Sharing-and-Visibility-Architect Salesforce Certified Sharing and Visibility Architect (SU24) Questions and Answers

Setting the External OWD to Private for the Delivery object is the best approach to limit the records a distributor can see, since it will restrict the access to only the records they own or are shared with them. Option A is incorrect, since ownership-based sharing rules are not available for partner community users. Option B is incorrect, since removing Read permission from the distributor profile would prevent them from accessing any delivery records. Option D is incorrect, since criteria-based sharing rules are not available for partner community users.

The architect can configure the system to support the requirements by using a sharing rule. A sharing rule is a declarative way of extending record access to users or groups of users based on criteria such as ownership, role, or field values3. In this case, the architect can create a sharing rule that grants read or read/write access to all records owned by customer community users to UC users in the customer support role. A sharing set is used to grant access to community users based on a common account or contact, not to internal users. A share group is used to share records with groups of community users who have Customer Community Plus or Partner Community licenses, not with internal users. Apex sharing is used to programmatically share records when declarative sharing cannot fulfill complex requirements, but it is not necessary in this case.

Granular locking is an advanced tool that Salesforce can enable for large-scale role hierarchy realignments. Granular locking allows finer-grained locking for certain operations that affect large data sets, such as bulk loading or updating. Granular locking can reduce the locking time and avoid performance issues when changing role hierarchy or ownership. Therefore, the answer C is correct and the other options are incorrect

A sharing set is the best way to share cases with community users based on a common account. Sharing sets are available for Customer Community licenses and can grant access to related records using predefined criteria. Option A is incorrect, since sharing rules are not available for community users. Option B is incorrect, since there is no such thing as a share group in Salesforce. Option D is incorrect, since Apex sharing is complex and requires code maintenance

 Setting the OWD for internal users to Public Read Only is the simplest and most efficient way to give access to all internal employees to the ServiceFeedback object. Option A is incorrect, since creating a trigger on ServiceFeedback to change ownership to an internal employee would be complicated and affect the data quality. Option B is incorrect, since ensuring all the internal users are above the partners in the role hierarchy would not work, as the role hierarchy does not apply to partner users. Option C is incorrect, since creating an owner-based sharing rule for all ServiceFeedback records owned by partners would be redundant and inefficient

Setting the organization-wide default on Shipment to Private, creating a trigger to update the Account record with the shipment information, and using a lookup relationship to Account are the best recommendations to accomplish this requirement. This way, the Marketing team can see the shipment information on the Account record, but not the Shipment records themselves. Option A is incorrect, since setting the organization-wide default on Shipment to Public would give access to all Shipment records to all users. Option B is incorrect, since using a master-detail relationship to Account would inherit the sharing settings from Account, which may not be Private. Option C is incorrect, since using a master-detail relationship to Account and setting the organization-wide default on Shipment to Controlled by Parent would have the same effect as option B.

Cloning the Sales Rep profile, adjusting settings, and assigning the pilot users the new profile is the optimal way to grant only this Sales Reps access to the new functionality, while hiding it from other users. This way, the pilot users can have different permissions and access than the other Sales Reps who are not part of the pilot. Option B is incorrect, since revoking access to legacy function in the Sales Rep profile and creating a permission set for the new functionality would affect all Sales Reps, not just the pilot users. Option C is incorrect, since creating a permission set to grant access to the new functionality and hide the old functionality would not work, as permission sets cannot revoke access. Option D is incorrect, since creating new user records for the pilot user that they will use for the pilot would be unnecessary and inefficient.

Using bind variables or the escapeSingleQuotes() method are two techniques that can prevent SOQL Injection attacks by ensuring that user input is treated as literal strings rather than part of the query9. Bind variables are preferred over escapeSingleQuotes(), as they also improve performance and readability of the code10. Option A is incorrect, since escaping double quotes in the user input does not prevent SOQL Injection. Option D is incorrect, since using the with Sharing keyword on the controller does not affect SOQL Injection, but rather enforces record-level access based on the user’s profile and sharing rules.

