Salesforce Certified Sharing and Visibility Architect Exam Dumps & Practice Test Questions
Question 1:
What should Universal Containers do to prevent managers from accessing NPS records, considering they are tracking Net Promoter Scores for all employees using a custom object?
A. Use Apex Sharing to explicitly remove NPS object sharing for Manager profiles.
B. Remove the Create, Read, Edit, and Delete permissions from Manager profiles and permission sets.
C. Set the organization's default access to Private and disable the "Access Using Hierarchies" option for the NPS object.
D. Create a criteria-based sharing rule to prevent Manager roles and above from accessing the NPS object.
Correct Answer: B
Explanation:
To address the requirement of restricting managers from accessing NPS records while ensuring that other employees can still interact with these records, we need to look at how Salesforce’s sharing model works and the various options available for limiting access to custom objects.
A. Apex Sharing can be used for more granular control over record access by programmatically managing sharing rules. However, this approach is typically used for specific scenarios where access needs to be dynamically controlled, rather than just a static, role-based restriction. Additionally, using Apex Sharing to explicitly remove sharing might be complex and not the most efficient approach for this situation. This would require custom code and ongoing maintenance, which isn’t ideal when simpler solutions are available.
B. Removing the Create, Read, Edit, and Delete permissions from Manager profiles and permission sets is a straightforward and effective way to limit access to the NPS object for managers. By directly modifying the profile settings, this option ensures that managers have no permissions on the object, thus preventing them from viewing or editing any NPS records. This solution is direct and works within Salesforce's permission structure, ensuring that no manager can access the NPS records without needing to implement any additional complex configurations.
C. Setting the organization's default access to Private for the NPS object and disabling the “Access Using Hierarchies” option is a more restrictive approach that limits access to records, but it’s not ideal in this case. The “Access Using Hierarchies” setting is typically used to allow managers to access records owned by their subordinates. Disabling it for the NPS object would prevent all users in the hierarchy from accessing the NPS records, not just managers. This would lead to broader restrictions than required, as other users (such as employees themselves) may also lose access to their own NPS records.
D. A criteria-based sharing rule allows access to records based on certain conditions, but creating a rule to specifically exclude managers could be complex. Sharing rules are generally used to grant access, not to explicitly block certain users, and setting up a rule that involves excluding specific roles or profiles can be prone to errors or maintenance challenges. It might also lead to unintended access in some cases.
Thus, B is the best approach, as it directly removes access at the profile and permission set levels for managers without complicating the sharing model or introducing unnecessary restrictions for other users.
Question 2:
How can Universal Containers grant the US sales manager access to Canadian account records that belong to the same segment, given that the role hierarchy is based on countries and the US-based sales manager cannot view account records from Canada?
A. Create an owner-based sharing rule to provide access to accounts of the same segment for all sales manager roles.
B. Set up a public group, associate it with accounts of the same segment, and grant access through a permission set.
C. Implement a criteria-based sharing rule to allow access to accounts of the same segment for all sales manager roles.
D. Modify the role hierarchy to place both US and Canada sales managers in the same role.
Correct Answer: C
Explanation:
To solve the issue of granting access to Canadian account records for the US sales manager, it's important to consider the different methods Salesforce offers for controlling record access within a company’s structure. Since the role hierarchy is based on countries, simply modifying roles or profiles may not be the most effective solution in this case.
A. Owner-based sharing rules are typically used to share records based on the owner’s role or specific attributes, such as ownership of accounts. While owner-based sharing rules could help in certain circumstances, this approach would not directly address the issue of granting access to accounts based on shared segments, regardless of the owner. Additionally, setting up owner-based rules would only allow access to records owned by a specific user, not to all records in the same segment.
B. Setting up a public group and associating it with accounts of the same segment is a potential solution but is less effective when compared to a criteria-based sharing rule. Public groups can be used to grant access to specific users, but the criteria-based sharing rule would allow for more flexible, scalable access to records based on specific conditions like segment rather than static group membership.
C. A criteria-based sharing rule is the most appropriate solution here. This type of sharing rule grants access based on specific criteria, such as segment, rather than being based on the owner or a specific group. Since the sales managers need access to accounts of the same segment across countries, a criteria-based sharing rule can be configured to allow access to these records for all sales managers in the same segment, regardless of their role in the hierarchy. This allows the US sales manager to access Canadian account records without needing to change the role structure or complicate other sharing settings.
