Part 1 Study Guide: The Front Door and the Offices

The study guide for Part 1 of Securing Salesforce: Sharing and Visibility: five chapters, from thinking like a security architect to the map of every way to share a record. Each chapter has its own study guide with the full checklist; this page puts them together by exam section.

About this study guide. It’s built only from this course’s own content and the published Salesforce exam guide’s list of objectives. It is never based on real exam questions, and it doesn’t claim to know what’s on the exam. If you’ve taken the exam, please don’t send me questions from it: the certification agreement forbids sharing them, and memorizing answers is the wrong way to become an architect anyway.

How to Use This Page

Part 1 is the building: the front door, the offices, and the map of the file cabinets. It finishes most of one exam section and sets up the biggest one. Work through it in this order:

1. Finish each chapter, then tick off its own study guide.
2. Come back here and check each exam section below. If a line doesn’t feel solid, follow it back to its chapter guide.
3. Then try the map from memory: the eight sets, and who or what opens the record in each. If you can draw it, Part 1 has come together.

By Exam Section

The weights come from the published exam guide. Check the current version before you book: Salesforce revises it.

Permissions to Standard Objects, Custom Objects, and Fields (27% of the exam)

Mostly Part 1. Access controls for sensitive data (OBJ-4) and enforcing security in code (OBJ-5) come in Part 3.

• OBJ-1, object permissions for a set of users: profiles kept light, permission sets and permission set groups doing the work, muting, expiring and session-based assignments, user access policies; then the seven object permissions, and the two, View All Records and Modify All Records, that override sharing. Chapters 3 and 4.
• OBJ-2, field permissions for a set of users: a sensitive field starts on no profile but the admin’s and is granted Read, or Read and Edit, in a permission set; field-level security reaches list views, reports, search and the API; what gets around it; checking a field with three users. Chapter 4.
• OBJ-3, hiding data on the screen: page layouts, visibility rules and Dynamic Forms; hiding isn’t securing; data bleed through names and files; the assigned-rep pattern, worked layer by layer. Chapter 4.

Access to Records (39% of the exam)

Part 1 gives you the map; Parts 2 and 3 teach each objective in depth.

• REC-1 to REC-9, the 25 ways: org-wide defaults and the role hierarchy (REC-1, REC-2), sharing rules and groups (REC-3, REC-4), teams (REC-5), implicit sharing between parents and children (REC-6), programmatic sharing (REC-7), external users (REC-8), and the overrides, View All and Modify All (REC-9), each placed on the map with what it is and where it sits. Chapter 5.
• Where record access meets object access: the most restrictive wins, with View All and Modify All as the one exception. Chapters 1 and 5.

Implications of Security Model Choice (18% of the exam)

Started in Part 1. Scale (IMP-1) and testing the model (IMP-3) come later.

• IMP-2, licenses that limit sharing: the user licenses you’ll meet, why a permission set’s license is chosen when you create it, and, on the map, why high-volume external users have no role and no share table. Chapters 3 and 5.
• The habit behind IMP-3: three users, proving the positive and the negative, starts here, for records in chapter 1 and for fields in chapter 4. Chapters 1 and 4.

Access to Other Data (16% of the exam)

Part 2. Part 1 sets it up with the files that follow the record, not the fields (chapter 4).

The front door

The exam’s objectives start once a user is in, so the front door has no objective of its own. It’s still where every architect starts: authentication, multi-factor authentication, login controls, sessions and tokens. Chapter 2.

The Threads Through Part 1

Five chapters, and a few ideas that keep coming back. If you can explain these in your own words, Part 1 has done its job.

• The building, the offices and the file cabinets. Getting in, what you can touch, and which records you can open are three different sets of controls. Chapter 1.
• The most restrictive wins. Where object and record access meet, the lower one decides, except View All and Modify All.
• Grant only the bare minimum, to the fewest people. It’s easier to open up later than to lock it down later, and you plan how access is taken back, not only how it’s given.
• Count the doors. At the front door every way in is a decision, and in the offices you count the doors, not the job titles, when you decide how many profiles you need. Chapters 2 and 3.
• Permission sets do the work. Keep the profile light, and a subsystem isn’t finished until its permission sets are. Chapter 3.
• Hiding isn’t securing. Field-level security goes everywhere the data goes; a page only controls the screen. Chapter 4.
• Prove the negative. A share or a field checked only as the person who should see it is half tested.
• Save code for what the others can’t do. And every piece of code in system mode has a reason and a reviewer. Chapters 4 and 5.
• The share table records most of it, not all of it. Chapter 5.
• AI raises the stakes. An agent runs as a user, so it opens the same doors, offices and cabinets, and finds in seconds what a person might never look for.

Check Yourself

Each chapter’s study guide has its own Check Yourself questions. Work through them in order:

1. Thinking Like a Security Architect
2. The Front Door: Logging In to Salesforce
3. Profiles, Permission Sets and Permission Set Groups
4. Object and Field Security: What Users Can Touch
5. Steve’s 25 Ways to Share a Record: The Map

Where You Are on the Exam

Great work getting through Part 1. You’ve been through the front door and every office, and you’ve seen the whole map of the file cabinets. If you’re an admin, this is the part that changes how you grant access every day. The exam draws on all three parts, though: next is Part 2: The File Cabinets: Sharing Records, where you design the sharing for your own company, and then Part 3 takes you beyond the company and beyond the record. The course page shows the path.

Here’s the whole exam, and where each part of it is taught:

Exam section (weight)	Part 1 (this part)	Part 2 (coming)	Part 3 (coming)
Access to Records (39%)	REC-1 to REC-9: the map	REC-1 to REC-7, REC-9: org-wide defaults and the hierarchy, rules and groups, teams and territories, overrides and implicit sharing, programmatic sharing	REC-8 and REC-9: external users, sharing sets and share groups, restriction and scoping rules
Permissions to Standard Objects, Custom Objects, and Fields (27%)	OBJ-1, OBJ-2, OBJ-3	—	OBJ-4 and OBJ-5: encryption and monitoring, secure Apex
Implications of Security Model Choice (18%)	Start of IMP-2	IMP-3: testing the model	IMP-1 and IMP-2: sharing at scale, external licenses
Access to Other Data (16%)	—	OTH-1: files, folders, reports and dashboards	—

After Part 1, three of the five Permissions objectives are done, and you know every Access to Records objective by name and place, the biggest section on the exam. Part 2 teaches Access to Records in depth for your own users, with Access to Other Data and testing; Part 3 adds external users, taking access away, secure code, encryption and monitoring, and sharing at scale. Both are being written now. Until they’re out, study those objectives from the exam guide (opens in a new tab) and Salesforce’s own documentation.

Explore

• Salesforce Certified Platform Sharing and Visibility Architect Exam Guide (opens in a new tab), Salesforce Help (checked 2026-11-01): the official list of objectives and their weights.