Free Salesforce Certified Platform Administrator Sample Questions

Correct answer: A — Salesforce Platform

• A. Correct. The Salesforce Platform license is designed for users who need access to custom apps and custom objects without standard CRM functionality like Leads or Opportunities. It is the ideal license for a user who only uses custom apps built on Force.com.
• B. Incorrect. The Salesforce license includes full access to standard CRM features (e.g., Leads, Opportunities, Accounts) which this user does not need. It is more expensive and broader than required for a custom-app-only user.
• C. Incorrect. Force.com - One App is intended for users who need access to only a single custom app. The question states the user will access custom apps (plural), so the Salesforce Platform license is more appropriate.
• D. Incorrect. The Identity license provides authentication and identity management (e.g., SSO) but does not grant access to custom apps or records on the Force.com platform.

Correct answers: A, B, C — Marketing User; Knowledge User; Service Cloud User

• A. Correct. Marketing User is a feature license that can be assigned to users to enable marketing-related capabilities in Salesforce.
• B. Correct. Knowledge User is a feature license that allows users to create and manage knowledge articles.
• C. Correct. Service Cloud User is a feature license that provides access to Service Cloud-specific features and functionality.
• D. Incorrect. Offline User is not a feature license; it is a permission that can be enabled for offline access via Salesforce Mobile or Desktop.
• E. Incorrect. Salesforce Platform is a user license type, not a feature license. It defines the baseline access level for a user.
• F. Incorrect. Identity User is a user license type, not a feature license. It is used for users needing identity services without full Salesforce functionality.

Correct answer: B — Create a permission set with Modify All for Opportunities, assign it to users for the cleanup week, then remove assignments.

• A. Incorrect. Cloning the Standard User profile and assigning it temporarily is inefficient and risky. Reverting profiles after the week is manual and error-prone, and profiles should not be modified for temporary access. This approach also increases administrative overhead and the risk of leaving users on the wrong profile or creating profile sprawl.
• B. Correct. Permission sets are the ideal solution for temporary access. They can be assigned to users for the cleanup week and easily removed afterward without altering their base profiles. This minimizes admin overhead and follows Salesforce best practice for extending access temporarily.
• C. Incorrect. Modifying the Standard User profile directly affects all users assigned to that profile, which is too broad for a short-term need. It also creates a security risk and is not a best practice for temporary access, as the permission might not be correctly revoked after the cleanup week.
• D. Incorrect. Permission set groups are used to bundle permission sets, but they do not support automatic scheduling of activation and deactivation in Salesforce. The correct approach is to assign a permission set directly and remove it afterward.

Correct answer: A — Custom profiles

• A. Custom profiles define the baseline permissions and access settings for users, including object, field, and system permissions. They are a core feature for controlling user access.
• B. Permission set groups help organize and assign multiple permission sets together, but they do not define baseline access. They are used to bundle permission sets for easier administration.
• C. Muting permission sets are a valid Salesforce feature used within permission set groups to remove specific permissions, but they are not a standalone mechanism for defining user access.
• D. Profile cloning is a method to create a new profile by copying an existing one, but it is not a distinct access model. It is a technique used to create custom profiles.

Correct answer: A — Create an owner-based sharing rule granting read-only access to sales managers for opportunities owned by reps.

• A. Correct. An owner-based sharing rule grants read-only access to sales managers for opportunities owned by sales reps, providing view-only access without editing rights and without broader exposure than needed.
• B. Incorrect. Changing the Organization-Wide Default to Public Read Only makes all opportunities visible to all users with object access, which is broader than necessary and violates the principle of least privilege.
• C. Incorrect. Manually sharing each record is not scalable, prone to error, and creates administrative burden; it does not automate the process sustainably.
• D. Incorrect. A public group is a sharing target, but object permissions are assigned via profiles or permission sets. Granting read-only object permission through a profile would allow viewing all opportunities, not just those owned by reps, and does not leverage sharing rules.

Correct answer: C — Create a criteria-based sharing rule on Invoice__c to share matching records with the manager.

