Sharing-and-Visibility-Architect Salesforce Certified Sharing and Visibility Architect (SP23) Questions and Answers

To meet the distributor needs, a Salesforce Architect should recommend using Partner Community licenses. Partner Community licenses are designed for external users who need access to standard CRM objects, such as accounts, contacts, opportunities, and cases3. Partner Community users can also collaborate with internal users and other partners through Chatter and Communities4. Sales Cloud licenses are for internal users who need full access to standard CRM and custom objects. Customer Community Plus licenses are for external users who need access to custom objects and a subset of standard CRM objects, such as accounts and contacts. Custom Community licenses are for external users who need access to custom objects only

 Partner User roles are limited to three levels, which means that affiliates cannot create more than three levels of roles for their internal sales team. This is the main problem an architect should address in this situation. The Channel Manager role can be shared with Partner Community, as it is used to manage partner accounts and users. Partner Community does support Role Hierarchy, as it allows affiliates to create their own roles and grant access based on their own hierarchy.

 Enterprise Territory Management is a feature that allows you to assign accounts to territories based on criteria such as geography, industry, revenue, etc. With Enterprise Territory Management, you can1:

Use the Metadata API to create, update, and delete territory models, territories, and account assignments.

Integrate with Collaborative Forecasting to forecast sales revenue by territory.

Assign opportunities to territories based on the account assignment or other criteria.

Inherited access grants and group membership grants are two types of access grants that are stored in the group maintenance tables. These tables store information about which users belong to which groups (group membership grants) and which groups inherit access from which groups (inherited access grants). Explicit grants and implicit grants are not stored in the group maintenance tables, but in other tables such as share tables and role hierarchy tables.

Removing the “Opportunity Delete” permission from the sales team’s user profile in the object permissions is the best way to prevent a certain set of users from deleting opportunities, as it controls whether they can delete any opportunity record in Salesforce. Removing the delete button from the opportunity page layout and record type settings is not effective, as it only removes the button from the user interface, not from other access points such as API or reports. Creating a validation rule that checks the user’s profile before allowing the Is Deleted flag to be set to True is not possible, as validation rules cannot reference system fields such as Is Deleted. Overriding the standard button with a Visualforce page that warns them that they do not have permission to delete is not advisable, as it requires custom code and does not prevent deletion from other access points

The system permission in their profile that enabled the users to see all list views is manage public list views. This permission allows users to create, edit, and delete public list views, as well as view all list views shared with them or with their groups. To restrict visibility to the respective list views, the system administrator should remove this permission from the users’ profiles and assign it only to those who need to manage public list views

Apex runs in system mode, which means it does not respect the current user’s permissions and sharing settings. Therefore, the development team needs to enforce record visibility by using the WITH SECURITY_ENFORCED clause or the Security.stripInaccessible method

Storing the value in a text field on a protected custom setting in the package is the best way to support this requirement. Protected custom settings are not visible to subscribers, but they can be accessed by the package code and support representatives. The other options either expose the value to subscribers (B and C) or do not allow support representatives to access it (D).

The architect does not need to do anything to ensure field-level security is enforced on a custom Visualforce page using the standard lead controller. This is because the standard controller automatically enforces field-level security based on the user’s profile and permission sets. The user will only see the fields that they have read access to, and will only be able to edit the fields that they have edit access to

A Sharing Set is a feature that allows you to grant access to records that are associated with the same account or contact as the community user1. This is the best option to implement the requirement of allowing customers to see service requests for their account through the community. Manual sharing, Sharing Rules, and Apex Managed Sharing are not suitable for this scenario because they are either too labor-intensive, not applicable to external users, or too complex

 The access levels that can be set on the Account Team Member are Account Access, Opportunity Access, and Case Access2. Contact Access and Contract Access are not available options for Account Team Members.

Content delivery is a feature that allows users to share files with customers and protect them with a password. Setting up an experience cloud site would require additional configuration and licensing. Utilizing an AppExchange product would introduce a dependency on a third-party solution.

The probable cause for this error is lock contention due to system-initiated sharing rule recalculation. When there are mass updates to fields that affect sharing rules, such as territory or role fields, Salesforce automatically recalculates the sharing rules to reflect the changes. This can cause lock contention on group membership records, which store the users and groups that have access to records through sharing rules. The other options are not likely to cause this error.

The two methods that an Architect could use to enable this sharing requirement are A and D. Option A allows the account manager to access the account once they are added to the account team, which is a type of implicit sharing5. Option D allows the account management group to access the account based on a criteria that matches the type field value. The other options are either not relevant or not efficient.

