• Shuffle
    Toggle On
    Toggle Off
  • Alphabetize
    Toggle On
    Toggle Off
  • Front First
    Toggle On
    Toggle Off
  • Both Sides
    Toggle On
    Toggle Off
  • Read
    Toggle On
    Toggle Off
Reading...
Front

Card Range To Study

through

image

Play button

image

Play button

image

Progress

1/157

Click to flip

Use LEFT and RIGHT arrow keys to navigate between flashcards;

Use UP and DOWN arrow keys to flip the card;

H to show hint;

A reads text to speech;

157 Cards in this Set

  • Front
  • Back

Skip this Card - Logic and Process Automation - 46%




Describehow to use basic SOSL, SOQL, and DML statements when working with objects inApex.

Skip this Card - Logic and Process Automation - 46%




Describe how to use basic SOSL, SOQL, and DML statements when working with objects in Apex.

Skip This Card -


Logic and Process Automation - 46% -




Describehow to implement exception handling in Apex

Skip This Card - Logic and Process Automation - 46% -


Describe how to implement exception handling in Apex

What are the steps to take care of while creating custom exception class

1. Custom Exception Class should extend the built-in Exception class


2. Class name should end with the word Exception.


3. Append extends Exception after your class declaration

Which of the following syntax is correct to create Custom Exception Class -


A. public class MyExceptionClass extends Exception {}


B. public class MyException {}


C. public class MyException extends Exception {}


D. None of the above

C. public class MyException extends Exception {}

Which one of the following is the right syntax to throw Custom Exception -


A. throw new MyException('item could not be inserted.', e);


B. throw new MyException('item could not be inserted.');


C. throw new MyException(e);


D. All of the above

D. All of the above


Refer - https://developer.salesforce.com/docs/atlas.en-us.apex_workbook.meta/apex_workbook/apex7_5.htm

Which combination is valid -


1. one try block and multiple catch block for different types of Exception


2. one try block and multiple catch block for different types of exception and one finally block


3. one try block and one finally block (NO catch block)


4. one try block and one catch block and NO finally block


5. All of the above

5. All of the above


Note - It's okay to have no catch statements and only finally statements


Refer - https://developer.salesforce.com/docs/atlas.en-us.apex_workbook.meta/apex_workbook/apex7_2.htm

If the order of catch blocks are as follows - catch (Exception e) {} , catch (DMLException e) {}: Which of the following is true -


1. code in DML Exception block will always get called if there is a DML error


2. Code in DML Exception will not get called even if there is DML Exception


3. Code in Exception block will always get called if there is an Exception

3. If Generic Exception block is first then the other exceptions block will never get called



Will the code in the finally block get called if there is no exception




1. YES


2. NO

1. YES




Finally block will always get called, whether is an exception or not.

Any statements in the try block occurring after the exception are skipped and aren’t executed




A. TRUE


B. FALSE

A. TRUE

Exception throw by the runtime as a result of reaching a governor limit, cannot be handled in the code -




A - TRUE


B - FALSE

A. TRUE




Some exceptions can’t be handled, such as exceptions that the runtime throws as a result of reaching a governor limit.

Skip This Card - Logic and Process Automation - 46% -




Describe how to write Visualforce controllers

Skip - Logic and Process Automation - 46% -




Describe how to write Visualforce controllers

Can the standardController and controller attribute be used at the same time on Visualforce apex:page




A. YES


B. NO

A. NO




--Example -





Upto how many levels above can you traverse when using standard controller -


for e.g. if the Standard Controller is contact - contact.Account.Owner.FirstName




A. 3


B. 1


C. 5


D. None of the above


C. 5




Note - You can traverse up to five levels of child-to-parent relationships. For example, if using the Contact standard controller, you can use {!contact.Account.Owner.FirstName} (a three-level child-to-parent relationship) to return the name of the owner of the account record that is associated with the contact.

Up to how many levels of parent child relationship you can travers when using standard controller on Visualforce page -




for e.g. on Account Controller - account.Contacts




A. 3


B. 1


C. 5


D. None of the above

B. 1



Note - You can traverse one level of parent-to-child relationships. For example, if using the Account standard controller, you can use {!account.Contacts} to return an array of all contacts associated with the account that is currently in context.

List of objects on which the standard controllers can be used

1. Account


2.Asset


3.Campaign


4.Case


5.Contact


6.Contract


7.Idea


8.Lead


9.Opportunity


10.Order


11.Product2


12.Solution


13.User


14.Custom objects

If the VF Page shows standard list controller, and filter is not specified which filter will be used -




A. Will use default list for the user


B. Will use default list for the profile


C. Will use the filter from the list that was accessed last


D. Will use Recently Viewed Items

C. Will use list that was accessed last by the user



Note - e..g code -


standardcontroller="account" recordsetvar="accounts">


standardcontroller="account" recordsetvar="accounts" tabstyle="account"sidebar="false"> standardcontroller="account" recordsetvar="accounts" tabstyle="account"sidebar="false"> standardcontroller="account" recordsetvar="accounts" tabstyle="account"sidebar="false"> standardcontroller="account" recordsetvar="accounts" tabstyle="account"sidebar="false">


standardcontroller="account" recordsetvar="accounts">


This page does not specify a filter in the request, so the page is displayed with the last used filter. For information on using filters with list controllers,

Can a custom controller constructor have parameters




1. YES


2. NO

2. No




A custom controller is an Apex class that uses the default, no-argument constructor for the outer, top-level class. You cannot create a custom controller constructor that includes parameters.




Example -




public class MyController {




private final Account account;




public MyController() {


account = [SELECT Id, Name, Site FROM Account WHERE Id = :ApexPages.currentPage().getParameters().get('id')];


}




}




-- On Page --


controller="mycontroller" tabstyle="account"> controller="mycontroller" tabstyle="account">




....




Can a controller extension constructor take argument




1. YES


2. NO

1. YES




Note - . A controller extension is any Apex class containing a constructor that takes a single argument of type ApexPages.StandardController or CustomControllerName, where CustomControllerName is the name of a custom controller you want to extend.