D. Modifying the role hierarchy to place both the US and Canada sales managers in the same role might seem like a simple solution. However, this approach would require significant changes to the organization’s role structure, which could have unintended consequences, including affecting the visibility of other records in the hierarchy. Changing roles just to grant access to specific records is not a scalable or ideal solution when more flexible sharing options exist.
In conclusion, C is the best choice, as it allows for precise control over access to records based on shared attributes, in this case, the segment. This approach can grant the necessary access to the US sales manager without changing the underlying role hierarchy or introducing additional complexity.
Question 3:
A junior account manager is managing an account and has created an opportunity for a large deal. She needs to collaborate with a product specialist and a solutions engineer. Since the company uses a private sharing model, access to opportunities is restricted unless explicitly shared.
What is the best way for the junior account manager to share the opportunity with these colleagues?
A. Share the account manually with the product specialist and solution engineer.
B. Use the Opportunity Team feature to share the opportunity.
C. Create an owner-based sharing rule to provide access to the opportunity.
D. Share the opportunity manually with the product specialist and solution engineer.
Answer: B
Explanation:
In a private sharing model, access to records is strictly controlled, and users can only access the data if it is explicitly shared with them. For this scenario, the junior account manager needs to share an opportunity with two colleagues: a product specialist and a solutions engineer. The most efficient and scalable way to share the opportunity while maintaining control over access is through the Opportunity Team feature.
The Opportunity Team feature allows users to define roles for team members associated with a specific opportunity. By using this feature, the junior account manager can easily add the product specialist and the solutions engineer to the opportunity, assigning them appropriate roles (such as Product Specialist or Solutions Engineer). This enables them to collaborate effectively on the opportunity, ensuring that both individuals can access the opportunity and work on it, while adhering to the private sharing model.
A is incorrect because while it suggests manually sharing the account, the question specifically asks about sharing the opportunity, not the account. Additionally, manual sharing is often less scalable and harder to maintain in a growing organization with complex collaboration needs.
C is not the best option in this case. Creating an owner-based sharing rule would typically be used to automatically share records based on ownership criteria. However, owner-based sharing rules are typically applied to accounts, opportunities, or other records based on the owner’s attributes, which may not be necessary here, since the goal is to collaborate with specific individuals rather than adjusting access based on ownership.
D is essentially the same as option A, suggesting manual sharing of the opportunity, but it lacks the efficiency and flexibility that the Opportunity Team feature provides. Manually sharing the opportunity may work, but it does not provide the same streamlined approach for collaboration with defined roles.
Thus, B is the best choice because the Opportunity Team feature is designed specifically to facilitate collaboration and ensure that the necessary team members have access to the relevant opportunity without requiring manual sharing for each individual user.
Question 4:
Sales managers at Universal Containers (UC) need to access customer invoices within Salesforce. The invoice data is stored in an external ERP system, not within Salesforce. What is the correct method to provide sales managers access to this external invoice data?
A. Implement sharing rules to provide access to Invoice records for sales managers.
B. Configure object permissions on the sales manager’s profile to control access.
C. Use manual sharing to give sales managers access to Invoice records.
D. Create a sharing set for sales managers to grant them access to Invoice records.
Answer: A
Explanation:
When integrating external data into Salesforce, especially data from systems such as an ERP system, the approach to granting access can be different from the standard record sharing model. Since the invoice data is not stored within Salesforce but in an external system, the correct method of granting access relies on integrating that external data with Salesforce and then utilizing tools to manage access to it.
Sharing rules (option A) are the best solution in this case, provided the external data has been integrated into Salesforce through an external data source, like an External Object. External Objects in Salesforce allow users to view data from external systems as if it were part of Salesforce. Once the external data is available in Salesforce through External Objects, sharing rules can be configured to grant the appropriate access to the sales managers. These rules allow you to define criteria for sharing, such as roles or specific conditions, ensuring that only the users who meet certain criteria have access to the invoice records.
B is incorrect because object permissions on the sales manager’s profile control access to objects that are already part of Salesforce. Since the invoice data is stored externally, object permissions will not apply directly to the external ERP system's data. Instead, object permissions would control access to standard Salesforce objects, which is not the case here.
