Profiles and permission sets, the sharing model, relationships, roll-ups, validation rules, Flow and data loading - the admin questions asked most.
By Bhanu Pratap SinghLast reviewed 2026-10-2316 min read8 questions6 Beginner2 Intermediate
Level
Admin questions come up in every Salesforce interview, developer roles included - because code that ignores the security model or the data model is code that breaks. These are the ones asked most.
Q1BeginnerSecurityAccess
What is the difference between a profile and a permission set?
1What it is
Both grant what a user can do: which objects and fields they can use, and system permissions. A user has exactly one profile but can have many permission sets, and permission set groups bundle several sets together.
2Why it matters
Profiles used to carry everything, which led to dozens of near-identical profiles. Salesforce's guidance now is a minimal profile plus permission sets: access is added in small, named pieces that can be given to anyone who needs them.
3Example
Profile
Permission set
Per user
Exactly one, required
Zero or many
Typical content
Login hours, IP ranges, page layout assignment, a minimal baseline
Object, field and system permissions for a job
Grouping
-
Permission set groups bundle sets for a role
Direction
Keep it minimal
Where new access is granted
Example: every support agent gets the "Support User" profile. The few who also handle refunds get a "Refund Approver" permission set - no second profile needed.
4In short - say this in the interview
A profile is the one required baseline every user has; permission sets add access on top, and a user can have many. Best practice is a minimal profile with access granted through permission sets and permission set groups.
Common mistake
Saying a permission set can remove access. Permission sets only add - to take access away you change the profile or remove the set.
Likely follow-ups
What is a muting permission set? (Used inside a permission set group to turn a permission off.)
Where do you assign page layouts?
Q2IntermediateSecuritySharing
How does record-level security work - org-wide defaults, role hierarchy, sharing rules?
1What it is
Record access is built in layers. Org-wide defaults set the baseline for each object (Private, Public Read Only, Public Read/Write). The role hierarchy lets managers see their team's records. Sharing rules open records to groups, and manual sharing to individuals.
2Why it matters
Profiles say what a user can do with an object; sharing says which of the records they can see. You start as restrictive as the most-protected user needs, then open access up - because sharing can only ever add access, never take it away.
3Example
Example: Opportunity org-wide default is Private, so reps see only their own deals. Sales managers see their team's deals through the role hierarchy. A sharing rule gives the Finance group read access to every Closed Won opportunity.
4In short - say this in the interview
Org-wide defaults set the most restrictive baseline, then the role hierarchy, sharing rules and manual sharing open access up. Sharing only adds access; to restrict, you tighten the org-wide default.
Common mistake
Trying to restrict a user with a sharing rule. Sharing rules can only grant access.
Likely follow-ups
What does "Grant Access Using Hierarchies" do?
What is the difference between owner-based and criteria-based sharing rules?
Q3BeginnerData modelRelationships
What is the difference between a lookup and a master-detail relationship?
1What it is
Both link one object to another. A lookup is a loose link - the parent is optional and each record keeps its own owner and sharing. A master-detail is a tight link - the parent is required, the child inherits its sharing, and deleting the parent deletes the children.
2Why it matters
The choice decides security, deletion and reporting. Master-detail allows roll-up summary fields and keeps child records from existing without a parent; a lookup gives flexibility when the child has a life of its own.
3Example
Lookup
Master-detail
Parent required
No (unless made required)
Yes
Owner and sharing
Own
Inherited from the master
Deleting the parent
Clears the field or is blocked
Deletes the children
Roll-up summary fields
No
Yes
Per object
Up to 40
Up to 2
4In short - say this in the interview
Lookup is loose: optional parent, own sharing, children survive deletion. Master-detail is tight: required parent, inherited sharing, cascade delete, and roll-up summaries on the master.
Common mistake
Forgetting that a master-detail child has no owner field of its own - it is owned through its master.
Likely follow-ups
Can you convert a lookup into a master-detail? (Yes, if every record already has a parent.)
What is a junction object?
Q4BeginnerData modelFields
What is a roll-up summary field?
1What it is
A field on the master of a master-detail relationship that calculates COUNT, SUM, MIN or MAX over its detail records, optionally with a filter.
2Why it matters
It keeps a total live without code: when a detail record is added, changed or deleted, the master updates itself. It is the reason many teams choose master-detail.
3Example
Master
Roll-up
Over details
Invoice
Total = SUM(Amount)
Invoice lines
Account
Open deals = COUNT, filter Stage != Closed
Opportunities (a standard relationship that supports roll-ups)
Project
Latest due date = MAX(Due Date)
Tasks of the project
4In short - say this in the interview
A field on a master record that counts or sums its detail records - COUNT, SUM, MIN or MAX, with an optional filter - and stays up to date automatically. It needs a master-detail relationship.