The underlying issue for these users who don’t see any of the accounts that were shared with the public group is that they are in profiles that have no access to the Account object. If a user does not have Read permission on an object in their profile or permission set, they cannot access any records of that object, regardless of any sharing rules or manual sharing. The page layout assigned to these users does not affect their record visibility, only their field visibility and layout. The permission set that only allows accounts in Active status does not affect their record visibility, only their record filtering. The accounts being owned by users higher in the role hierarchy does not affect their record visibility, as sharing rules can grant access to records owned by any user in any role.

The correct format for creating share objects for custom objects in Apex code is MyCustomObject__Share. Share objects are used to grant access to individual records that are owned by another user or queue. For standard objects, the share object name is ObjectNameShare, such as AccountShare or ContactShare. For custom objects, the share object name is ObjectName__Share, such as MyCustomObject__Share or Project__Share.

The statement is true. By Viewer Access, you can see the data in a report or dashboard, but you can’t make any changes, except by cloning it into a new report or dashboard1. Viewer Access is one of the three types of folder access levels in Salesforce, along with Editor Access and Manage Access1.

To store sensitive invoice data in Salesforce, the architect should consider using a master-detail relationship between accounts and invoices, and setting the organization-wide default sharing for invoices to private. This would ensure that only the owners of the invoices and their subordinates can see them, and that the invoices inherit the sharing settings of the accounts. A workflow that populates the invoice sharing object upon insert is not necessary if the master-detail relationship is used. A lookup relationship between accounts and invoices would not enforce the same level of security and visibility as a master-detail relationship3

Deferred Sharing Recalculation is a feature that allows admins to postpone the recalculation of sharing rules until a scheduled maintenance window, which can improve performance and avoid locking issues when making changes to roles or account owners3. This is the best feature to recommend to avoid problems with this operation. Skinny table is a feature that improves performance by storing frequently used fields in a separate table, but it does not affect sharing recalculation. Partition data using Divisions is a feature that allows admins to segment data into logical subsets for reporting and searching purposes, but it does not affect sharing recalculation.

Disabling Grant Access Using Hierarchies for the object and creating a sharing rule to enable sharing to the Director of Support are the steps to ensure proper sharing in this role hierarchy structure. This way, the Team Leads will not have access to the Reimbursement records of their subordinates, but the Director of Support will have access to all Reimbursement records. Option A is incorrect, as setting the View All permission on the profile will grant access to all users with that profile, not just the Director of Support. Option B is incorrect, as changing the owner of the Reimbursement record will remove the access from the original submitter. Option D is incorrect, as by default, Grant Access Using Hierarchies is enabled for custom objects, which means that Team Leads will have access to their subordinates’ Reimbursement records.

The expected behavior if a user without FLS accesses the VF page is that the field is automatically removed from the page. This is because apex:outputField respects FLS settings and will not render any field that the user does not have read access to. The user will not encounter any error, see the output field, or enter any value into the phone field

 Criteria-based sharing rules are used to share records based on field values, not ownership. This is the best option to grant access to accounts of the same segment in other countries, regardless of who owns them. Owner-based sharing rules are based on the owner of the record, not the segment. Changing the role hierarchy would affect other aspects of data visibility and security. Creating a public group and a permission set would require manual maintenance and would not be scalable.

Using Dynamic Form to add different page sections and control visibility of sections by Work Order RecordType value is the best option to implement this requirement, as it will allow field agents to see only required information specific to the WorkOrder type they are addressing, without creating multiple page layouts or custom components. Using a custom LWC to override the view action of WorkOrder with custom metadata type defining relevant fields per WorkOrder type will work, but it will require additional development and maintenance. Using different page layouts per work order type with different sections representing key information about the specific work order type will work, but it will require creating multiple record types and page assignments.

 To help the system recover from a maintenance restart on Salesforce servers, the Salesforce feature that would help is enabling deferred sharing rule recalculation. This feature allows postponing the recalculation of sharing rules until a scheduled time, which can improve performance and avoid locking issues when there are frequent changes to sharing rules or role hierarchy5. Enabling granular locking or parallel sharing rule recalculation will not help, as they are related to improving performance and avoiding locking issues when recalculating sharing rules, not recovering from a maintenance restart. Enabling filter-based opportunity territory assignment will not help, as it is related to assigning opportunities to territories based on criteria, not recovering from a maintenance restart.

