Given a Scenario, Describe How to Minimize Security Risks in Programmatic Customizations (Apex and Visualforce) Relative to Data Visibility. SHARING-AND-VISIBILITY-ARCHITECT Practice Questions (Page 1)

Questions 1–5

1. 1expert · medium

   A developer is writing an Apex method that queries Accounts based on a user-provided ID. The method uses `Database.query('SELECT Id, Name FROM Account WHERE Id = \'' + inputId + '\'')`. What is the most secure way to rewrite this query?

   • AUse `System.debug` to log the query and manually review it for injection.
   • BUse a binding variable: `SELECT Id, Name FROM Account WHERE Id = :inputId`.
   • CUse `Database.query` with the input directly concatenated, but add a try-catch block.
   • DUse `String.escapeSingleQuotes(inputId)` and concatenate it into the query string.
   Reveal Solution Discussion Select an answer first
2. 2expert · medium

   A developer is writing a batch Apex class that processes all Account records to update a custom field. The class must run as a system administrator, but the batch job is scheduled and runs in the background. The org has private sharing on Accounts. What is the most appropriate sharing declaration for this class?

   • ADeclare the class `with sharing` to enforce sharing rules for the running user.
   • BUse `without sharing` and add a check for the user's profile to ensure they are an administrator.
   • CDeclare the class `without sharing` to ensure all records are processed regardless of the running user's sharing.
   • DUse `with sharing` and add `System.runAs` to run as a user with 'View All Data'.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which Visualforce page practice is a common security risk?

   • AUsing the <apex:outputText> component with escape="true"
   • BUsing the <apex:form> component to wrap input fields
   • CDisplaying user input directly using <apex:outputText> without escaping
   • DBinding a controller property to an <apex:inputText> component
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A Visualforce page uses a custom controller that is declared `without sharing`. The controller queries Opportunity records and displays them. The org uses private sharing on Opportunities. What is the security risk?

   • AThe controller will enforce sharing only for the first 100 records returned.
   • BThe controller will run in system context and bypass sharing rules, exposing all opportunities to the user.
   • CThe controller will fail to compile because sharing must be declared.
   • DThe controller will enforce sharing only if the user is a system administrator.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A developer wrote the following Apex code in a controller extension: `String searchTerm = ApexPages.currentPage().getParameters().get('search'); List<Account> accounts = Database.query('SELECT Id, Name FROM Account WHERE Name LIKE \'%' + searchTerm + '%\'');` What is the most significant security risk in this code?

   • ACross-site scripting, because the search term is not encoded before being used.
   • BSOQL injection, because user input is concatenated directly into a dynamic query.
   • CObject traversal, because the query returns all fields of the Account object.
   • DNo risk, because Database.query is safe as long as the user is authenticated.
   Reveal Solution Discussion Select an answer first