A Sharing Set is a feature that allows you to grant access to records that are associated with the same account or contact as the community user1. This is the best option to implement the requirement of allowing customers to see service requests for their account through the community. Manual sharing, Sharing Rules, and Apex Managed Sharing are not suitable for this scenario because they are either too labor-intensive, not applicable to external users, or too complex

 Adding the product specialist and solution engineer to the opportunity team is the optimal way for the junior account manager to share the opportunity, given the private sharing model. Opportunity teams are groups of users who work together on sales opportunities. Adding users to an opportunity team grants them access to the opportunity and related records. This way, the junior account manager can collaborate with the product specialist and solution engineer on the complex deal, and when the account is reassigned to a senior account manager, the opportunity team members will retain their access. Option A is incorrect, since manual sharing on the opportunity would be removed when the account owner changes. Option C is incorrect, since manual sharing on the account would not grant access to the opportunity, as it does not roll up from account to opportunity. Option D is incorrect, since creating an owner-based sharing rule would be unnecessary and inefficient.

 By default, three roles are created when the first external user is created on a partner account. These roles are Executive, Manager, and User. They form a role hierarchy that determines the level of access to data for the partner users

Three advanced tools that Salesforce can enable for large-scale role hierarchy realignments in organizations with large data volumes are partitioning by divisions, deferred sharing calculation, and skinny table indexing. Partitioning by divisions allows the organization to segment data into logical sections based on business criteria, which reduces the number of records that need to be recalculated when role hierarchy changes. Deferred sharing calculation allows the organization to postpone the sharing recalculation until a scheduled time, which avoids impacting users during peak hours. Skinny table indexing allows the organization to create custom indexes on frequently used fields, which improves query performance and reduces locking contention

Using Apex Managed sharing in a case Trigger that shares the record to the user identified in the Legal SME field is the best way to grant a lawyer access to a specific case when their assistance is needed, as it allows the case owner to dynamically share the case with a specific user based on a custom field value1. Creating a Criteria Based Sharing Rule that shares to the Corporate Legal Team Role when the ‘’legal assistance needed? Field is checked will not work, as it will share the case with all users in that role, not just the lawyer in the Legal SME field. Creating a Criteria Based Sharing Rule that shares to the Legal Public Group when the ‘’legal assistance needed?’’ field is checked will not work, as it will share the case with all users in that group, not just the lawyer in the Legal SME field.

According to this source, the runAs system method in test classes can be used to test using different users and profiles, and the with sharing keyword in Apex classes can be used to enforce record visibility rules. The other options are not valid keywords in Apex

Public groups are used to grant access to a set of users who do not have a predefined relationship in the role hierarchy or territory hierarchy. Sharing sets are used for community users, not internal users. Role hierarchy is used to grant access based on the user’s position in the organization.

According to this source, creating the share records and setting the RowCause to a custom Apex Sharing Reason will prevent them from being deleted when the owner of the account is changed. The other options will not have this effect.

 To prevent orders from being deleted in the future, a Salesforce Architect should recommend removing Order delete permission from profiles and permission sets, and changing the record type/page layout assignment for orders to be read only. Removing Order delete permission will prevent users from deleting any order records, regardless of their ownership or sharing. Changing the record type/page layout assignment will prevent users from editing any order fields, regardless of their field-level security. Implementing a sharing rule that changes access for order to read will not work, as it will only affect the record-level access, not the field-level access or the delete permission. Removing the Delete button from the order page layout will not work, as it will only affect the user interface, not the API or other ways of deleting records.

The reason why there are many duplicate Account records and numerous sharing rules created in Salesforce is that the Organization-Wide Default for the Account object is Private4. This means that users can only see their own accounts and those shared with them explicitly by sharing rules or other means. This could lead to users creating duplicate accounts without knowing that they already exist in Salesforce. If the Organization-Wide Default for the Account object is Public Read/Write or Public Read Only, users would be able to see all accounts in Salesforce and avoid creating duplicates. The Object permissions for the Account object are not relevant for this question.

The action that Mary can take on Joe’s Invoice records is none. This is because Mary’s profile does not have the Read permission for the Invoice object, which means she cannot view any Invoice records, regardless of the OWD or role hierarchy settings. Profile permissions override any other access settings3. Read/Write, Edit Only, and View Only are not possible actions for Mary.

 Adding the user to the Sales Team for the Presentation record will not work, as Sales Teams are only available for standard objects, not custom objects. Giving Edit rights to the Presentation record via a Permission set will not work, as Permission sets are assigned to users, not records. The best option is to use a trigger on Presenter junction object that uses Apex Managed sharing to add or remove access to the related Presentation record based on the junction object records.