 To grant the sales managers access to the customer invoices data, the architect should control the invoices object permission on the sales manager’s profile. This will allow the sales managers to view and query the external object records, as long as they have access to the parent account records. Creating a sharing set or a sharing rule will not work, as they are not supported for external objects. Using manual sharing will not work, as it is not available for external objects

 When a sharing rule grants access to a public group, the access is also extended to the subordinates of the users in that group, according to the role hierarchy1. Therefore, subordinates of managers who have sales engineers in the public group will also have access to these records. Other sales engineers who are in the same role hierarchy as the sales engineers of the public group will not have access to these records, unless they are subordinates or managers of the users in the public group. Sales engineers and their managers in the role hierarchy will not have access to these records, unless they are part of the public group or its subordinates.

 Roles is an option that can be selected to share data when creating a sharing rule, as it allows admins to grant access to users who have a specific role or roles below that role in the hierarchy2. Users is not an option that can be selected to share data when creating a sharing rule, as sharing rules are based on groups, not individuals. Profiles is not an option that can be selected to share data when creating a sharing rule, as sharing rules are based on record ownership or criteria, not profiles.

The best way to review access to a certain set of key customer accounts is to export the Account Share table and review it. The Account Share table stores all the sharing records that grant access to accounts, including manual sharing, sharing rules, team sharing, and implicit sharing4. The other options are either not feasible or not comprehensive.

 Enforcement of a user’s record sharing is the functionality that is verified by the system method “runAs()”. This method allows test methods to run in the context of a specific user and verify whether that user has access to the records based on the sharing settings. The other options are not verified by the runAs() method.

Creating a permission set that grants the View All permission for Opportunity is the best approach to meet these requirements, as it will allow the sales reporting team members to view all opportunity records without modifying their profiles. Creating a permission set that grants the View All Data permission will work, but it will also grant access to all other objects, which may not be necessary or secure. Giving the View All Data permission to the Sales Reporting profile will work, but it will also affect all users with that profile, which may not be desired.

The Architect can support this request by creating a Permission Set with read-only access to the Category field and assigning it to the 3 users who need it. This will override the profile permissions and restrict their access to the field.

The two methods that would be used to enforce this requirement are A and D. Schema.DescribeFieldResult and Schema.DescribeSObjectResult can be used to check the user permissions for creating records and accessing certain fields, even if the Visualforce controller is written with “Without Sharing”. The other options are either not related to field or object permissions, or not sufficient to enforce them.

Creating a Sharing set for the Distributor profile to grant access to the Delivery object is the correct way to share records with users in a partner community. Sharing sets allow you to share records based on a common account or contact2. Criteria-based sharing rules are not available for partner communities3.

Profiles and Permission Sets can be used to control the object-level and field-level access for different types of users. For example, sales reps can have read/write access to Account object but not to the segment field, while service reps can have read-only access to Account object and all fields. Role Hierarchy can be used to control the record-level access for users based on their position in the organization. For example, sales managers can access and modify any account of reps reporting to them, while service managers can access and modify any account regardless of ownership. Field-Level Security can be used to override the profiles and permission sets for specific fields on specific records. For example, service managers can edit the segment field on any account, even if their profile does not allow it. Therefore, the answer D is correct and the other options are incorrect3

Susan and users with the View All Data permission and Susan and users with access to the record are two statements that accurately describe who can view the file by default. When a file is posted to a record’s feed, it inherits the sharing settings of that record. Therefore, only users who can view the record can view the file. Users with the View All Data permission can view all records and files in the organization. Option C is incorrect, since users with a shared chatter post link to the file can only view the file if they have access to the record as well. Option D is incorrect, since Susan is not the only one who can view the file, but also users who have access to the record or the View All Data permission.

 To give access to the invoice records from an external object on the account page, the Sales Architect should recommend including the Invoice Related List on Account Page layout. This will allow the finance users to see the invoice records related to each account, as long as they have access to the account record and the external object4. Creating sharing rules or using Apex managed sharing are not applicable for external objects, as they do not support manual or programmatic sharing

Setting the Request object’s OWD to Public Read/Write is the simplest and most efficient way to allow all employees to collaborate on requests. Option B is incorrect, since granting Modify All Data permission on all profiles would give too much access and affect other objects as well. Option C is incorrect, since creating a criteria-based sharing rule to share all records with all users would be redundant and inefficient. Option D is incorrect, since setting the OWD to Public Read Only would not allow users to edit requests3.

