<< Prev Question Next Question >>

Question 22/35

Universal Containers (UC) would like to store an encryption key within Salesforce for use in Apex code, but it does not want users to be able to see this confidential key. Users require the view setup permission.
How can UC securely store the confidential key?

Recent Comments (The most recent comments are at the top.)

test - Nov 25, 2025

**Correct Answer: A. Create a protected custom metadata type… packaged in a managed package.**

### Explanation

UC needs to store an encryption key **inside Salesforce**, but:

* Users have **View Setup** permission → they can see Setup objects.
* Therefore, **Custom Metadata and Custom Settings are visible** to them.
* UC needs a way to hide the key **even from admins**, but still allow **Apex code** to read it.

The **only** Salesforce mechanism that allows this is:

### ✔ **Protected Custom Metadata in a Managed Package**

* **Protected** → the metadata values are *not visible* in subscriber orgs (even to admins).
* **Managed package** → protection only works in **managed** (not unlocked) packages.
* **Apex in the subscriber org** can read the protected data if the packaged Apex code exposes it correctly.

### Why the other options are wrong?

| Option | Why it’s incorrect |
| ---------------------------------------------------------- | ----------------------------------------------------------------------------------------- |
| **B. Protected CMDT in an unlocked package** | ❌ Unlocked packages do **not** support protected metadata. Values would be visible. |
| **C. Custom metadata type with restricted profile access** | ❌ Users with **View Setup** permission can still see metadata and its values. Not secure. |

### Final Answer

👉 **A. Create a protected custom metadata type in a managed package and deploy it to production.**...

test - Nov 25, 2025

**Correct Answer: A. Create a protected custom metadata type… packaged in a managed package.**

### Explanation

UC needs to store an encryption key **inside Salesforce**, but:

* Users have **View Setup** permission → they can see Setup objects.
* Therefore, **Custom Metadata and Custom Settings are visible** to them.
* UC needs a way to hide the key **even from admins**, but still allow **Apex code** to read it.

The **only** Salesforce mechanism that allows this is:

### ✔ **Protected Custom Metadata in a Managed Package**

* **Protected** → the metadata values are *not visible* in subscriber orgs (even to admins).
* **Managed package** → protection only works in **managed** (not unlocked) packages.
* **Apex in the subscriber org** can read the protected data if the packaged Apex code exposes it correctly.

### Why the other options are wrong?

| Option | Why it’s incorrect |
| ---------------------------------------------------------- | ----------------------------------------------------------------------------------------- |
| **B. Protected CMDT in an unlocked package** | ❌ Unlocked packages do **not** support protected metadata. Values would be visible. |
| **C. Custom metadata type with restricted profile access** | ❌ Users with **View Setup** permission can still see metadata and its values. Not secure. |

### Final Answer

👉 **A. Create a protected custom metadata type in a managed package and deploy it to production.**...

LEAVE A REPLY

Your email address will not be published. Required fields are marked *

Question List (35q)
2 commentQuestion 1: Universal Containers (UC) delivers training in 500 different...
1 commentQuestion 2: Universal Containers (UC) has affiliates who sell containers...
1 commentQuestion 3: Universal Containers uses Person Accounts to represent retai...
1 commentQuestion 4: Universal Containers requested to leverage Lightning Web Com...
1 commentQuestion 5: A custom Invoice object has been created with a master-detai...
1 commentQuestion 6: Universal Containers has expanded to sell virtual containers...
1 commentQuestion 7: Users at Universal Containers are complaining that a field h...
3 commentQuestion 8: An architect has a requirement to create a criteria-based sh...
2 commentQuestion 9: A consulting company uses the Salesforce mobile app for its ...
1 commentQuestion 10: Which option can be selected to share data when creating a s...
1 commentQuestion 11: Universal1 Containers (UC) is a non-profit organization with...
1 commentQuestion 12: A sales rep at Universal Containers was added to an opportun...
1 commentQuestion 13: Universal Containers has implemented Customer Community with...
1 commentQuestion 14: A sales rep (John) at Universal Containers requested to upda...
5 commentQuestion 15: Sales operations at Universal Containers (UC) has created Pu...
1 commentQuestion 16: Sales reps at Universal Containers (UC) complain about the m...
2 commentQuestion 17: Universal Containers uses 75,000 distributors that have clos...
Question 18: Besides their own team accounts, sales managers at Universal...
Question 19: An architect from a previous project implemented Platform Sh...
1 commentQuestion 20: Which method should be used to grant an unrelated group of u...
Question 21: Universal Containers (UC) delivers training and courses to s...
Question 22: Universal Containers (UC) would like to store an encryption ...
Question 23: Universal Containers is implementing Sales Cloud. During the...
1 commentQuestion 24: Which advanced tool should Salesforce enable for large-scale...
1 commentQuestion 25: Sales operations at Universal Containers (UC) wants to creat...
2 commentQuestion 26: To grant Universal Containers sales managers access to shipm...
1 commentQuestion 27: Universal Containers (UC) has a partner community for its 20...
Question 28: Universal Containers (UC) has created a custom Invoice objec...
Question 29: Universal Containers has selected a small and diverse group ...
1 commentQuestion 30: A user posts a file to the Chatter feed for a record of an o...
1 commentQuestion 31: Which community function is impacted by having the Site User...
1 commentQuestion 32: The sales managers at Universal Containers requested their t...
1 commentQuestion 33: Customer complaints for bad interactions with a customer sup...
1 commentQuestion 34: Dreamforce presenters need to be able to edit their presenti...
Question 35: The finance team at Universal Containers usually does not ha...