To assign opportunities to a territory for an account that meets criteria for two Enterprise Territory Management territories, the territory with the highest Territory Type Priority is automatically assigned to the opportunity. This is how Salesforce resolves conflicts when an account matches multiple territories. Creating a criteria-based sharing rule or a Process Builder process will not work, as they do not affect the territory assignment. Creating an Apex class that implements Filter-Based Opportunity Territory Assignment will not work, as it is only applicable for accounts that do not match any territory

Sharing the folders with the Sales Managers profile is the best way to grant access to sales managers to automate access to these Public Reports and Dashboard folder, as it allows admins to share folders with users who have a specific profile4. Sharing the folders with a “Sales Managers” Public Group will work, but it will require manual maintenance and may not reflect changes in roles or positions. Sharing the folders with the lowest rates in the Role Hierarchy will not work, as folders cannot be shared with roles or subordinates.

The two methods that would be used to enforce this requirement are A and D. Schema.DescribeFieldResult and Schema.DescribeSObjectResult can be used to check the user permissions for creating records and accessing certain fields, even if the Visualforce controller is written with “Without Sharing”. The other options are either not related to field or object permissions, or not sufficient to enforce them.

 Criteria-based sharing rules are used to share records based on field values, not ownership. This is the best option to grant access to accounts of the same segment in other countries, regardless of who owns them. Owner-based sharing rules are based on the owner of the record, not the segment. Changing the role hierarchy would affect other aspects of data visibility and security. Creating a public group and a permission set would require manual maintenance and would not be scalable.

The feature in Salesforce that is needed to restrict access to a custom object that has public read/write access is profile. Profile settings can control the create, read, edit, and delete permissions for a custom object at the user level, regardless of the organization-wide default settings. The other options are either not related to object access or not restrictive enough.

The two reasons that the architect should consider regarding the use of Apex sharing reasons are A and B. Option A allows the developer to more easily troubleshoot programmatic sharing, as they can identify which sharing records are created by which Apex code. Option B prevents the share record from being deleted upon ownership change, as Apex sharing reasons are not subject to recalculation by Salesforce. The other options are either incorrect or irrelevant.

The side effect of granting opportunity access to sales reps on the same team using ownership-based sharing rules is that all sales reps will have Read access to all accounts. This is because ownership-based sharing rules are based on the role or territory of the owner of the record, and they grant access to both the record and its parent account. Therefore, if a sharing rule grants Read access to opportunities owned by users in a certain role or below, it also grants Read access to the accounts of those opportunities4. Sales reps on the same team will not have Edit access to the accounts for opportunities owned by their peers, as sharing rules only grant Read or Read/Write access, not Edit access. Sales reps on the same team will not have Read access to the accounts for opportunities owned by their peers only, as sharing rules grant access to all accounts in the specified role or below, not just their peers. All sales reps will not have Read access to accounts for all opportunities, as sharing rules only grant access to accounts for opportunities owned by users in a certain role or below, not all opportunities.

 Enterprise Territory Management is a feature that allows you to assign accounts to territories based on criteria such as geography, industry, revenue, etc. With Enterprise Territory Management, you can1:

Use the Metadata API to create, update, and delete territory models, territories, and account assignments.

Integrate with Collaborative Forecasting to forecast sales revenue by territory.

Assign opportunities to territories based on the account assignment or other criteria.

Changes affect only the ACME Account. Changing the team member access to the account does not affect the default account team, the default opportunity team, or the child accounts. The team member access is specific to the individual account record.

The field has been configured for encryption, which might cause it to not show up on the list of available fields for creating a criteria-based sharing rule. Encrypted fields are not available for sharing rules, as they may contain sensitive data that should not be exposed. Option B is incorrect, since the architect does not need permission to Compliance fields to create a sharing rule. Option C is incorrect, since the architect’s profile does not need field-level security for this field to create a sharing rule. Option D is incorrect, since fields with validation rules are available for sharing rules.

The best option for the architect to make sure Universal Health stays compliant is B. Enabling Salesforce Shield Platform Data Encryption and marking the patient notes field as encrypted will ensure that the data is encrypted at rest as well as in transit, using a tenant secret that only Universal Health can access. This will also allow them to use standard Salesforce features and functionality with the encrypted data. The other options are either incorrect or not optimal.

Sharing the list views with the appropriate role and internal subordinates is the best way to hide list views that are not relevant to an individual user, as it will grant access to users who have a specific role or roles below that role in the hierarchy. Sharing the list views with the appropriate queue will not work, as queues are used for assigning records to a group of users, not for filtering list views. Sharing the list views with the appropriate individual users will not work, as it will require manual maintenance and will not be scalable.