• A. Incorrect. The 'Grant Access Using Hierarchies' checkbox applies to standard objects like Account, Contact, Case, and Opportunity, not custom objects such as Invoice__c. It also does not target a specific manager's access to a subset of records.
• B. Incorrect. Changing the organization-wide default to Public Read/Write would expose all Invoice__c records to every user, violating the principle of least privilege. It grants access far beyond the senior manager.
• C. Correct. A criteria-based sharing rule can automatically share Invoice__c records that match specified criteria (e.g., records owned by users in the manager's role hierarchy) with the manager. This is scalable and meets the requirement efficiently.
• D. Incorrect. Manually adding the senior manager to each Invoice record's sharing list is not scalable or maintainable, especially with a large number of records. Automated sharing rules are preferred.

Correct answer: A — Assign the page layouts to the record types in the Object Manager page layout assignment matrix.

• A. Correct. The page layout assignment matrix in Object Manager allows administrators to explicitly assign specific page layouts to each record type. This is the standard step that determines which layout users see for each record type.
• B. Incorrect. Lightning record page visibility filters control component visibility on a Lightning page, not which page layout is assigned to a record type. Page layout assignments are managed separately from Lightning page configurations via the Page Layout Assignment matrix.
• C. Incorrect. Record type configuration lets you define attributes like record type label and picklist values, but page layout assignment is not set directly there. The correct assignment happens in the Page Layout Assignment matrix in Object Manager.
• D. Incorrect. Salesforce does not automatically match page layouts to record types based on the record type name. A default layout may exist, but you must explicitly assign layouts to record types using the Page Layout Assignment matrix to ensure the correct one is used.

Correct answer: B — The profile-to-record-type mapping in the page layout assignment matrix.

• A. Incorrect. The user’s profile assignments in the user record detail page do not directly control page layout assignments. Profile assignments are managed separately in the page layout assignment matrix.
• B. Correct. The profile-to-record-type mapping in the page layout assignment matrix determines which page layout is assigned to a user based on their profile and the record type. This is the most likely place to check if the layout and record type are already verified.
• C. Incorrect. The Lightning page activation history in the App Builder shows when pages were activated or deactivated but does not control which page layout a user sees for a specific record type.
• D. Incorrect. Field-level security settings control visibility of fields but do not determine which page layout is displayed to a user.

Correct answer: C — The page layout where the action is added in layout editor.

• A. Incorrect. The action’s visibility filter in Lightning App Builder controls component visibility on a Lightning page, but it does not restrict visibility based on record type. Record-type-specific visibility for quick actions is handled through page layout assignment, not through visibility filters.
• B. Incorrect. The target object of the quick action defines the object context (e.g., Account), but it does not restrict the action to specific record types. It only determines which object the action applies to.
• C. Correct. The page layout where the quick action is added controls its visibility for different record types because page layouts can be assigned to specific record types. Adding the action to a particular page layout ensures it appears only for records using that layout.
• D. Incorrect. Flow input variables and condition logic affect the flow's behavior and data input, but they do not control the visibility of the quick action on the record. Visibility is governed by layout assignment, not flow logic.

Correct answer: C — The formula field becomes invalid; all Opportunity saves fail until updated.

• A. Incorrect. A cross-object formula does not store a copy of the referenced field's value. Deleting the reference field makes the formula definition invalid, so it will not simply display blank and continue normally. The formula cannot evaluate properly.
• B. Incorrect. Salesforce does not automatically remove dependent formula fields or notify the admin when a referenced field is deleted. The formula field remains on the object but becomes invalid.
• C. Correct. Deleting a referenced field from a cross-object formula invalidates the formula. The formula field remains on the object but cannot evaluate correctly, and any attempt to save an Opportunity record will fail until the formula is updated or the referenced field is restored.
• D. Incorrect. Formula fields are calculated dynamically at runtime, so they depend on the referenced field existing. Salesforce does not maintain data backups that restore formula functionality; the formula will fail due to the missing reference.

