Salesforce Plat-Arch-205 - Salesforce Certified Platform Sharing and Visibility Architect

The architect must extend the Shield Platform Encryption policy to include the additional supported Account fields and also address the data that already exists. Enabling encryption for a field establishes the policy for the field, but historical values that were stored before the change must be brought into the encrypted state through the platform ' s data synchronization or re-encryption process. That is why simply waiting for an activation notification is not sufficient to guarantee that every existing value has been encrypted. Classic Encryption is also not a substitute for the Shield Platform Encryption architecture that the organization already uses. The secure implementation treats encryption as a lifecycle concern: select supported fields, activate the policy, ensure key material and tenant-secret management are correct, synchronize existing data, and validate the resulting encryption state. This preserves a consistent enterprise encryption model instead of mixing encryption technologies. Study Guide reference: Access to Other Data - Shield Platform Encryption, encryption policies, key management, existing-data synchronization, field encryption, and data-at-rest protection.

Because the Account page layout did not change, the next control to inspect is Field-Level Security and effective field accessibility. Salesforce can hide a field from a user even when that field remains present on the assigned page layout. The Field Accessibility view in Object Manager provides a consolidated way to determine whether a field is visible, read-only, or hidden for the relevant profile and configuration. This is a better diagnostic than logging in and checking several records because the symptom is field-level, not record-specific. A Who Sees What analysis focuses on record visibility and therefore does not explain why one field disappeared while the user can still open the Account. The administrator should verify the affected field ' s FLS for the user ' s profile and any relevant permission-set assignments, then confirm that the page layout and record type do not impose additional presentation restrictions. Field-Level Security is the enforceable security boundary; page layout placement alone is not. Study Guide reference: Permissions to Standard Objects, Custom Objects, and Fields - Field-Level Security, field accessibility, profiles, permission sets, and page layouts.

Salesforce Content Deliveries are designed to distribute files externally through generated links and include an option to require a password before the recipient can access the content. That directly satisfies the CISO ' s requirement without adding a third-party product or building an Experience Cloud site solely for file delivery. A content delivery can provide a controlled external URL while the password is communicated separately to the customer. Administrators can also establish organization-level policies for content-delivery password behavior so the security requirement is applied consistently. An Experience Cloud site would introduce identity, licensing, and site-management overhead that is unnecessary when the business simply needs to send a protected file link. The architect should still consider the sensitivity of the content, expiration requirements, and broader information-governance policy when deciding whether content delivery is appropriate for a particular file. Study Guide reference: Access to Other Data - Salesforce Files, Content Deliveries, external file access, password protection, and secure content distribution.

A Default Account Team is designed for sales representatives who repeatedly collaborate with the same internal specialists on customer Accounts. The representative can define recurring team members such as legal, engineering, or finance and specify the access each team member receives to the Account and, where applicable, related Opportunities and Cases. The default team can then be applied automatically to new or transferred Accounts or added to existing Accounts, eliminating the repetitive manual-sharing work described in the scenario. A criteria-based sharing rule is better suited to record access determined by stable record attributes and a fixed audience; it does not model a recurring collaboration team tied to a particular salesperson. View All Data would be dramatically overprivileged because it bypasses record-level controls across the organization. Default Account Teams therefore improve productivity while preserving least privilege and making the collaboration relationship explicit. Study Guide reference: Access to Records - Default Account Teams, team roles, related-record access, collaboration, and least-privilege sharing.

The relevant Experience Cloud capability is Super User access, which gives selected external users broader visibility to records belonging to other users associated with the same external account. For Customer Community Plus, the modern terminology commonly used is Portal Super User; the answer choice uses the broader or legacy Partner Super User wording, but it represents the same architectural concept being tested. Delegated external-user administration focuses on managing external users rather than granting broad same-account Case visibility, and a generic community-administration permission is not the record-sharing mechanism required. Super User access should be assigned only to carefully selected agents because it materially expands what they can see within the distributor account. The organization ' s external OWD can remain restrictive between distributors while the elevated user receives the intended same-account visibility. Study Guide reference: Access to Records - Customer Community Plus, Super User access, same-account Case visibility, external-user administration, and Experience Cloud least privilege.