C is also incorrect. Manual sharing is typically used to provide access to Salesforce records on a case-by-case basis. However, in this case, since the invoice data is coming from an external ERP system, manual sharing is not an appropriate method because the records are not part of Salesforce and therefore cannot be shared in the traditional way. Additionally, manually sharing individual records is not scalable when you need to grant access to multiple records.
D is not correct. A sharing set is typically used to share records like cases or custom objects with community users. It’s a feature for external users accessing Salesforce via a portal. However, since the invoice data is from an external ERP system and not part of Salesforce, a sharing set would not apply in this scenario. Sharing sets work for data already within Salesforce, not external systems.
Therefore, A is the correct method. Once the external invoice data is integrated into Salesforce through External Objects, sharing rules provide a scalable and manageable way to grant the necessary access to sales managers based on roles or criteria.
Question 5:
Universal Containers has a customer account that qualifies for two territories under Enterprise Territory Management: Portugal and Southern Europe. To ensure the correct territory is assigned to opportunities related to this account, what needs to be done?
A. Develop an Apex class that implements Filter-Based Opportunity Territory Assignment.
B. Create a criteria-based sharing rule for Opportunities to assign a territory.
C. Use Process Builder to update the Territory field on Opportunities.
D. The territory with the higher TerritoryType Priority is automatically assigned to the Opportunity.
Answer: D
Explanation:
When using Enterprise Territory Management (ETM) in Salesforce, territories are assigned to accounts and opportunities based on specific criteria and the territory structure set up by the organization. In this case, the customer account qualifies for two territories: Portugal and Southern Europe. The key to understanding how territories are assigned to opportunities lies in Salesforce's handling of territory assignments under ETM.
The territory with the higher TerritoryType Priority will be automatically assigned to the opportunity related to the account. This means that Salesforce uses the priority ranking of territories (set up by the administrator) to determine which territory is most relevant to the opportunity. If there is a conflict, the territory with the higher priority is selected, ensuring that the correct territory is always applied based on the predefined territory types and their priority.
A is incorrect because Filter-Based Opportunity Territory Assignment is a more advanced method and typically used when additional custom logic is needed to assign territories. However, in this case, Salesforce will handle the assignment of territories automatically based on the TerritoryType Priority rather than requiring custom code.
B is not correct. Criteria-based sharing rules are used to share records between users or groups based on specific conditions. They do not apply to assigning territories to opportunities. Sharing rules control visibility and access, not territory assignment, which requires territory management features in Salesforce.
C is also incorrect. Process Builder is a tool for automating processes in Salesforce, and while it can update fields based on criteria, it is not necessary for assigning territories in ETM. Territory assignment is a function handled automatically by Salesforce based on predefined rules and priorities. Using Process Builder would add unnecessary complexity in this case.
Thus, the best option is D, where Salesforce automatically assigns the territory based on the TerritoryType Priority, ensuring that the correct territory is linked to opportunities related to the account without needing additional customization.
Question 6:
Universal Containers (UC) is struggling with duplicate lead creation and uncontrolled lead edits. Multiple users are entering redundant leads, and anyone can edit or reassign them. UC wants to:
Minimize duplicate lead creation by providing visibility into existing leads
Ensure only the lead owner can edit or reassign their leads
Which Organization-Wide Default (OWD) setting should be applied to the Lead object to address these concerns?
A. Set OWD for Lead to Public Read Only/Transfer.
B. Set OWD for Lead to Private.
C. Set OWD for Lead to Public Read/Write.
D. Set OWD for Lead to Public Read Only.
Answer: B
Explanation:
When dealing with issues like duplicate lead creation and uncontrolled edits on leads, it’s crucial to configure the Organization-Wide Default (OWD) settings to control how users can interact with lead records. The OWD settings determine the default level of access users have to records they do not own.
To address the concerns mentioned by Universal Containers (UC), the ideal setting would be one that minimizes the risk of duplicate records by limiting visibility, while also ensuring that only the lead owner can make edits or reassign the lead. This is where the Private OWD setting comes into play.
Why Private OWD for Leads is the Best Choice:
Minimizing Duplicate Lead Creation: When the OWD for leads is set to Private, users will only be able to see the leads they own. This encourages users to check existing leads before creating new ones, as they won't have visibility into leads owned by other users. This greatly reduces the likelihood of creating redundant or duplicate leads.
