Demonstrate How to Properly Enforce Object and Field Level Permission When Designing Programmatic Solutions. SHARING-AND-VISIBILITY-ARCHITECT Practice Questions (Page 4)

Questions 16–17

1. 16expert · hard

   A developer is writing an Apex REST API that returns a list of custom object records. The API is called by an external system. The developer wants to ensure that the API returns a 403 Forbidden status if the user does not have read access to the object, and a 400 Bad Request status if the user does not have FLS access to a specific field. Which approach should be used?

   • ACheck object-level access with isAccessible() and field-level access with isAccessible() on the field, and throw custom exceptions mapped to the appropriate HTTP status codes.
   • BUse System.runAs() to run the query as a system administrator.
   • CUse the WITH SECURITY_ENFORCED clause in the SOQL query and let the default exception propagate.
   • DUse Database.query() without any access level parameter.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   A Visualforce page displays a custom field from an Account record. Which Visualforce attribute is used to enforce field-level security by hiding the field if the user does not have access?

   • Arendered
   • Bvalue
   • Cstyle
   • Did
   Reveal Solution Discussion Select an answer first