CRT-450 Salesforce Certified Platform Developer 1 (SP25) Free Practice Exam Questions (2025 Updated)

A Flow with an Assignment element is the best declarative solution to assign cases based on criteria such as Case Origin. It can automatically evaluate the value of the Case Origin and assign the support representative.

Why not other options?

A: Using a trigger is a programmatic approach and less ideal when declarative tools can solve the problem.

B: A formula field cannot assign values; it only calculates and displays results.

C: Validation rules are used to enforce constraints, not for assigning values.

Salesforce Flows Overview

A validation rule can ensure that theLead Sourcefield is populated before the Lead is converted. This prevents users from proceeding unless the required data is entered.

Why not other options?

A: Triggers are programmatic, whereas a declarative solution like validation rules is simpler and more efficient.

B: Lead Conversion field mapping maps fields between Lead and Account/Contact but cannot enforce field requirements.

C: A formula field is read-only and cannot enforce user input.

Validation Rules Documentation

The Apex Interactive Debugger allows developers to step through code execution in real time, which is the most effective way to identify the root cause of the duplication issue.

Account Trigger:

Apex triggers allow for complex logic to retrieve and update theTimezonefield based onPostalCodeToTimezone__c.

Fast Field Updates Record-Triggered Flow:

A record-triggered flow in Fast Field Updates mode can fetch the necessary data fromPostalCodeToTimezone__cand update the Account.

Why Not Other Options?

A. Quick actions: Used for user interface updates, not for automation based on edits.

B. Approval process: Not relevant to dynamic field updates.

A: Formula fields are calculated at runtime based on the formula definition and are not stored in the database.

C: Formula fields can reference fields from related objects, allowing cross-object calculations.

Why not other options?

B: Formulas cannot reference themselves; doing so would result in a circular reference error.

D: If a field used in a formula field is deleted, the formula field will break, and Salesforce will prevent deletion until the formula field is updated.

Formula Fields Documentation

A roll-up summary field is the best practice for aggregating values (e.g., sum, count, or average) from child records in a master-detail relationship. This feature automatically calculates the sum of all Order Line item totals and displays it on the parent Order record.

The provided code attempts to update allLeadrecords in an environment with more than 2,000 records. This will likely exceed the governor limit for the total number of records processed in DML statements, which is 10,000 per transaction. To avoid this, the developer can useDatabase.updatewith batching logic.

Why Developer Console?

TheDeveloper Consoleprovides tools to troubleshoot query performance, including the Query Plan tool.

The Query Plan tool evaluates SOQL query performance and provides insight into query costs and optimization.

Why Not Other Options?

A. Setup Menu: Used for administrative tasks, not performance troubleshooting.

B. Visual Studio Code IDE: Useful for development, but does not offer query performance tools.

C. AppExchange: Provides apps but does not directly help with query troubleshooting.

75% Code Coverage (A):To deploy Apex code to production, Salesforce requires at least 75% of the code to be covered by tests across the organization.

Visual Studio Code (VS Code)is the recommended tool for Salesforce development. It supports the Salesforce Extensions Pack for debugging and fixing issues in Lightning Web Components (LWCs).

Not Suitable:

Option A: The Developer Console is less effective for LWC debugging.

Option B: The Force.com IDE is deprecated.

Option C:Execute Anonymousdoes not provide tools to debug or fix LWC bugs.

VS Code with Salesforce Extensions Pack

Whyupsert?

Theupsertstatement inserts records that don’t exist and updates existing records based on the external ID (Order Number__cin this case).

Salesforce automatically recognizes and uses the external ID field for matching.

Why Not Other Options?

A and B:mergeis for merging records, not for upserting.

C: Adding the field name afterupsertis unnecessary, as Salesforce detects the external ID automatically.

Why a Trigger on the Child Object?

Since the relationship is not master-detail, a trigger on the child object can perform aggregate calculations and update the parent Opportunity.

Why Not Other Options?

A: Tree sorting is unnecessary and unrelated to roll-up summaries.

B and D: Neither Streaming API nor Metadata API is suitable for real-time roll-up calculations.

A:Using the order number as an external ID ensures Salesforce can identify and update existing records instead of creating duplicates during updates.

B:Ensuring the order number is unique in the OMS guarantees that there will not be multiple records in Salesforce corresponding to a single order.

 Why Queueable?

Queueable Apex allows asynchronous processing, which can handle bulk updates efficiently without hitting governor limits.

