SF-Data-Arch Data Governance Practice Test 3 — 15 Questions

Question 1

A Salesforce org has a data governance policy that requires all new custom objects to have a description and a data owner assigned before deployment to production. The architect needs to enforce this policy automatically during the development lifecycle. Which approach should the architect take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a Salesforce CLI plugin or a script in the CI/CD pipeline to check metadata for description and owner before deployment.. Enforcing metadata standards like requiring a description and data owner on custom objects requires checking metadata before deployment. A CI/CD pipeline with Salesforce CLI or scripts can automate these checks, preventing non-compliant metadata from being deployed. Validation rules, permission sets, and workflow rules operate on data or user access, not metadata, so they cannot enforce this policy.

Answer

Configure a permission set that only allows users to create custom objects if they include a description.

Answer

Create a validation rule on the custom object that requires the description field to be populated.

Answer

Set up a workflow rule that sends an email to the data governance team when a new custom object is created without a description.

Question 2

A Salesforce org has a data governance policy that requires all new custom objects to have a description and a data owner assigned before deployment to production. The architect needs to enforce this policy automatically during the development lifecycle. Which approach should the architect take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Submit a request to the data governance council for review and approval, providing business justification and impact analysis.. The governance policy clearly states that new custom objects and fields must be reviewed and approved before creation. The developer should first submit a request to the data governance council with business justification and impact analysis. This ensures the council can evaluate the request against data standards and avoid unnecessary or redundant fields. Only after approval should the field be created.

Answer

Ask the Salesforce administrator to create the field as a temporary workaround and document it in a technical debt log.

Answer

Use the Salesforce Setup menu to create the field directly in production, then notify the governance council afterward.

Answer

Create the field in a sandbox and then submit a change set for deployment to production.

Question 3

A multinational financial services company uses Salesforce to manage customer interactions. Its data governance team must ensure that all data elements containing Personally Identifiable Information (PII) are consistently classified, protected, and auditable across Production and Full Sandbox environments. The team is considering using Salesforce Data Mask to anonymize PII in Full Sandboxes. However, they are concerned that masking might alter the original data in Production. What is the most accurate statement regarding Data Mask and its role in this governance strategy?

Accepted Answer

Data Mask can be used to mask data in Full Sandboxes, and it does not affect Production data because masking occurs only during sandbox creation or refresh.. Data Mask is specifically designed to obfuscate sensitive data in sandboxes without affecting Production. It applies masking policies during sandbox creation or refresh, ensuring that PII is protected in non-production environments while maintaining data integrity in Production. This supports governance by enabling safe testing and development with realistic but anonymized data.

Answer

Data Mask permanently alters Production data when a masking policy is applied, so it should only be used in Full Sandboxes after a full backup.

Answer

Data Mask requires the use of Salesforce Shield and can only be applied to custom objects, not standard objects like Account or Contact.

Answer

Data Mask is a real-time field-level encryption service that automatically masks PII in both Production and Sandboxes, eliminating the need for separate policies.

Question 4

A multinational Salesforce org must ensure that records created in the EU region are stored and processed only within EU-approved infrastructure, while global reporting aggregates anonymized metrics. Which governance control should the architect prioritize to satisfy data residency?

Accepted Answer

Deploy the EU data in a Salesforce instance hosted in the EU region and restrict cross-region data flows through integration and sharing design. Data residency requires the records to physically reside and be processed in the approved region, and only anonymized aggregates to cross borders for reporting. Hosting EU data in an EU-region instance with controlled cross-region flows achieves that. Encryption key custody, sharing rules, and authentication each improve security but do not govern the location of storage or processing.

Answer

Configure Shield Platform Encryption with a tenant secret held by the EU legal entity

Answer

Apply record-level sharing rules that limit EU records to EU-based users

Answer

Enable Multi-Factor Authentication for all EU users to protect access to regulated records

Question 5

Universal Containers maintains a single Salesforce org used by sales teams across North America, EMEA, and APAC. Each region has its own legal requirements for how long personal data may be retained. The VP of Sales wants one consistent retention policy applied everywhere to simplify administration. As the data architect, what should you recommend?

Accepted Answer

Define region-specific retention rules in the governance policy and enforce them through record segmentation and automated deletion processes.. Retention requirements that vary by jurisdiction demand a governance policy that encodes those differences rather than flattening them. Segmenting records by region and applying automated retention jobs per segment allows one org to comply with multiple legal regimes. This approach keeps the policy centralized and auditable while respecting local law, which is the core purpose of a data governance framework in a multi-region Salesforce deployment.

Answer

Retain all personal data indefinitely because Salesforce storage is inexpensive and deletion carries operational risk.

