SALESFORCE CERTIFICATION · OBJECTIVE ASSESSMENT A+ VERIFIED
2026/2027 Salesforce Admin Certification
Exam Test Bank — Complete
Official Exam Test Bank
65 Questions Full Rationales Verified Answers
A+ 8 100%
QUESTIONS SECTIONS RATIONALES
Complete coverage Core exam domains Every answer explained
WHAT THIS COVERS
01 Configuration and Setup (15%)
02 Object Manager and Lightning App Builder (15%)
03 Sales and Marketing Applications (10%)
04 Service and Support Applications (10%)
05 Productivity and Collaboration (10%)
06 Data and Analytics Management (17%)
07 Automation (15%)
08 Agentforce (8%)
ABOUT THIS ASSESSMENT
Build mastery in Salesforce administration — from configuration and setup, Object Manager, and Lightning App Builder to sales, marketing,
service, and support applications, productivity and collaboration, data and analytics management, automation with Flow Builder, and the
new Agentforce AI section. This original study bank targets application and analysis skills for the Salesforce Certified Platform Administrator
exam, with full rationales for every answer. For review use only; not an institutional proctored assessment.
PASSING SCORE LEVEL FORMAT
65% Intermediate (Salesforce Certification) Application / Analysis
STUVIA ACTUAL EXAM Page 1
,SECTION 1: Configuration and Setup
Q1. A system administrator at a global manufacturing company needs to ensure that users in the EMEA region can only view and edit
accounts owned by other EMEA users, while executives require unrestricted access. The organization uses role hierarchy and
sharing rules. Which configuration approach best satisfies both requirements without creating excessive sharing rules?
A. Create a public group for EMEA users and a sharing rule granting read/write access, then assign executives the 'View All' and
'Modify All' permissions on Account via a permission set.
B. Use territory management to define EMEA territories and assign executives as territory managers with full access.
C. Disable the organization-wide default for Account and rely solely on the role hierarchy with executives placed at the top of the
hierarchy.
D. Set the organization-wide default for Account to Private, place EMEA users under a common role, and grant executives the
'Modify All Data' system permission.
Correct Answer: A
Rationale:
Organization-wide defaults and role hierarchy alone cannot grant unrestricted access to executives while restricting peers. A sharing rule limited to the
EMEA public group provides the regional visibility, while a permission set with View All/Modify All on Account gives executives the needed unrestricted
access without elevating their role or using the powerful Modify All Data system permission. Territory management is unnecessary for a simple
regional restriction.
Q2. During a quarterly security review, an administrator discovers that several users still retain the 'API Enabled' permission after their
integration accounts were decommissioned. The company policy requires that only active integration users keep this permission.
What is the most efficient way to identify and remediate these accounts while minimizing disruption to legitimate users?
A. Use Login Access Policies to restrict API access based on IP ranges and ignore the residual permission assignments.
B. Run a user permission report filtered by 'API Enabled' equals true, export the results, compare against the list of active
integration users, and remove the permission via a permission set assignment update.
C. Create a validation rule that blocks login for any user with API Enabled who is not in the Integration Users public group.
D. Deactivate all users with the API Enabled permission and then reactivate only those confirmed as legitimate integration
accounts.
Correct Answer: B
Rationale:
A targeted permission report combined with a controlled permission set update is the least disruptive method. Deactivating users risks locking out
legitimate accounts and loses historical context. Validation rules cannot enforce login restrictions based on permission presence in this way, and Login
Access Policies control network access rather than the underlying API Enabled permission.
Q3. A multi-subsidiary organization wants each subsidiary's users to see a distinct company logo and color scheme when they log into
Salesforce. The subsidiaries share the same Salesforce org but operate under different brands. Which feature should the
administrator configure to meet this requirement?
A. Build custom Visualforce pages that hard-code each subsidiary's branding and assign the pages as home page components.
B. Use Salesforce Sites with different branding domains for each subsidiary and redirect users after login.
C. Create separate Lightning Experience themes and assign each theme to the corresponding subsidiary profiles or permission
sets.
D. Upload multiple company logos under Company Information and rely on the role hierarchy to display the correct logo.
Correct Answer: C
Rationale:
Lightning Experience themes support logo, brand colors, and background images and can be assigned by profile or permission set. Company
Information stores only a single logo. Custom Visualforce is over-engineered and harder to maintain. Salesforce Sites are intended for external users,
not internal branded login experiences.
