Salesforce ArchitectureArchitect (Hardest)securityzero-trustshield
Design security architecture with Zero Trust for Salesforce
Real World Scenario
CISO mandates Zero Trust after phishing compromised admin credentials affecting customer PII.
Expected Answer
• MFA enforced all users; step-up auth for sensitive actions
• Least privilege profiles and permission sets; eliminate modify all data
• Session security: timeout, IP ranges, Login Flow for high-risk profiles
• Shield Platform Encryption for sensitive fields at rest
• Event Monitoring and Transaction Security policies detecting anomalies
• Integration users isolated with API-only access and certificate auth
• Regular access certification and privileged access management for admins
Follow-Up Questions & Answers
Click to expand — each follow-up includes a direct, interview-ready answer
Direct answer: MFA enforced all users; step-up auth for sensitive actions Also consider: Least privilege profiles and permission sets; eliminate modify all data In practice: Session security: timeout, IP ranges, Login Flow for high-risk profiles Document the decision in an ADR and align with enterprise standards.
Architect Perspective
Zero Trust in Salesforce means assume breach—layer detective controls not only preventive profiles.