 The development team missed using the with Sharing keyword in Apex classes to enforce sharing rules evaluation, and the isAccessible() method in Apex classes to check field accessibility. The with Sharing keyword ensures that the Apex code respects the sharing rules defined for the current user, while the isAccessible() method checks if the user has read access to a specific field1. The run as method in test class is used to test whether a user can perform certain actions, not to enforce permissions2. The isSharable keyword in Apex classes does not exist.

The license type that must be used by community users who want to collaborate on opportunities is Partner Community. As mentioned above, Partner Community licenses allow users to access standard CRM objects such as opportunities and collaborate with other partners and internal users using Chatter and Communities. Sales Community licenses do not exist as a separate license type. Customer Community and Customer Community Plus licenses do not allow users to access opportunities, as they are intended for customer service scenarios rather than sales scenarios.

The architect can configure the system to support the requirements by using a sharing rule. A sharing rule is a declarative way of extending record access to users or groups of users based on criteria such as ownership, role, or field values3. In this case, the architect can create a sharing rule that grants read or read/write access to all records owned by customer community users to UC users in the customer support role. A sharing set is used to grant access to community users based on a common account or contact, not to internal users. A share group is used to share records with groups of community users who have Customer Community Plus or Partner Community licenses, not with internal users. Apex sharing is used to programmatically share records when declarative sharing cannot fulfill complex requirements, but it is not necessary in this case.

 Profiles can control the login hours for users, which can restrict their access to Salesforce based on their time zone. Option A is incorrect, since login hours are not set on user records. Option B and C are incorrect, since permission sets and custom permissions do not control login hours

Organization-wide defaults (OWD) are a way to set the baseline level of access for each object in the organization. OWD can be set to Private, Public Read Only, Public Read/Write, or Public Read/Write/Transfer for different objects. In this case, setting OWD to Public Read Only for Lead object will allow all full-time internal employees to view all leads, but not edit them. A subset of employees can be granted additional access to leads using other mechanisms such as profiles, permission sets, or sharing rules. Therefore, the answer B is correct and the other options are incorrect .

The side effect of this approach is that sales reps on the same team will have read access to the accounts for opportunities owned by their team members. This is because owner-based sharing rules grant access to both the parent and child records of the same object. For example, if a sharing rule grants access to opportunities owned by a certain role, it also grants access to the accounts associated with those opportunities. All sales reps will not have read access to accounts for all opportunities, as the sharing rules are based on ownership. Sales reps on the same team will not have edit access to the accounts for opportunities owned by their team members, as owner-based sharing rules only grant read or read/write access to child records, not parent records. All sales reps will not have read access to all accounts, as the account organization-wide default is private.

 Cross-Site Scripting (XSS) and SOQL Injection are two common types of security vulnerabilities that can affect Salesforce applications. XSS occurs when malicious code is injected into a web page that can execute in the browser of a user who visits that page6. SOQL Injection occurs when user input is used to construct a SOQL query without proper validation or escaping, which can allow an attacker to manipulate the query and access unauthorized data7. To prevent XSS, developers should use appropriate encoding methods when displaying user input on custom pages8. To prevent SOQL Injection, developers should use bind variables or the escapeSingleQuotes() method when building SOQL queries with user input9. Option A is incorrect, since Apex queries are not vulnerable to XSS. Option D is incorrect, since testing for invalid user access attempts is not related to security vulnerabilities within the Salesforce organization.

The architect can design the solution to federate user setup to the partners by assigning delegated external administrators at each partner and allowing external users to self-register. A delegated external administrator is a user who can create and manage users in their own partner account. This way, the partners can have more control over their seasonal workers and reduce the administrative burden on UC. Allowing external users to self-register is another way of simplifying user creation and management for partners, as they can enable their workers to create their own accounts and log in to the community. Granting the Modify Users permission to the partner managers is not a good practice, as it would give them too much power over all users in the org. Creating a permission set giving Read/Write to the User object to partner manager is also not advisable, as it would expose sensitive user data and allow unauthorized changes.

 Setting the case organization-wide default to Private and adding the specialized marketing consultants to the account team with Read/Edit permission are the best recommendations to allow this scenario. This way, only the support rep who owns the case and the marketing consultants who are related to the account can see and edit the case records of VIP customers. Option B is incorrect, since setting the case organization-wide default to Public Read Only would give access to all cases to all users. Option C is incorrect, since using a role hierarchy and a read-only ownership-based sharing rule would not give edit access to the marketing consultants. Option D is incorrect, since adding the marketing consultants to the case team would require manual configuration and maintenance.