Q4. An administrator is configuring Login IP Ranges for a high-security profile used by finance users. After adding the corporate office
ranges, several remote finance contractors report that they can no longer log in even when using the company VPN. What is the most
likely cause and the recommended corrective action?
A. The contractors' user records have the 'Password Never Expires' setting enabled, which conflicts with IP restrictions.
B. Two-factor authentication is enforced at the org level and overrides profile-level IP ranges; disable MFA for the finance profile.
C. Login IP Ranges ignore VPN traffic; remove the ranges entirely and rely solely on Multi-Factor Authentication.
D. The VPN assigns IP addresses outside the configured ranges; expand the Login IP Ranges to include the VPN address pool
or require the contractors to use a different profile with broader ranges.
Correct Answer: D STUVIA ACTUAL EXAM · Page 2
Rationale:
Login IP Ranges are evaluated against the source IP presented to Salesforce. When users connect through a corporate VPN, the source IP is the
, SECTION 1: Configuration and Setup
Q5. A company is migrating from Classic to Lightning Experience. Several power users rely on custom JavaScript buttons that perform
mass updates on list views. The administrator must preserve equivalent functionality. Which approach aligns with Salesforce best
practices for Lightning?
A. Convert each JavaScript button into a Visualforce page that is launched from a custom button on the list view.
B. Replace the JavaScript buttons with Lightning Web Components or screen Flows that can be invoked from list-view actions,
and assign the new actions to the relevant page layouts or search layouts.
C. Enable the 'Allow Classic JavaScript Buttons in Lightning' preference so the existing buttons continue to work unchanged.
D. Instruct users to stay in Salesforce Classic for those objects until JavaScript buttons are fully supported in Lightning.
Correct Answer: B
Rationale:
Salesforce has deprecated JavaScript buttons for Lightning Experience. The supported path is to rebuild the logic with Lightning Web Components or
declarative screen Flows and surface them as list-view actions. There is no preference that re-enables Classic JavaScript buttons, and Visualforce is a
temporary bridge rather than a best-practice long-term solution.
Q6. An administrator needs to grant a group of support managers the ability to transfer cases owned by any user in the organization, but
they must not be able to transfer opportunities or accounts. Which combination of settings achieves this least-privilege goal?
A. Assign the 'Transfer Cases' permission via a permission set and ensure the managers do not have 'Modify All Data' or
object-level Transfer permissions on Opportunity and Account.
B. Place the support managers at the top of the role hierarchy so they inherit ownership transfer rights on all objects.
C. Grant the managers the 'Transfer Record' system permission and then restrict Opportunity and Account via sharing rules.
D. Create a custom permission called 'Case Transfer Only' and reference it in an Apex trigger that performs the transfer.
Correct Answer: A
Rationale:
The Transfer Cases permission is object-specific and can be granted independently through a permission set. Placing users at the top of the hierarchy
or granting Transfer Record would give broader transfer rights than required. Custom Apex is unnecessary when a standard permission already exists.
Q7. During user provisioning, the administrator notices that new users created via the Salesforce API are not receiving the expected
default profile and role. Manual user creation through the UI works correctly. What configuration area should the administrator
examine first?
A. The Login Hours defined on the default profile, which can block API-created users from activating.
B. The Password Policies page, because API-created users inherit a different password expiration setting.
C. The User Management settings and any active assignment rules or default values defined for the User object that apply only
to the UI creation path.
D. The organization-wide defaults for the User object, which may differ between API and UI contexts.
Correct Answer: C
Rationale:
Default values and assignment logic for User records can be influenced by setup configurations that behave differently for UI versus API insert paths.
Organization-wide defaults do not control profile or role assignment. Login Hours and Password Policies affect authentication after the user exists, not
the initial assignment of profile and role.
Q8. A regulated financial services firm requires that every successful and failed login attempt be retained for seven years. Salesforce
standard login history is retained for only six months. Which solution meets the retention requirement with the least ongoing
administrative overhead?
A. Create a custom object to store login events and write an Apex trigger on the User object that records every login.
B. Increase the standard Login History retention period to seven years under Company Information settings.
C. Export the Login History report every month and store the CSV files on a network share for seven years.
D. Enable Event Monitoring, subscribe to the LoginEvent stream, and archive the events to a long-term external data store or
Big Objects on a scheduled basis.
Correct Answer: D
Rationale:
Event Monitoring provides a durable stream of LoginEvent records that can be archived automatically. Manual monthly exports are error-prone and do
not scale. There is no triggerable event on the User object for logins, and the standard Login History retention cannot be extended beyond six months
inside Salesforce.
