Sharing-and-Visibility-Architect Questions and Answers

The report owner is the only one who can view and run the report that is saved in the “Private Reports” folder. Option A is incorrect, since there is no such thing as the “My Private Reports” folder in Salesforce. Option B is incorrect, since the role hierarchy does not affect the access to private reports. Option D is incorrect, since the “View All Data” permission does not grant access to private reports.

The architect can configure the system to support the requirements by using a sharing rule. A sharing rule is a declarative way of extending record access to users or groups of users based on criteria such as ownership, role, or field values3. In this case, the architect can create a sharing rule that grants read or read/write access to all records owned by customer community users to UC users in the customer support role. A sharing set is used to grant access to community users based on a common account or contact, not to internal users. A share group is used to share records with groups of community users who have Customer Community Plus or Partner Community licenses, not with internal users. Apex sharing is used to programmatically share records when declarative sharing cannot fulfill complex requirements, but it is not necessary in this case.

A sharing rule is missing to share Accounts to the AR team, which could be the issue preventing AR team members from seeing invoices. Since invoice is a custom object with a master-detail relationship to account, its sharing settings are controlled by its parent account. If AR users do not have access to account records, they will not be able to see or query invoice records either. Option A is incorrect, since a sharing rule to share invoices to the AR team would not work, as invoice inherits its sharing settings from account. Option B is incorrect, since assigning an invoice page layout to the AR team profile would not affect their visibility of invoice records. Option D is incorrect, since giving read permission to the invoice object to the Accounts receivable profile would not grant access to invoice records that are owned by other users.

 Profiles can control the login hours for users, which can restrict their access to Salesforce based on their time zone. Option A is incorrect, since login hours are not set on user records. Option B and C are incorrect, since permission sets and custom permissions do not control login hours

To implement Filter-Based Opportunity Territory Assignment, you need to define a Territory assignment rule with filter criteria for Filter-Based Opportunity Territory Assignment1. This will allow you to assign opportunities to territories based on field values of the opportunity or its related account1. Defining an account assignment, a custom Apex class, or an opportunity assignment rule are not required for this feature.

Ensuring the profile has the “Modify All Data” permission enabled is the optimal way to enable this requirement. This permission allows the user to view, edit, delete, and transfer all records in the org, regardless of sharing and CRUD settings. The other options are not sufficient to grant full access to all data.

To give users in the partner user role access to all Case and Container records owned by any user at the same distributor, an Architect can give super user permission to the individual partner users. Super user permission allows partner users to access data owned by other partner users belonging to the same account or below them in the role hierarchy. Creating an ownership-based sharing rule will not work, as it will share records based on the owner’s role or territory, not their account. Creating sharing sets will not work, as they are only available for Customer Community licenses, not Partner Community licenses. Creating a Permission Set granting “View All” permission to Case and Container records will not work, as it will give access to all records in those objects, regardless of their owner or account.

Using bind variables or the escapeSingleQuotes() method are two techniques that can prevent SOQL Injection attacks by ensuring that user input is treated as literal strings rather than part of the query9. Bind variables are preferred over escapeSingleQuotes(), as they also improve performance and readability of the code10. Option A is incorrect, since escaping double quotes in the user input does not prevent SOQL Injection. Option D is incorrect, since using the with Sharing keyword on the controller does not affect SOQL Injection, but rather enforces record-level access based on the user’s profile and sharing rules.

Only Bob can view the file that he uploads to his Files Home private library. Users above Bob in the role hierarchy, users with View All Data permission, or users with Modify All Data permission cannot access the file unless Bob explicitly shares it with them

Creating a Share Group based on the sharing set created for the Customer Community User Profile is the best way to give support representatives access to Container and Case records owned by Customer Community users. Share Groups are groups of users who have access to records based on a sharing set. Sharing sets are settings that grant community users access to records that have a lookup relationship to their user record1. Creating an ownership-based sharing rule, creating a criteria-based sharing rule, and relying on the role hierarchy are not options that can achieve the same result.