----




public class myControllerExtension {


private final Account acct;04


// The extension constructor initializes the private member variable acct by using the getRecord method from the standard


// controller.


public myControllerExtension(ApexPages.StandardController stdController) {


this.acct = (Account)stdController.getRecord();


}




}


--




standardcontroller="account" extensions="mycontrollerextension">




Logic and Process Automation - 46%




Describe when and how to use standard Visualforce controllers vs. Apex custom controllers and controller extensions

Logic and Process Automation - 46%




Describe when and how to use standard Visualforce controllers vs. Apex custom controllers and controller extensions

When should you use controller extensions

1. To leverage built-in functionality of a standard controller but override one or more std actions.


2. To add new actions.


3. To build a Visualforce page that respects user permissions. Although a controller extension class executes in system mode (unless if you use with sharing keyword in the controller), if a controller extension extends a standard controller, the logic from the standard controller does not execute in system mode. Instead, it executes in user mode, in which permissions, field-level security, and sharing rules of the current user apply.

Identify which of the following types of controllers will execute in System Mode ?


1. Custom Controller


2. Extension Controller


3. Standard Controller

1. Custom Controller


2. Extension Controller




Although custom controllers and controller extension classes execute in system mode and thereby ignore user permissions and field-level security. a controller extension class executes in system mode, if a controller extension extends a standard controller, the logic from the standard controller does not execute in system mode.

Can you have more than one controller extensions on the same page


1. YES


2. NO

1. YES




Note - Multiple controller extensions can be defined for a single page through a comma-separated list. This allows for overrides of methods with the same name.

In the scenario when there are more than one controller extensions and if there are methods with same name, which controller's methods will be used when accessed from Visualforce Page-




1. First one in the list


2. Second one in the list


3. Will throw runtime error


4. Will not VF Page to be saved

1. First one in the list -




Multiple controller extensions can be defined for a single page through a comma-separated list. This allows for overrides of methods with the same name. Overrides are defined by whichever methods are defined in the “leftmost” extension, or, the extension that is first in the comma-separated list.

Standard Set Controller immutable -




1. TRUE


2. FALSE

1. TRUE




Note - The list of sObjects returned by ApexPages.StandardSetController.getRecords() is immutable. For example, you can’t call clear() on it. You can make changes to the sObjects contained in the list, but you can’t add items to or remove items from the list itself.




Refer - https://developer.salesforce.com/docs/atlas.en-us.pages.meta/pages/pages_custom_list_controller.htm

Skip this Card - Testing - 12%




Describe the differences between invoking Apex in execute anonymous vs. unit tests.

Skip this Card - Testing - 12%




Describe the differences between invoking Apex in execute anonymous vs. unit tests.

What are the different ways to invoke Apex

You can run Apex using:


1. Anonymous block.


2. A trigger for specific events


3. Future Method - Asynchronous Apex


4. Scheduling an Apex class to run at specified intervals


5. Running a batch job.


6. Apex Web Services, which allow exposing your methods via SOAP and REST Web services.


7. Apex Email Service to process inbound email.


8. Visualforce controllers


9. The Ajax toolkit to invoke Web service methods implemented in Apex.

What is the User permission needed to execute Anonymous Apex

1. Author Apex

Which are following ways to execute Anonymous Block ?

1. Developer Console


2. Force.com IDE


3. The executeAnonymous() SOAP API call:

Which of the following stmts are false about anonymous block -




A. Can have user-defined methods and exceptions


B. Can have Static in user defined methods


C. Anonymous block can run in System Mode


D. B and C


E. A and B


F. All of the above are false

D. B and C




Note - Anonymous block cannot have static defined in the methods and will always run in the logged in user mode.

What is the scope of the code in the anonymous block -




A. Public


B. Global


C. Local


D. Depends on the scope defined for the method

C. Local




Anonymous block do not have a scope other than local. For example, though it is legal to use the global access modifier, it has no meaning. The scope of the method is limited to the anonymous block

What security privileges are used if Execute Anonymous runs a method in a class which has public without sharing - is this logged in user's privileges or in system mode ?????

To Be Answered.



What are users allowed to perform in Execute Anonymous if they don't have Author Apex permission ...




???

???? To Analyze this more--



Running any other Apex code isn’t allowed when the user doesn’t have the “Author Apex” permission. For example, calling methods of custom Apex classes that are saved in the organization isn’t allowed nor is using custom classes as arguments to built-in methods.When users without the “Author Apex” permission run DML statements in an anonymous block, triggers can get fired as a result.

Can user perform Execute Anonymous even if they don't have Author Apex permission -




1. YES


2. NO

???? To Analyze this more--




1. YES -




For users who don’t have the “Author Apex” permission, the API allows restricted execution of anonymous Apex. This exception applies only when users execute anonymous Apex through the API, or through a tool that uses the API, but not in the Developer Console. Such users are allowed to run the following in an anonymous block.Code that they write in the anonymous blockWeb service methods (methods declared with the webservicekeyword) that are saved in the organizationAny built-in Apex methods that are part of the Apex languageRunning any other Apex code isn’t allowed when the user doesn’t have the “Author Apex” permission. For example, calling methods of custom Apex classes that are saved in the organization isn’t allowed nor is using custom classes as arguments to built-in methods.When users without the “Author Apex” permission run DML statements in an anonymous block, triggers can get fired as a result.

What are some of the difference between running Apex in Anonymous block as oppose to Unit test

1. Anonymous Block : Record creation will store in DB


Unit test : - Record creation – will not store


2. Anonymous Block - Enforce user permission Unit test:- Default system permission


3. AB - Output verify in Log


Unit test- Coverage will calculate


4. AB - Web Service Callouts can be made


Unit test:- Web Service Callouts cannot be made


5. AB :- Methods do not get stored as MetaData


Unit test: Test methods do get stored as MetaData


6. AB:- Can only run in as logged in user


Unit test:- Can define Run As User


7. AB: ????


Unit Test: Send outbound email


8. AB: Have access to pre-existing data based on user's privileges


Unit test: By default, Apex test methods don’t have access to pre-existing data in the organization. Org data can be accessed by using special keyword - seeAllData = true. There are some objects that tests can still access in the organization. They’re metadata objects and objects used to manage your organization, such as User or Profile.



Skip This Card - Debug and Deployment Tools - 10%




Describe the different processes for deploying metadata and business data.

