, since the role hierarchy does not affect sharing rules. Option D is incorrect, since page layouts do not affect visibility

Service reps will not be able to access all UC contact records if they are controlled by parent and service reps will not be able to access all UC account records because account OWD is private are two details that Salesforce Architects should consider in this scenario. Since service reps are assigned to a profile which has View All in Case object (Private OWD), they can access all case records regardless of ownership or sharing rules. However, this does not grant them access to related contact or account records, unless they have View All or Modify All permissions on those objects as well. If contact records are controlled by parent (account), their sharing settings will depend on the account OWD and sharing rules. If account OWD is private, service reps will only be able to access account records that they own or are shared with them. Implicit sharing does not apply to internal users. Option A and C are incorrect, since service reps will not be able to access all UC contact or account records due to the reasons explained above.

Reviewing the user provisioning process to not automatically create a user role for any new user and contacting Salesforce support and requesting to increase the number of users’ roles allowed are two recommendations that could solve this problem. Salesforce has a limit on the number of roles that can be created in an organization, which depends on the edition and the number of licenses. If this limit is reached, no more roles can be created unless the limit is increased by Salesforce support. Therefore, it is not advisable to create a new role for every new user, as this would quickly exhaust the limit and cause the “User Role Limit Exceeded” error. Option B is incorrect, since removing role hierarchy from Salesforce org and controlling the record access using Apex managed sharing would be a complex and custom solution that would not address the root cause of the problem. Option D is incorrect, since creating an Apex class to replace the User Roles by generic one as soon as they are created would be unnecessary and inefficient.

 Creating an ownership-based sharing rule is the best way to achieve the requirements. Ownership-based sharing rules allow administrators to automatically grant access to records owned by certain users or roles to other users or roles2. This way, the sales manager in Australia can access the deals owned by the sales manager in Japan. Using sharing set, using opportunity teams, and assigning View All on the opportunity object are not options that can achieve the same result.

Setting the Request object’s OWD to Public Read/Write is the simplest and most efficient way to allow all employees to collaborate on requests. Option B is incorrect, since granting Modify All Data permission on all profiles would give too much access and affect other objects as well. Option C is incorrect, since creating a criteria-based sharing rule to share all records with all users would be redundant and inefficient. Option D is incorrect, since setting the OWD to Public Read Only would not allow users to edit requests3.

The Grant Access Using Hierarchies option on Shipment Sharing Settings allows users above the owner in the role hierarchy to have the same level of access as the owner. If this option is disabled, the role hierarchy will not grant access to the Shipment records, even if it is configured correctly. Therefore, the answer A is correct and the other options are incorrect

Using Account teams, Opportunity teams, and Case teams is the best way to achieve these requirements. Account teams allow you to share accounts and related records with a group of users. Opportunity teams allow you to share opportunities with a group of users who can have different levels of access. Case teams allow you to share cases and related records with a group of users who can have different roles and levels of access. Using Sharing rules to share cases with sales associates will not work, because sharing rules can only be based on record owner or criteria, not on account team membership. Using Account Teams to define access to accounts as well as opportunities and cases related to accounts will not work, because account team members can only have read-only access to cases by default.

List views are a way to filter and display records of a specific object based on certain criteria. List views can be shared with all users, a group of users, or only the owner of the list view. To share a list view with a group of users, such as sales executives who specialize in closing problematic deals, the architect can recommend creating a public group that includes those users and sharing the list view with that public group. Therefore, the answer B is correct and the other options are incorrect 

Deleting the public link is the best way to ensure that the potential customers do not have access to the file after the meeting. Renaming the file, deleting the file, or moving the file to another folder will not affect the public link, which will still point to the file

 Deferred Sharing Recalculation allows the admin to postpone the recalculation of sharing rules until a later time, which can improve performance and avoid locking issues when changing role hierarchy or ownership. Parallel Sharing Rule Recalculation allows the admin to run multiple sharing rule recalculations at the same time, which can also improve performance and reduce downtime. Granular Locking enables finer-grained locking for certain operations that affect large data sets, such as bulk loading or updating. These features can help avoid problems when reorganizing roles and reassigning account owners. Therefore, the answer B, C, and E are correct and the other options are incorrect

The license recommendation that will meet distributor needs is Partner Community. Partner Community licenses are designed for users who are not employees of UC, but are part of their partner ecosystem, such as distributors, resellers, or suppliers. Partner Community users can access standard CRM objects such as accounts, contacts, leads, opportunities, cases, and campaigns. They can also collaborate with other partners and UC employees using Chatter and Communities. Sales Cloud licenses are for internal sales users who need full access to standard CRM and custom objects. Customer Community Plus licenses are for high-volume customers who need access to standard CRM objects and custom objects, but not opportunities. Customer Community licenses are for low-volume customers who need access only to custom objects and a subset of standard CRM objects.

The side effect of this approach is that sales reps on the same team will have read access to the accounts for opportunities owned by their team members. This is because owner-based sharing rules grant access to both the parent and child records of the same object. For example, if a sharing rule grants access to opportunities owned by a certain role, it also grants access to the accounts associated with those opportunities. All sales reps will not have read access to accounts for all opportunities, as the sharing rules are based on ownership. Sales reps on the same team will not have edit access to the accounts for opportunities owned by their team members, as owner-based sharing rules only grant read or read/write access to child records, not parent records. All sales reps will not have read access to all accounts, as the account organization-wide default is private.

The license type that must be used by community users who want to collaborate on opportunities is Partner Community. As mentioned above, Partner Community licenses allow users to access standard CRM objects such as opportunities and collaborate with other partners and internal users using Chatter and Communities. Sales Community licenses do not exist as a separate license type. Customer Community and Customer Community Plus licenses do not allow users to access opportunities, as they are intended for customer service scenarios rather than sales scenarios.

To mitigate the risk of improper access to records when using Apex managed sharing, the Salesforce architect should recommend using runAs system method in test classes and with Sharing keyword in Apex classes. The runAs system method allows testing the code as different users with different profiles and permissions, which can help verify that the sharing logic is working as expected2. The with Sharing keyword enforces the record visibility rules for the current user context, which can help prevent unauthorized access to records that are not shared with the user