The 30 Salesforce questions asked again and again - data model, security, Flow, Apex, LWC and integration - each answered in four steps with an example.
By Bhanu Pratap SinghLast reviewed 2026-10-2422 min read30 questions16 Beginner13 Intermediate1 Advanced
Level
These are the 30 questions that come up in almost every Salesforce interview, from admin to senior developer. Each one is answered with the same formula: what it is in one clear line, why it exists, a real example, and a summary to close the answer. Interviewers remember structure, not length.
Start here for the full picture, then use the "Go deeper" links to reach the part of the series that covers each topic in detail. One tip from real interviews: after the summary, add one line about your own work - "In my last project, I used this to..." - it turns theory into experience.
Q1BeginnerPlatform
What is multi-tenant architecture?
1What it is
Many companies (orgs) share one infrastructure, database and codebase. Each org's data is kept separate by its Org ID, so no org can see another's records.
2Why it matters
Sharing keeps costs low and lets Salesforce upgrade everyone at once, three times a year. Because the resources are shared, the platform has to stop any one org using too much - which is exactly why governor limits exist.
3Example
Think of one apartment building: every flat (org) has its own lock and its own things, but the water, electricity and lift are shared - and every flat has a meter. The meter is the governor limit.
4In short - say this in the interview
Shared infrastructure plus isolated data is multi-tenancy. It is why Salesforce upgrades everyone three times a year, and why governor limits exist.
Common mistake
Saying each customer gets its own server. They share one; only the data is separated.
Likely follow-ups
How does multi-tenancy affect the code you write?
What are the three releases called? (Spring, Summer and Winter.)
Q2BeginnerData model
What is the difference between standard and custom objects?
1What it is
Standard objects come built in - Account, Contact, Opportunity, Case. Custom objects are ones you create for your own data, and their API name ends in __c.
2Why it matters
Standard objects come with reports, apps, integrations and features already wired up, so you use them first. You build a custom object only when the data is truly unique to the business.
3Example
Standard
Custom
Account
Invoice__c
Contact
Project__c
Opportunity
Warranty__c
Case
Asset_Log__c
Ready-made, with reports and apps
Built for your business
4In short - say this in the interview
Standard objects come ready-made; custom objects, ending in __c, fill the gaps. Use standard first and go custom only for data that is unique to the business.
Common mistake
Building a custom "Customer__c" object when Account already does the job - and losing every feature built on Account.
Likely follow-ups
What suffix does a custom field have? (Also __c.)
What does __r mean? (A relationship name in SOQL.)
Q3BeginnerData model
What is the difference between a lookup and a master-detail relationship?
1What it is
Both link two objects. Master-detail is a tight parent-child bond: the child cannot exist without its parent. Lookup is a loose, usually optional link.
2Why it matters
The choice decides what happens on delete, who owns the child record, how it is shared, and whether you can use roll-up summary fields.
3Example
Feature
Master-detail
Lookup
Parent required
Yes
No (optional by default)
Delete the parent
Children are deleted too
Children stay; the field is cleared
Owner and sharing
Inherited from the parent
The child's own
Roll-up summary fields
Yes
No (not natively)
How many per object
Up to 2
Up to 40 relationship fields in total
Order to Order_Line__c is master-detail: a line has no meaning without its order. Contact to Account is a lookup: a contact can exist on its own.
4In short - say this in the interview
Master-detail means the parent controls the child - required, deleted with it, shared like it, and roll-ups work. A lookup is an independent link.
Common mistake
Saying 40 lookups plus 2 master-details. The 40 counts all relationship fields on the object together.
Likely follow-ups
Can you convert a lookup to master-detail? (Yes, if every record has a value.)
How do you roll up over a lookup? (A Flow, Apex, or a tool such as DLRS.)
Q4BeginnerData model
What is a junction object?
1What it is
A custom object with two master-detail fields, one to each side, that creates a many-to-many relationship.
2Why it matters
Salesforce has no direct many-to-many field. A student takes many courses and a course has many students, so a record in the middle - the junction - holds each pairing.
3Example
Student - Enrollment__c - Course
Student <-M-D- Enrollment__c -M-D-> Course
Riya -> enrolled in -> Apex, LWC
Apex course -> has -> Riya, Aman
The first master-detail field you create is the primary one. The junction record takes its look (icon and colour) and its owner from that primary master.
4In short - say this in the interview
Two master-detail fields on one object give you many-to-many: each junction record links one record on each side.