Common mistake
Promising a roll-up summary over a lookup relationship. That needs a Flow or Apex instead.
Likely follow-ups
How would you roll up over a lookup? (A record-triggered flow or an Apex trigger.)
When is a roll-up recalculated in the order of execution?
Q5BeginnerData qualityFormulas
What is a validation rule? Give an example.
1What it is
A formula that checks a record when it is saved. If the formula is true, the save is blocked and the user sees your error message.
2Why it matters
It keeps bad data out at the door, with no code, for every way a record can be saved - the UI, imports and the API alike.
Error message: "Enter the deal amount before closing it as won." Shown on the Amount field.
4In short - say this in the interview
A formula that runs on save; if it evaluates to true, the save is blocked with your message. For example AND(ISPICKVAL(StageName, "Closed Won"), ISBLANK(Amount)) stops a won deal with no amount.
Common mistake
Writing the formula for the valid case. It must describe the invalid case - true means "block it".
Likely follow-ups
Do validation rules run on data loads and API calls? (Yes.)
Where do validation rules run in the order of execution?
Q6IntermediateAutomationFlow
What kinds of Flow are there, and when do you choose Flow over Apex?
1What it is
Flow is Salesforce's declarative automation. The main kinds: record-triggered (on create, update or delete; before-save or after-save), screen (guided steps for a user), scheduled, autolaunched (called from Apex, a button or another flow) and platform event-triggered.
2Why it matters
Flow is now the standard tool for automation - Workflow Rules and Process Builder are retired. Admins can build and change it without a deployment cycle. Apex is still the answer for complex logic, heavy volumes, callouts with custom handling, or anything that needs unit tests to prove it.
3Example
Need
Use
Set a field on the same record when it saves
Before-save record-triggered flow (fastest)
Create a task when a case is escalated
After-save record-triggered flow
Guide an agent through a refund
Screen flow
Nightly clean-up of old records
Scheduled flow, or Batch Apex for large volumes
Complex logic, large volumes, custom integration
Apex
4In short - say this in the interview
Record-triggered, screen, scheduled, autolaunched and platform event-triggered flows. Use Flow first for standard automation - it replaced Workflow Rules and Process Builder - and Apex when the logic is complex, the volume is high, or it needs real tests.
Common mistake
Building after-save flows for field updates on the same record. A before-save flow does it without an extra update.
Likely follow-ups
What is the difference between before-save and after-save flows?
How do you stop a flow and a trigger fighting over the same field?
Q7BeginnerUIData model
What is the difference between record types and page layouts?
1What it is
A page layout decides which fields, sections, buttons and related lists appear on a record page. A record type lets one object serve different processes: its own picklist values, sales or support process, and its own page layout per profile.
2Why it matters
One Case object can hold both "Hardware fault" and "Billing question" cases. Record types give each its own values and process; page layouts show each team only what it needs.
3Example
Page layout
Record type
Controls
What is shown on the page
Picklist values, business process, which layout
Assigned by
Profile and record type
Profile (which types a user can create)
Security
Not security - hiding a field here does not protect it
Not security either
4In short - say this in the interview
Page layouts control what appears on the record page; record types let one object run different processes, with their own picklist values and layout. Neither is security - field-level security is.
Common mistake
Hiding a sensitive field from the page layout and calling it secure. It is still visible in reports and the API - use field-level security.
Likely follow-ups
What are Dynamic Forms?
How is a record type assigned to a new record?
Q8BeginnerDataTools
Data Import Wizard or Data Loader - which do you use?
1What it is
Both load data into Salesforce. The Data Import Wizard runs in the browser, for up to 50,000 records of common objects. Data Loader is a desktop and command-line tool for up to 5 million records, for any object, including updates, deletes and exports.
2Why it matters
The wizard is quick and safe for an admin with a spreadsheet - it can even match and skip duplicates. Data Loader is for volume, for objects the wizard does not support, and for repeatable, scripted loads.
3Example
Data Import Wizard
Data Loader
Records
Up to 50,000
Up to 5 million
Objects
Common standard objects and custom objects
All objects
Operations
Insert, update, upsert
Insert, update, upsert, delete, export
Runs
In the browser
Desktop app or command line
4In short - say this in the interview
The Data Import Wizard for up to 50,000 records of common objects, in the browser. Data Loader for up to 5 million records, any object, deletes and exports, and scripted loads.
Common mistake
Forgetting that a data load fires triggers, flows and validation rules - a big load can hit limits or send thousands of emails.
Likely follow-ups
What is an External ID, and why does upsert need one?
When would you use Bulk API directly?
Answers describe documented behaviour, checked against the sources listed. Platforms change between releases - confirm limits and versions before an interview.