Plat-Admn-301 — Salesforce Certified Advanced Administrator

Full question text, answer options, and explanations for this practice set — a spoiler-free alternative is the interactive quiz above for scored, shuffled practice.

1. 1. A user's record access is determined by multiple sharing mechanisms. What is the correct order in which Salesforce evaluates record access?

   • A. Sharing Rules → Role Hierarchy → OWD → Manual Sharing
   • B. OWD (baseline) → Role Hierarchy → Sharing Rules → Manual Sharing (most permissive wins)(correct)
   • C. Profiles → Permission Sets → OWD → Role Hierarchy
   • D. Record ownership → Apex Managed Sharing → Role Hierarchy → OWD

   Explanation: Salesforce record access uses an additive model starting from the most restrictive baseline: OWD defines the floor, then access is extended upward via role hierarchy, then sharing rules (criteria-based and owner-based), then manual sharing, then Apex managed sharing. The most permissive access granted wins. FLS and profile permissions are evaluated separately from sharing.

2. 2. An administrator needs to grant a group of users read access to all Accounts owned by users in a specific role, regardless of the normal OWD (Private). Which mechanism is most appropriate?

   • A. Criteria-Based Sharing Rule on Account matching all records
   • B. Owner-Based Sharing Rule: Share Account records owned by users in [Role] with [Public Group] as Read Only(correct)
   • C. Change the Account OWD from Private to Public Read Only
   • D. Add the users to the role whose records they need to see

   Explanation: Owner-Based Sharing Rules extend access to records owned by users in a specific role/group to another group. This is more targeted than changing OWD (which affects all records for all users). Criteria-Based Sharing Rules share records matching criteria regardless of owner. Changing OWD would expose ALL Account records to ALL users — too broad.

3. 3. What is the difference between 'Grant Access Using Hierarchies' setting on a sharing rule and the standard role hierarchy?

   • A. 'Grant Access Using Hierarchies' controls whether sharing rules extend access upward through the role hierarchy
   • B. 'Grant Access Using Hierarchies' is an OWD setting that enables the role hierarchy to extend access upward for that object(correct)
   • C. Both are identical — the role hierarchy always grants upward access regardless of this setting
   • D. 'Grant Access Using Hierarchies' is a Sharing Rule type that uses parent-child relationships

   Explanation: 'Grant Access Using Hierarchies' is a checkbox on the OWD settings for custom objects (and some standard objects). When enabled, users higher in the role hierarchy can see records owned by subordinates — the standard role hierarchy behavior. When disabled (only possible for custom objects), the role hierarchy does NOT extend access for that object, giving admins tighter control for sensitive custom data.

4. 4. What is a Permission Set Group in Salesforce?

   • A. A group of users who share the same permission set
   • B. A container that bundles multiple Permission Sets together so they can be assigned as a single unit to users(correct)
   • C. A set of sharing rules grouped together for bulk application
   • D. An alternative to Profiles that replaces them entirely

   Explanation: Permission Set Groups bundle multiple related Permission Sets into a single assignable unit. Assigning a Permission Set Group to a user grants all the permissions from all included Permission Sets simultaneously. This simplifies permission management for complex roles (e.g., a 'Sales Manager' group containing 'CRM Access', 'Forecast Management', and 'Reports Admin' permission sets).

5. 5. Which of the following Salesforce features protect data at rest with encryption? (Select TWO)

   • A. Salesforce Shield Platform Encryption (encrypts standard and custom fields at the database level)(correct)
   • B. Classic Encryption (encrypts custom text fields with AES-128, shown as masked values)(correct)
   • C. Field-Level Security (FLS) — hides fields from unauthorized users
   • D. TLS in transit encryption for API calls to Salesforce

   Explanation: Data at rest encryption: Shield Platform Encryption uses AES-256 to encrypt standard and custom fields at the database level (transparent to authorized users, opaque in backups). Classic Encryption encrypts individual custom text fields with AES-128 and shows masked values — legacy and limited. FLS hides fields from the UI but data is not encrypted at rest. TLS protects data in transit, not at rest.

6. 6. An administrator wants to create a custom object that tracks support cases for specific products, where each support case record must always have a parent product record. Which relationship and what behavior apply?

   • A. Lookup (Required) — the product field must be populated but deleting the product does not cascade
   • B. Master-Detail — the support case (detail) cannot exist without the product (master); deleting the product deletes all associated support cases(correct)
   • C. External Lookup — references a product record in an external system
   • D. Indirect Lookup — links the records via an External ID field

   Explanation: Master-Detail is the correct choice when a child record should not exist without its parent and cascade delete is desired. The support case (detail) inherits owner and sharing from the product (master). Deleting the product triggers cascade deletion of all related support cases. A required Lookup prevents saving without a parent but does not cascade on delete.