Common mistake
Using two lookups and expecting the same behaviour. You lose cascade delete, inherited sharing and roll-ups.
Likely follow-ups
What happens to the junction record when one master is deleted?
Can a junction object have roll-ups on both masters? (Yes.)
Q5IntermediateData modelConfiguration
What is the difference between Custom Metadata and Custom Settings?
1What it is
Both store configuration. Custom Metadata types (ending in __mdt) are metadata, so their records deploy with your code. Custom Settings records are data, so they do not.
2Why it matters
Both stop hardcoding values in Apex - you change the configuration without changing the code. Which one you choose depends on whether the value must travel between orgs, or differ per user.
Deployable configuration goes in Custom Metadata; values that change per user or profile go in a Hierarchy Custom Setting.
Common mistake
Storing per-environment secrets in either. Use Named Credentials for endpoints and keys.
Likely follow-ups
Does reading Custom Metadata count against SOQL limits? (getInstance does not.)
What is a List Custom Setting?
Q6BeginnerSecurity
What is the difference between a profile and a permission set?
1What it is
A profile gives a user their base access, and every user has exactly one. A permission set adds extra access, and a user can have as many as needed.
2Why it matters
The rule is least privilege: keep profiles minimal, then grant extra access with permission sets and permission set groups. Salesforce is moving permissions off profiles, so this is the modern answer.
3Example
Layer
Example
Gives
Profile
Sales User
Read Account
+ Permission set
Discount Approver
Edit Discount__c
+ Permission set group
Sales Ops bundle
Several permission sets at once
= Effective access
Rahul
Everything above, added together
4In short - say this in the interview
The profile sets the floor and permission sets add on top. One profile per user, as many permission sets as needed.
Common mistake
Creating a new profile for every small difference. That is what permission sets are for.
Likely follow-ups
Can a permission set take access away? (No - but a muting permission set inside a group can.)
What is a permission set group?
Q7BeginnerSecurity
What is the role hierarchy?
1What it is
A tree of roles that opens record visibility upwards: a manager can see the records their team owns.
2Why it matters
It mirrors the reporting structure, so data access follows the org chart automatically, without a sharing rule for every manager.
3Example
Visibility flows up
CEO sees everything below
└ Sales Head sees Rep A's and Rep B's records
├ Rep A sees own records
└ Rep B sees own records
Rep A cannot see Rep B's records.
4In short - say this in the interview
The profile decides what you can do; the role decides which records you can see. Access rolls up the hierarchy to managers.
Common mistake
Thinking the role hierarchy controls object or field access. It only affects record visibility.
Likely follow-ups
Can you turn off "grant access using hierarchies"? (Only for custom objects.)
Is a role required for every user? (No.)
Q8IntermediateSecurity
What are org-wide defaults and sharing rules?
1What it is
Org-wide defaults (OWD) set the baseline access for each object - usually the most restrictive. The role hierarchy, sharing rules and manual sharing then open access up.
2Why it matters
Salesforce security works by starting locked and granting access, not the other way round. Set the OWD to the access the least-trusted user should have.
3Example
1. OWD: Private - the baseline.
2. Role hierarchy - managers see their team's records.
3. Sharing rules - by owner or by criteria.
4. Manual sharing and teams - one record at a time.
Example: Opportunity OWD is Private, and a criteria-based sharing rule gives the North team Read access to every opportunity in the North region.
4In short - say this in the interview
The OWD locks records down; the role hierarchy, sharing rules and manual sharing only open them up.
Common mistake
Saying nothing can ever go below the OWD. Restriction rules can narrow access further on supported objects.
Likely follow-ups
What OWD options are there? (Private, Public Read Only, Public Read/Write, Controlled by Parent.)
What is the difference between owner-based and criteria-based sharing rules?
Q9IntermediateSecurityApex
What do with sharing, without sharing and inherited sharing mean?
1What it is
Class keywords that decide whether Apex respects the running user's record access.
2Why it matters
Apex runs in system mode by default. Without the right keyword, a controller behind an LWC can show a user records they are not allowed to see - a data leak.
3Example
The three keywords · Apex
publicwithsharingclassAccountService {} // respects the user's sharingpublicwithoutsharingclassSystemJob {} // sees every record (system mode)publicinheritedsharingclassUtil {} // follows whoever calls it
Sharing is record access only. For object and field security, add WITH USER_MODE to queries or use Security.stripInaccessible().
4In short - say this in the interview
Default to with sharing, use inherited sharing for shared utility classes, and use without sharing only on purpose. None of them checks field security.