Skip This Card - Debug and Deployment Tools - 10%

What is the minimum percentage test coverage required on a given class before deploying to Production -




A. 75%


B. 0%


C. None of the Above

B. 0% ??????




Salesforce requires to have 75% of Apex Statements must be covered, however that is cumulative, a class can have 0% if all the classes in the org is more than 75% cumulative.

What is the minimum percentage of test coverage needed on triggers -




A. 0%


B. More than 0%


C. 75%


D. None of the above

B. Move than 0% ?????




Salesforce requires that all the triggers must get called as part of test coverage, however there is no minimum % requirement per trigger. So it has to be at least more than 0%

Skip this card - Logic and Process Automation - 46%




Describe how to write and when to use Apex classes and interfaces

Skip this card - Logic and Process Automation - 46%




Describe how to write and when to use Apex classes and interfaces

How many levels of inner classes can you have in Apex ?


A. One Level Deep


B. Two Levels Deep


C. No Limit

A- One Level Deep




In Apex, you can define top-level classes (also called outer classes) as well as inner classes, that is, a class defined within another class. You can only have inner classes one level deep

What is the default access modifier for inner class?

A. Private




The private access modifier declares that this class is only known locally, that is, only by this section of code. This is the default access for inner classes—that is, if you don't specify an access modifier for an inner class, it is consideredprivate. This keyword can only be used with inner classes.

What is public access modifier for a class ?

The public access modifier declares that this class is visible in your application or namespace.

What is a global access modifier for a class ?

The global access modifier declares that this class is known by all Apex code everywhere. All classes that contain methods defined with the webService keyword must be declared as global. If a method or inner class is declared asglobal, the outer, top-level class must also be defined as global.

What should be the access modifier for webService class ?




A. Global


B. Private


C. Public

A. Global




The global access modifier declares that this class is known by all Apex code everywhere. All classes that contain methods defined with the webService keyword must be declared as global. If a method or inner class is declared asglobal, the outer, top-level class must also be defined as global.

What are the types of definition modifiers for class ?



A. Virtual , Abstract , With Sharing , Without Sharing



What can be done if the class is defined as virtual class ?

The virtual definition modifier declares that this class allows extension and overrides. You cannot override a method with the override keyword unless the class has been defined as virtual.

What's an abstract class ?

The abstract definition modifier declares that this class contains abstract methods, that is, methods that only have their signature declared and no body defined.

What are the restriction of abstract class ?

You cannot add an abstract method to a global class after the class has been uploaded in a Managed - Released package version.



If the class in the Managed - Released package is virtual, the method that you can add to it must also be virtual and must have an implementation.




You cannot override a public or protected virtual method of a global class of an installed managed package.

Does Apex support multiple inheritance ?




A. YES


B. NO

B. No




A class can implement multiple interfaces, but only extend one existing class. This restriction means that Apex does not support multiple inheritance. The interface names in the list are separated by commas. For more information about interfaces, see Understanding Interfaces.

What is the Syntax for writing class ?

private | public | global


[virtual | abstract | with sharing | without sharing]


class ClassName


[implements InterfaceNameList] [extends ClassName]


{ // The body of the class }




To define a class, specify the following:


1. Access modifiers:You must use one of the access modifiers (such as public or global) in the declaration of a top-level class.You do not have to use an access modifier in the declaration of an inner class.


2. Optional definition modifiers (such as virtual, abstract, and so on)


3. Required: The keyword class followed by the name of the class


4. Optional extensions and/or implementations

What is an Interface ?

An interface is like a class in which none of the methods have been implemented—the method signatures are there, but the body of each method is empty. To use an interface, another class must implement it by providing a body for all of the methods contained in the interface




e.g. -


public interface PurchaseOrder {


// All other functionality excluded


Double discount();


}

When do you want to use interface ?

1. Interfaces can provide a layer of abstraction to your code. They separate the specific implementation of a method from the declaration for that method. This way you can have different implementations of a method based on your specific application.




2. For example, a company might have two types of purchase orders, ones that come from customers, and others that come from their employees. Both are a type of purchase order. Suppose you needed a method to provide a discount. The amount of the discount can depend on the type of purchase order.




3.

Should the class implementing interface have all the methods from interface defined or can it only define the ones that it needs ?




A. All


B. Only one that it needs

A. All




Any class that implements an interface must define all of the methods contained in the interface.

Managed Package limitation on Interface Class ?

You cannot add a method to a global interface after the class has been uploaded in a Managed - Released package version.

Example of Interface

// An interface that defines what a purchase order looks like in general


public interface PurchaseOrder {


// All other functionality excluded


Double discount(); }


------


// One implementation of the interface for customers


public class CustomerPurchaseOrder implements PurchaseOrder {


public Double discount() {


return .05; // Flat 5% discount


} }




-------


// Another implementation of the interface for employees




public class EmployeePurchaseOrder implements PurchaseOrder {




public Double discount() {


return .10; // It’s worth it being an employee! 10% discount


} }




----

Skip this card - Logic and Process Automation - 46%




Describethe programmatic techniques to prevent security vulnerabilities in Apex and Visualforce

Skip this card - Logic and Process Automation - 46%




Describethe programmatic techniques to prevent security vulnerabilities in Apex and Visualforce

What is Cross Site Scripting (XSS) ?

Cross-site scripting (XSS) attacks cover a broad range of attacks where malicious HTML or client-side scripting is provided to a Web application. The Web application includes malicious scripting in a response to a user of the Web application. The user then unknowingly becomes the victim of the attack.

Why is it better to use tags / components in Visualforce ?

All standard Visualforce components, which start with apex , have anti-XSS filters in place. All characters that appear to be HTML tags are converted to their literal form, except for the one that's part of apex tags.




This prevents the malicious scripts that may have got posted by attackers using a Website or email to be executed as HTML tags.


Why is it not a good practice to use escape = false in the apex tags in Visualforce Pages ?

By default, nearly all Visualforce tags escape the XSS-vulnerable characters. It is possible to disable this behavior by setting the optional attribute escape="false". For example, the following output is vulnerable to XSS attacks:







Following is the alternative that is not vulnerable to XSS attacks :





{!CurrentPage.parameters.userInput}




Why is the following line of code vulnerable to XSS attacks ?




