Universal Containers allows all employees to submit reviews for leadership using a custom object called Review. These Reviews should only be visible to the HR department and the employee who submitted the record.
Which three steps should an app builder take to properly control access to Reviews? (Choose three.)
To properly control access to Reviews, several steps are necessary. First, adding a Master-Detail(User) field on the Review object ensures the employee who submits the review has explicit access to it. Second, disabling Grant Access Using Hierarchies prevents higher-level roles from gaining automatic access, thus ensuring privacy. Finally, setting the organization-wide default to Private ensures that only explicitly granted users (the HR department and the submitting employee) can view the records. This combination of steps effectively restricts access to the necessary parties.
Answer is A, C and E
The question is a bit tricky since it says "3 steps", in other words, after completing these 3 steps, the request should be completed. I thought CDE at first, but completing CDE won't complete the request. D is good to have since E already should cover what D does. So I'm going with ACE
Should be CDE
why A?
I Think A is excluded because there is no criteria for sharing the review record, they probably have something like 'view all' or 'modifyh all' on their profile (or permission set)
But for D, if we remove the Read permission for non-HR Department, it means that the employees won't be able to submit a review since they won't have access to the object Review.