Salesforce Sharing and Visibility Certification Practice Exam

What is the expected behavior when a user without field-level security accesses a Visualforce page that contains an apex:outputField?

1. The user encounters an error while saving the record.

2. The output field is visible to the user.

3. The user is able to enter a value into the Phone field.

4. The field is automatically removed from the page.

The correct answer is: The field is automatically removed from the page.

When a user who does not have the necessary field-level security accesses a Visualforce page containing an apex:outputField, the expected behavior is that the field will not be displayed on the page. Apex:outputField respects the user's permissions and field-level security settings—if the user does not have access to that specific field, it is not rendered at all on the Visualforce page. This means that the field is essentially removed from the page for the user who lacks the appropriate permissions. In this case, this behavior ensures that sensitive or restricted information is not visible to users who are not authorized to see or interact with that data, reinforcing data security and privacy within the Salesforce platform. In contrast, the other options imply that the user would either face errors, see the output field, or be able to enter data into the field, which would not align with how field-level security is designed to function in conjunction with Visualforce pages. By ensuring that the field is entirely hidden when permissions are not granted, Salesforce maintains a consistent adherence to security practices.