The Visualforce component allows you to include a custom script on the page. In these cases, be very careful to validate that the content is safe and does not include user-supplied data. For example, the following snippet is extremely vulnerable because it includes user-supplied input as the value of the script text. The value provided by the tag is a URL to the JavaScript to include. If an attacker can supply arbitrary data to this parameter (as in the example below), they can potentially direct the victim to include any JavaScript file from any other website.


Why are formula expressions in Visualforce Page typically vulnerable to XSS ?

Formula expressions like $Request.title, $API.An important feature of these expressions is that data is not escaped during rendering. Since expressions are rendered on the server, it is not possible to escape rendered data on the client using JavaScript or other client-side technology. This can lead to potentially dangerous situations if the formula expression references non-system data (that is potentially hostile or editable data) and the expression itself is not wrapped in a function to escape the output during rendering. A common vulnerability is created by the use of the{!$Request.*} expression to access request parameters.




Unfortunately, the unescaped {!$Request.title} tag also results in a cross-site scripting vulnerability




The standard mechanism to do server-side escaping is through the use of the SUBSTITUTE() formula tag.





What is SOQL Injection and how to avoid that ?

SQL/SOQL injection involves taking user-supplied input and using those values in a dynamic SOQL query. If the input is not validated, it can include SOQL commands that effectively modify the SOQL statement and trick the application into performing unintended commands.



To prevent a SOQL injection attack, avoid using dynamic SOQL queries. Instead, use static queries and binding variables.

What can one do to prevent SOQL injection even if dynamic SOQL has to be used ?

If you must use dynamic SOQL, use the escapeSingleQuotes method to sanitize user-supplied input. This method adds the escape character (\) to all single quotation marks in a string that is passed in from a user. The method ensures that all single quotation marks are treated as enclosing strings, instead of database commands.




String strEsc = String.escapeSingleQuotes(str); String wQuotes = '\'%'+strEsc+'%\'';


//<-- try to create just the like


List accts = Database.query('Select Id FROM Account WHERE Name like \'%'+strEsc+'%\'');

Why should one use with sharing keyword ?

The with sharing keyword directs the platform to use the security sharing permissions of the user currently logged in, rather than granting full access to all records.





What kind of issues can Salesforce security tools help in identifying in the code ?

Tools help in identifying many of the following types of issues :




1. Cross-Site Scripting


2. S(O)QL Injection


3. Cross Site Request Forgery


4. Secure Communications and Cookies


5. Storing Secrets


6. Arbitrary Redirects


7. Access Control


8. Enforcing CRUD and FLS (Force.com)


9. SSO for Composite Apps


10. Lightning Security Best Practices


11. Marketing Cloud API Integration Security

What kind of attack can be prevented by imposing IP Address restrictions ?

A. Phishing attacks can be provided.




The limitations imposed on IP addresses are used to help protect against phishing attacks. A malicious attack cannot be triggered from outside your range of IP addresses, even if the attacker has a correct user name and password.

What kind of information can we get via Salesforce Auditing feature ?

A final aspect of this security is auditing. Setup | Manage Users | Login History displays the last 20 logins to your organization, as well as access to download 6 months worth of login data, which includes IP addresses, browser types and so on.

What kind of data level auditing available in Salesforce ?

You can turn on auditing for objects with a single click. Object-level auditing tracks changes in the overall object records, such as record creation. You can also enable auditing for individual fields, automatically tracking any changes in the values of selected fields. Although auditing is available for all custom objects, many standard objects do not allow auditing.

How does Apex Sharing Reason helps ?

Normally, you want all sharing to be recalculated to reflect the current conditions. However, there may be times when you have added shares through Apex that you do not want to lose, despite changes in ownership, roles or groups. To avoid losing these shares, you can indicate that share is associated with an Apex sharing reason. Shares associated with an Apex sharing reason are not recalculated by the platform due to changes which affect other shares which were granted.

What is CSRF ?

Cross-Site Request Forgery (CSRF)



In other words, the attacker's page contains a URL that performs an action on your website. If the user is still logged into your Web page when they visit the attacker's Web page, the URL is retrieved and the actions performed. This attack succeeds because the user is still authenticated to your Web page. This is a very simple example and the attacker can get more creative by using scripts to generate the callback request or even use CSRF attacks against your AJAX methods.

How does salesforce handles CSRF ?

Within the Force.com platform, Salesforce has implemented an anti-CSRF token to prevent this attack. Every page includes a random string of characters as a hidden form field. Upon the next page load, the application checks the validity of this string of characters and does not execute the command unless the value matches the expected value. This feature protects you when using all of the standard controllers and methods.

Give an example of CSRF ?

Here again, the developer might bypass the built-in defenses without realizing the risk. For example, suppose you have a custom controller where you take the object ID as an input parameter, then use that input parameter in an SOQL call. Consider the following code snippet.



In this case, the developer has unknowingly bypassed the anti-CSRF controls by developing their own action method. Theid parameter is read and used in the code. The anti-CSRF token is never read or validated. An attacker Web page might have sent the user to this page using a CSRF attack and provided any value they wish for the id parameter.There are no built-in defenses for situations like this and developers should be cautious about writing pages that take action based upon a user-supplied parameter like the id variable in the preceding example. A possible work-around is to insert an intermediate confirmation page before taking the action, to make sure the user intended to call the page. Other suggestions include shortening the idle session timeout for the organization and educating users to log out of their active session and not use their browser to visit other sites while authenticated.

Is it possible to assign security to inner level class to a specific profile and not give access to top level class ?




A. No


B. Yes

A. NO



You can specify which users can execute methods in a particular top-level class based on their user profile or permission sets. You can only set security on Apex classes, not on triggers.

What is Apex Managed Sharing ?

Apex managed sharing provides developers with the ability to support an application’s particular sharing requirements programmatically through Apex or the SOAP API. This type of sharing is similar to Force.com managed sharing. Only users with “Modify All Data” permission can add or change Apex managed sharing on a record. Apex managed sharing is maintained across record owner changes.

What is User Managed Sharing ?

