Salesforce Updated Sharing-and-Visibility-Architect Exam Questions and Answers by ivie

The recommended way for the architect to implement this is to create an AccountShare record associated to a public group containing the role. This way, the architect can use Apex Managed Sharing to share certain account records with all users who are assigned to a specific role in the role hierarchy. Creating an AccountShare record associated to a public group containing the users in the role is not possible because public groups can only contain users, roles, or other public groups, but not a combination of them. Creating an AccountShare record associated to each user who is assigned to the role is not efficient because it requires more sharing records and maintenance. Creating an AccountShare record associated to the required role is not valid because AccountShare records can only be associated to users or groups, not roles1

Creating a permission set that grants the View All permission for Opportunity is the best approach to meet these requirements, as it will allow the sales reporting team members to view all opportunity records without modifying their profiles. Creating a permission set that grants the View All Data permission will work, but it will also grant access to all other objects, which may not be necessary or secure. Giving the View All Data permission to the Sales Reporting profile will work, but it will also affect all users with that profile, which may not be desired.

 When a sharing rule grants access to a public group, the access is also extended to the subordinates of the users in that group, according to the role hierarchy1. Therefore, subordinates of managers who have sales engineers in the public group will also have access to these records. Other sales engineers who are in the same role hierarchy as the sales engineers of the public group will not have access to these records, unless they are subordinates or managers of the users in the public group. Sales engineers and their managers in the role hierarchy will not have access to these records, unless they are part of the public group or its subordinates.

Two options that the user can see while adding account team members to the account are case access and opportunity access. This is because these are the two objects that have public read only sharing settings and allow users to specify different levels of access for account team members. Contact access and activity access are not options because these objects have controlled by parent sharing settings and inherit their access from the account