 By default, three roles are created when the first external user is created on a partner account. These roles are Executive, Manager, and User. They form a role hierarchy that determines the level of access to data for the partner users

Creating a reusable SOQLQueries class without specifying “With” or “Without Sharing” on the class or specifying “With Sharing” or “Without Sharing” on the methods are two ways to meet the requirements. The sharing mode of the class or method will depend on the context of the calling code, which can be either “With Sharing” or “Without Sharing”. Option B is incorrect because the runAs() method is only available in test methods and does not change the sharing mode. Option D is incorrect because it requires creating two separate classes for different sharing modes, which is not reusable.

The term that describes the situation when you make changes to roles and groups Salesforce locks the entire group membership table is Granular Locking. Granular Locking is a feature that improves the concurrency and performance of sharing operations by locking only the affected nodes in the role or territory hierarchy, instead of locking the entire hierarchy. This allows multiple sharing operations to run in parallel without causing lock contention or blocking each other.

The two reasons that the architect should consider regarding the use of Apex sharing reasons are A and B. Option A allows the developer to more easily troubleshoot programmatic sharing, as they can identify which sharing records are created by which Apex code. Option B prevents the share record from being deleted upon ownership change, as Apex sharing reasons are not subject to recalculation by Salesforce. The other options are either incorrect or irrelevant.

The potential vulnerabilities in the code snippet are SOQL Injection and Data Access Control. SOQL Injection is a technique that exploits a security vulnerability in a database layer of an application. It occurs when user input is directly appended to a SOQL query string, which allows attackers to execute arbitrary SOQL commands2. Data Access Control is a mechanism that ensures that users have appropriate permissions to access data in Salesforce. It involves checking the object-level, field-level, and record-level access of the user before performing any data operation3. The code snippet does not perform any FLS check or data access control check, which could expose sensitive data to unauthorized users or allow them to modify data without proper permissions3. Arbitrary Redirects are not a vulnerability in this code snippet, as they occur when a web application accepts untrusted input that could cause the web browser to redirect the user to a malicious website

The underlying issue for these users who don’t see any of the accounts that were shared with the public group is that they are in profiles that have no access to the Account object. If a user does not have Read permission on an object in their profile or permission set, they cannot access any records of that object, regardless of any sharing rules or manual sharing. The page layout assigned to these users does not affect their record visibility, only their field visibility and layout. The permission set that only allows accounts in Active status does not affect their record visibility, only their record filtering. The accounts being owned by users higher in the role hierarchy does not affect their record visibility, as sharing rules can grant access to records owned by any user in any role.

The action that Mary can take on Joe’s Invoice records is none. This is because Mary’s profile does not have the Read permission for the Invoice object, which means she cannot view any Invoice records, regardless of the OWD or role hierarchy settings. Profile permissions override any other access settings3. Read/Write, Edit Only, and View Only are not possible actions for Mary.

A sharing set is the best way to share cases with community users based on a common account. Sharing sets are available for Customer Community licenses and can grant access to related records using predefined criteria. Option A is incorrect, since sharing rules are not available for community users. Option B is incorrect, since there is no such thing as a share group in Salesforce. Option D is incorrect, since Apex sharing is complex and requires code maintenance

Using Account teams, Opportunity teams, and Case teams is the best way to achieve these requirements. Account teams allow you to share accounts and related records with a group of users. Opportunity teams allow you to share opportunities with a group of users who can have different levels of access. Case teams allow you to share cases and related records with a group of users who can have different roles and levels of access. Using Sharing rules to share cases with sales associates will not work, because sharing rules can only be based on record owner or criteria, not on account team membership. Using Account Teams to define access to accounts as well as opportunities and cases related to accounts will not work, because account team members can only have read-only access to cases by default.