User Managed Sharing, also known as Manual Sharing




User managed sharing allows the record owner or any user with Full Access to a record to share the record with a user or group of users. This is generally done by an end-user, for a single record. Only the record owner and users above the owner in the role hierarchy are granted Full Access to the record. It is not possible to grant other users Full Access. Users with the “Modify All” object-level permission for the given object or the “Modify All Data” permission can also manually share a record. User managed sharing is removed when the record owner changes or when the access granted in the sharing does not grant additional access beyond the object's organization-wide sharing default access level.

How is User Managed Sharing different from Apex Managed Sharing ?

1. Apex Managed Sharing is maintained across record owner changes, however User Managed Sharing is removed when the record owner changes.




2. Apex Managed Sharing is done via code, User Managed Sharing happens manually by user

Is Apex managed Sharing Reasons available on standard objects ?




1. Yes


2. No

2. No




Apex sharing reasons and Apex managed sharing recalculation are only available for custom objects



What are some of the examples of values in rowCause ?

Force.com Managed Sharing - values in rowcause


ImplicitChild


ImplicitParent


Owner


Team


Rule


TerritoryRule




User Managed Sharing - values in rowcause


Manual


TerritoryManual




Apex Managed Sharing




Display value is what developer has defined and rowCause value is Defined by Developer



True / False ; When determining a user’s access to a record, the most permissive level of access is used

TRUE -



When determining a user’s access to a record, the most permissive level of access is used

What is Force.com Managed Sharing ?

Force.com managed sharing involves sharing access granted by Force.com based on record ownership, the role hierarchy, and sharing rules:


Record Ownership


Role Hierarchy


Sharing Rules




User 1 changes the owner of the record to User 2, using standard page layout. However User 1 is not allowed to view User 1 records. Will Salesforce allow this change or will it throw error ?

1. Salesforce will NOT allow the change -




Apex Triggers and User Record SharingIf a trigger changes the owner of a record, the running user must have read access to the new owner’s user record if the trigger is started through the following:APIStandard user interfaceStandard Visualforce controllerClass defined with the with sharing keyword




If a trigger is started through a class that’s not defined with the with sharing keyword, the trigger runs in system mode. In this case, the trigger doesn’t require the running user to have specific access.

How can you programmatically get the sharing information of an object for a specific user ?

To access sharing programmatically, you must use the share object associated with the standard or custom object for which you want to share.

Is there a sharing object created for the detail object ?

No




Objects on the detail side of a master-detail relationship do not have an associated sharing object. The detail record’s access is determined by the master’s sharing object and the relationship’s sharing setting

What are the two types of sharing information not maintained in Sharing Object ?

“View All Data,” and “Modify All Data” are not tracked with this object.

If Controller Class A calls Class B, is there a need to give access to both classes ?




1. Yes


2. No

1. No (User only needs access to Class A)




Permission for an Apex class is checked only at the top level. For example, if class A calls class B, and a user profile has access only to class A but not class B, the user can still execute the code in class A

Is there a need to give access to Controllers associated to Component, even if user has access to Controller associated to the main Visualforce Page ?




1. Yes


2. No

1. No




if a Visualforce page uses a custom component with an associated controller, security is only checked for the controller associated with the page. The controller associated with the custom component executes regardless of permissions.

Does the Apex generally runs in System Context or Current User's Permission ?

Apex generally runs in system context; that is, the current user's permissions, field-level security, and sharing rules aren’t taken into account during code execution.



The only exceptions to this rule are Apex code that is executed with the executeAnonymous call and Chatter in Apex. executeAnonymous always executes using the full permissions of the current user

What is the difference between 15 digit and 18 digit id ?

15 digit Id number will have numeric digits range from (0-9), a Lowercase letter(a-z) or a Uppercase letters(A-Z). 15 digit ID in salesforce.com is case sensitive.




Salesforce.com has established 18 digit character insensitive ID. This 18 Digit ID is case insensitive which is formed by adding a suffix to the 15 Character Id number. , this is to resolve the issue when users use 15 digit id in excel or other databases, where it's not case sensitive

If a method1 in class 1 (with sharing ) is called from class 2 (without sharing) Method2, what sharing rules will be applied in Method1 ?

1. With Sharing will be applied for Method1



The sharing setting of the class where the method is defined is applied, not of the class where the method is called. For example, if a method is defined in a class declared with with sharing is called by a class declared with without sharing, the method will execute with sharing rules enforced.

If a method1 in class 1 (No Sharing is defined) is called from class 2 (With sharing) Method2, what sharing rules will be applied in Method1 ?

For Method 1, With Sharing will be applied -



If a class isn’t declared as either with or without sharing, the current sharing rules remain in effect. This means that the class doesn’t enforce sharing rules except if it acquires sharing rules from another class. For example, if the class is called by another class that has sharing enforced, then sharing is enforced for the called class.


Can there be different sharing settings for outer class and inner class ?

YES - TBD ?????? to be checked and confirmed



Both inner classes and outer classes can be declared as with sharing. The sharing setting applies to all code contained in the class, including initialization code, constructors, and methods. Inner classes do not inherit the sharing setting from their container class.


If the class is inherited from interface, can it have different sharing settings from the one it's implementing ?

Classes inherit this setting from a parent class when one class extends or implements another.




??? Check what happens if between interface and extended class they have different sharing settings ?????

What is reason to explicitly call for Public Without Sharing, even though if nothing is defined is technically without sharing ?

· Use the withoutsharing keywords when declaring a class to ensure thatthe sharing rules for the current user are not enforced. For example, youmay want to explicitly turn off sharing rule enforcement when a class acquiressharing rules when it is called from another class that is declared using withsharing Ee

If in Apex Class with sharing keyword is enforced, will this enforce User's permission and field level security ?

1. No -




Enforcing sharing rules by using the with sharing keyword doesn’t enforce the user's permissions and field-level security. Apex code always has access to all fields and objects in an organization, ensuring that code won’t fail to run because of hidden fields or objects for a user.

if in Apex Class with Sharing keyWord is enforced, will the system retrieve record that the user is not able to access ?

1. no .




Because of With Sharing the secirity gets applied to record level accessibility. However, object and field level permissions are still run in system context.

If class says without sharing, will the code delete data even if user does not have delete access on his profile / perm set ?

