Given a Scenario, Describe How to Minimize Security Risks in Programmatic Customizations (Apex and Visualforce) Relative to Data Visibility. SHARING-AND-VISIBILITY-ARCHITECT Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is 'object traversal' in the context of Apex security risks?

   • AAccessing related objects through relationship queries without checking user permissions
   • BQuerying fields that are not visible to the user
   • CIterating over a list of sObjects in a loop
   • DUsing the 'with sharing' keyword to limit record access
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which Apex code pattern is a common security risk that can lead to unauthorized data visibility?

   • AUsing System.debug to log query results
   • BUsing static SOQL with binding variables
   • CApplying the 'with sharing' keyword to a class
   • DUsing dynamic SOQL with concatenated user input
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A developer wrote an Apex class that queries Account records and returns them to a Visualforce page. The class is declared without the 'with sharing' keyword. The org has private sharing on Accounts, and the running user is a sales rep who should only see their own accounts. What is the most likely security risk?

   • AThe class will fail to compile because sharing must be explicitly declared.
   • BThe class will enforce sharing only if the user has the 'View All Data' permission.
   • CThe class will run in system context and bypass sharing rules, exposing all accounts to the sales rep.
   • DThe class will enforce sharing only for the first 100 records returned.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the risk of using dynamic SOQL with concatenated user input?

   • AIt can slow down query performance
   • BIt can cause a runtime error if the input contains special characters
   • CIt can bypass field-level security
   • DIt can allow an attacker to modify the query and access unauthorized data
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What does the System.stripInaccessible method do in Apex?

   • AIt deletes records that are not shared with the user
   • BIt removes records from query results that the user cannot access
   • CIt strips all user input from a string to prevent injection
   • DIt removes fields from query results that the user cannot access
   Reveal Solution Discussion Select an answer first