Correct answers: A, B, D — Currency; Number; Percent

• A. Correct. Currency fields are numeric and can be summed across related records in a roll-up summary.
• B. Correct. Number fields store numeric data that can be added together using SUM.
• C. Incorrect. Date fields are not numeric and cannot be summed; they support only MIN or MAX in roll-ups.
• D. Correct. Percent fields are treated as decimal numbers and can be aggregated using SUM.
• E. Incorrect. Checkbox fields are boolean (true/false) and are not numeric, so they cannot be summed.

Correct answer: B — Enable the Sales Path to mandate the Competitor field before the Closed Won stage.

• A. A validation rule can enforce that the Competitor field is not blank when the Stage is Closed Won, but this approach is not integrated into the guided sales process experience. While it works, it is less user-friendly and not the recommended best practice for stage-specific field requirements.
• B. Sales Path is the intended tool for guiding sales reps through stages. It allows administrators to mark fields as required for specific stages, prompting users to fill in the Competitor field before moving to Closed Won. This provides a seamless, guided user experience and is the standard best practice.
• C. Process Builder can create a flow that checks the Competitor field and prevents stage changes, but it adds unnecessary complexity for a simple requirement. A validation rule or Sales Path is simpler and more straightforward. Process Builder is not the standard tool for requiring fields at a stage.
• D. Dependent picklists control which values appear in one picklist based on another field's value. They do not enforce field requiredness or prevent stage transitions. This approach does not solve the requirement to force entry of a Competitor before Closed Won.

Correct answer: A — Enable the 'Automatically add to opportunity contact roles' option in Lead Settings.

• A. Correct. This standard setting in Lead Settings, when enabled, automatically adds the converted lead's contact to the opportunity contact roles, fulfilling the requirement without custom code or manual steps.
• B. Incorrect. An Apex trigger could technically achieve this, but it is not the declarative solution preferred for administrators. The standard setting provides a simpler, built-in alternative, making custom code unnecessary and less optimal.
• C. Incorrect. Training sales reps to manually add contacts is not an automated solution. It relies on manual intervention, which is error-prone and does not meet the requirement for automation.
• D. Incorrect. While a Process Builder flow can automate contact role creation, it is an alternative approach when the standard setting is insufficient. Since the built-in setting directly addresses the requirement, using Flow is unnecessary and adds complexity.

Correct answer: B — Activate the Home Page Assistant to show actionable items like overdue tasks and neglected opportunities on the home page.

• A. Incorrect. Although a custom Lightning component could be built, it requires development effort and is unnecessary because a standard feature exists for this purpose.
• B. Correct. The Home Page Assistant is a built-in Salesforce feature that displays actionable items like overdue tasks, neglected opportunities, and upcoming meetings on the home page when users log in.
• C. Incorrect. A dynamic dashboard displays charts and reports, but it is not designed to show a prioritized list of to-dos such as overdue tasks and neglected opportunities at login.
• D. Incorrect. A Chatter group feed is meant for collaboration and discussions, not for automatically surfacing structured follow-up items on the home page.

Correct answers: A, B, D — Quotas defined for each forecast manager to measure performance towards goals.; Forecast categories like pipeline, best case, commit, and closed for forecasting.; A forecast hierarchy that rolls up submissions from subordinates to managers.

• A. Correct. Quotas are a core component of Collaborative Forecasts, allowing managers to set and track performance targets for their teams.
• B. Correct. Forecast categories (pipeline, best case, commit, closed) are fundamental to Collaborative Forecasts, enabling users to classify opportunities by likelihood to close.
• C. Incorrect. Opportunity scoring using AI is part of Einstein Opportunity Scoring, not Collaborative Forecasts.
• D. Correct. A forecast hierarchy allows automatic roll-up of submissions from subordinates to managers, enabling consolidated forecasting.
• E. Incorrect. Einstein Forecasting is a separate AI-powered feature, not part of standard Collaborative Forecasts.
• F. Incorrect. Opportunity splits are used for dividing credit among team members but are not a component of Collaborative Forecasts.