STUVIA ACTUAL EXAM · Page 3
2026/2027 Salesforce Admin Certification
Exam Test Bank — Complete
Official Exam Test Bank
65 Questions Full Rationales Verified Answers
A+ 8 100%
QUESTIONS SECTIONS RATIONALES
Complete coverage Core exam domains Every answer explained
WHAT THIS COVERS
01 Configuration and Setup (15%)
02 Object Manager and Lightning App Builder (15%)
03 Sales and Marketing Applications (10%)
04 Service and Support Applications (10%)
05 Productivity and Collaboration (10%)
06 Data and Analytics Management (17%)
07 Automation (15%)
08 Agentforce (8%)
ABOUT THIS ASSESSMENT
Build mastery in Salesforce administration — from configuration and setup, Object Manager, and Lightning App Builder to sales, marketing,
service, and support applications, productivity and collaboration, data and analytics management, automation with Flow Builder, and the
new Agentforce AI section. This original study bank targets application and analysis skills for the Salesforce Certified Platform Administrator
exam, with full rationales for every answer. For review use only; not an institutional proctored assessment.
PASSING SCORE LEVEL FORMAT
65% Intermediate (Salesforce Certification) Application / Analysis
STUVIA ACTUAL EXAM Page 1
,SECTION 1: Configuration and Setup
Q1. A system administrator at a global manufacturing company needs to ensure that users in the EMEA region can only view and edit
accounts owned by other EMEA users, while executives require unrestricted access. The organization uses role hierarchy and
sharing rules. Which configuration approach best satisfies both requirements without creating excessive sharing rules?
A. Create a public group for EMEA users and a sharing rule granting read/write access, then assign executives the 'View All' and
'Modify All' permissions on Account via a permission set.
B. Use territory management to define EMEA territories and assign executives as territory managers with full access.
C. Disable the organization-wide default for Account and rely solely on the role hierarchy with executives placed at the top of the
hierarchy.
D. Set the organization-wide default for Account to Private, place EMEA users under a common role, and grant executives the
'Modify All Data' system permission.
Correct Answer: A
Rationale:
Organization-wide defaults and role hierarchy alone cannot grant unrestricted access to executives while restricting peers. A sharing rule limited to the
EMEA public group provides the regional visibility, while a permission set with View All/Modify All on Account gives executives the needed unrestricted
access without elevating their role or using the powerful Modify All Data system permission. Territory management is unnecessary for a simple
regional restriction.
Q2. During a quarterly security review, an administrator discovers that several users still retain the 'API Enabled' permission after their
integration accounts were decommissioned. The company policy requires that only active integration users keep this permission.
What is the most efficient way to identify and remediate these accounts while minimizing disruption to legitimate users?
A. Use Login Access Policies to restrict API access based on IP ranges and ignore the residual permission assignments.
B. Run a user permission report filtered by 'API Enabled' equals true, export the results, compare against the list of active
integration users, and remove the permission via a permission set assignment update.
C. Create a validation rule that blocks login for any user with API Enabled who is not in the Integration Users public group.
D. Deactivate all users with the API Enabled permission and then reactivate only those confirmed as legitimate integration
accounts.
Correct Answer: B
Rationale:
A targeted permission report combined with a controlled permission set update is the least disruptive method. Deactivating users risks locking out
legitimate accounts and loses historical context. Validation rules cannot enforce login restrictions based on permission presence in this way, and Login
Access Policies control network access rather than the underlying API Enabled permission.
Q3. A multi-subsidiary organization wants each subsidiary's users to see a distinct company logo and color scheme when they log into
Salesforce. The subsidiaries share the same Salesforce org but operate under different brands. Which feature should the
administrator configure to meet this requirement?
A. Build custom Visualforce pages that hard-code each subsidiary's branding and assign the pages as home page components.
B. Use Salesforce Sites with different branding domains for each subsidiary and redirect users after login.
C. Create separate Lightning Experience themes and assign each theme to the corresponding subsidiary profiles or permission
sets.
D. Upload multiple company logos under Company Information and rely on the role hierarchy to display the correct logo.
Correct Answer: C
Rationale:
Lightning Experience themes support logo, brand colors, and background images and can be assigned by profile or permission set. Company
Information stores only a single logo. Custom Visualforce is over-engineered and harder to maintain. Salesforce Sites are intended for external users,
not internal branded login experiences.
Q4. An administrator is configuring Login IP Ranges for a high-security profile used by finance users. After adding the corporate office
ranges, several remote finance contractors report that they can no longer log in even when using the company VPN. What is the most
likely cause and the recommended corrective action?