Two methods that will allow the architect to meet the requirements for creating a custom team solution on the custom Loan object are creating a custom trigger on the Custom Team object that inserts or updates records in the Loan_share object, and creating Apex Sharing Reasons on the Loan object to identify the reason the Loan record was shared. The custom trigger can use Apex Managed Sharing to grant Read Only or Read/Edit access to the Custom Team members based on the Primary field value. The Apex Sharing Reasons can be used to distinguish between different types of sharing and provide more granular control over access

Creating and customizing Reports and Report Folders and Manage Reports in Public Folders are two permissions that are required to accomplish this task, as they allow users to create reports and folders and share them with other users or groups. Editing My Reports is not a permission that is required to accomplish this task, as it only allows users to edit reports in their personal folders. Creating Report Folders is not a permission that exists in Salesforce.

To support the requirements with the minimum amount of effort, three platform security features that are required are criteria-based sharing rules, role hierarchy, and permission sets. Criteria-based sharing rules can be used to share all accounts with the custom field “Kay Customer” to all senior account managers based on a filter condition. Role hierarchy can be used to grant access to accounts that users or their subordinates own based on the ownership and role level. Permission sets can be used to grant view and edit access to the custom field that contains sensitive information to the three designated users, regardless of their user groups or profiles

Storing the value in a text field on a protected custom setting in the package is the best way to support this requirement. Protected custom settings are not visible to subscribers, but they can be accessed by the package code and support representatives. The other options either expose the value to subscribers (B and C) or do not allow support representatives to access it (D).

The correct security settings to achieve this are to set all Organization-Wide Default security to be Private for both internal and external users and use Sharing Rules to grant the desired access. This way, internal users can access all survey responses through the account object, and external users can only access survey responses that belong to their own account through the custom object.

Disabling Grant Access Using Hierarchies for the object and creating a sharing rule to enable sharing to the Director of Support are the steps to ensure proper sharing in this role hierarchy structure. This way, the Team Leads will not have access to the Reimbursement records of their subordinates, but the Director of Support will have access to all Reimbursement records. Option A is incorrect, as setting the View All permission on the profile will grant access to all users with that profile, not just the Director of Support. Option B is incorrect, as changing the owner of the Reimbursement record will remove the access from the original submitter. Option D is incorrect, as by default, Grant Access Using Hierarchies is enabled for custom objects, which means that Team Leads will have access to their subordinates’ Reimbursement records.

 When using the runAs() method to design Apex unit tests, the architect should consider that runAs() does not enforce user permissions or field-level permissions in test classes, runAs() can be used inside of test classes to validate record-level security, and runAs() counts towards total DML statements issued within transaction. These are important considerations to ensure that the test classes cover all possible scenarios and do not exceed governor limits. runAs() cannot be used outside of test classes to bypass record-level security, and runAs() cannot be used inside of test classes to validate field-level permissions

 To grant the sales managers access to the customer invoices data, the architect should control the invoices object permission on the sales manager’s profile. This will allow the sales managers to view and query the external object records, as long as they have access to the parent account records. Creating a sharing set or a sharing rule will not work, as they are not supported for external objects. Using manual sharing will not work, as it is not available for external objects

Creating a custom object for defects and relating it to cases using lookup is the best option to meet the requirement. This way, the defects can have their own fields, owners, and security settings, and they can be related to multiple cases. The standard defect object does not exist in Salesforce, so option A is incorrect. Option C is not scalable or flexible, as it would require adding many fields to the case object and limit the number of defects per case. Option D is also not suitable, as it would make the defects dependent on the cases and delete them if the cases are deleted.

When a user transfers ownership of a record to another user, the original owner loses access to the record unless they have access through other means, such as role hierarchy, sharing rules, teams, etc. In this case, since both Sales Rep A and B have the same role in the role hierarchy, and the sharing model for the Opportunity object is private, Sales Rep A will have no access to the Opportunity after the transfer

According to this source, cross-site scripting (XSS) is a security vulnerability that occurs when malicious code is injected into a web page that can execute in the browser of a user who views the page. In this case, the code snippet does not escape the output text value, which means that if the input text contains any HTML or JavaScript code, it will be rendered as such in the output panel. This could allow an attacker to execute malicious scripts on behalf of the user. The other options are not relevant to this code snippet.