Correct answers: B, C — Assignment rules that route cases based on priority; Escalation rules triggered by time and priority conditions

• A. Incorrect. Auto-response rules are used to automatically send email replies to the person who created the case, not to send reminders to case owners. They do not handle case routing or escalation.
• B. Correct. Assignment rules automatically route cases to the appropriate queue or user based on criteria such as priority, case origin, or other field values. This is a standard case automation feature.
• C. Correct. Escalation rules automatically escalate cases when time-based or priority-based conditions are met, ensuring high-priority or aging cases get attention according to service requirements.
• D. Incorrect. Einstein Case Wrap-Up is an AI-assisted productivity feature that helps agents auto-generate case summaries during wrap-up. It does not automate core case routing or escalation.

Correct answer: C — Rule entry criteria based on case fields

• A. Incorrect. A list of email recipients is not a required component of an escalation rule. Email notifications can be configured as an optional action, but the rule itself does not depend on a recipient list.
• B. Incorrect. A case record type is used for categorization and process tailoring, but it is not a mandatory part of an escalation rule. Escalation rules can apply to all record types or be filtered by criteria, but the record type itself is not a required element.
• C. Correct. Rule entry criteria based on case fields are required to define which cases should be escalated. These criteria determine the conditions under which the rule triggers and moves a case to the next escalation step.
• D. Incorrect. An email template is used for notification messages during escalation, but it is optional. The escalation rule is defined by criteria and actions, and the template only provides formatting for optional email communications.

Correct answers: A, C — Ensure the Email-to-Case routing address has contact matching enabled in its configuration.; Use a custom Apex trigger to parse the email and set the Contact field on the case.

• A. Correct. Email-to-Case includes a contact matching feature that, when enabled on the routing address, automatically links incoming emails to existing Contacts based on the email address. This is a standard, configuration-only approach without custom development.
• B. Incorrect. Workflow rules are event-driven and can update fields, but they cannot perform lookup queries to match an email address to a Contact record without additional custom logic or a formula field, which is not a standard out-of-the-box solution.
• C. Correct. A custom Apex trigger can be written to parse the sender's email address from the incoming email, query for a matching Contact, and populate the Contact field on the Case. This is a valid approach when the standard contact matching feature does not meet specific requirements.
• D. Incorrect. The Contact Match setting is specific to Web-to-Case and does not apply to Email-to-Case. These are separate features with independent configurations.

Correct answers: A, D — Add the legal team user as a member of the case team with the appropriate access rights.; Use manual sharing to give Read/Write access to the legal team user on the case record.

• A. Correct. Adding the legal team user as a member of the case team provides a structured way to collaborate, granting appropriate access and roles on the case record. Case teams are designed for this purpose.
• B. Incorrect. Chatter posts do not automatically grant record access; users need explicit permissions to view the case. Chatter alone does not provide secure collaboration on the record.
• C. Incorrect. Temporarily reassigning the case changes ownership and disrupts case processes. It is not a best practice for collaboration and can cause confusion.
• D. Correct. Manual sharing allows explicit granting of Read/Write access to the legal team user on the case record, enabling collaboration. While case teams are preferred, manual sharing is also a valid method.

Correct answers: A, C — Queue Name; Queue Members (Users or Roles)

• A. The Queue Name is a required component when setting up a Case Queue, as it uniquely identifies the queue for routing and assignment purposes.
• B. An email address for case creation is not a direct component of Case Queue configuration. It is typically configured separately through Email-to-Case settings.
• C. Queue Members (Users or Roles) are a key component of Case Queue configuration, as they define who can access and work on cases assigned to the queue.
• D. Auto-Response Rules are not part of Queue configuration. They are set up separately to automatically send responses to case submitters based on criteria.
• E. Case Assignment Rules are configured separately from Queues and are used to automatically assign cases to users or queues based on criteria.
• F. Escalation Rules are configured independently of Queues and are used to escalate cases based on time or other criteria.