 Partner super user is the only feature that supports the requirement of granting specific community users (agents) to view cases submitted by other agents of the same distributor. Partner super users are community users who can access and edit data owned by other partner users in their account. They can also access reports and dashboards that display data from their account1. Permission set to grant community admin permission, delegate external user, and partner community admin are not features that can achieve the same result.

Setting the organization-wide default to Private and unchecking the Access Using Hierarchies option for the NPS object will prevent the managers from accessing the NPS records of their subordinates. This is because the access using hierarchies option allows users above the owner in the role hierarchy to have the same level of access as the owner

The Grant Access Using Hierarchies option on Shipment Sharing Settings allows users above the owner in the role hierarchy to have the same level of access as the owner. If this option is disabled, the role hierarchy will not grant access to the Shipment records, even if it is configured correctly. Therefore, the answer A is correct and the other options are incorrect

 Setting the OWD for internal users to Public Read Only is the simplest and most efficient way to give access to all internal employees to the ServiceFeedback object. Option A is incorrect, since creating a trigger on ServiceFeedback to change ownership to an internal employee would be complicated and affect the data quality. Option B is incorrect, since ensuring all the internal users are above the partners in the role hierarchy would not work, as the role hierarchy does not apply to partner users. Option C is incorrect, since creating an owner-based sharing rule for all ServiceFeedback records owned by partners would be redundant and inefficient

To implement Apex managed sharing, a Salesforce Developer should consider using the with Sharing keyword and the runAs system method. The with Sharing keyword ensures that the Apex class respects the record visibility rules of the current user context, which can help prevent unauthorized access to records that are not shared with the user1. The runAs system method allows testing the code as different users with different profiles and permissions, which can help verify that the sharing logic is working as expected2.

Granular locking is an advanced tool that Salesforce can enable for large-scale role hierarchy realignments. Granular locking allows finer-grained locking for certain operations that affect large data sets, such as bulk loading or updating. Granular locking can reduce the locking time and avoid performance issues when changing role hierarchy or ownership. Therefore, the answer C is correct and the other options are incorrect

Master-Detail relationships enforce the sharing and security settings of the parent object on the child object. This means that if a user has access to an Account record, they will also have access to any Invoice records that are related to that Account. To prevent this, the architect can recommend replacing the Master-Detail relationship with a Lookup relationship, which allows the child object to have its own sharing and security settings independent of the parent object. Then, the architect can remove the Invoice access from the unauthorized profiles or use other mechanisms such as sharing rules or permission sets to restrict or grant access to the Invoice object. Therefore, the answer C is correct and the other options are incorrect

To give users in the partner user role access to all Case and Container records owned by any user at the same distributor, an Architect can give super user permission to the individual partner users. Super user permission allows partner users to access data owned by other partner users belonging to the same account or below them in the role hierarchy. Creating an ownership-based sharing rule will not work, as it will share records based on the owner’s role or territory, not their account. Creating sharing sets will not work, as they are only available for Customer Community licenses, not Partner Community licenses. Creating a Permission Set granting “View All” permission to Case and Container records will not work, as it will give access to all records in those objects, regardless of their owner or account.

 Creating an ownership-based sharing rule is the best way to achieve the requirements. Ownership-based sharing rules allow administrators to automatically grant access to records owned by certain users or roles to other users or roles2. This way, the sales manager in Australia can access the deals owned by the sales manager in Japan. Using sharing set, using opportunity teams, and assigning View All on the opportunity object are not options that can achieve the same result.

There is an Account ownership data skew problem, which could be the reason for this problem. Data skew occurs when a large number of records (more than 10,000) are owned by a single user or belong to a single role. This can cause performance issues when accessing or updating those records, as well as when recalculating sharing rules or changing ownership. In this scenario, since each donation rep owns over 50,000 donor accounts, there is a significant data skew that affects the system performance. Option A is incorrect, since the donation reps access to the assigned accounts is not a problem by itself, but rather a consequence of data skew. Option B is incorrect, since Salesforce sharing recalculation kicked off is not a problem by itself, but rather a consequence of data skew. Option D is incorrect, since the Account (donor) object OWD being Private is not a problem by itself, but rather a consequence of data skew.

Only Bob can view the file that he uploads to his Files Home private library. Users above Bob in the role hierarchy, users with View All Data permission, or users with Modify All Data permission cannot access the file unless Bob explicitly shares it with them

 Ownership-based sharing rules are a way to grant access to records based on the record owner’s role or public group membership. Ownership-based sharing rules can be used to share records with Partner Community users, who are not supported by sharing sets. In this case, ownership-based sharing rules can be used to share Case and Container records owned by partner managers and partner users with other partner managers at the same distributor. Therefore, the answer D is correct and the other options are incorrect .