1. Yes




If Public without Sharing - All code in this class ignores sharing rules and operates as if the context user has the Modify All Data permission.

What sharing rules are enforced for the inner class ? Does the inner class inherits sharing rules from the outer class ?

1. NO -




If Inner Class does specify with /without sharing all code in the inner class, executes with the same sharing context as the code that calls it.


Inner classes are separate from outer classes.

If the Inner Class ot Outer Class is extended from a class. Will the class inherit sharing from the class that it's extending ?

1. Yes




/ All code in this class ignores sharing rules because this class extends a parent class that ignores sharing rules.

Skip This Card - Logic and Process Automation - 46%




Describe how Apex impacts the ability to make declarative changes

Skip This Card - Logic and Process Automation - 46%




Describe how Apex impacts the ability to make declarative changes

When should Apex be used ?

Use Apex if you want to:


1. Create Web services.


2. Create email services.


3. Perform complex validation over multiple objects.


4. Create complex business processes that are not supported by workflow.


5. Create custom transactional logic (logic that occurs over the entire transaction, not just with a single record or object).


6. Attach custom logic to another operation, such as saving a record, so that it occurs whenever the operation is executed, regardless of whether it originates in the user interface, a Visualforce page, or from SOAP API.

List few things for which Apex cannot be used ?

Apex cannot be used to:


Render elements in the user interface other than error messages


Change standard functionality—Apex can only prevent the functionality from happening, or add additional functionality


Create temporary files


Spawn threads

What should you consider before writing Trigger, to see which other declarative feature can be used ?

Instead of writing Triggers, we can automate Field Updates using Workflow – automatically populating a field with a default value or updating a field based on the value of another field is a pretty common requirement. Workflow can address the basic use cases just as well as writing an Apex Trigger.




Check Flow or Process Builder as well

Instead of writing VF page and calculating field values in the controller, what are the declarative features that should be looked into ?

Use Formula Fields and Roll-Up Summary Fields for field calculations instead of writing a Visualforce page and calculate the field values in a controller extension

What should be considered to enforce business rules ?

Enforce Business Rules with Validation Rules whenever possible instead of Triggers and code

What declarative feature is a good alternative for complex business processes to be considered ?

Use Approval Processes and Flows to implement logic and processesA lot of complex custom business logic and business processes can be defined using these two powerful tools. And probably the nicest benefit is that Approval Processes and Flows visualize the process, which makes it much easier to understand what’s going on than looking at lines and lines of Apex code.

What are some of the Apex Best Practices ?

1. Keep thy code stupid simple (KISS principle)


2. Do not put queries in loops


3. utilize maps for queries


4. use relationships to reduce queries


5. Do not put DML in loops


6. only use one trigger per object


7. keep logic outside of triggers


8. have a happy balance between clicks and code


9. Cover cooe as much as possible


10. Write meaningfull unit test


11. write unit tests before developing


12. test all conditions


13. never use dummy code coverage


14. never test with existing data


15. Do not introduce extra logic for tests



Skip this card Testing - 12%




Describe when and how to use various sources of test data.

Skip this card Testing - 12%

Which annotations would you use to create test records once for the whole class ?

@testSetup

Skip this card - Logic and Process Automation - 46%




Describe how to programmatically access and utilize the object schema.

Skip this card - Logic and Process Automation - 46%



Describe how to programmatically access and utilize the object schema.

What are the different ways of describing sObject ?

1. By using tokens or


2. By using describeSObjects Schema method.

What is describing by token ?

Token—a lightweight, serializable reference to an sObject or a field that is validated at compile time. This is used for token describes.

What is describeSObjects method ?

The describeSObjects method—a method in the Schema class that performs describes on one or more sObject types.

What is a describe result ?

Describe result—an object of type Schema.DescribeSObjectResult that contains all the describe properties for the sObject or field. Describe result objects are not serializable, and are validated at runtime. This result object is returned when performing the describe, using either the sObject token or the describeSObjects method.

Is following an example of getting describeSObjectResult, using token or describe by describeSObjects -




// Get the sObject describe result for the //Account object


Schema.DescribeSObjectResult dsr = Account.sObjectType.getDescribe();

1. Using Token






Refer - https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_dynamic_describe_objects_understanding.htm

Give an example of getting Field Result using token ?

// Get the field describe result for the Name // field on the Account object


Schema.DescribeFieldResult dfr = Schema.sObjectType.Account.fields.Name;

Give an example of getting token for Account ?

Account a = new Account();


Schema.sObjectType t = a.getSObjectType();

What are the two ways of getting Account token ?

1. Schema.sObjectType t = Account.sObjectType;




OR




2. Account a = new Account();


Schema.sObjectType t = a.getSObjectType();

What are the two ways to get describeSObjectResult using token ?

1. Schema.DescribeSObjectResult dsr = Account.sObjectType.getDescribe();




OR




Following uses static member variable




2. Schema.DescribeSObjectResult dsr = Schema.SObjectType.Account;

What are the two different ways for getting Field Tokens ?

To access the token for a field, use one of the following methods:


1. Access the static member variable name of an sObject static type, for example, Account.Name.


2. Call the getSObjectField method on a field describe result.

Are field tokens available for Person Accounts.

Field tokens aren't available for person accounts. If you access Schema.Account., you'll get an exception error. Instead, specify the field name as a string.


If an Apex code running in classes or triggers (not part of managed package), has the code to get the map of all the sObjects in the organization (using with sharing on class) will the system return list of all the sObjects of the organization or only the ones that's the running user has access to ?

1. It will get all of them (even if it says with Sharing).




This is because Apex Triggers and Classes always run in the system mode. However in Anonymous blocks user permissions are taken into account. As a result, not all sObjects and fields can be looked up if access is restricted for the running user.




Refer - https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_dynamic_permissions.htm

Will all the sObjects of the org be returned in the map when describe code is ran in Apex class / triggers within managed package ?

1. NO. It will only return the sObjects that are part of the managed package. However this is not true for unmanaged package, in which all the sObjects (part of the org) will be returned






--


Dynamic Apex, contained in managed packages created by Salesforce ISV partners that are installed from Force.com AppExchange, have restricted access to any sObject outside the managed package. Partners can set the API Access value within the package to grant access to standard sObjects not included as part of the managed package. While Partners can request access to standard objects, custom objects are not included as part of the managed package and can never be referenced or accessed by dynamic Apex that is packaged.