Correct answer: C — Access only groups where they are a member

• A. Incorrect. External users cannot create new Chatter groups. Group creation is restricted to internal users with appropriate permissions, as external users are not full members of the organization.
• B. Incorrect. External users do not have the ability to send direct messages to any internal user. Their communication is limited by group and user visibility rules set by the organization, and direct messaging is typically not enabled for external users.
• C. Correct. External users can only access Chatter groups where they are explicitly added as members. This restriction ensures security and controlled collaboration, protecting private company information by limiting external access to approved groups only.
• D. Incorrect. External users cannot view all Chatter group feeds in the organization. They only see the feeds for groups they belong to, not every group across the org, as their access is scoped to their membership.

Correct answer: B — Share files by posting them directly in the group's Chatter feed.

• A. Incorrect. Setting the group to unlisted hides it from search but does not inherently restrict file access. Uploading files to Salesforce Files without posting them in the group does not ensure auditors see only the designated group's files.
• B. Correct. Posting files directly in the group's Chatter feed shares them only with group members (including external auditors). Group membership controls visibility, and files shared in the feed are scoped to the group, meeting the requirement.
• C. Incorrect. Salesforce does not use sharing rules on the File object for Chatter files. File access is typically managed via group membership, library permissions, or explicit sharing, not through File object sharing rules.
• D. Incorrect. Granting 'View All Data' permission is overly permissive, giving auditors access to all files in the org, not just those in their designated group. This violates the requirement to restrict access.

Correct answer: A — Task with the call logged, a due date, and high priority

• A. Correct. A Task in Salesforce is used to log past activities like calls, set due dates or reminders for follow-ups, and assign priority levels. This fully meets the rep's needs to log the conversation, set a follow-up reminder, and mark the task as high priority.
• B. Incorrect. An Event is designed for scheduled meetings or appointments, not for logging past calls. While reminders can be set, Events do not support priority marking and are not the correct tool for tracking a follow-up task.
• C. Incorrect. A Note can summarize the call conversation, but it does not provide due dates, reminders, or priority levels. Notes are for static documentation, not for managing follow-up actions.
• D. Incorrect. A Chatter post enables collaboration and communication but lacks the structured activity management features needed to log a call, set a reminder, and assign a priority. It does not replace the functionality of a Task.

Correct answer: A — Activity Timeline

• A. Correct. The Activity Timeline displays all past and upcoming tasks and events related to a record in a chronological, consolidated view directly on the record page, allowing quick review without running reports.
• B. Incorrect. Activity Reports can summarize activity data, but they require running a report and do not provide an immediate, on-record consolidated view. They are better for analysis than for day-to-day record viewing.
• C. Incorrect. Dashboards provide visual summaries of report data for high-level analytics, not a unified timeline of activities on an individual account record.
• D. Incorrect. The Chatter Feed shows posts, comments, and file shares related to a record, but it does not consolidate tasks and events in a timeline format.

Correct answer: E — Records with owners higher in the role hierarchy.

• A. Incorrect. The report type defines which objects and relationships are available, but it does not control record-level visibility. Sharing model impacts are about record access, not report type configuration.
• B. Incorrect. While a report filter can limit records shown, this is not a sharing model impact. The question focuses on how the sharing model (e.g., role hierarchy, sharing rules) affects record visibility in reports.
• C. Incorrect. If the user lacks access to the report folder, they cannot view the report at all, not just a subset of records. This is a folder permission issue, not a sharing model explanation.
• D. Incorrect. Missing Read permission on the object prevents the user from seeing any records of that object in reports. This is object-level security, not the record-level sharing model.
• E. Correct. In Salesforce, role hierarchy grants record access downward. Records owned by users higher in the role hierarchy are not visible by default, so the user sees only records owned by themselves or users below them.
• F. Incorrect. If the report is stored in a private folder the user cannot access, they cannot open the report at all. This does not explain why only some records appear; it is a report access issue, not a sharing model impact.

Correct answer: C — The report folder has restricted sharing settings.

