SF-Admin Agentforce AI Practice Question
A Salesforce administrator is building an Agentforce Agent to assist customers with product recommendations. The agent must use a large language model to generate personalized suggestions based on customer purchase history. The administrator wants to ensure that sensitive customer data, such as credit card numbers, is not exposed to the external LLM. Which feature should the administrator configure?
⚠ Common exam trap
Test-takers frequently confuse data-at-rest encryption or field-level security with data-in-transit masking for LLM interactions, which is uniquely handled by the Einstein Trust Layer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Einstein Trust Layer
The Einstein Trust Layer is the correct feature to prevent sensitive data from being exposed to external LLMs. It allows administrators to define masking rules that replace sensitive information with placeholders before the data is sent. This ensures that the LLM never sees actual credit card numbers while still enabling the agent to generate personalized recommendations based on other data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Field-Level Security
Why it's wrong here
Field-level security controls which users can view or edit fields, but it does not affect data sent to an external LLM by an agent. The agent runs under a user context, and if that user has access to credit card numbers, the data could be sent. Field-level security alone does not mask data for LLM interactions. The Einstein Trust Layer provides the necessary masking.
- ✗
Named Credentials
Why it's wrong here
Named Credentials are used to authenticate to external services, not to mask data. They would not prevent sensitive data from being included in the prompt sent to the LLM. While they are important for secure callouts, they do not provide data masking. The administrator should use the Einstein Trust Layer to protect sensitive information.
- ✓
Einstein Trust Layer
Why this is correct
The Einstein Trust Layer is designed to securely handle data sent to external LLMs. It provides data masking, zero-data retention, and audit trails. By configuring masking rules for sensitive fields like credit card numbers, the administrator ensures that such data is replaced with placeholder tokens before being sent to the LLM. This protects customer privacy while still allowing the agent to generate recommendations based on non-sensitive data.
- ✗
Shield Platform Encryption
Why it's wrong here
Shield Platform Encryption encrypts data at rest within Salesforce, but it does not mask data before it is sent to an external LLM. The LLM would still receive the actual data if it is decrypted for use. Encryption at rest is important for compliance, but it does not address the specific risk of data exposure to the LLM. The Einstein Trust Layer is the correct feature for that.
About these practice questions
One of 202 original SF-Admin practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Salesforce exam blueprint
This SF-Admin practice question is part of Courseiva's free Salesforce certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SF-Admin exam.