The trigger enqueues the Queueable class to process the asset updates.

 Avoiding Limit Failures:

Moving logic to a Queueable class offloads resource-intensive operations to asynchronous processing.

Unit Test Scenarios:

Option Bis valid becausegetContentAsPDF()can generate PDF content for testing purposes.

Why Not Other Options?

A: Unit tests cannot execute anonymous Apex as a different user.

C: Unit tests cannot perform callouts unless mock responses are provided.

D: TheSystem.createdDatefield cannot be set manually in unit tests.

B: Using partial DML statements (e.g.,Database.insert(list, false)) allows only valid records to be committed while identifying invalid ones, avoiding runtime errors.

D: TheDatabase.Savepointmethod ensures transactional control by allowing rollback to a specific savepoint if an error occurs.

Why not other options?

A: The@ReadOnlyannotation is for read-only operations and would not allow DML operations.

C: TheSystem.Limitclass helps monitor limits but does not directly control transaction behavior.

Best Practices for Apex Transactions

Comprehensive and Detailed Explanation From Exact Extract:

To determine which Visualforce code snippet presents a security vulnerability, we need to evaluate each option for potential risks, such as cross-site scripting (XSS), based on Salesforce’s Visualforce security best practices. XSS vulnerabilities occur when user input is rendered on a page without proper sanitization, allowing malicious scripts to execute. Let’s analyze each option systematically, referencing Salesforce’s official documentation, particularly the Visualforce Developer Guide and Secure Coding Guidelines.

Understanding Visualforce Security:

Visualforce Components: Components like and are used to display data on a Visualforce page. Their behavior regarding HTML escaping (sanitizing output to prevent script injection) is critical to security.

XSS Vulnerability: XSS occurs when untrusted user input (e.g., from URL parameters or controller variables) is rendered as HTML without escaping special characters (e.g., <, >, &). The Visualforce Developer Guide states: “To prevent XSS, Visualforce automatically escapes output unless explicitly disabled, but developers must be cautious with user input” (Salesforce Visualforce Developer Guide, Secure Coding for Visualforce).

Key Security Features:

: By default, escapes HTML characters unless escape="false" is set.

: Automatically escapes output and is designed for bound fields, reducing XSS risk.

User input (e.g., ApexPages.currentPage().getParameters()) must be sanitized to prevent injection of scripts like .

Evaluating the Options:

A. <apex:outputText value="{!ApexPages.currentPage().getParameters().get('userInput')}" />

Component: Uses to display a URL parameter (userInput) accessed via ApexPages.currentPage().getParameters().get('userInput').

Escaping: The escape attribute is not specified, so defaults to escape="true". The Visualforce Developer Guide confirms: “The apex:outputText component escapes HTML characters by default, converting characters like < to < to prevent script execution” (Salesforce Visualforce Developer Guide, apex:outputText).

Security: Even though userInput is untrusted (coming from a URL parameter), the default escaping ensures that any malicious content (e.g., ) is rendered as plain text (e.g., <script>alert('hack');</script>), preventing XSS.

Conclusion: Safe, as default escaping mitigates XSS risks.

Note on Typo: The question likely contains a typo in “SCurrentPage” (should be ApexPages.currentPage()). For analysis, we assume the correct syntax, as the intent is clear.

B. <apex:outputText escape="false" value="{!ApexPages.currentPage().getParameters().get('userInput')}" />

Component: Uses to display the userInput URL parameter.

Escaping: Explicitly sets escape="false", disabling HTML escaping. The Visualforce Developer Guide warns: “Setting escape=’false’ on apex:outputText allows unescaped output, which can lead to XSS vulnerabilities if the data is not sanitized” (Salesforce Visualforce Developer Guide, Secure Coding for Visualforce).

Security: With escape="false", any malicious input in userInput (e.g., ) is rendered as executable HTML, enabling XSS. For example, a URL like ?userInput= would execute the script in the user’s browser. The Salesforce Secure Coding Guidelines explicitly state: “Avoid setting escape=’false’ on apex:outputText when rendering untrusted input, such as URL parameters” (Salesforce Secure Coding Guidelines, Cross-Site Scripting).

Conclusion: Presents a security vulnerability (XSS) due to disabled escaping with untrusted input.

Note on Typo: The question has a typo in “sCurrentPage” (should be ApexPages.currentPage()). We assume the correct syntax for analysis.