Example of describing sObjects using Schema Method ?

// sObject types to describe


String[] types = new String[]{'Account','Merchandise__c'};


// Make the describe call


Schema.DescribeSobjectResult[] results = Schema.describeSObjects(types);

Example to get map of sObject Tokens and sObject Names ?

Map gd = Schema.getGlobalDescribe();,>


,>


,>



,>


Use the Schema getGlobalDescribe method to return a map that represents the relationship between all sObject names (keys) to sObject tokens (values)
,>

If a class says With Sharing, what kind of rule will be applied to the SOQL or SOSl associated to priceBook2

1. for PriceBook SOQL and SOSL it will be Without Sharing always.




Class-level security is always still necessary. In addition, all SOQL or SOSL queries that use PriceBook2 ignore the with sharing keyword. All PriceBook records are returned, regardless of the applied sharing rules.

Give example of some of the methods that can be called on describeSObjectResult ?

You can call isAccessible, isCreateable, or isUpdateable methods of Schema.DescribeSObjectResult

What all are not included in the number of characters limit for a specific class ?

A single class can be up to 1 million characters in length, not including comments, test methods, or classes defined using @isTest.

Skip This Card - Logic and Process Automation - 46%




Describe when to use and how to write triggers.

Skip This Card - Logic and Process Automation - 46%




Describe when to use and how to write triggers.





How many trigger events are there ?




A. 4


B. 6


C. 7


D. None of the above

C. 7




Following are the trigger events -


before insert


before update


before delete


after insert


after update


after delete


after undelete

Trigger Syntax ?

trigger RestrictInvoiceDeletion on Invoice_Statement__c (before delete) {

Are the records already committed to the database by the time after trigger is triggered ?

1...NO (it's not truly committed until other processes are fully committed, like Workflow Rules, Assignment Rules...)

Where will you be performing following logic, before or after trigger -


1. Perform data validation, 2. Set default values, or 3. performing additional logic and/or calculations.





Before Trigger

Is there record id available in Before Insert or After Insert trigger or both




1. Before


2. After


3. Both

3. Both




Even though Id is available in After Insert trigger it is not truly committed until all the other rules have been successfully processed.

When will you use After Trigger ?

After Trigger Event is ideal for working with data that is external to the record itself such as referenced objects or creating records based on information from the triggered object

What does trigger.New gives ?

The trigger.new variable holds the information about the record(s) that was just inserted or updated (please make note that if you are looking for the data that was deleted that you will instead need to use the trigger.old variable to access that data).

In which of the foll events is newMap available ?




1. Before Update


2. After Update


3. Before Insert


4. After Insert


5. All of the above

1. Before Update


2. After Update


3. After Insert




newMap is not available in Before Insert




Refer - https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_triggers_context_variables.htm

In which triggers is Trigger.old adn Trigger.oldMap available ?


1. Insert


2. Update


3. Delete


4. UnDelete

1. Update


2. Delete




Trigger.Old and Trigger.oldMap is NOT available in Insert and Undelete

Trigger Context Variables Considerations ?

1. Trigger.new and trigger.old cannot be used in Apex DML operations.


2. You can use an object to change its own field values using trigger.new, but only in before triggers. In all after triggers,trigger.new is not saved, so a runtime exception is thrown.


3. trigger.old is always read-only.


4. You cannot delete trigger.new.




Refer THIS AGAIN - IMPORTANT


- https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_triggers_context_variables_considerations.htm

For which if the following list of standard objects trigger can be created -


1. Attachment


2. Content Document


3. Note


4. None of the above

Triggers can be created for


1. Attachment


2. Content Document


3. Note




For all these listed objects triggers can be created. Note - you CANNOT create a trigger in the Salesforce user interface. However, you CAN CREATE triggers for these objects, using development tools, such as the Developer Console or the Force.com IDE. Alternatively, you can also use the Metadata API.

During merge process, will the trigger for all the child records get fired if there has been re-parenting to the master record ?


1. Yes


2. No

2. NO




A single merge operation fires a single update event for the winning record only. Any child records that are reparented as a result of the merge operation do not fire triggers.

What is the order in which triggers will get fired during merge process ?

During Merge the following is the order of events when a merge occurs:


1. The before delete trigger fires.


2. The system deletes the necessary records due to the merge, assigns new parent records to the child records.


3. The after delete trigger fires, and sets the MasterRecordId field on the deleted records (happens in after delete).


4. The system does the specific updates required for the master record. Normal update triggers apply.

In the foll scenario, If Account record is undeleted from recycle bin, the associated opportunity records get undeleted as well, will the undelete trigger gets fired for -


1. Only Account


2. Both Account and Opportunity


3. None



1. Only Account




The after undelete trigger events only run on top-level objects.



Give the list of objects for which undelete will get fired ?

1.Account


2.Asset


3.Campaign


4.Case


5.Contact


6.Content


7.Document


8.Contract


9.Custom objects


10. Event


11. Lead


12. Opportunity


13. Product


14. Solution


15. Task

Skip this Card - Logic and Process Automation - 46%




Describe the relationship between Apex transactions, the save execution order, and the potential for recursion and/or cascading

Skip this Card - Logic and Process Automation - 46%

What is an Apex Transaction ?

An Apex transaction represents a set of operations that are executed as a single unit. All DML operations in a transaction either complete successfully, or if an error occurs in one operation, the entire transaction is rolled back and no data is committed to the database. The boundary of a transaction can be a trigger, a class method, an anonymous block of code, a Visualforce page, or a custom Web service method.

What is the Order of Execution ?

Refer - https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_triggers_order_of_execution.htm



Client Side - Runs Javascript validation if there is any dependent picklist fields.


Server Side -


1. Loads original from the db or initializes record for an upsert stmt


2. Loads the new record field values from the request and overwrites the old values.



If the request came from a standard UI edit page, Salesforce runs system validation to check the record for:


Compliance with layout-specific rules


Required values at the layout level and field-definition level


Valid field formats


Maximum field length




When the request comes from other sources, such as an Apex application or a SOAP API call, Salesforce validates only the foreign keys. Prior to executing a trigger, Salesforce verifies that any custom foreign keys do not refer to the object itself.