Implementing a third-party proxy server is the best technology to achieve the requirement of accessing on-premise information from Salesforce. A proxy server acts as an intermediary between Salesforce and the on-premise database, and it can handle authentication, encryption, and data transformation. Option A is incorrect, as tokenization is a technique to replace sensitive data with tokens, not to access on-premise data. Option B is incorrect, as it does not specify how Salesforce can connect to the on-premise database. Option D is incorrect, as Salesforce Shield is a set of tools to enhance data security and compliance in Salesforce, not to access external data sources.

Content delivery is a feature that allows users to share files with customers and protect them with a password. Setting up an experience cloud site would require additional configuration and licensing. Utilizing an AppExchange product would introduce a dependency on a third-party solution.

According to this source, Apex managed sharing is the best way to share records based on complex logic that can’t be handled by declarative sharing. In this case, the architect can use Apex code to create a trigger on the Job Interview object that will create a share record for the interviewer user when the lookup field is populated. The other options are not feasible or scalable.

 A criteria-based sharing rule is the best option to give access to accounts based on a specific field value, such as the record type. Option A would give access to all accounts, not just person accounts. Option B would only control the layout and not the visibility. Option C would not apply to person accounts, since they do not have account contact roles

A sharing rule is missing to share Accounts to the AR team, which could be the issue preventing AR team members from seeing invoices. Since invoice is a custom object with a master-detail relationship to account, its sharing settings are controlled by its parent account. If AR users do not have access to account records, they will not be able to see or query invoice records either. Option A is incorrect, since a sharing rule to share invoices to the AR team would not work, as invoice inherits its sharing settings from account. Option B is incorrect, since assigning an invoice page layout to the AR team profile would not affect their visibility of invoice records. Option D is incorrect, since giving read permission to the invoice object to the Accounts receivable profile would not grant access to invoice records that are owned by other users.

The OWD for pricebook should be set to Use, which means that users can only view and use price books that are shared with them. This way, sales agents can have access to products and create opportunities for their customers. Option A is incorrect, since Public Read Only would give access to all price books to all users. Option B is incorrect, since Public Read Write would give access and edit rights to all price books to all users. Option C is incorrect, since View is not a valid OWD setting for pricebook.

Creating a criteria-based sharing rule that shares delivery records matching the Distributor to users of a Public Group created for the distributor is the correct solution for this scenario. This will allow all users at a distributor to access delivery records for all customer accounts associated with that distributor. Creating a Sharing set for the Distributor profile will not work, because sharing sets are only available for portal or community users, not internal users. Giving ownership of the delivery record to a distributor user will not work, because it will limit the access to only one user per record. Creating a criteria-based sharing rule that shares delivery records matching the Distributor to user distributor will not work, because it will not share records with other users at the same distributor.

Sharing the list views with the appropriate public group and sharing the list views with the appropriate role in the role hierarchy are two ways that UC can hide lists that are not relevant to an individual user. List view sharing allows users to share list views with other users based on public groups, roles, subordinates, or individual users. This way, users can only see list views that are relevant to them and their work. Option A is incorrect, since sharing list views with a queue is not possible. Option B is incorrect, since sharing list views with individual users would be tedious and inefficient.

To make the sensitive fields accessible to the Human Resource team, other than field level security, another option is to create a new custom object with private OWD and Lookup relationship to Employee to store new restricted information. This will allow creating a separate security model for the new custom object, which can be shared with the Human Resource team using sharing rules or permission sets. Creating a new custom object controlled by parent and a Master-Detail relationship to Employee will not work, as it will inherit the same OWD as Employee, which is Public Read Only. Changing OWD of Employee custom object to private and a Lookup self-relationship to store only new restricted information will not work, as it will make all employee records inaccessible to other users who need them.

To implement Apex managed sharing, a Salesforce Developer should consider using the with Sharing keyword and the runAs system method. The with Sharing keyword ensures that the Apex class respects the record visibility rules of the current user context, which can help prevent unauthorized access to records that are not shared with the user1. The runAs system method allows testing the code as different users with different profiles and permissions, which can help verify that the sharing logic is working as expected2.

Sharing the folders with the “VP of Sales” Role and Subordinates and sharing the folders with a “Sales Managers” Public Group are two ways that UC can grant access to sales managers to automate access to these Reports and Dashboards folders. Folder sharing allows users to share reports and dashboards with other users based on roles, subordinates, public groups, or individual users. Option A is incorrect, since sharing the folders with lowest roles in the role hierarchy would not give access to superiors automatically, but only to subordinates. Option C is incorrect, since sharing the folders with a queue is not possible.