Disabling Grant Access Using Hierarchies for the object and creating a sharing rule to enable sharing to the Director of Support are the steps to ensure proper sharing in this role hierarchy structure. This way, the Team Leads will not have access to the Reimbursement records of their subordinates, but the Director of Support will have access to all Reimbursement records. Option A is incorrect, as setting the View All permission on the profile will grant access to all users with that profile, not just the Director of Support. Option B is incorrect, as changing the owner of the Reimbursement record will remove the access from the original submitter. Option D is incorrect, as by default, Grant Access Using Hierarchies is enabled for custom objects, which means that Team Leads will have access to their subordinates’ Reimbursement records.

By turning off the Customer User Visibility feature in its Customer Community, Universal Containers can expect that community functionality related to searching for other external users will be affected. The Customer User Visibility feature allows customer community users to find and collaborate with other customer community users who belong to different accounts. If this feature is turned off, customer community users can only see other users who belong to the same account as them. Turning off this feature will not affect creating new customer community users, updating their user profile, or searching for internal users.

 Criteria-based sharing rules are used to share records based on field values, not ownership. This is the best option to grant access to accounts of the same segment in other countries, regardless of who owns them. Owner-based sharing rules are based on the owner of the record, not the segment. Changing the role hierarchy would affect other aspects of data visibility and security. Creating a public group and a permission set would require manual maintenance and would not be scalable.

Creating a criteria-based sharing rule giving the Retail Sales role access to Accounts of type PersonAccount is the best option to meet these requirements, as it will grant access to all retail customers based on a field value, regardless of ownership2. Creating an owner-based sharing rule on AccountContactRelation will not work, as it will only grant access to account contact roles records owned by retail sales reps, not all retail customers. Updating the Retail Sales profile to grant access to Person Account record type will not work, as it will only control the record type visibility, not the record visibility.

To meet the distributor needs, a Salesforce Architect should recommend using Partner Community licenses. Partner Community licenses are designed for external users who need access to standard CRM objects, such as accounts, contacts, opportunities, and cases3. Partner Community users can also collaborate with internal users and other partners through Chatter and Communities4. Sales Cloud licenses are for internal users who need full access to standard CRM and custom objects. Customer Community Plus licenses are for external users who need access to custom objects and a subset of standard CRM objects, such as accounts and contacts. Custom Community licenses are for external users who need access to custom objects only

The probable cause for this error is lock contention due to system-initiated sharing rule recalculation. When there are mass updates to fields that affect sharing rules, such as territory or role fields, Salesforce automatically recalculates the sharing rules to reflect the changes. This can cause lock contention on group membership records, which store the users and groups that have access to records through sharing rules. The other options are not likely to cause this error.

Updates to child records that have the same parent records being processed simultaneously in separate transactions and updates to parent records and their child records being processed simultaneously in separate threads may pose a risk of producing locking errors. These situations may cause concurrency issues and result in record locking exceptions. Updates to parent and child records being processed in the same batch or synchronously in the same thread are less likely to cause locking errors as they are processed sequentially.

When assigning access level for a record using Apex Managed Sharing, you can only use ‘Read’ or ‘Edit’ values. Using ‘All’ or ‘None’ values will cause a DML exception on insert to the database.

The user groups that can add team members on the Account are the current Account Owner and someone above the Account Owner in the Role Hierarchy with read access3. The user specified as the Manager on the Owner’s User record and any Account Team Member with read access on the Account cannot add team members on the Account.

Named Credentials, Protected Custom Metadata, and Protected Custom Settings are three options to secure the credentials for the external system. They allow the developer to store the credentials in a secure way that is not exposed to other users or packages. Storing the credentials in a custom object using encrypted fields or in the apex code are not secure options

 Enterprise Territory Management is a feature that allows you to assign accounts to territories based on criteria such as geography, industry, revenue, etc. With Enterprise Territory Management, you can1:

Use the Metadata API to create, update, and delete territory models, territories, and account assignments.

Integrate with Collaborative Forecasting to forecast sales revenue by territory.

