Question

Universal Containers (UC) has a requirement to expose a web service to their business partners. The web service will be used to allow each business partner to query UC's Salesforce instance to retrieve the status of orders. The business partner should only be allowed access to orders for which the business partner is the fulfillment vendor. The Architect does not want the business partners to utilize the standard APIs and would prefer a custom API be developed. Which three design elements should the Architect consider in order to ensure the data security of the solution?

Answer 1

Answer:

"- Set the Orders object's sharing settings to Private in the Org-Wide Defaults

_Provide each partner with their own Salesforce login set to API Enabled on the profile

-Develop a custom Apex web service using the "With Sharing" keyword"

Explanation:

Universal Containers (UC) has a requirement to expose a web service to their business partners. The web service will be used to allow each business partner to query UC's Salesforce instance to retrieve the status of orders. The business partner should only be allowed access to orders for which the business partner is the fulfillment vendor. The Architect does not want the business partners to utilize the standard APIs and would prefer a custom API be developed. Which three design elements should the Architect consider in order to ensure the data security of the solution?

A. Query the Orders object with Dynamic SOQL based upon the fulfillment ID.

B. Set the Orders object's sharing settings to Private in the Org-Wide Defaults

C. Provide each partner with their own Salesforce login set to API Enabled on the profile.  

D. Develop a custom Apex web service with a fulfillment ID input attribute

E. Develop a custom Apex web service using the "With Sharing" keyword.

The above should be a follow up option to the question

The Architect should consider the following design

"- Set the Orders object's sharing settings to Private in the Org-Wide Defaults

_Provide each partner with their own Salesforce login set to API Enabled on the profile

-Develop a custom Apex web service using the "With Sharing" keyword"

 There is need for some sharing rule between the architect and the user