Common mistake
Believing with sharing also hides fields the user cannot see. It does not.
Likely follow-ups
What happens if a class has no keyword?
What is the difference between USER_MODE and SYSTEM_MODE?
Q10BeginnerAutomationFlow
What are the types of Flow?
1What it is
Screen flows (with a user interface), record-triggered flows, schedule-triggered flows, autolaunched flows (called from Apex, a button or another flow) and platform event-triggered flows.
2Why it matters
Flow is now the main no-code automation tool: Salesforce retired Workflow Rules and Process Builder, ending support at the end of 2025.
3Example
A before-save record-triggered flow
Trigger Opportunity is updated
↓
Condition Stage = Closed Won
↓
Action Closed_Won_Date__c = TODAY()
A before-save flow updates fields on the same record with no extra DML, so it is very fast. An after-save flow is for related records, emails and actions that need the saved record.
4In short - say this in the interview
Five types: screen, record-triggered, schedule-triggered, autolaunched and platform event-triggered. Use Flow first, and move to Apex when the logic gets complex or heavy.
Common mistake
Building new automation in Process Builder. It is retired - migrate it to Flow.
Likely follow-ups
When would you choose Apex over Flow?
What runs first, a before-save flow or a before trigger?
Q11BeginnerAutomationData quality
What is a validation rule?
1What it is
A formula that runs when a record is saved. If the formula returns TRUE, the save is blocked and the user sees an error.
2Why it matters
It enforces data quality at the source, for every way a record can be saved - the UI, imports and the API - without writing any code.
The formula returns TRUE, so the record is not saved and the user sees: "Amount is required to close a deal."
4In short - say this in the interview
A validation rule is a formula on save: TRUE means an error is shown and the record is not saved.
Common mistake
Writing the formula for the valid case. It must describe the invalid case - TRUE blocks the save.
Likely follow-ups
Do validation rules run on delete? (No.)
Where do validation rules run in the order of execution?
Q12AdvancedAutomationTriggers
What is the order of execution?
1What it is
The fixed sequence of steps Salesforce follows every time a record is saved - from validation through triggers, flows and roll-ups to the final commit.
2Why it matters
It explains bugs like "why did my field get overwritten?" or "why did my trigger run twice?" - a favourite senior-level question.
3Example
Step
What runs
1
System validation
2
Before-save record-triggered flows
3
Before triggers
4
Custom validation rules
5
Duplicate rules
6
Record saved (not yet committed)
7
After triggers
8
Assignment and auto-response rules
9
After-save record-triggered flows
10
Roll-up summaries and criteria-based sharing
11
Commit to the database
12
After commit: emails, async jobs
4In short - say this in the interview
Before-save flows, before triggers, validation, save, after triggers, after-save flows, roll-ups, then commit - with emails and async work after the commit.
Common mistake
Forgetting that a roll-up on the parent saves the parent too, which fires the parent's own triggers.
Likely follow-ups
Why can a trigger run twice in one save?
When are emails actually sent?
Q13BeginnerApexGovernor limits
What are governor limits?
1What it is
Per-transaction caps the platform enforces on queries, DML, CPU time and memory. Cross one and Salesforce stops the code and rolls back the transaction.
2Why it matters
Multi-tenancy: no single org is allowed to hog the shared servers. The limits also force code to handle real data volumes.
Governor limits cap what one transaction can use - 100 SOQL, 150 DML, 10 seconds of CPU. Write bulk-safe code or hit a LimitException that cannot be caught.
Common mistake
Saying you can catch a limit exception. You cannot - you design to stay under the limits.
Likely follow-ups
How do you check usage at runtime? (The Limits class.)
Why are async limits higher?
Q14BeginnerApexBulkification
What is bulkification?
1What it is
Writing code that handles 200 records as efficiently as it handles one.
2Why it matters
Triggers receive records in batches of up to 200. SOQL or DML inside a loop runs once per record and breaks the limits fast.
3Example
✗ Wrong: DML inside the loop
for (Account a : accs) {
insertnewContact(LastName = a.Name, AccountId = a.Id);
}
✓ Right: collect, then one DML
List<Contact> cons = newList<Contact>();
for (Account a : accs) {
cons.add(newContact(LastName = a.Name, AccountId = a.Id));
}
insert cons;
4In short - say this in the interview
No SOQL or DML inside loops: collect first, then act once. Always test with 200 records, not one.
Common mistake
Testing with a single record and calling the code done.
Likely follow-ups
Why is a Map<Id, sObject> useful here?