Assign opportunities to territories based on the account assignment or other criteria.

If the organization-wide default for activities is controlled by parent, then the users need at least read-only access to the parent accounts and contacts to view the associated activities. A private sharing default with a sharing rule for each department that grants read-only access to the relevant accounts and contacts would meet this requirement. Public read/write access is not necessary and would violate the principle of least privilege. Private access would not allow the users to see any accounts or contacts outside their own role hierarchy. Activity sharing rules and profile permissions for the accounts tab are not relevant if the activities are controlled by parent

Creating a territory is an activity that can happen in parallel to changing a community account owner without risking group membership lock errors, assuming granular locking is enabled. Granular locking is a feature that allows for concurrent sharing operations on different objects or groups, reducing lock contention and improving performance. Deletion or creation of a role is an activity that can cause group membership lock errors, as it affects the role hierarchy and all the groups that are associated with it. Deletion of a territory is also an activity that can cause group membership lock errors, as it affects the territory hierarchy and all the groups that are associated with it

 To make sure service reps have access to all relevant information to attend to customer requests, the architect should consider that service reps will be able to access contact records if they are controlled by parent or due to implicit sharing. If contact records are controlled by parent, their access level is determined by the access level of their parent account. If service reps have View All permission on Case object, they also have implicit Read access to the accounts and contacts associated with cases that they can access3. Service reps will not be able to access contact records if account OWD is private and contact records are not controlled by parent, as they will need explicit sharing or permission to access them. Service reps will not be able to access contact records if they are controlled by parent and they do not have access to the parent account.

Content delivery is a feature that allows users to share files with customers and protect them with a password. Setting up an experience cloud site would require additional configuration and licensing. Utilizing an AppExchange product would introduce a dependency on a third-party solution.

Two methods that will allow the architect to meet the requirements for creating a custom team solution on the custom Loan object are creating a custom trigger on the Custom Team object that inserts or updates records in the Loan_share object, and creating Apex Sharing Reasons on the Loan object to identify the reason the Loan record was shared. The custom trigger can use Apex Managed Sharing to grant Read Only or Read/Edit access to the Custom Team members based on the Primary field value. The Apex Sharing Reasons can be used to distinguish between different types of sharing and provide more granular control over access

 A master-detail relationship is a type of relationship between two objects where the master object controls certain behaviors of the detail object, such as security and deletion. In this case, the Invoice Line Item Object should have a master-detail relationship to the Invoice Object, so that3:

The Invoice Line Item records are deleted when the parent Invoice record is deleted.

The Invoice Line Item records inherit the sharing and security settings of the parent Invoice record.

The Invoice Line Item fields can be rolled up to calculate sums, averages, etc. on the parent Invoice record.

 Territory Model State is the feature that can help UC stay within their org limits. It allows them to create multiple territory models and activate only one at a time. The inactive models do not count towards the org limit

Programmatic sharing is a way to use Apex code to create or delete sharing rules for records. Programmatic sharing is useful when2:

An external system manages user record access and you need to synchronize the access settings in Salesforce.

The native sharing functionality does not meet your complex or dynamic sharing requirements.

Using Dynamic Form to add different page sections and control visibility of sections by Work Order RecordType value is the best option to implement this requirement, as it will allow field agents to see only required information specific to the WorkOrder type they are addressing, without creating multiple page layouts or custom components. Using a custom LWC to override the view action of WorkOrder with custom metadata type defining relevant fields per WorkOrder type will work, but it will require additional development and maintenance. Using different page layouts per work order type with different sections representing key information about the specific work order type will work, but it will require creating multiple record types and page assignments.

The user who posted the file and users with access to the record can view the file by default, as files posted to a record’s feed inherit the record’s sharing settings3. Users with a shared chatter post link to the file will not be able to view the file by default, unless they also have access to the record. Only the user who posted the file will not be able to view the file by default, as other users who have access to the record can also view it.