Answer

Implement a single global retention schedule for all personal data records and document it in the data governance policy.

Answer

Delegate all retention decisions to regional sales managers and let each team manage its own data without a central policy.

Question 6

A Salesforce org is implementing a data governance program to manage data quality for a large volume of customer records. The architect must recommend tools and features to monitor and improve data quality on an ongoing basis. Which two Salesforce features should be used to proactively identify and address data quality issues? (Choose two.)

Accepted Answer

Duplicate Management with Matching Rules and Duplicate Rules. Duplicate Management and Validation Rules are proactive features that identify and prevent data quality issues. Duplicate Management detects and manages duplicate records, while Validation Rules enforce data quality at entry by blocking invalid saves. Data Loader, Salesforce Optimizer, and Reports/Dashboards are not proactive data quality tools; they serve other purposes like data loading, org optimization, or monitoring.

Answer

Data Loader with batch size optimization

Answer

Salesforce Optimizer

Answer

Reports and Dashboards with custom report types

Question 7

A retail company wants to ensure that customer email addresses are consistently formatted and that invalid values are rejected at the point of entry across web, mobile, and integration channels. The data governance lead asks the architect which Salesforce feature provides a single, reusable definition of the validation that all channels can share. Which feature should the architect recommend?

Accepted Answer

A validation rule on the Contact object using a REGEX function to enforce a standard email pattern.. Validation rules are evaluated on every insert and update no matter which channel performs the write, so a REGEX-based rule gives one reusable definition of the email format standard. It prevents invalid values from being saved, which is what the governance policy requires. Formula fields, duplicate rules, and notification flows either do not validate or act only after the fact.

Answer

A duplicate rule that matches contacts with similar email addresses.

Answer

A formula field that concatenates the email domain with a fixed suffix.

Answer

A record-triggered flow that sends a notification to the data steward when the email is malformed.

Question 8

A healthcare organization uses Salesforce to manage patient cases and must comply with HIPAA. The data governance team needs to ensure that audit trails for access to Protected Health Information (PHI) are comprehensive and tamper-evident. They are evaluating Salesforce Shield Event Monitoring and Field Audit Trail. Which combination of features should the team implement to meet the requirement for tracking who accessed PHI fields and when, while also retaining the audit data for 10 years?

Accepted Answer

Enable Field Audit Trail with a retention policy of 10 years, and use Event Monitoring to track field-level access events.. Field Audit Trail provides long-term retention of field history, up to 10 years, and tracks changes to PHI fields. Event Monitoring captures access events, including reads and exports, which are not covered by Field Audit Trail. Together, they deliver a complete audit trail for HIPAA compliance, ensuring both change and access tracking with the required retention.

Answer

Use Salesforce Shield Platform Encryption to encrypt PHI fields, which automatically generates audit logs for all access and retains them for 10 years.

Answer

Use Event Monitoring alone, as it captures all user activity including field-level changes, and set the retention period to 10 years.

Answer

Enable Field Audit Trail and configure it to also capture read access events, eliminating the need for Event Monitoring.

Question 9

A multinational company uses Salesforce across multiple regions. Each region has its own data retention requirements: the EU requires customer data to be deleted after 7 years, while the US requires retention for 10 years. The company wants to implement a data lifecycle governance policy that automatically enforces these retention periods. Which solution should the data architect recommend?

Accepted Answer

Implement a combination of Salesforce Shield Field Audit Trail for compliance and a custom batch process to archive and purge records according to regional policies.. The company needs region-specific retention enforcement with auditability. Field Audit Trail retains field history for compliance, while a custom batch process can archive and purge records according to each region's retention period. This approach provides the flexibility to implement different retention rules and maintains an audit trail, unlike native recycle bin or non-existent general retention settings.

Answer

Create a custom object to store retention policies and use scheduled Apex to delete records based on region-specific criteria.

Answer

Rely on the Salesforce recycle bin and set its retention period to 7 years for EU records and 10 years for US records.

Answer

Use Salesforce Data Retention policies in Setup to define region-specific retention rules and automate deletion.

Question 10

The governance board at a financial services firm wants to know when critical fields on the Opportunity object were changed, who changed them, and what the previous value was, without writing custom code. Which native capability should the architect enable?

Accepted Answer

Enable Field History Tracking on the selected Opportunity fields. The board wants a native, no-code record of when critical Opportunity fields changed, who changed them, and the prior values. Field History Tracking provides exactly that for selected fields and requires only configuration. Chatter notifications, custom Flow logging, and nightly exports each capture partial or indirect information and cannot deliver a reliable, attributed field-change history.