7. 7. What is the maximum number of Master-Detail relationships a single custom object can have?

   • A. 1
   • B. 2(correct)
   • C. 5
   • D. 25

   Explanation: A custom object can have a maximum of 2 Master-Detail relationships. This is why junction objects (for many-to-many relationships) work — they use both slots for their two master-detail fields. An object can have many more Lookup relationships (up to 40 total relationship fields including lookups and master-details combined).

8. 8. Which Salesforce feature provides a log of all login attempts, including successful and failed logins, login time, and IP address?

   • A. Setup Audit Trail
   • B. Login History(correct)
   • C. Field History Tracking
   • D. Debug Logs

   Explanation: Login History (Setup > Users > Login History) records all login attempts — successful, failed, and challenged — with timestamp, user, source IP, login type, and browser/API. It retains 6 months of data. Setup Audit Trail logs setup configuration changes. Field History Tracking logs field value changes on records. Debug Logs capture Apex/Flow execution details.

9. 9. An administrator changed a user's profile 3 weeks ago and the change needs to be audited. Where should the administrator look?

   • A. Login History
   • B. Field History Tracking on the User object
   • C. Setup Audit Trail (retains 180 days of configuration changes)(correct)
   • D. Debug Logs

   Explanation: Setup Audit Trail (Setup > Security > View Setup Audit Trail) captures metadata and configuration changes made in Setup, including user profile changes, permission set assignments, object/field creation, and more. It retains the last 180 days (6 months) of changes. The Field History Tracking on User only tracks specific field changes if enabled for that field.

10. 10. A Sales Director wants all reps to see each other's Opportunities in the pipeline but not edit them. The current OWD for Opportunity is Private. What is the correct solution?

    • A. Change the Opportunity OWD to Public Read Only
    • B. Create a Criteria-Based Sharing Rule to share all Opportunities with the 'All Internal Users' group as Read Only(correct)
    • C. Add all reps to the same role so the role hierarchy grants access
    • D. Change each rep's profile to include 'View All' on Opportunities

    Explanation: A Criteria-Based Sharing Rule that shares all Opportunity records (no filter or filter matching all records) with 'All Internal Users' as Read Only is the targeted solution. Changing OWD to Public Read Only is broader and can't be done just for one group. Role hierarchy already grants upward visibility — it doesn't help peers in the same role. 'View All' grants access to ALL data beyond just pipeline.

11. 11. Enterprise Territory Management uses 'Territory Types', 'Territories', and 'Territory Models'. What is the purpose of a Territory Model?

    • A. A geographical map overlay showing sales territory boundaries
    • B. A complete representation of a company's territory hierarchy, including all territory types and territories, which can be activated, archived, or run in planning state(correct)
    • C. A set of assignment rules that determine which rep owns each Account
    • D. A forecast model based on territory rather than role hierarchy

    Explanation: In Enterprise Territory Management, a Territory Model is the container for the entire territory hierarchy. An org can have multiple models in different states (Planning, Active, Archived) but only one Active model at a time. Territory Types categorize territories (e.g., Named Account, Geographic). Territories are the specific sales areas within the model hierarchy.

12. 12. What does 'Opportunity Splits' allow sales teams to do in Salesforce?

    • A. Divide an Opportunity into multiple smaller deals across different close dates
    • B. Assign revenue credit across multiple team members on a single Opportunity, with configurable percentage splits for quota attribution(correct)
    • C. Split forecast amounts between two fiscal periods
    • D. Divide the Opportunity Amount into installment payments

    Explanation: Opportunity Splits allow multiple team members to receive credit (quota and revenue attribution) for a single Opportunity. Revenue Split types must add up to 100%. Overlay Split types can exceed 100% (for indirect contributors). This supports complex selling scenarios with account executives, overlay reps, and sales engineers.

13. 13. An administrator enables Omni-Channel in Service Cloud. What does Omni-Channel do?

    • A. Routes work items (Cases, Leads, Chat sessions) to the most appropriate available agent based on skills, capacity, and channel(correct)
    • B. Integrates Salesforce with external CRM systems via a single API
    • C. Provides a unified inbox for agents to receive emails, calls, and chats simultaneously
    • D. Enables customers to contact support via multiple channels simultaneously

    Explanation: Omni-Channel is Salesforce's intelligent routing engine. It automatically assigns work items (Cases, Live Chat, Messaging sessions, Leads) to the most appropriate available agent based on configured rules: agent capacity (work item limits), presence status (available/busy/away), and optionally skills-based routing. Supervisors can monitor queues in real time via the Omni-Channel Supervisor tab.