When adding account team members to an account, the user can see the opportunity access options that are equal to or less than the organization-wide default access level for the opportunity object3. Since the organization-wide default access level for the opportunity object is Public Read Only, the user can see Read Only and Read/Write options. Private and Private and Read Only are not valid options.

Sharing the folders with the Sales Managers profile is the best way to grant access to sales managers to automate access to these Public Reports and Dashboard folder, as it allows admins to share folders with users who have a specific profile4. Sharing the folders with a “Sales Managers” Public Group will work, but it will require manual maintenance and may not reflect changes in roles or positions. Sharing the folders with the lowest rates in the Role Hierarchy will not work, as folders cannot be shared with roles or subordinates.

The record owner and any user above the external user in the role hierarchy have access to opportunity records owned by an external user. This is because external users are always at the bottom of the role hierarchy and do not grant access to users below them. The record owner and all internal users do not have access to opportunity records owned by an external user unless they have other sharing mechanisms such as sharing rules or manual sharing

 Creating a criteria-based sharing rule to give access to the public group for high-value opportunities and creating a public group and assigning the auditors to the group are the best options to give access to high-value opportunities to a team of auditors distributed through the organization. Option A is incorrect, since putting the auditors as the highest level of the role hierarchy would give them access to all opportunities, not just high-value ones. Option B is incorrect, since adding the auditors to the default opportunity team would require manual configuration and maintenance

 To give access to the invoice records from an external object on the account page, the Sales Architect should recommend including the Invoice Related List on Account Page layout. This will allow the finance users to see the invoice records related to each account, as long as they have access to the account record and the external object4. Creating sharing rules or using Apex managed sharing are not applicable for external objects, as they do not support manual or programmatic sharing

Roles and Public Groups are two options that can be selected to share data with when creating a sharing rule. Sharing rules can grant additional access to records based on the owner’s role or public group membership. Option C is incorrect, since Users are not an option for sharing rules. Option D is incorrect, since Profiles are not an option for sharing rules.

 Setting the case organization-wide default to Private and adding the specialized marketing consultants to the account team with Read/Edit permission are the best recommendations to allow this scenario. This way, only the support rep who owns the case and the marketing consultants who are related to the account can see and edit the case records of VIP customers. Option B is incorrect, since setting the case organization-wide default to Public Read Only would give access to all cases to all users. Option C is incorrect, since using a role hierarchy and a read-only ownership-based sharing rule would not give edit access to the marketing consultants. Option D is incorrect, since adding the marketing consultants to the case team would require manual configuration and maintenance.

The OWD for pricebook should be set to Use, which means that users can only view and use price books that are shared with them. This way, sales agents can have access to products and create opportunities for their customers. Option A is incorrect, since Public Read Only would give access to all price books to all users. Option B is incorrect, since Public Read Write would give access and edit rights to all price books to all users. Option C is incorrect, since View is not a valid OWD setting for pricebook.

A sharing rule is missing to share Accounts to the AR team, which could be the issue preventing AR team members from seeing invoices. Since invoice is a custom object with a master-detail relationship to account, its sharing settings are controlled by its parent account. If AR users do not have access to account records, they will not be able to see or query invoice records either. Option A is incorrect, since a sharing rule to share invoices to the AR team would not work, as invoice inherits its sharing settings from account. Option B is incorrect, since assigning an invoice page layout to the AR team profile would not affect their visibility of invoice records. Option D is incorrect, since giving read permission to the invoice object to the Accounts receivable profile would not grant access to invoice records that are owned by other users.