• A. Incorrect. The report type not including a custom object would prevent creating a report on that object, but it does not affect visibility of an existing report in the list.
• B. Incorrect. The Export Reports permission controls the ability to export report data, not the ability to see a report in the list. A user without this permission can still view reports.
• C. Correct. If the report folder has restricted sharing settings, users without access to the folder will not see the report in their report list, regardless of other permissions.
• D. Incorrect. Setting the sharing model to Private affects record-level access, not report visibility. Report visibility is controlled by folder sharing settings.

Correct answer: B — It allows managers to see data owned by their subordinates.

• A. Incorrect. The sharing model controls record-level access via role hierarchies and sharing rules, not report access limited to an immediate team. Report visibility is determined by folder sharing and underlying data access.
• B. Correct. The role hierarchy in the sharing model enables managers to view records owned by users below them, which directly impacts the data visible in reports.
• C. Incorrect. Users do not need to be the report owner to view it; report access is controlled by folder permissions and the user's record-level access.
• D. Incorrect. Field availability in reports is determined by field-level security, object permissions, and report types, not by the sharing model.

Correct answer: C — Duplicate rules support accounts, contacts, leads, and some custom objects.

• A. Incorrect. Duplicate rules are not available for every standard and custom object. Salesforce restricts duplicate rules to specific standard objects (accounts, contacts, leads) and certain custom objects that meet criteria for matching and duplicate management.
• B. Incorrect. While duplicate rules are commonly used for accounts, contacts, and leads, they are not limited to these three. Some custom objects also support duplicate rules, so the scope is broader than this option suggests.
• C. Correct. Duplicate rules are supported for standard objects like accounts, contacts, and leads, as well as for some custom objects that satisfy Salesforce's requirements for duplicate management. This allows administrators to manage duplicates across a defined set of objects.
• D. Incorrect. Duplicate rules are not available for all objects except activities. Only a specific set of standard objects and selected custom objects support duplicate rules; many objects, including activities, do not support them.

Correct answer: B — Add a custom permission and exempt its holders in the validation rule formula.

• A. Incorrect. Granting 'Modify All Data' is far too broad and would bypass all validation rules and security across the entire org, not just this one. This weakens data integrity and creates unnecessary risk.
• B. Correct. Adding a custom permission and referencing it in the validation rule formula (e.g., AND(NOT($Permission.Allow_High_Discount), Discount_Percent__c > 20)) allows the manager to bypass the rule while keeping it enforced for others. This provides a controlled, auditable exception.
• C. Incorrect. Deactivating the validation rule to accommodate occasional exceptions removes protection for all users during that time. This compromises data integrity and is not a scalable or secure solution.
• D. Incorrect. Validation rules are not typically restricted by record type in a way that solves this use case, and record type access does not provide a selective exception for one manager. This option does not address the need to selectively bypass the rule.

Correct answer: B — Change the error location from the page top to the specific Subject field.

• A. Incorrect. Shortening the error message may make it easier to read, but it does not solve the core issue of helping the user identify which field caused the error. The main usability problem is that the error is displayed only at the top of a long page, not near the Subject field.
• B. Correct. Changing the validation rule error location to the specific Subject field helps users immediately see which field needs attention. This is the best way to improve usability on long page layouts because the error appears where the correction must be made.
• C. Incorrect. Duplicate rules are used for detecting duplicate records, not for improving validation rule error messaging. They would not address the issue of the user not knowing which field is invalid.
• D. Incorrect. Help text can explain that a field is required, but it does not replace the immediate feedback provided by a validation rule or direct the user to the field after submission. The user experience issue is specifically about the placement of the error message.