14. 14. What are Entitlements and Milestones used for in Service Cloud?

    • A. Entitlements define the support services customers are entitled to; Milestones are required steps within those entitlements with time-based targets (e.g., respond within 2 hours)(correct)
    • B. Entitlements are SLA contracts stored in Contract object; Milestones are related list items
    • C. Entitlements restrict which customers can create Cases; Milestones are approval steps
    • D. Entitlements are badges earned by agents; Milestones are monthly performance targets

    Explanation: Entitlements define what support a customer is entitled to (e.g., phone support, 24/7 support). Milestones are time-based targets within an entitlement — required steps cases must reach within a time limit (e.g., First Response within 2 hours, Case Resolved within 8 hours). When milestones are violated, warning and escalation actions can trigger automatically.

15. 15. What is the purpose of a 'Macro' in Service Cloud?

    • A. An automated rule that runs when a Case is created
    • B. A saved sequence of actions that agents can execute with one click to quickly perform repetitive tasks (e.g., update case fields, send email templates)(correct)
    • C. A batch script that processes cases overnight
    • D. A Knowledge Article template for common resolutions

    Explanation: Macros are one-click automation tools for service agents. A Macro contains a series of instructions (update Case fields, select email template, log a note, close case) that agents execute with one click from the Case record. They reduce average handle time and ensure consistent process adherence without requiring agents to perform repetitive manual steps.

16. 16. An administrator needs to delete 200,000 outdated Lead records. Which tool is most appropriate?

    • A. Data Import Wizard (only supports insert and update, not delete)
    • B. Data Loader (supports delete and hard delete via bulk operations)(correct)
    • C. Mass Delete Records (limited to 250 records per operation)
    • D. SOQL query in the Developer Console (cannot perform DML)

    Explanation: Data Loader supports delete operations (moves records to Recycle Bin) and hard delete operations (bypasses Recycle Bin) using a CSV of record IDs. For 200,000 records, Data Loader's Bulk API mode handles the volume efficiently. Mass Delete Records is limited to 250 records per operation. Data Import Wizard does not support delete operations.

17. 17. What is the purpose of 'Duplicate Management' in Salesforce (Duplicate Rules + Matching Rules)?

    • A. To automatically merge duplicate records without user intervention
    • B. Matching Rules define how records are compared for similarity; Duplicate Rules define what happens when a potential duplicate is detected (alert, block, or allow)(correct)
    • C. Duplicate Rules prevent any two records with the same Name from being created
    • D. To identify records that should be archived based on age and duplicate status

    Explanation: Salesforce Duplicate Management has two components: Matching Rules define the algorithm for identifying similar records (e.g., fuzzy match on Name + Email for Contacts). Duplicate Rules define the action when a match is found: Alert (show warning but allow), Block (prevent save), or Report (allow but log for review). They work together to prevent data quality degradation without blocking legitimate entries.

18. 18. Which of the following are features of Salesforce Data Backup and Recovery? (Select TWO)

    • A. The Recycle Bin holds deleted records for 15 days before permanent deletion(correct)
    • B. Data Export (weekly or monthly CSV exports) can be scheduled for compliance and backup purposes(correct)
    • C. Salesforce automatically restores deleted records daily without admin action
    • D. The 'Restore' function allows restoring specific records from any point in time up to 1 year

    Explanation: Salesforce's built-in backup options: Recycle Bin holds deleted records for 15 days (or until manually emptied), allowing admins/users to restore them. Data Export (Setup > Data Export) allows scheduling weekly or monthly full org data exports as ZIP files of CSV data for offsite backup. There is no automated daily restore, and the 1-year point-in-time restore described would require a third-party backup solution.

19. 19. What is Salesforce Files and how does it differ from Salesforce CRM Content (Libraries)?

    • A. Salesforce Files is the modern, native file storage system tied to records and Chatter; CRM Content/Libraries provides categorized, version-controlled document libraries with tagging and search(correct)
    • B. Salesforce Files stores files externally; CRM Content stores files internally
    • C. They are identical — Salesforce Files is just the new name for CRM Content
    • D. CRM Content is for customer-facing files; Salesforce Files are for internal only

    Explanation: Salesforce Files (ContentDocument/ContentVersion objects) is the core file storage, tied to records and Chatter posts, with versioning and sharing. Salesforce CRM Content (Libraries) adds a structured layer: folders/libraries, content types, tagging, subscriptions, content delivery links, and advanced search. They share the same underlying ContentDocument storage but CRM Content adds governance and discovery features.