Limiting Edit and Reassigning Rights: With a Private OWD, only the lead owner can view, edit, or reassign their leads. This ensures that no one else can edit or reassign a lead unless they are the owner, which helps enforce proper ownership and control over lead records. It prevents users from inadvertently or intentionally making changes to leads that they do not own.
Why the Other Options are Less Suitable:
A. Public Read Only/Transfer: This setting would allow users to view all leads in the organization but restrict them from editing or creating new leads. However, it allows users to transfer leads, meaning users could still reassign leads. While it reduces some edit problems, it doesn't fully address the need to restrict lead ownership and prevent unauthorized reassignment. It also does not minimize the risk of duplicate leads because users can see all existing leads.
C. Public Read/Write: This setting would allow all users to view and edit all leads, which could exacerbate the problem of uncontrolled edits. Additionally, users could create duplicates without any restrictions, as they would have full access to all leads in the organization. This would not solve the problem of restricting lead edits and reassignments to the owner, and it would allow too much freedom in terms of creating redundant leads.
D. Public Read Only: This setting would allow all users to view leads but not edit or create new ones. While it would prevent unauthorized edits, it does not fully address the need to minimize duplicate lead creation, as users would still be able to see all leads without any restrictions on creating new leads. It also doesn't provide the ability for lead owners to reassign or edit leads, which could cause confusion in certain scenarios.
Therefore, B. Private is the best option, as it limits visibility and ensures that only lead owners can edit or reassign their own leads, addressing both the issues of duplicate lead creation and uncontrolled lead edits.
Question 7:
Universal Containers uses Person Accounts for retail customers and Business Accounts for commercial customers. The Retail Sales team should have access to all Person Accounts but no access to Business Accounts. Currently, the Account object’s OWD is set to Private.
What is the best solution to meet these requirements?
A. Create a criteria-based sharing rule to share all Person Accounts with the Retail Sales role.
B. Set up an owner-based sharing rule on AccountContactRelation for retail sales contacts.
C. Modify the Retail Sales profile to grant access to the Person Account record type.
D. Assign "View All" permission on Accounts to the Retail Sales profile.
Answer: A
Explanation:
To address the specific requirements at Universal Containers, we need to ensure that the Retail Sales team has access to Person Accounts (which represent retail customers) while maintaining restricted access to Business Accounts (which represent commercial customers). The key challenge here is to configure the system so that only the Retail Sales team has visibility into Person Accounts, while the Private OWD setting for Accounts restricts general access to all account records.
Why A is the Best Choice:
The best approach is to create a criteria-based sharing rule (Option A). Sharing rules are used to automatically share records with specific users or groups based on criteria. In this case, the sharing rule would be based on the Person Account type. By creating a criteria-based sharing rule, you can specify that all Person Accounts should be shared with the Retail Sales role. This means the Retail Sales team will have access to all records classified as Person Accounts, without giving them access to Business Accounts or other account types.
This method is appropriate because it provides:
Granular control over data access: The Retail Sales team gets access only to Person Accounts.
Automation: Sharing rules can automatically share the relevant Person Accounts with the appropriate team members, ensuring no manual intervention is required.
Minimal administrative overhead: You don't need to adjust individual record permissions or rely on profiles to manage access to specific account types.
Why the Other Options Are Less Suitable:
B. Set up an owner-based sharing rule on AccountContactRelation for retail sales contacts: This option is not ideal because it involves sharing based on the AccountContactRelation object, which is typically used for associating contacts with accounts. It doesn’t directly address the need to share Person Accounts with the Retail Sales team. This would add unnecessary complexity and doesn’t specifically solve the issue of limiting access to only Person Accounts.
C. Modify the Retail Sales profile to grant access to the Person Account record type: While modifying the profile to allow access to the Person Account record type is useful in ensuring the Retail Sales team can view and create Person Accounts, it doesn't address the sharing of these records when the OWD for Accounts is set to Private. Simply allowing the record type won’t automatically grant access to the existing Person Accounts or ensure that they can be shared according to specific criteria.
D. Assign "View All" permission on Accounts to the Retail Sales profile: This option would grant the Retail Sales team unrestricted access to all accounts, including both Person and Business Accounts, which goes against the requirement of limiting access strictly to Person Accounts. This would violate the principle of data security by allowing access to all account types, including business accounts, which is not the desired solution.
