ADM-201 practice question 8 of 30

An analytics user at Cloud Kicks needs Read, Create, and Edit access for objects and Should be restricted from deleting any records. What should the…

Choose your answer, then check it against the explanation and the full breakdown below.

Domain Configuration and Setup

An analytics user at Cloud Kicks needs Read, Create, and Edit access for objects and Should be restricted from deleting any records. What should the administrator do to meet this requirement?

Answer options

Correct Answer:

Explanation

A user's baseline permissions are determined by their assigned profile. To meet the requirement of allowing Read, Create, and Edit access while explicitly denying Delete access, the most appropriate and secure method is to create a custom profile. This profile can be configured with the precise object-level permissions needed (Read, Create, Edit checked; Delete unchecked). Assigning this custom profile to the user ensures they have exactly the permissions required for their role, adhering to the principle of least privilege.

Why Incorrect

A. The standard System Administrator profile grants "Modify All Data," which includes the ability to delete all records, directly violating the core requirement of restricting deletion.

B. The role hierarchy and "View All" access control record-level visibility, not the fundamental object-level permissions (like Create, Edit, or Delete) that a user can perform.

D. Permission sets are used to grant additional permissions to users, not to restrict them. A permission set cannot remove the Delete permission if it is already granted by the user's base profile.

References

1. Salesforce Help - Control Access to Objects: "Object permissions determine the kinds of records (such as contacts or accounts) users can view

create

edit

or delete. You set object permissions in profiles and permission sets." This establishes that profiles are the primary tool for setting these baseline permissions.

2. Salesforce Help - Profiles: "Profiles define how users access objects and data

and what they can do within the application... For example

you can use profiles to grant a user Create and Edit permissions on an object but not Delete permission." (Found under User Management > Profiles).

3. Salesforce Help - Permission Sets: "Permission sets extend users’ functional access without changing their profiles... Use a permission set to grant additional permissions and access settings to a user." This highlights that permission sets are for additive permissions

not for creating baseline access or restrictions.

Question 8 of 30

Question breakdown

Tests: Configure object permissions with profiles and permission sets
Difficulty: Medium

Key idea: Object CRUD permissions are set in profiles and permission sets, and because permissions are additive, delete must be withheld at the profile level.

How to reach the answer

The clue is 'restricted from deleting any records', which calls for object-level permissions.
The System Administrator profile includes Modify All Data, which grants delete.
View All and the role hierarchy affect record visibility, not create, edit, or delete rights.
Permission sets only add access and cannot remove a delete permission granted elsewhere.
A custom profile with Read, Create, and Edit but no Delete meets the requirement.

Each option

AIncorrect. System Administrator has Modify All Data, which allows deleting records.
BIncorrect. View All and a high role expand visibility but do not control the delete permission.
CCorrect. A custom profile can grant Read, Create, and Edit while leaving Delete unchecked for each object.
DIncorrect. A permission set adds access but cannot enforce a delete restriction, which depends on the base profile.

Common trap: Option D lists the exact permissions needed, but permission sets cannot take away delete if the profile grants it.

In practice: Admins clone a minimal profile for analysts, remove Delete on objects, and layer extra access through permission sets as needed.

Remember: Restrictions belong in the baseline profile; permission sets only ever add access.

Drafted with AI assistance and checked against the answer key.

Keep practicing

Take the free ADM-201 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test