Free Practice Questions for Salesforce PDI Exam

Many-to-Many Relationship:

To track which companies (Accounts) report which bugs and allow multiple associations for both, ajunction objectis needed.

This junction object will have two master-detail relationships: one toBug__cand one toAccount.

Why Not Other Options?

A. Roll-up summary field: Not suitable for many-to-many relationships.

B. Master-detail field on Bug__c to Account: Creates a one-to-many relationship, not many-to-many.

C. Lookup field on Bug__c to Account: Still creates a one-to-many relationship, not many-to-many.

A. Unify all three triggers in a single trigger on the Expense__c object that includes all events:

Salesforce best practices recommend having only one trigger per object to avoid redundancy and conflicts.

By combining all the events (before delete, before insert, and before update) into a single trigger, the developer can manage the logic in an organized and maintainable manner.

This also simplifies debugging and ensures that the trigger logic executes in a predictable order.

C. Create helper classes to execute the appropriate logic when a record is saved:

Using helper classes allows for a clean separation of concerns. The trigger becomes a dispatcher that delegates logic to dedicated classes.

For example, you can create methods like applyDefaultsToExpense(), validateExpenseUpdate(), and deleteExpense() in a helper class and invoke them from the trigger.

This improves reusability, readability, and testability of the code.

Why not the other options?

B. Unify the before insert and before update triggers and use Flow for the delete action:

While Flow is a powerful tool, it is not ideal for deleting records or replacing Apex trigger functionality, especially when triggers already exist for other events.

D. Maintain all three triggers on the Expense__c object but move the Apex logic out of the trigger definition:

Maintaining multiple triggers on the same object can lead to conflicts and execution order issues, even if the logic is moved to helper classes.

Option A: This is the correct syntax for SOSL to retrieve data across multiple objects. It searches for "Universal Containers" in theCompanyNamefields and returns the specified fields forLead,Account, andContact.

Other Options:

Option BandD: These are invalid SOQL statements since SOQL does not support multi-object queries.

Option C:Namefields are not relevant to the search term "CompanyName."

SOSL Syntax

Comprehensive and Detailed Explanation From Exact Extract:

To embed a Lightning component in a Visualforce page, you need to:

Include the Lightning framework using .

Use $Lightning.use to load Lightning components and resources.

Use $Lightning.createComponent to render the component dynamically in the Visualforce page.

A roll-up summary field is the best practice for aggregating values (e.g., sum, count, or average) from child records in a master-detail relationship. This feature automatically calculates the sum of all Order Line item totals and displays it on the parent Order record.

Comprehensive and Detailed Explanation From Exact Extract:

To determine which Visualforce code snippet presents a security vulnerability, we need to evaluate each option for potential risks, such as cross-site scripting (XSS), based on Salesforce’s Visualforce security best practices. XSS vulnerabilities occur when user input is rendered on a page without proper sanitization, allowing malicious scripts to execute. Let’s analyze each option systematically, referencing Salesforce’s official documentation, particularly the Visualforce Developer Guide and Secure Coding Guidelines.

Understanding Visualforce Security:

Visualforce Components: Components like and are used to display data on a Visualforce page. Their behavior regarding HTML escaping (sanitizing output to prevent script injection) is critical to security.

XSS Vulnerability: XSS occurs when untrusted user input (e.g., from URL parameters or controller variables) is rendered as HTML without escaping special characters (e.g., <, >, &). The Visualforce Developer Guide states: “To prevent XSS, Visualforce automatically escapes output unless explicitly disabled, but developers must be cautious with user input” (Salesforce Visualforce Developer Guide, Secure Coding for Visualforce).

Key Security Features:

: By default, escapes HTML characters unless escape="false" is set.

: Automatically escapes output and is designed for bound fields, reducing XSS risk.

User input (e.g., ApexPages.currentPage().getParameters()) must be sanitized to prevent injection of scripts like .

Evaluating the Options:

A. <apex:outputText value="{!ApexPages.currentPage().getParameters().get('userInput')}" />

Component: Uses to display a URL parameter (userInput) accessed via ApexPages.currentPage().getParameters().get('userInput').