Master-Detail relationships enforce the sharing and security settings of the parent object on the child object. This means that if a user has access to an Account record, they will also have access to any Invoice records that are related to that Account. To prevent this, the architect can recommend replacing the Master-Detail relationship with a Lookup relationship, which allows the child object to have its own sharing and security settings independent of the parent object. Then, the architect can remove the Invoice access from the unauthorized profiles or use other mechanisms such as sharing rules or permission sets to restrict or grant access to the Invoice object. Therefore, the answer C is correct and the other options are incorrect

 Searching for external users is the community functionality that is impacted by having the customer user visibility turned off. When customer user visibility is turned off, community users cannot find or interact with other community users in global search, people search, or chatter. Option B is incorrect, since updating their user profile is not affected by customer user visibility. Option C is incorrect, since creating new customer community users is not affected by customer user visibility. Option D is incorrect, since searching for internal users is not affected by customer user visibility.

Granular locking is an advanced tool that Salesforce can enable for large-scale role hierarchy realignments. Granular locking allows finer-grained locking for certain operations that affect large data sets, such as bulk loading or updating. Granular locking can reduce the locking time and avoid performance issues when changing role hierarchy or ownership. Therefore, the answer C is correct and the other options are incorrect

Reviewing the user provisioning process to not automatically create a user role for any new user and contacting Salesforce support and requesting to increase the number of users’ roles allowed are two recommendations that could solve this problem. Salesforce has a limit on the number of roles that can be created in an organization, which depends on the edition and the number of licenses. If this limit is reached, no more roles can be created unless the limit is increased by Salesforce support. Therefore, it is not advisable to create a new role for every new user, as this would quickly exhaust the limit and cause the “User Role Limit Exceeded” error. Option B is incorrect, since removing role hierarchy from Salesforce org and controlling the record access using Apex managed sharing would be a complex and custom solution that would not address the root cause of the problem. Option D is incorrect, since creating an Apex class to replace the User Roles by generic one as soon as they are created would be unnecessary and inefficient.

 Creating a specific Sharing Reason for the custom object is the best way to make sure that users that gained access to a custom object do not lose access to it when its owner is changed. Sharing Reasons are labels that identify why users or groups have access to records. They are used in Apex managed sharing, which allows developers to programmatically create and maintain sharing rules1. Using ‘‘runAS’’ system method in Apex classes to enforce record visibility, creating a new record in_Share object with RowCause ‘‘Manual’’, and using ‘‘With Sharing’’ keyword to make sure record visibility will be considered are not ways to prevent losing access when the owner changes.

The license recommendation that will meet distributor needs is Partner Community. Partner Community licenses are designed for users who are not employees of UC, but are part of their partner ecosystem, such as distributors, resellers, or suppliers. Partner Community users can access standard CRM objects such as accounts, contacts, leads, opportunities, cases, and campaigns. They can also collaborate with other partners and UC employees using Chatter and Communities. Sales Cloud licenses are for internal sales users who need full access to standard CRM and custom objects. Customer Community Plus licenses are for high-volume customers who need access to standard CRM objects and custom objects, but not opportunities. Customer Community licenses are for low-volume customers who need access only to custom objects and a subset of standard CRM objects.

Service reps will not be able to access all UC contact records if they are controlled by parent and service reps will not be able to access all UC account records because account OWD is private are two details that Salesforce Architects should consider in this scenario. Since service reps are assigned to a profile which has View All in Case object (Private OWD), they can access all case records regardless of ownership or sharing rules. However, this does not grant them access to related contact or account records, unless they have View All or Modify All permissions on those objects as well. If contact records are controlled by parent (account), their sharing settings will depend on the account OWD and sharing rules. If account OWD is private, service reps will only be able to access account records that they own or are shared with them. Implicit sharing does not apply to internal users. Option A and C are incorrect, since service reps will not be able to access all UC contact or account records due to the reasons explained above.

Disabling Grant Access Using Hierarchies and setting an Owner-Based Sharing rule for Strategic Deals team is the best way to design for this requirement. This will ensure that only the owner and the strategic team can access the confidential proposals, regardless of the role hierarchy. Setting the Proposal Owner to the Strategic Deals Team Queue will not work, because queues can only own leads, cases, orders, and custom objects. Setting a Criteria-Based Sharing rule for Strategic Deals team will not work, because criteria-based sharing rules can only grant access, not restrict it.