How many records does a trigger receive at once?
Q15BeginnerApexTriggers
What are trigger context variables?
1What it is
Built-in variables that tell a trigger what is happening: Trigger.new, Trigger.old, newMap, oldMap, and flags such as isInsert, isUpdate, isBefore, isAfter.
2Why it matters
They tell you which records changed, what the values were before, and which event you are handling - so one trigger can serve every event correctly.
3Example
Did the phone number change? · Apex
if (Trigger.isUpdate) {
for (Account a : Trigger.new) {
Account old = Trigger.oldMap.get(a.Id);
if (a.Phone != old.Phone) {
// phone number changed
}
}
}
Variable
Holds
Not available in
Trigger.new
Values after the change
Delete triggers
Trigger.old
Values before the change
Insert triggers
Trigger.newMap
New values by Id
Before insert (no Id yet)
4In short - say this in the interview
Trigger.new holds the values after the change, Trigger.old the values before it; the maps give the same records by Id, and the flags say which event fired.
Common mistake
Using Trigger.newMap in a before insert trigger. The records have no Id yet, so it is null.
Likely follow-ups
What does Trigger.operationType give you?
How do you compare old and new values in bulk?
Q16BeginnerApexTriggers
When do you use a before trigger and when an after trigger?
1What it is
A before trigger changes the same record before it is saved. An after trigger runs once the record is saved and has an Id.
2Why it matters
Field updates in a before trigger need no extra DML, so they are faster and cannot cause recursion. Work on other records, or anything that needs the Id, belongs in an after trigger.
3Example
Before insert
After insert
Typical work
acc.Rating = 'Hot'; - no DML needed
insert new Task(WhatId = acc.Id);
Record Id
Still null
Available
Trigger.new
Editable
Read-only
4In short - say this in the interview
Same record, use before. Other records, or you need the Id, use after.
Common mistake
Running an update DML on the same record from an after trigger. Set the field in a before trigger instead.
Likely follow-ups
Why is Trigger.new read-only in an after trigger?
How do you stop recursion?
Q17IntermediateApexTriggers
What is the trigger handler pattern, and how do you stop recursion?
1What it is
One trigger per object that hands the work to a handler class, plus a static guard that remembers what has already been processed in this transaction.
2Why it matters
The logic stays testable and runs in a known order, and a trigger that updates records cannot fire itself in an endless loop.
Own test data - tests cannot see org data by default.
startTest / stopTest - fresh limits, and async work runs.
Always assert - coverage without assertions proves nothing.
4In short - say this in the interview
Create your own test data, wrap the call in startTest and stopTest, and always assert. 75% coverage is the minimum, not the goal.
Common mistake
Writing tests with no assertions just to reach 75%.
Likely follow-ups
Why avoid SeeAllData=true?
How do you test a callout? (HttpCalloutMock.)
Q23IntermediateLWC
What are the LWC lifecycle hooks?
1What it is
Methods LWC calls at each stage of a component's life, from creation to removal.
2Why it matters
They tell you where to load data and where it is safe to touch the DOM.
3Example
Hook
When
Use it to
constructor()
Created
Set initial state - no DOM yet
connectedCallback()
Inserted into the page
Load data, subscribe
render()
Before drawing
Pick a template (rarely needed)
renderedCallback()
After every render
Touch the DOM - guard against loops
disconnectedCallback()
Removed
Clean up listeners and subscriptions
errorCallback()
A child throws
Show a fallback
4In short - say this in the interview
Connected means inserted, rendered means painted, disconnected means removed - load data in connectedCallback, touch the DOM in renderedCallback.
Common mistake
Setting a tracked property in renderedCallback without a guard. It re-renders, calls itself again, and loops.
Likely follow-ups
In what order do parent and child hooks run?
Why can you not access child elements in the constructor?
Q24IntermediateLWC
What do @api, @track and @wire do?
1What it is
@api makes a property public, so a parent can set it. @track watches changes inside an object or array. @wire fetches data reactively.
2Why it matters
Together they control a component's inputs and when it re-renders.
3Example
parent.html · HTML
<c-child record-id={recId}></c-child>
child.js · JavaScript
@api recordId; // set by the parent@track filters = { city: '' }; // watch changes inside the object@wire(getRecord, { recordId: '$recordId', fields: FIELDS })
record; // fetched again when recordId changes
Since Spring '20 every field is reactive when it is reassigned. @track is only needed to notice changes inside an object or array.
4In short - say this in the interview
@api exposes a property, @track watches inside objects and arrays, @wire fetches data and re-runs when its parameters change.