20. 20. A company is deploying Salesforce customizations from sandbox to production. Which deployment method supports version control integration and package-based deployment?

    • A. Change Sets (outbound from sandbox to production via UI)
    • B. Salesforce DX with the SFDX CLI and unlocked packages(correct)
    • C. Manual recreation of all configurations in production
    • D. AppExchange managed packages

    Explanation: Salesforce DX (Developer Experience) with the SFDX CLI uses source-driven development with Git version control. Unlocked Packages group related metadata into versioned, installable packages with explicit dependency management. This is Salesforce's recommended approach for DevOps teams. Change Sets are UI-based and don't integrate with source control. AppExchange packages are for distributing ISV solutions, not internal deployments.

21. 21. What is a 'Joined Report' in Salesforce and when is it used?

    • A. A report that merges data from two external databases into a single view
    • B. A report with multiple blocks, each using a different report type, displayed side-by-side to allow comparison of different data sets(correct)
    • C. A report that performs SQL-style JOINs between Salesforce objects
    • D. A report that combines results from two separate report runs into one output

    Explanation: Joined Reports allow multiple report blocks (each with a different report type or different filters) on the same canvas. Each block shows related data — for example, Block 1 (Opportunities this quarter) and Block 2 (Cases this quarter) for the same accounts. Cross-block filters and formulas can reference data across blocks. Useful for side-by-side comparisons.

22. 22. A dashboard is displaying data as of last Monday, but users need to see real-time data. What should the administrator check?

    • A. The dashboard's 'Auto-Refresh' option in the dashboard settings
    • B. Whether the dashboard is scheduled to refresh on a specific day and the schedule hasn't run yet(correct)
    • C. The sharing settings of the underlying reports
    • D. The running user's license type

    Explanation: Dashboards in Salesforce are not automatically refreshed in real time — they display data as of the last refresh. If a dashboard is set to refresh on a schedule (e.g., weekly on Monday), it will show that week's snapshot until the next scheduled refresh runs. Users can manually click 'Refresh' to get the latest data. Administrators can also configure the schedule or enable users to refresh themselves.

23. 23. Which of the following are valid ways to filter a dashboard dynamically? (Select TWO)

    • A. Dashboard Filters (configurable by the viewer at runtime without rebuilding reports)(correct)
    • B. Dynamic Dashboards (the dashboard data reflects each viewer's own data access, not a fixed running user)(correct)
    • C. Row-Level Formula Filters in each underlying report
    • D. Profile-based dashboard visibility rules

    Explanation: Dashboard Filters add drop-down or text filter controls to the dashboard that viewers can adjust (e.g., filter by Region). Each filter maps to a field filter in the underlying reports. Dynamic Dashboards display data based on the viewing user's own access, not a fixed running user — each viewer sees their own pipeline instead of a global view. Row-Level Formulas and profile rules are not dynamic dashboard filter mechanisms.

24. 24. A complex business process requires checking a related Account's field, creating child records, sending platform events, and calling an Apex method — all triggered when an Opportunity is Closed Won. Which automation tool handles all of these in a single declarative solution?

    • A. Workflow Rules with multiple actions
    • B. Record-Triggered Flow (After Save) with Get Records, Create Records, Platform Event Publish, and Apex Action elements(correct)
    • C. Process Builder with Apex-called actions
    • D. Approval Process with multiple action types

    Explanation: Record-Triggered Flows (After Save) can: get related records (Get Records), create child records (Create Records), publish Platform Events (Publish Message), and call Apex Invocable methods — all in a single flow. This covers the full automation scenario declaratively. Workflow Rules are being retired and have limited action types. Process Builder is also being retired. Approval Processes are for human review workflows, not automation logic.

25. 25. A Scheduled Flow runs nightly to update records that meet a specific criteria. Today the flow failed with a 'MIXED_DML_OPERATION' error. What does this error indicate?

    • A. The Flow is attempting to update both setup objects (e.g., User) and non-setup objects (e.g., Account) in the same transaction, which Salesforce doesn't allow(correct)
    • B. The Flow exceeded the nightly record limit for scheduled operations
    • C. Two Flows attempted to update the same record simultaneously
    • D. The Flow's running user doesn't have permission to update the records

    Explanation: MIXED_DML_OPERATION errors occur in Salesforce when a single transaction attempts DML operations on both setup objects (User, Profile, Permission Set, etc.) and non-setup objects (Account, Contact, etc.) in the same transaction. Salesforce prohibits this combination. The solution is to separate the DML operations into different transactions, typically using asynchronous processing (e.g., a second flow or queueable Apex).