Study guide

Study guide for chapter 12 of the Securing Salesforce: Sharing and Visibility course. Read the eight modules first; this page helps you check what stuck.

About this study guide. It’s built only from this course’s own content and the published Salesforce exam guide’s list of objectives. It is never based on real exam questions, and it doesn’t claim to know what’s on the exam. If you’ve taken the exam, please don’t send me questions from it: the certification agreement forbids sharing them, and memorizing answers is the wrong way to become an architect anyway.

This chapter teaches a whole section of the exam, Access to Other Data (16% of the exam), which has one objective: access controls for data that isn’t a standard or custom object, such as files, reports, dashboards and big objects. The exam guide aligns to Winter ‘23, and a few things have changed since then, so those are in their own list at the end. Know both, and know which date each belongs to.

For the Exam

Tick them off as you go. Each one links to where it’s taught.

Two questions (supports OTH-1)

I can ask both questions of any cabinet: who can open the container, and whose access fills what’s inside. (Two questions for every cabinet)
I know the four kinds: follows record sharing; a model of its own; someone else’s access; permissions only. (Four kinds of cabinet)

Files (supports OTH-1)

I know the three file settings: private, privately shared and your company, and that file sharing isn’t the share table. (Three settings)
I know the four ways into a file: shared directly, on a record, in a library, and by a link. (Four ways into a file)
I know File Privacy on Records: visible to anyone with record access, or Private on Records, only the owner. (On a record)
I know a library has its own members and permissions, that a public group is the right member, and that a guest member makes the library public. (In a library)
I know anyone with a public link can download the file, that single-file links expire in 90 days by default, and that folder links have no password or expiry. (By a link)
I know View All Data sees files it doesn’t own, except in a private library. (And the overrides)
I know owner, collaborator and viewer, and that a viewer can share the file on. (Owner, collaborator, viewer)

Chatter groups (supports OTH-1)

I know a Chatter group isn’t a public group. (Chatter Groups)
I know public, private and unlisted groups, and that View All Data and Modify All Data see private groups but not unlisted ones unless they’re members. (Three kinds of Chatter group)
I know Manage Unlisted Groups is the only way into an unlisted group without membership. (Unlisted)
I know a file posted to a group is shared with the group, and that private and unlisted groups can include customers. (Where a group lets a file out)

Reports and dashboards (supports OTH-1)

I know folders are shared with users, groups, roles or territories, as viewer, editor or manager, and that the greatest level wins. (The folder)
I know Manage Reports in Public Folders and Manage Dashboards in Public Folders are needed to share folders. (The folder)
I know a report shows each viewer only the records they can see. (The report)
I know a static dashboard shows every viewer its running user’s data, and Salesforce’s warning that viewers can see more than they normally have. (The dashboard)
I know a dynamic dashboard runs as the viewer, and that editions limit how many you can have. (Dynamic dashboards have limits)

Knowledge (supports OTH-1)

I know that by default articles have no org-wide defaults, sharing rules or manual sharing, and that data category visibility comes from role, permission set or profile. (The default: data categories)
I know a visible category brings its whole family line, an article needs one visible category from each of its groups, and a child role can’t see more than its parent. (The default: data categories)
I know high-volume site users have no role, so they need a permission set or profile for categories. (The default: data categories)
I know Lightning Knowledge can use standard sharing instead, without manual or Apex sharing. (The other option)
I know the four channels: internal app, customer, partner and public knowledge base. (Whichever model)

Calendars and events (supports OTH-1)

I know the activity defaults, Private and Controlled by Parent, and that Private still lets anyone who can read the related record read the activity. (Through the record)
I know the calendar levels and the default, Hide Details and Add Events. (Through the calendar)
I know admins can’t give coworkers access to event details; only the user can. (Each user opens their own calendar)
I know a private event is hidden on the calendar but not from View All Data, Modify All Data or exports, and can’t be related to a record. (The Private checkbox)

CRM Analytics (supports OTH-1)

I know datasets are loaded by the Integration User, with View All Data, and that without row-level security anyone with the dataset sees every record. (Two questions again)
I know the two kinds of row-level security: sharing inheritance and security predicates. (Row-level security, two ways)
I know sharing inheritance comes from one object per dataset, from Account, Case, Contact, Lead or Opportunity, is for Salesforce users only, and needs a backup predicate. (Where sharing inheritance stops)
I know Experience Cloud sites need security predicates. (Where sharing inheritance stops)

Big and external objects (supports OTH-1)

I know big objects support only object and field permissions, not sharing rules. (Big objects)
I know external objects don’t support record-level sharing, and that restriction rules work on the OData 2.0, OData 4.0 and cross-org adapters. (In Salesforce: restriction rules)
I know the identity types, named principal and per user, and that with a named principal every user sees what that one login sees. (In the other system)

What changed since the exam’s Winter ‘23 alignment (dated, beyond the exam today)

I know that since Spring ‘26, the Delete Salesforce Files permission lets chosen users delete files they don’t own, without Modify All Data. (Who can delete a file)
I know that since Summer ‘26, list views have the narrower Manage Shared List Views permission. (Three permissions, in chapter 7)

Beyond the Exam

The exam is the floor, not the ceiling. These are the habits from this chapter that an architect needs, whether or not a question ever asks about them.

