Question 1
Choose 1
A company ' s external application is protected by Salesforce through OAuth. The identity architect for the project needs to limit the level of access to the data of the protected resource in a flexible way.
What should be done to improve security?
What should be done to improve security?
Correct answer:
B. Create custom scopes and assign to the connected app.
Explanation:
When an external application accesses Salesforce via OAuth, the level of data access is governed by OAuth scopes. Predefined scopes (e.g., api, refresh_token) offer coarse control. To flexibly limit access, custom OAuth scopes can be created, allowing fine-grained permissions tailored to specific resources or operations, improving security by following least privilege.
Correct Option:
B. Create custom scopes and assign to the connected app.
Custom OAuth scopes allow architects to define granular permissions (e.g., read_orders, update_inventory) that map to specific Apex classes or API resources. By assigning these custom scopes to the connected app, the external application receives only the permissions it needs. This follows the principle of least privilege and provides flexible access control beyond Salesforce's standard scopes.
Incorrect Option:
A. Select "Admin approved users are pre-authorized" and assign specific profiles.
This setting controls the OAuth approval flow (whether users must approve access), but it does not limit data access scope. Assigning profiles controls user permissions within Salesforce, not the access level of the external application via OAuth. This option confuses user authorization with OAuth scoping.
C. Leverage external objects and data classification policies.
External objects represent data outside Salesforce, and data classification policies label sensitivity (e.g., PII). Neither directly limits OAuth access from an external application to protected resources. These are unrelated to OAuth scope configuration.
D. Define a permission set that grants access to the app and assign to authorized users.
Permission sets grant permissions (object, field, page) to users inside Salesforce. They are not used to restrict OAuth scopes for external applications. The external app's access is defined by the connected app's OAuth scopes, independent of user permission sets (though user permissions still apply as a second factor).
Reference:
Salesforce Developer Guide: "OAuth 2.0 – Custom Scopes"
Salesforce Help Article: "Create Custom OAuth Scopes for Connected Apps"
Trailhead: "OAuth 2.0 for API Integration" – Unit on "Scopes and Permissions"
When an external application accesses Salesforce via OAuth, the level of data access is governed by OAuth scopes. Predefined scopes (e.g., api, refresh_token) offer coarse control. To flexibly limit access, custom OAuth scopes can be created, allowing fine-grained permissions tailored to specific resources or operations, improving security by following least privilege.
Correct Option:
B. Create custom scopes and assign to the connected app.
Custom OAuth scopes allow architects to define granular permissions (e.g., read_orders, update_inventory) that map to specific Apex classes or API resources. By assigning these custom scopes to the connected app, the external application receives only the permissions it needs. This follows the principle of least privilege and provides flexible access control beyond Salesforce's standard scopes.
Incorrect Option:
A. Select "Admin approved users are pre-authorized" and assign specific profiles.
This setting controls the OAuth approval flow (whether users must approve access), but it does not limit data access scope. Assigning profiles controls user permissions within Salesforce, not the access level of the external application via OAuth. This option confuses user authorization with OAuth scoping.
C. Leverage external objects and data classification policies.
External objects represent data outside Salesforce, and data classification policies label sensitivity (e.g., PII). Neither directly limits OAuth access from an external application to protected resources. These are unrelated to OAuth scope configuration.
D. Define a permission set that grants access to the app and assign to authorized users.
Permission sets grant permissions (object, field, page) to users inside Salesforce. They are not used to restrict OAuth scopes for external applications. The external app's access is defined by the connected app's OAuth scopes, independent of user permission sets (though user permissions still apply as a second factor).
Reference:
Salesforce Developer Guide: "OAuth 2.0 – Custom Scopes"
Salesforce Help Article: "Create Custom OAuth Scopes for Connected Apps"
Trailhead: "OAuth 2.0 for API Integration" – Unit on "Scopes and Permissions"