A. The contractors' user records have the 'Password Never Expires' setting enabled, which conflicts with IP restrictions.
B. Two-factor authentication is enforced at the org level and overrides profile-level IP ranges; disable MFA for the finance profile.
C. Login IP Ranges ignore VPN traffic; remove the ranges entirely and rely solely on Multi-Factor Authentication.
D. The VPN assigns IP addresses outside the configured ranges; expand the Login IP Ranges to include the VPN address pool
or require the contractors to use a different profile with broader ranges.
Correct Answer: D STUVIA ACTUAL EXAM · Page 2
Rationale:
Login IP Ranges are evaluated against the source IP presented to Salesforce. When users connect through a corporate VPN, the source IP is the
, SECTION 1: Configuration and Setup
Q5. A company is migrating from Classic to Lightning Experience. Several power users rely on custom JavaScript buttons that perform
mass updates on list views. The administrator must preserve equivalent functionality. Which approach aligns with Salesforce best
practices for Lightning?
A. Convert each JavaScript button into a Visualforce page that is launched from a custom button on the list view.
B. Replace the JavaScript buttons with Lightning Web Components or screen Flows that can be invoked from list-view actions,
and assign the new actions to the relevant page layouts or search layouts.
C. Enable the 'Allow Classic JavaScript Buttons in Lightning' preference so the existing buttons continue to work unchanged.
D. Instruct users to stay in Salesforce Classic for those objects until JavaScript buttons are fully supported in Lightning.
Correct Answer: B
Rationale:
Salesforce has deprecated JavaScript buttons for Lightning Experience. The supported path is to rebuild the logic with Lightning Web Components or
declarative screen Flows and surface them as list-view actions. There is no preference that re-enables Classic JavaScript buttons, and Visualforce is a
temporary bridge rather than a best-practice long-term solution.
Q6. An administrator needs to grant a group of support managers the ability to transfer cases owned by any user in the organization, but
they must not be able to transfer opportunities or accounts. Which combination of settings achieves this least-privilege goal?
A. Assign the 'Transfer Cases' permission via a permission set and ensure the managers do not have 'Modify All Data' or
object-level Transfer permissions on Opportunity and Account.
B. Place the support managers at the top of the role hierarchy so they inherit ownership transfer rights on all objects.
C. Grant the managers the 'Transfer Record' system permission and then restrict Opportunity and Account via sharing rules.
D. Create a custom permission called 'Case Transfer Only' and reference it in an Apex trigger that performs the transfer.
Correct Answer: A
Rationale:
The Transfer Cases permission is object-specific and can be granted independently through a permission set. Placing users at the top of the hierarchy
or granting Transfer Record would give broader transfer rights than required. Custom Apex is unnecessary when a standard permission already exists.
Q7. During user provisioning, the administrator notices that new users created via the Salesforce API are not receiving the expected
default profile and role. Manual user creation through the UI works correctly. What configuration area should the administrator
examine first?
A. The Login Hours defined on the default profile, which can block API-created users from activating.
B. The Password Policies page, because API-created users inherit a different password expiration setting.
C. The User Management settings and any active assignment rules or default values defined for the User object that apply only
to the UI creation path.
D. The organization-wide defaults for the User object, which may differ between API and UI contexts.
Correct Answer: C
Rationale:
Default values and assignment logic for User records can be influenced by setup configurations that behave differently for UI versus API insert paths.
Organization-wide defaults do not control profile or role assignment. Login Hours and Password Policies affect authentication after the user exists, not
the initial assignment of profile and role.
Q8. A regulated financial services firm requires that every successful and failed login attempt be retained for seven years. Salesforce
standard login history is retained for only six months. Which solution meets the retention requirement with the least ongoing
administrative overhead?
A. Create a custom object to store login events and write an Apex trigger on the User object that records every login.
B. Increase the standard Login History retention period to seven years under Company Information settings.
C. Export the Login History report every month and store the CSV files on a network share for seven years.
D. Enable Event Monitoring, subscribe to the LoginEvent stream, and archive the events to a long-term external data store or
Big Objects on a scheduled basis.
Correct Answer: D
Rationale:
Event Monitoring provides a durable stream of LoginEvent records that can be archived automatically. Manual monthly exports are error-prone and do
not scale. There is no triggerable event on the User object for logins, and the standard Login History retention cannot be extended beyond six months
inside Salesforce.
STUVIA ACTUAL EXAM · Page 3