Common mistake
Adding @track to every field. Plain fields are already reactive.
Likely follow-ups
Can a child change an @api property? (No - it belongs to the parent.)
What does the $ in '$recordId' mean?
Q25IntermediateLWC
How do LWC components communicate?
1What it is
Parent to child with an @api property. Child to parent with a CustomEvent. Unrelated components with Lightning Message Service (LMS).
2Why it matters
It is one of the most common questions in LWC coding rounds, because every real page has components talking to each other.
3Example
The child tells its parent · JavaScript
this.dispatchEvent(newCustomEvent('select', { detail: id }));
4In short - say this in the interview
Down with properties, up with events, sideways with LMS.
Common mistake
Using LMS between a parent and its own child. Properties and events are simpler and clearer.
Likely follow-ups
What do bubbles and composed do on an event?
How does the parent listen? (onselect={handleSelect}.)
Q26IntermediateLWCApex
When do you use @wire and when an imperative Apex call?
1What it is
@wire calls Apex automatically and reactively. An imperative call runs when you call it, and returns a Promise.
2Why it matters
Button clicks and anything that changes data (DML) need an imperative call. Read-only data for display suits @wire, with the Apex method marked cacheable=true.
3Example
Both ways · JavaScript
// Wire: automatic and cached@wire(getAccounts) accounts;
// Imperative: on a click
handleClick() {
getAccounts()
.then((r) => { this.data = r; })
.catch((e) => { this.error = e; });
}
4In short - say this in the interview
Read-only and reactive, use @wire. On demand, or anything with DML, use an imperative call.
Common mistake
Wiring a method that does DML. A cacheable method cannot change data.
Likely follow-ups
How do you refresh wired data? (refreshApex.)
Why must a wired Apex method be cacheable?
Q27BeginnerLWC
What is Lightning Data Service?
1What it is
Built-in create, read, update and delete for single records with no Apex: record forms, getRecord, updateRecord and related adapters.
2Why it matters
It shares one cache across components, enforces field security and sharing automatically, and needs no Apex - so no test class either.
For single-record work, reach for Lightning Data Service before Apex.
Common mistake
Writing an Apex controller just to read one record's fields.
Likely follow-ups
When do you still need Apex? (Many records, complex queries, or DML across objects.)
What is the difference between record-form, record-edit-form and record-view-form?
Q28IntermediateIntegration
What are Platform Events?
1What it is
Publish-subscribe messages, defined like an object with the suffix __e. Publishers send events to an event bus, and any number of subscribers receive them.
2Why it matters
They decouple systems: the publisher never waits for, or even knows about, the subscribers. They power real-time notifications inside and outside Salesforce.
A fire-and-forget event bus: publishers send, subscribers react, and neither waits for the other.
Common mistake
Expecting an event to roll back with the transaction. "Publish immediately" events are sent even if the transaction fails - choose "after commit" when that matters.
Likely follow-ups
How long are events kept for replay? (72 hours.)
What is the difference between Platform Events and Change Data Capture?
Q29IntermediateIntegration
How do you make a REST callout, and what is a Named Credential?
1What it is
Apex calls an external API with HttpRequest. A Named Credential stores the endpoint and the authentication, so the code only names it.
2Why it matters
No URLs or secrets are hardcoded in the code, OAuth tokens are handled for you, and each environment can point to its own endpoint.
A callout after uncommitted DML in the same transaction fails with "You have uncommitted work pending". Make the callout first, or move it to a Queueable. Test callouts with HttpCalloutMock.
4In short - say this in the interview
Callouts go through Named Credentials so no secret lives in code, and they run asynchronously when DML comes first.
Common mistake
Putting an API key in a Custom Setting or in the code.
Likely follow-ups
What is an External Credential?
Why can a trigger not make a callout directly?
Q30BeginnerDevOps
What are sandboxes, and how do you deploy?
1What it is
Sandboxes are copies of production for building and testing. Changes move between orgs with change sets, the Salesforce CLI or DevOps Center.
2Why it matters
You never build directly in production. Each change is built, tested and approved before it reaches real users.
Build in a sandbox, keep the source in Git, and deploy with the Salesforce CLI or DevOps Center.
Common mistake
Testing a data migration in a Developer sandbox, which has no production data.
Likely follow-ups
What is the difference between a change set and source-driven deployment?
What is a scratch org?
Answers describe documented behaviour, checked against the sources listed. Platforms change between releases - confirm limits and versions before an interview.