Why I took it
I'd been designing security models for years — multi-org healthcare platforms, government portals with strict audit requirements, Experience Cloud sites with external users. I wanted to replace instinct with a complete, structured mental model of how Salesforce decides who can see what. This certification forced exactly that.
What it actually tests
Less about memorising features, more about choosing the right access mechanism for a scenario and understanding its consequences at scale. The big areas:
- Declarative sharing — org-wide defaults, role hierarchy, sharing rules, teams, territories, manual sharing.
- Programmatic sharing — Apex managed sharing, share objects, row causes,
with sharing/without sharing/inherited sharing. - Object and field security — profiles, permission sets, permission set groups, field-level security.
- External users — Experience Cloud sharing sets, share groups, external OWDs.
- Performance at scale — data skew, group membership calculation, large data volume implications.
The mental model that made it click
flowchart TD
Q[Can user X see record Y?] --> O{Object access? profile / perm set}
O -->|no| N[No access]
O -->|yes| A{View All / Modify All?}
A -->|yes| Y[Access]
A -->|no| OW{Owner, or OWD grants it?}
OW -->|yes| Y
OW -->|no| S{Shared via hierarchy, rules, teams, territories, manual or Apex?}
S -->|yes| Y
S -->|no| I{Implicit sharing? parent / child}
I -->|yes| Y
I -->|no| N
Y --> F[Then field-level security decides which fields]
Once I could walk any scenario through this flow out loud, the exam scenarios became much easier to reason about.
My approach — four weeks
| Week | Focus | How |
|---|---|---|
| 1 | Declarative sharing end-to-end | Built a dev org with a realistic role hierarchy and tested every mechanism as different users |
| 2 | Programmatic sharing & code security | Wrote Apex managed sharing with custom row causes; tested sharing keywords in nested calls |
| 3 | External users & scale | Experience Cloud sharing sets and share groups; read deeply on data skew and group recalculation |
| 4 | Scenarios & review | Practised scenario questions; explained each answer out loud — and why the others were wrong |
Topics I'd spend extra time on
- Implicit sharing between accounts and their child records — easy to forget, often the answer.
- Ownership and lookup skew — why one user owning 10,000+ records causes problems, and what to do about it.
- Territory management vs role hierarchy — when each is the right tool.
- When Apex managed sharing is justified — and when a declarative option is better.
Preparation guidelines
- Start from the official exam guide and its weightings
- Build every scenario in a dev org and log in as test users
- Read Salesforce's sharing architecture guidance and "record access under the hood" material
- Practise explaining trade-offs, not just answers
- Rely on memorised question dumps — they teach the wrong skill
- Skip the large-data-volume topics
- Assume real-world habits match the "best" exam answer
- Rush week four — scenario practice is where it comes together
What it changed in my day job
I now start every security design from the most restrictive OWD and open up deliberately — with a written reason for each opening. Security reviews got shorter, and audits got easier. That alone made the certification worth it.
Pranav Sanvatsarkar is a Solution Architect with 14+ years across telecom, healthcare, public sector and non-profit, focused on AI, agentic automation and Salesforce architecture. Say Hello!