Removing order delete permission from profiles and permission sets is the best approach to ensure that order records cannot be removed from the system in the future. This way, only users with the Modify All Data permission can delete order records. Option A is incorrect, since removing the delete button from the order page layout would not prevent users from deleting order records using other methods, such as data loader or API. Option B is incorrect, since changing the record type/page layout assignment for orders to be read-only would not affect the delete permission, but only the edit permission. Option D is incorrect, since implementing a sharing rule that changes access for the records to read would not prevent users from deleting order records that they own.

 Leveraging default Account team is the best way to help improve sales reps productivity by granting access to supporting internal users for customer records when they need help. Default Account teams are predefined groups of users who work together on an account. When a user creates or owns an account, Salesforce automatically adds the default Account team to the account team related list on the account2. Creating a permission set with “view all data” and assigning it to supporting users would give them too much access to data that they may not need. Creating a public group and replacing the account ownership with it would not be feasible or scalable. Creating a criteria-based sharing rule to grant access to other users would require manual maintenance and may not reflect the changes in the account team.

To give users in the partner user role access to all Case and Container records owned by any user at the same distributor, an Architect can give super user permission to the individual partner users. Super user permission allows partner users to access data owned by other partner users belonging to the same account or below them in the role hierarchy. Creating an ownership-based sharing rule will not work, as it will share records based on the owner’s role or territory, not their account. Creating sharing sets will not work, as they are only available for Customer Community licenses, not Partner Community licenses. Creating a Permission Set granting “View All” permission to Case and Container records will not work, as it will give access to all records in those objects, regardless of their owner or account.

The two options to propose a solution to meet the requirements are Scheduled Apex job to remove access and Opportunity team to share opportunities with sales managers. Scheduled Apex job allows developers to run Apex code at a specified time, which can be used to revoke the sharing access after two weeks. Opportunity team allows users to grant access to other users who work on the same opportunity1. Apex Sharing and Sharing Rules are not suitable options because they do not support automatic expiration of sharing.

Deleting the public link is the best way to ensure that the potential customers do not have access to the file after the meeting. Renaming the file, deleting the file, or moving the file to another folder will not affect the public link, which will still point to the file

 Account records can be accessed due to implicit sharing from Opportunity and Account records can be accessed due to role hierarchy are two reasons that could be causing this issue. Implicit sharing grants access to parent records when a user has access to a child record. For example, if a user has access to an opportunity, they also have access to its related account and contract records. Role hierarchy grants access to records owned by or shared with users who are below in the hierarchy. For example, if a user is above another user in the role hierarchy, they can access any records that the lower user can access. Option A is incorrect, since contact records cannot be accessed due to implicit sharing from account, as implicit sharing does not grant access to child records. Option C is incorrect, since contact records cannot be accessed due to implicit sharing from opportunity, as implicit sharing does not grant access to child records.

 Creating a criteria-based sharing rule to give access to the public group for high-value opportunities and creating a public group and assigning the auditors to the group are the best options to give access to high-value opportunities to a team of auditors distributed through the organization. Option A is incorrect, since putting the auditors as the highest level of the role hierarchy would give them access to all opportunities, not just high-value ones. Option B is incorrect, since adding the auditors to the default opportunity team would require manual configuration and maintenance

Setting the Request object’s OWD to Public Read/Write is the simplest and most efficient way to allow all employees to collaborate on requests. Option B is incorrect, since granting Modify All Data permission on all profiles would give too much access and affect other objects as well. Option C is incorrect, since creating a criteria-based sharing rule to share all records with all users would be redundant and inefficient. Option D is incorrect, since setting the OWD to Public Read Only would not allow users to edit requests3.

 Ownership-based sharing rules are a way to grant access to records based on the record owner’s role or public group membership. Ownership-based sharing rules can be used to share records with Partner Community users, who are not supported by sharing sets. In this case, ownership-based sharing rules can be used to share Case and Container records owned by partner managers and partner users with other partner managers at the same distributor. Therefore, the answer D is correct and the other options are incorrect .

Creating a Sharing set for the Distributor profile to grant access to the Delivery object is the correct way to share records with users in a partner community. Sharing sets allow you to share records based on a common account or contact2. Criteria-based sharing rules are not available for partner communities3.