Which Apex method is used to check if the current user can create records of a specific object?

Schema.sObjectType.Account.isDeletable()

Schema.sObjectType.Account.isAccessible()

Schema.sObjectType.Account.isCreateable()

Schema.sObjectType.Account.isUpdateable()

Which practice is the most effective way to prevent SOQL injection in Apex?

Validating that user input contains only alphanumeric characters

Escaping single quotes in user input

Using binding variables in SOQL queries

Using String.escapeSingleQuotes() on the entire query

What is a risk of using the 'id' parameter from the page URL in a Visualforce controller without validation?

It can cause a Visualforce page to crash

It can expose the controller's internal state

It can lead to SOQL injection if used in a query

It can allow a user to access records they are not authorized to see

A developer wrote an Apex method that takes a string parameter `accountName` and uses it in a SOQL query: `SELECT Id FROM Account WHERE Name = :accountName`. The method is exposed via a custom REST API. What is the security risk?

SOQL injection, because the parameter is used in a dynamic query.

No risk, because binding variables prevent SOQL injection.

Object traversal, because the query returns all fields of Account.

Unauthorized data visibility if the class is not sharing-enforced.

How can a Visualforce controller enforce sharing rules for the current user?

By using the 'without sharing' keyword in the page's tag

By declaring the controller class with 'with sharing'

By setting the 'sharing' attribute on the tag to 'true'

By using the System.runAs() method in the controller

SalesforceCertified Sharing and Visibility Architect

Domain 3Objective 2

Given a Scenario, Describe How to Minimize Security Risks in Programmatic Customizations (Apex and Visualforce) Relative to Data Visibility. SHARING-AND-VISIBILITY-ARCHITECT Practice Questions (Page 3)

Part of the PROGRAMMATIC SHARING domain, which accounts for 25% of the SHARING-AND-VISIBILITY-ARCHITECT exam.

27questions here

6free pages

10concepts

25%of the exam

10 Concepts in This Objective

Apex Security Risks
Visualforce Security Risks
Enforcing Sharing in Apex
Enforcing Sharing in Visualforce
CRUD and FLS Enforcement
Using Security Methods
Mitigating SOQL Injection
Mitigating XSS in Visualforce
Secure Data Binding
Testing Security Controls

Questions 11–15

11foundation · easy
Which Apex method is used to check if the current user can create records of a specific object?
Select an answer first
12foundation · easy
Which practice is the most effective way to prevent SOQL injection in Apex?
Select an answer first
13foundation · easy
What is a risk of using the 'id' parameter from the page URL in a Visualforce controller without validation?
Select an answer first
14application · medium
A developer wrote an Apex method that takes a string parameter `accountName` and uses it in a SOQL query: `SELECT Id FROM Account WHERE Name = :accountName`. The method is exposed via a custom REST API. What is the security risk?
Select an answer first
15foundation · easy
How can a Visualforce controller enforce sharing rules for the current user?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SHARING-AND-VISIBILITY-ARCHITECT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Salesforce. “SHARING-AND-VISIBILITY-ARCHITECT” is a trademark of its owner, used for identification only.