The most effective and secure solution is to use a criteria-based sharing rule to share only Person Accounts with the Retail Sales role, ensuring they can access the necessary data without compromising the privacy and security of Business Accounts. Thus, A is the correct answer.
Question 8:
A sales rep at Universal Containers has just closed a large deal. To ensure timely delivery, the rep needs to collaborate with the logistics team and the customer service department.
What is the most effective way to share the opportunity record with these teams while maintaining the security of the opportunity?
A. Share the opportunity record manually with the logistics and customer service teams.
B. Use an Opportunity Team to share access with the logistics and customer service teams.
C. Create a sharing rule to provide access to the opportunity record.
D. Create a permission set to grant the logistics and customer service teams access to the opportunity.
Answer: B
Explanation:
To effectively share the opportunity record while maintaining security and ensuring that only the appropriate teams can access it, the best approach is to use an Opportunity Team (Option B). The Opportunity Team feature in Salesforce allows the sales rep to define and assign specific roles to members of the team, such as the logistics team and the customer service department. By using this feature, the sales rep can ensure that only the right people have access to the opportunity record, while also maintaining control over the data.
Why B is the Best Choice:
Collaboration with Defined Roles: The Opportunity Team feature allows you to assign specific roles (such as Logistics and Customer Service) to each team member, ensuring they have the appropriate level of access to the opportunity record. This role-based sharing makes it clear who is responsible for what and helps prevent unauthorized access to the opportunity.
Maintaining Security: Opportunity Teams provide a secure way to share access, as they respect the record-level access rules (such as private sharing models) but allow for fine-grained control over who can view or edit the opportunity record. You can also ensure that team members only get access to the opportunity, not to other sensitive records, maintaining data security.
Scalability: As the team grows or the opportunity progresses, the Opportunity Team feature allows for easy adjustments. New members can be added to the team with specific roles and responsibilities, and the permissions are automatically adjusted accordingly.
Why the Other Options Are Less Suitable:
A. Share the opportunity record manually with the logistics and customer service teams: While manual sharing can be used in certain situations, it is not the most scalable or efficient method for sharing opportunities, especially when multiple team members need access. This approach requires more effort and can lead to inconsistencies, as each user has to be manually added, which could increase the risk of errors or security breaches.
C. Create a sharing rule to provide access to the opportunity record: Sharing rules are typically used to automatically share records based on specific criteria, such as roles or ownership. However, in this case, the opportunity is closed, and it would be more efficient to use the Opportunity Team feature to explicitly define the roles and responsibilities of team members. Sharing rules might be too broad in this context and would not provide the same level of granular control over who can access and modify the opportunity.
D. Create a permission set to grant the logistics and customer service teams access to the opportunity: While permission sets can be useful for granting access to certain objects or fields, they are not the most appropriate solution for record-level sharing of specific opportunities. The permission set would grant access to all opportunities, which is broader than necessary. The Opportunity Team feature is more tailored to the specific need for sharing a single opportunity with defined teams.
The Opportunity Team feature is the most effective and secure way to share the opportunity record with the logistics and customer service teams while maintaining control over access and ensuring the security of the opportunity. This method provides fine-grained control, ease of use, and scalability, making it the best option in this scenario. Therefore, B is the correct answer.
Question 9:
Universal Containers (UC) has an application that needs to be accessed by different teams based on specific criteria. The access should be dynamic, and users in different roles should see different records.
Which sharing model should UC implement to meet these requirements?
A. Public Read Only
B. Criteria-Based Sharing
C. Manual Sharing
D. Role Hierarchy
Answer: B
Explanation:
To meet the requirement of dynamic access based on specific criteria, the most appropriate sharing model is Criteria-Based Sharing (Option B). This model allows you to define conditions (criteria) for sharing records with users based on specific attributes, such as record fields or user roles. It ensures that users in different roles see different records according to these defined rules.
Why B is the Best Choice:
Dynamic Access Control: Criteria-Based Sharing rules allow you to control access to records dynamically, based on the criteria that you define. For example, you could create a sharing rule that grants access to records based on their status, region, or type of record. This dynamic sharing ensures that only users who meet the specific criteria will have access to the records they need to see.
Granular Sharing: This model offers flexibility in managing record access. You can share records with users in different roles based on certain conditions, which aligns perfectly with the requirement of providing access based on user roles and specific criteria.