The most likely reason why some users cannot see the accounts shared with the public group is that their profiles do not have access to the account object. Sharing rules and public groups cannot grant access to an object that is not enabled by the profile. Option A is incorrect, since permission sets do not control record status. Option B is incorrect, since the role hierarchy does not affect sharing rules. Option D is incorrect, since page layouts do not affect visibility

Lead and Case are two objects that support creating queues. Queues are used to route records to a group of users who share workloads. Queues are available for standard objects such as Lead and Case, and custom objects that have a queue-supported lookup field. Option A is incorrect, since Account does not support creating queues. Option B is incorrect, since Opportunity does not support creating queues.

Sharing the list views with the appropriate public group and sharing the list views with the appropriate role in the role hierarchy are two ways that UC can hide lists that are not relevant to an individual user. List view sharing allows users to share list views with other users based on public groups, roles, subordinates, or individual users. This way, users can only see list views that are relevant to them and their work. Option A is incorrect, since sharing list views with a queue is not possible. Option B is incorrect, since sharing list views with individual users would be tedious and inefficient.

Susan and users with the View All Data permission and Susan and users with access to the record are two statements that accurately describe who can view the file by default. When a file is posted to a record’s feed, it inherits the sharing settings of that record. Therefore, only users who can view the record can view the file. Users with the View All Data permission can view all records and files in the organization. Option C is incorrect, since users with a shared chatter post link to the file can only view the file if they have access to the record as well. Option D is incorrect, since Susan is not the only one who can view the file, but also users who have access to the record or the View All Data permission.

To audit user setup in Salesforce, the team needs to have both View Setup and Configuration and View All Users permissions. View Setup and Configuration allows them to access the setup menu and see the user profiles, roles, and permission sets. View All Users allows them to see all the user records and their details, such as login history and assigned licenses

The architect should consider that changing complex role hierarchy can cause a high level of sharing recalculation, and that replacing account records ownerships massively can cause data skew. Changing role hierarchy affects the sharing rules that are based on roles or role and subordinates, which can trigger a recalculation of sharing for all the records owned by users in those roles. Replacing account records ownerships massively can cause data skew, which is a condition where a large number of child records are associated with one parent record, resulting in performance issues. Using a temporary parking lot account to improve performance is not a recommended practice, as it can cause data quality issues and security risks. Restricting the organization-sharing configurations to private is not relevant to this situation, as it does not address the impact of changing roles and reassigning accounts.

 Deferred Sharing Recalculation allows the admin to postpone the recalculation of sharing rules until a later time, which can improve performance and avoid locking issues when changing role hierarchy or ownership. Parallel Sharing Rule Recalculation allows the admin to run multiple sharing rule recalculations at the same time, which can also improve performance and reduce downtime. Granular Locking enables finer-grained locking for certain operations that affect large data sets, such as bulk loading or updating. These features can help avoid problems when reorganizing roles and reassigning account owners. Therefore, the answer B, C, and E are correct and the other options are incorrect

 Ownership-based sharing rules are a way to grant access to records based on the record owner’s role or public group membership. Ownership-based sharing rules can be used to share records with Partner Community users, who are not supported by sharing sets. In this case, ownership-based sharing rules can be used to share Case and Container records owned by partner managers and partner users with other partner managers at the same distributor. Therefore, the answer D is correct and the other options are incorrect .

 Creating a Permission Set that grants “View All” permission for Opportunity is the best approach to meet the requirements. This will allow the Sales Reporting team to view all Opportunity records without changing their profile or OWD settings. Creating a Permission Set that grants “View All Data” permission would give them access to all data in the org, which is not necessary. Making Opportunity OWD read-only would affect all users in the org, which may not be desirable. Giving “View All Data” permission to the Sales Reporting Profile would also give them access to all data in the org, which is not necessary