To audit user setup in Salesforce, the team needs to have both View Setup and Configuration and View All Users permissions. View Setup and Configuration allows them to access the setup menu and see the user profiles, roles, and permission sets. View All Users allows them to see all the user records and their details, such as login history and assigned licenses

Enabling Community User Visibility is the best option to allow viewing chatter posts from all customers. Community User Visibility is a setting that allows community users to see and interact with other community users, regardless of their account or role2. Setting View All for Chatter posts, enabling Chatter Super User, and enabling Internal Users Visibility are not options that can achieve the same result.

Removing the Work Order Edit permission from the sales representative profile is the optimal approach to implement these requirements, as it will prevent sales representatives from changing virtual container work orders that are provisioned immediately by the system. Option B is incorrect, since removing the edit button from the work order page layout would not prevent sales representatives from editing work orders using other methods, such as inline editing or data loader. Option C is incorrect, since changing the record type/page layout assignment for Work Order to be Read Only would not affect the edit permission, but only the layout configuration. Option D is incorrect, since implementing a sharing rule that changes access for all Work Order to Read would not prevent sales representatives from editing work orders that they own.

 Searching for external users is the community functionality that is impacted by having the customer user visibility turned off. When customer user visibility is turned off, community users cannot find or interact with other community users in global search, people search, or chatter. Option B is incorrect, since updating their user profile is not affected by customer user visibility. Option C is incorrect, since creating new customer community users is not affected by customer user visibility. Option D is incorrect, since searching for internal users is not affected by customer user visibility.

The two actions that are required to achieve the requirement are setting up External Object to use OAuth to connect to the Accounting system and restricting access to data in the accounting system. OAuth is an authentication protocol that allows Salesforce to securely access data from an external system without storing the username and password of the external system user3. Restricting access to data in the accounting system is a way to ensure that only authorized users can view the invoice records from the external source. Creating an owner based sharing rule to grant visibility to the Invoice object and granting access to the External Object to only the Account Manager profile are not actions that can ensure that a user only accesses invoice records the user is authorized to see.

Roles and Public Groups are two options that can be selected to share data with when creating a sharing rule. Sharing rules can grant additional access to records based on the owner’s role or public group membership. Option C is incorrect, since Users are not an option for sharing rules. Option D is incorrect, since Profiles are not an option for sharing rules.

The report owner is the only one who can view and run the report that is saved in the “Private Reports” folder. Option A is incorrect, since there is no such thing as the “My Private Reports” folder in Salesforce. Option B is incorrect, since the role hierarchy does not affect the access to private reports. Option D is incorrect, since the “View All Data” permission does not grant access to private reports.

 Adding the product specialist and solution engineer to the opportunity team is the optimal way for the junior account manager to share the opportunity, given the private sharing model. Opportunity teams are groups of users who work together on sales opportunities. Adding users to an opportunity team grants them access to the opportunity and related records. This way, the junior account manager can collaborate with the product specialist and solution engineer on the complex deal, and when the account is reassigned to a senior account manager, the opportunity team members will retain their access. Option A is incorrect, since manual sharing on the opportunity would be removed when the account owner changes. Option C is incorrect, since manual sharing on the account would not grant access to the opportunity, as it does not roll up from account to opportunity. Option D is incorrect, since creating an owner-based sharing rule would be unnecessary and inefficient.

The sales rep will have read-only access to the related account record. This is because the organization-wide default for the account object is private, which means that users can only access the accounts that they own or are shared with them. However, when a user has access to an opportunity, they also have implicit read-only access to the account associated with that opportunity1. This is called implicit sharing and it allows users to view the parent records of the child records they own or can access2. Therefore, the sales rep can view the account record related to the opportunity, but cannot create, edit, or delete it.

Disabling Grant Access Using Hierarchies and setting an Owner-Based Sharing rule for Strategic Deals team is the best way to design for this requirement. This will ensure that only the owner and the strategic team can access the confidential proposals, regardless of the role hierarchy. Setting the Proposal Owner to the Strategic Deals Team Queue will not work, because queues can only own leads, cases, orders, and custom objects. Setting a Criteria-Based Sharing rule for Strategic Deals team will not work, because criteria-based sharing rules can only grant access, not restrict it.