C. <apex:outputField value="{!ctrl.userInput}" rendered="{!isEditable}" />

Component: Uses to display a controller variable (ctrl.userInput), with a rendered attribute based on isEditable.

Escaping: is designed to display field values from sObjects and automatically escapes output to prevent XSS. The Visualforce Developer Guide states: “The apex:outputField component renders field data with automatic HTML escaping, ensuring safe output” (Salesforce Visualforce Developer Guide, apex:outputField). Even if ctrl.userInput contains malicious content, it’s rendered as plain text.

Security: The value attribute expects a field reference (e.g., {!object.FieldName}), but here it’s bound to a controller variable (ctrl.userInput). This is unconventional, as is typically used for sObject fields. However, even if ctrl.userInput is untrusted, the automatic escaping prevents XSS. The rendered attribute (isEditable) controls visibility and does not affect escaping.

Conclusion: Safe, as escapes output, though the usage is atypical.

Note on Typo: The question has a typo in the value attribute: “(!ctrl.userinput)” should be {!ctrl.userInput} (curly braces instead of parentheses), and “isfditable” should be isEditable. We assume the corrected syntax: .

D. <apex:outputField value="{!ctrl.userInput}" />

Component: Uses to display a controller variable (ctrl.userInput).

Escaping: As with option C, automatically escapes output, preventing XSS. The Visualforce Developer Guide confirms: “apex:outputField ensures safe rendering by escaping special characters” (Salesforce Visualforce Developer Guide, apex:outputField).

Security: Even if ctrl.userInput contains malicious content, it’s rendered as plain text, mitigating XSS risks. Like option C, using for a controller variable is unusual, but it does not introduce a vulnerability.

Conclusion: Safe, as escapes output.

Note on Typo: The question has a typo in the value attribute: “{'ctrl.userInput}” should be {!ctrl.userInput} (correct merge field syntax). We assume the corrected syntax: .

Why Option B is Correct:

Option B presents a security vulnerability because:

It uses with escape="false", disabling HTML escaping.

It renders untrusted user input (ApexPages.currentPage().getParameters().get('userInput')) directly, allowing malicious scripts to execute, which is a classic XSS vulnerability.

The Salesforce Secure Coding Guidelines explicitly warn against this practice: “Rendering unescaped user input, such as URL parameters, can allow attackers to inject scripts” (Salesforce Secure Coding Guidelines, Cross-Site Scripting).

The other options (A, C, D) either use default escaping ( in A) or inherently safe components ( in C and D), preventing XSS.

Handling Typos:

The question contains several typos, which were corrected for analysis:

Option A: “SCurrentPage” → ApexPages.currentPage().

Option B: “sCurrentPage” → ApexPages.currentPage().

Option C: “(!ctrl.userinput)” → {!ctrl.userInput}, “isfditable” → isEditable.

Option D: “{'ctrl.userInput}” → {!ctrl.userInput}.These corrections align with standard Visualforce and Apex syntax, ensuring the analysis reflects the intended functionality.

Example of the Vulnerability (Option B):

Consider a Visualforce page with option B’s code:

If a user accesses the page with a URL like:

https://example.salesforce.com/apex/MyPage?userInput=

The script is rendered as executable HTML, displaying an alert in the user’s browser, demonstrating an XSS attack. In contrast, option A (with default escaping) would render the script as plain text, preventing execution.

Mitigating the Vulnerability:

To fix option B, either:

Remove escape="false" to enable default escaping:

Sanitize the input in the controller using methods like String.escapeHtml4():

public String getUserInput() {

String input = ApexPages.currentPage().getParameters().get('userInput');

return input != null ? String.escapeHtml4(input) : '';

}

The Visualforce Developer Guide recommends: “Sanitize untrusted input or rely on Visualforce’s built-in escaping to prevent XSS” (Salesforce Visualforce Developer Guide, Secure Coding for Visualforce).

Option B: To update a junction object, the user needsRead/Writeaccess to the primary relationship object.

Option C: The user must also haveRead/Writeaccess on the junction object itself.

Junction Objects Documentation

Why Re-Parentable Master-Detail Field?

A master-detail relationship allows Line Items to roll up totals (e.g., calculate total amount) to the Order.

Setting the relationship asre-parentablesupports moving Line Items between different Orders.

Why Not Other Options?

B. Lookup field: Does not support roll-up summary fields for calculations.

C and D: Relationships in the opposite direction (Order to Line Item) do not support the required logic.