Scalability: As UC grows or as the criteria for sharing evolve, criteria-based sharing provides an easy way to adjust record visibility without needing manual intervention. This scalability is crucial in dynamic environments where access needs change over time.
Why the Other Options Are Less Suitable:
A. Public Read Only: This sharing model would make records publicly available to all users in the organization with read-only access. It doesn't provide the dynamic and role-specific record visibility that UC requires. It's too broad and does not allow for conditional, criteria-based control over record access.
C. Manual Sharing: Manual Sharing is a method where the record owner manually shares individual records with specific users. While this works for sharing individual records, it’s not scalable or efficient for a dynamic and role-based access model. It would be cumbersome to manually share records for each user, and it wouldn't allow for automated or criteria-based sharing of records.
D. Role Hierarchy: The Role Hierarchy model allows access to records based on the role structure within the organization. While it ensures that users in higher roles can access records owned by users in lower roles, it does not offer the flexibility of sharing based on specific criteria. It’s more static and does not address the need for dynamic record sharing based on conditions like specific attributes or team-based requirements.
Criteria-Based Sharing is the most appropriate sharing model for UC's needs, as it provides dynamic, role-based access to records based on specific criteria. This ensures that users see only the records they are authorized to view based on defined conditions, making it the best solution for this scenario. Therefore, B is the correct answer.
Question 10:
Universal Containers (UC) wants to allow their marketing team to create campaigns but restrict access to sensitive customer information for these users.
What is the most appropriate way to restrict sensitive customer data while allowing campaign creation?
A. Set up a Profile with restricted permissions for customer object fields but full permissions for campaign objects.
B. Use Permission Sets to restrict customer object data access while granting campaign object permissions.
C. Use Record Types to separate sensitive customer information and restrict access based on roles.
D. Use a sharing rule to prevent access to customer information while granting full access to campaigns.
Answer: B
Explanation:
The goal is to allow the marketing team to create and manage campaigns without providing access to sensitive customer information. To achieve this, the most appropriate solution is to use Permission Sets to control access to customer data while granting the required permissions to campaign objects.
Why B is the Best Choice:
Granular Control with Permission Sets: Permission Sets allow administrators to grant additional permissions to users on an object-by-object basis without modifying their primary profile. In this case, you can grant the marketing team full access to the campaign object while restricting access to the customer object (or specific fields within it). This provides the necessary flexibility to allow campaign creation, while ensuring that sensitive customer data remains restricted.
Flexibility: Permission Sets are ideal for targeted permission adjustments. If the marketing team needs full permissions on campaigns but limited access to customer information, permission sets allow you to grant or remove access to specific objects, fields, and records as needed, without requiring a complete overhaul of user profiles.
Scalability: As new users join the marketing team, you can quickly assign them the appropriate permission set to ensure they have the right access. This makes it easier to manage access for different teams across the organization without the need for complex reconfigurations of their base profiles.
Why the Other Options Are Less Suitable:
A. Set up a Profile with restricted permissions for customer object fields but full permissions for campaign objects: While modifying profiles can provide access control, using profiles to handle this scenario would require creating a separate profile for the marketing team, which might not be necessary. Profiles are typically designed for broader user categories, and using them here would result in a more rigid, less flexible solution than using permission sets. Furthermore, maintaining multiple profiles for different variations of access can lead to administrative complexity.
C. Use Record Types to separate sensitive customer information and restrict access based on roles: While Record Types can be useful for separating different types of records, they do not directly address the issue of restricting access to fields or objects. Record Types control the structure and page layouts but do not provide the same level of fine-grained control over field-level security or access to specific objects, which is essential in this case.
D. Use a sharing rule to prevent access to customer information while granting full access to campaigns: Sharing rules are primarily used to control record-level access (visibility) rather than field-level or object-level access. While sharing rules can be effective for giving or restricting access to records, they are not ideal for restricting sensitive data fields or controlling which users can interact with specific objects (like campaigns versus customers). Sharing rules are also more suited for scenarios where you need to share records between users rather than manage the permissions for specific actions on objects.
The most effective and flexible solution for restricting access to sensitive customer data while allowing the marketing team to create campaigns is to use Permission Sets (Option B). Permission sets allow for fine-grained control over access to specific objects and fields, which is exactly what UC needs in this case. Therefore, B is the correct answer.