Ask both questions of every cabinet, and never assume the second answer is the viewer’s own access.
Treat public links as the widest door. Decide who may make them, and require a password for anything confidential.
Share libraries and folders with groups, not people.
Keep the override list short: View All Data, Modify All Data, Manage Unlisted Groups, and the folder-sharing permissions.
Choose every running user on purpose, and spend the few dynamic dashboards where the numbers are sensitive.
Know which Knowledge model the org uses, and who can tick Visible in Public Knowledge Base.
Put row-level security on every CRM Analytics dataset, with a backup predicate.
Check the identity type of every external data source before anyone, or any agent, reads through it.
Remember what sharing can’t stop: an export. Watching for that is chapter 19’s job.

Words to Know

Term	In one line
Cabinet	This course’s word for any container of data with its own lock
File Privacy on Records	A file’s setting: visible to anyone with record access, or Private on Records
Library	A shared shelf of files with its own members and permissions
Public link	A URL to a file that anyone who has it can open
Unlisted group	A Chatter group hidden from nonmembers, and even from View All Data
Running user	The user whose access fills a static dashboard for everyone who opens it
Dynamic dashboard	A dashboard that runs as whoever is viewing it
Data category	A tag on a Knowledge article; visibility to categories decides who reads it by default
Channel	Where a Knowledge article can be seen: internal app, customer, partner or public knowledge base
Private event	An event whose details are hidden on the owner’s calendar; it can’t be related to a record
Integration User	The user CRM Analytics loads data as, with View All Data
Sharing inheritance	CRM Analytics row-level security copied from one Salesforce object’s sharing
Security predicate	A filter you write that decides which dataset rows a user sees
Big object	An object for billions of rows, with object and field permissions only
Identity type	Whose credentials Salesforce uses to read an external system: one named login or each user’s own

Check Yourself

Short scenarios in the style of the course. Decide your answer before you open it.

1. A contract file is attached to an opportunity only a few people can see. Someone outside that group still has the file. How might they have got it?

Through one of the other ways in. Someone with access may have shared it directly, posted it to a group, put it in a library, or made a public link, and a viewer can share a file on. The record is only one way into a file. Reread Four ways into a file.

2. An auditor with View All Data says they can't find a file. Where might it be?

In a private library, where only the file owner has access, or posted to an unlisted Chatter group the auditor isn’t a member of. Reread And the overrides and Unlisted.

3. A sales rep can't see another region's opportunities in a report, but sees that region's totals on a dashboard. Is that a bug?

No. The report runs with the rep’s own access; a static dashboard shows everyone its running user’s data. If the totals shouldn’t be seen, make it a dynamic dashboard or choose a running user with less access. Reread The dashboard: whose eyes it uses.

4. A user is added to a report folder's group as viewer and to the folder directly as manager. What access do they get?

Manager. When someone is in more than one entry, the greatest level is granted. Reread The folder: who can open it.

5. A partner portal user with a high-volume license can't see any categorized Knowledge articles. Why?

High-volume site users don’t have roles, and data category visibility for them has to be set by permission set or profile. Until it is, they see no categorized articles. Reread The default: data categories.

6. The activity default is Private, yet a coworker read the notes of a meeting logged against an account. How?

Private only limits who can edit and delete an activity. Anyone who can read the related account can view and report on it. Or the meeting’s owner shared their calendar with Show Details. Reread Through the record and Each user opens their own calendar.

7. A CRM Analytics dashboard shows every opportunity to every user with the app. What's missing?

Row-level security on the dataset. The Integration User loaded it with View All Data, so without sharing inheritance or a security predicate everyone with access sees every row. Inherit sharing from Opportunity, and set a backup predicate for users it can’t cover. Reread Row-level security, two ways.

8. CRM Analytics dashboards are embedded in a customer site, and the dataset uses sharing inheritance. Is that enough?

No. Sharing inheritance only works for Salesforce users, not Experience Cloud site users. The site needs security predicates. Reread Where sharing inheritance stops.

9. Each sales rep must see only their own rows in a big object of order history. Can a sharing rule do it?

No. Big objects support only object and field permissions. Anyone who can read the object reads every row. Split the data, or keep the rows that need different audiences in a normal object. Reread Big objects: permissions only.

10. An external object reads orders from another system through a named principal with an administrator's login. What does every Salesforce user with the object see?

Whatever that administrator’s login can see in the other system. Narrow it with a restriction rule if the adapter supports one, or switch to per user so the other system checks each person’s own access. Reread In the other system: whose credentials.

Explore

Salesforce Certified Platform Sharing and Visibility Architect Exam Guide (opens in a new tab), Salesforce Help (checked 2026-11-07)

The official list of objectives and their weights. Always check the current version before you book an exam.