Correct answers: A, C, E — When a lead is created from a web-to-lead form submission; When a lead is imported via Data Loader with assignment rules; When an existing lead is edited with the assign rule checkbox selected

• A. Correct. Lead assignment rules are evaluated when a lead is created from a web-to-lead form submission because Salesforce automatically applies the active assignment rule to route the lead.
• B. Incorrect. Manual creation of a lead does not automatically trigger assignment rules; the user must select the 'Assign using active assignment rule' checkbox during creation. As stated, it is not a scenario where rules are evaluated by default.
• C. Correct. When importing leads via Data Loader with assignment rules enabled, Salesforce evaluates the active assignment rule to determine the lead owner.
• D. Incorrect. Lead conversion does not evaluate assignment rules; it creates related records but does not re-run assignment rules.
• E. Correct. Editing an existing lead and selecting the 'Assign using active assignment rule' checkbox triggers Salesforce to evaluate the active assignment rule and potentially reassign the lead.

Correct answer: A — Lead assignment rules with round-robin assignment logic

• A. Correct. Lead assignment rules natively support round-robin assignment logic, which automatically distributes leads equally among specified users or queues in a sequential manner. This is the standard out-of-the-box solution for round-robin lead distribution.
• B. Incorrect. Case assignment rules are designed for case records, not leads, and do not support round-robin distribution for leads. They cannot be applied to lead records.
• C. Incorrect. Escalation rules are used to escalate cases based on time or criteria, not for distributing leads in a round-robin fashion. They are not applicable to lead assignment.
• D. Incorrect. While a custom flow could technically implement round-robin logic, it is not the most efficient or native solution for this use case. Lead assignment rules already provide this functionality out of the box, making a custom flow unnecessary and more complex.

Correct answer: A — Agentforce uses the authenticated user's credentials to enforce record-level sharing per transaction.

• A. Correct. Agentforce natively runs in the context of the authenticated user and respects Salesforce sharing and record-level access controls during execution, using the user's credentials to enforce record-level sharing rules. This ensures customers can only see or act on data they are permitted to access without custom security logic.
• B. Incorrect. Writing an Apex trigger on the Session object is not a native feature of Agentforce. Agentforce handles data access automatically via the platform's security model, without requiring custom code.
• C. Incorrect. Granting 'View All Data' permission would bypass record-level security, allowing access to all records. This is the opposite of what is needed to restrict customers to their own data.
• D. Incorrect. While OAuth 2.0 is used for authentication, Agentforce does not rely on client credentials or customer-impersonation tokens natively. Instead, it uses the authenticated user's context to enforce data access.

Correct answer: B — The agent's dedicated API user lacks the 'Bypass Apex Authorization' permission in the org.

• A. Incorrect. The 'View Setup and Configuration' permission is a broad administrative permission and is not typically required for the running user of an Agentforce agent. This error is not related to viewing setup, but rather to the agent's runtime authorization.
• B. Correct. Agentforce agents often run under a dedicated API user or runtime user. If that user lacks the 'Bypass Apex Authorization' permission, access checks fail and surface as 'Insufficient privileges' errors, even when the agent is active and correctly assigned.
• C. Incorrect. A JSON parsing or field mapping error would typically produce a configuration or validation error, not a permissions-related error like 'Insufficient privileges.' This points to a data format issue rather than an access-control problem.
• D. Incorrect. A missing required field in a platform event definition would cause schema or event processing failures, not a privilege error. Such errors would typically be surfaced as platform event or data configuration issues, not access errors.

Correct answer: A — Create an External Services registration that calls the ERP API and expose it as an invocable action in a flow used by the agent.

• A. Correct. External Services registers the ERP API and exposes it as an invocable action in a flow. Agentforce can then call this action in real time, passing the order number to retrieve the current status dynamically.
• B. Incorrect. A scheduled Apex job syncs data periodically (e.g., every hour), so it cannot provide real-time status during a chat. The agent would not have access to the most current status on demand.
• C. Incorrect. While Named Credentials enable secure external calls, simply adding the endpoint and credential does not make the action available to the agent. The agent requires an exposed invocable action or flow, not just connectivity setup.
• D. Incorrect. The Translation plugin is for language translation, not for querying external databases. SOQL cannot directly query external databases, and this option does not represent a valid Agentforce integration pattern for real-time ERP access.