Answer

Build a Flow that writes a record to a custom log object on every Opportunity update

Answer

Schedule a nightly Data Loader export of Opportunity records for comparison

Answer

Create a Workflow Rule that posts to Chatter when Opportunity fields change

Question 11

Northern Trail Outfitters has a Salesforce org where the Account object contains 40 custom fields, many of which were created by different teams over five years. No one is certain which fields are actively used, which are populated by integrations, and which are safe to remove. The CIO asks the data architect to establish ongoing visibility into field usage and data provenance. Which approach best addresses this governance gap?

Accepted Answer

Create a data dictionary and metadata inventory that documents each field's purpose, source system, and owning team, and establish a review cadence to keep it current.. The core issue is a lack of documented knowledge about existing fields and their origins. A data dictionary paired with a metadata inventory captures purpose, source, and ownership for each field, and a review cadence keeps it trustworthy over time. This combination gives leadership the ongoing visibility needed to make informed deprecation and consolidation decisions rather than guessing from a single usage metric.

Answer

Enable Field Audit Trail on all 40 custom fields and rely on the audit history as the primary source of field usage documentation.

Answer

Restrict field creation permissions to system administrators and freeze the Account object schema to prevent further sprawl.

Answer

Run a one-time report on field population rates and delete all fields with less than 10% fill rate.

Question 12

A global insurer is preparing for a data privacy audit. The architect must demonstrate that the Salesforce org can identify where personal data lives and prove who accessed it. Which two capabilities should the architect include in the governance solution? (Choose two.)

Accepted Answer

Data Classification metadata on fields, using the Data Classification feature to tag fields as personal or sensitive.. The audit asks two distinct questions: where personal data resides and who accessed it. Data Classification metadata answers the first by tagging fields with sensitivity categories, and Event Monitoring answers the second by retaining access and API logs for analysis. Field history, bulk exports, and platform encryption do not provide classification inventory or access evidence.

Answer

A nightly Data Loader job that exports all records for offline retention.

Answer

Field History Tracking enabled on every field in the org to record old and new values.

Answer

Enabling Shield Platform Encryption on all text fields to mask values at rest.

Question 13

A retail company is implementing a data governance program and needs to define ownership and accountability for data quality. The company has multiple business units, each using Salesforce differently. The governance team wants to ensure that each data domain (e.g., Customer, Product, Order) has a clear owner responsible for data quality, definitions, and issue resolution. Which role should be assigned to fulfill this responsibility?

Accepted Answer

Data Steward. A Data Steward is the role specifically designed to own data domains, ensure data quality, define standards, and resolve issues. They bridge business and technical teams, providing accountability for data within their domain. This aligns with the governance team's need for clear ownership and accountability at the domain level.

Answer

Salesforce Administrator

Answer

Chief Data Officer

Answer

Data Governance Council

Question 14

A global Salesforce org has implemented a data governance framework. The governance team needs to ensure that data is retained according to legal and regulatory requirements, and that it is securely deleted when no longer needed. They are evaluating Salesforce's native capabilities for data lifecycle management. Which statement accurately describes a limitation or behavior of Salesforce's native data retention and deletion features that the team must consider?

Accepted Answer

Salesforce Field Audit Trail can be used to retain field history for up to 10 years, but it does not automatically delete the data after the retention period; manual intervention is required.. Field Audit Trail retains field history for up to 10 years, but it does not automatically delete data after that period. Manual deletion or archiving is required to enforce retention limits. This is a critical limitation for data lifecycle governance, as organizations must implement their own processes to purge data when it is no longer needed, ensuring compliance with legal and regulatory requirements.

Answer

When a record is deleted in Salesforce, it is immediately and permanently removed from all backups and disaster recovery systems, ensuring compliance with right-to-erasure requests.

Answer

Salesforce automatically archives inactive records to a separate cold storage system after 2 years, and users can retrieve them via a standard API.

Answer

Salesforce provides a built-in data retention policy engine that automatically deletes records based on custom retention rules without any development.

Question 15

A healthcare organization is building a data governance program for its Salesforce org. The compliance officer wants a documented record of who owns each data domain, what the approved data definitions are, and how changes to those definitions are approved. Which artifact should the architect establish as the authoritative source for this information?

Accepted Answer

A data governance charter and data dictionary that define domain ownership, approved definitions, and the change-approval workflow.. The compliance officer is asking for documented accountability, agreed definitions, and a controlled change process. A governance charter defines the program's roles, decision rights, and approval paths, while a data dictionary records the approved definition and owner for each data domain. Together they form the authoritative governance reference that can be audited and maintained over time.

Answer

A Salesforce report listing all custom objects and their record counts.

Answer

A set of validation rules that enforce data entry standards on key objects.

Answer

An integration architecture diagram showing how data flows between Salesforce and external systems.