Salesforce runs user-defined validation rules if multiline items were created, such as quote line items and opportunity line items.




3. Executes all before triggers.


4. Runs most system validation steps again, such as verifying that all required fields have a non-null value, and runs any user-defined validation rules. The only system validation that Salesforce doesn't run a second time (when the request comes from a standard UI edit page) is the enforcement of layout-specific rules.


5. Executes duplicate rules. If the duplicate rule identifies the record as a duplicate and uses the block action, the record is not saved and no further steps, such as after triggers and workflow rules, are taken.


6. Saves the record to the database, but doesn't commit yet.


7. Executes all after triggers.


8. Executes assignment rules.


9. Executes auto-response rules.


10. Executes workflow rules.


11. If there are workflow field updates, updates the record again.


12. If the record was updated with workflow field updates, fires before update triggers and after update triggers one more time (and only one more time), in addition to standard validations. Custom validation rules, duplicate rules, and escalation rules are not run again.


13. Executes processes.


If there are workflow flow triggers, executes the flows.


The Process Builder has superseded flow trigger workflow actions, formerly available in a pilot program. Organizations that are using flow trigger workflow actions can continue to create and edit them, but flow trigger workflow actions aren’t available for new organizations.


14. Executes escalation rules.


15. Executes entitlement rules.


16. If the record contains a roll-up summary field or is part of a cross-object workflow, performs calculations and updates the roll-up summary field in the parent record. Parent record goes through save procedure.


17. If the parent record is updated, and a grandparent record contains a roll-up summary field or is part of a cross-object workflow, performs calculations and updates the roll-up summary field in the grandparent record. Grandparent record goes through save procedure.


18. Executes Criteria Based Sharing evaluation.


19. Commits all DML operations to the database.


20. Executes post-commit logic, such as sending email.




Note - During a recursive save, Salesforce skips steps 8 (assignment rules) through 17 (roll-up summary field in the grandparent record).

In the following scenario -


Suppose an existing record has a number field with an initial value of 1. A user updates this field to 10, and a workflow rule field update fires and increments it to 11. In the update trigger that fires after the workflow field update, the field value of the object obtained from Trigger.old will be -




A. 1


B. 10

A. 1




Trigger.old contains a version of the objects before the specific update that fired the trigger. However, there is an exception. When a record is updated and subsequently triggers a workflow rule field update, Trigger.old in the last update trigger won’t contain the version of the object immediately prior to the workflow update, but the object before the initial update was made.

List out the operations that do not initiate trigger ?

1.Cascading delete operations. Records that did not initiate a delete don't cause trigger evaluation.


2. Cascading updates of child records that are reparented as a result of a merge operation


3. Mass campaign status changes


4. Mass division transfers


5. Mass address updates


6. Mass approval request transfers


7. Mass email actions


8. Modifying custom field data types


9. Renaming or replacing picklists


10. Managing price books


11. Changing a user's default division with the transfer division option checked


12. Changes to the following objects:


12.1 BrandTemplate


12.2 MassEmailTemplate


12.3 Folder


Update account triggers don't fire before or after a business account record type is changed to person account (or a person account record type is changed to business account.)




Note - Inserts, updates, and deletes on person accounts fire Account triggers, not Contact triggers.

The before triggers associated with the following operations are fired during lead conversion only if validation and triggers for lead conversion are enabled in the organization:

1. insert of accounts, contacts, and opportunities


2. update of accounts and contacts

Opportunity triggers are not fired when the account owner changes as a result of the associated opportunity's owner changing.

Opportunity triggers are not fired when the account owner changes as a result of the associated opportunity's owner changing.

Triggers on the Attachment object don’t fire when:

1. the attachment is created via Case Feed publisher.


2. the user sends email via the Email related list and adds an attachment file.

Triggers fire when the Attachment object is created via Email-to-Case or via the UI.

Triggers fire when the Attachment object is created via Email-to-Case or via the UI.

Fields Not Updateable in Before Triggers




Some field values are set during the system save operation, which occurs after before triggers have fired. As a result, these fields cannot be modified or accurately detected in before insert or before update triggers.

Fields Not Updateable in Before Triggers Some examples include:


1. Task.isClosed


2. Opportunity.amount*


3. Opportunity.ForecastCategory


3. Opportunity.isWon


4. Opportunity.isClosed


5. Contract.activatedDate


6. Contract.activatedById


7. Case.isClosed


8. Solution.isReviewed


9. Id (for all records)**


10. createdDate (for all records)**


11. lastUpdated (for all records)


12. Event.WhoId (when Shared Activities is enabled)


13. Task.WhoId (when Shared Activities is enabled)




* When Opportunity has no lineitems, Amount can be modified by a before trigger.


** Id and createdDate can be detected in before update triggers, but cannot be modified.

Fields Not Updateable in After Triggers




The following fields can’t be updated by after insert or after update triggers.

Fields Not Updateable in After Triggers




The following fields can’t be updated by after insert or after update triggers.



Event.WhoId


Task.WhoId

Field History Tracking Trigger Consideration

Field history tracking honors the permissions of the current user. If the current user doesn't have permission to directly edit an object or field, but they activate a trigger that changes an object or field with history tracking enabled, no history of the change is recorded.

How can you prevent trigger to perform DML ?

Triggers can be used to prevent DML operations from occurring by calling the addError() method on a record or field.

Where do you put addError, trigger.new or trigger.old or both ?

When used on Trigger.new records in insert and update triggers, and on Trigger.old records in delete triggers, the custom error message is displayed in the application interface and logged.

Trigger Exception Consideration -

1. If the trigger was spawned by a DML statement in Apex, any one error results in the entire operation rolling back. However, the runtime engine still processes every record in the operation to compile a comprehensive list of errors.




2. If the trigger was spawned by a bulk DML call in the Force.com API, the runtime engine sets aside the bad records and attempts to do a partial save of the records that did not generate errors.




3. If the trigger was spawned by a bulk DML call in the Force.com API, the runtime engine sets aside the bad records and attempts to do a partial save of the records that did not generate errors.