Escaping: The escape attribute is not specified, so defaults to escape="true". The Visualforce Developer Guide confirms: “The apex:outputText component escapes HTML characters by default, converting characters like < to < to prevent script execution” (Salesforce Visualforce Developer Guide, apex:outputText).

Security: Even though userInput is untrusted (coming from a URL parameter), the default escaping ensures that any malicious content (e.g., ) is rendered as plain text (e.g., <script>alert('hack');</script>), preventing XSS.

Conclusion: Safe, as default escaping mitigates XSS risks.

Note on Typo: The question likely contains a typo in “SCurrentPage” (should be ApexPages.currentPage()). For analysis, we assume the correct syntax, as the intent is clear.

B. <apex:outputText escape="false" value="{!ApexPages.currentPage().getParameters().get('userInput')}" />

Component: Uses to display the userInput URL parameter.

Escaping: Explicitly sets escape="false", disabling HTML escaping. The Visualforce Developer Guide warns: “Setting escape=’false’ on apex:outputText allows unescaped output, which can lead to XSS vulnerabilities if the data is not sanitized” (Salesforce Visualforce Developer Guide, Secure Coding for Visualforce).

Security: With escape="false", any malicious input in userInput (e.g., ) is rendered as executable HTML, enabling XSS. For example, a URL like ?userInput= would execute the script in the user’s browser. The Salesforce Secure Coding Guidelines explicitly state: “Avoid setting escape=’false’ on apex:outputText when rendering untrusted input, such as URL parameters” (Salesforce Secure Coding Guidelines, Cross-Site Scripting).

Conclusion: Presents a security vulnerability (XSS) due to disabled escaping with untrusted input.

Note on Typo: The question has a typo in “sCurrentPage” (should be ApexPages.currentPage()). We assume the correct syntax for analysis.

C. <apex:outputField value="{!ctrl.userInput}" rendered="{!isEditable}" />

Component: Uses to display a controller variable (ctrl.userInput), with a rendered attribute based on isEditable.

Escaping: is designed to display field values from sObjects and automatically escapes output to prevent XSS. The Visualforce Developer Guide states: “The apex:outputField component renders field data with automatic HTML escaping, ensuring safe output” (Salesforce Visualforce Developer Guide, apex:outputField). Even if ctrl.userInput contains malicious content, it’s rendered as plain text.

Security: The value attribute expects a field reference (e.g., {!object.FieldName}), but here it’s bound to a controller variable (ctrl.userInput). This is unconventional, as is typically used for sObject fields. However, even if ctrl.userInput is untrusted, the automatic escaping prevents XSS. The rendered attribute (isEditable) controls visibility and does not affect escaping.

Conclusion: Safe, as escapes output, though the usage is atypical.

Note on Typo: The question has a typo in the value attribute: “(!ctrl.userinput)” should be {!ctrl.userInput} (curly braces instead of parentheses), and “isfditable” should be isEditable. We assume the corrected syntax: .

D. <apex:outputField value="{!ctrl.userInput}" />

Component: Uses to display a controller variable (ctrl.userInput).

Escaping: As with option C, automatically escapes output, preventing XSS. The Visualforce Developer Guide confirms: “apex:outputField ensures safe rendering by escaping special characters” (Salesforce Visualforce Developer Guide, apex:outputField).

Security: Even if ctrl.userInput contains malicious content, it’s rendered as plain text, mitigating XSS risks. Like option C, using for a controller variable is unusual, but it does not introduce a vulnerability.

Conclusion: Safe, as escapes output.

Note on Typo: The question has a typo in the value attribute: “{'ctrl.userInput}” should be {!ctrl.userInput} (correct merge field syntax). We assume the corrected syntax: .

Why Option B is Correct:

Option B presents a security vulnerability because:

It uses with escape="false", disabling HTML escaping.

It renders untrusted user input (ApexPages.currentPage().getParameters().get('userInput')) directly, allowing malicious scripts to execute, which is a classic XSS vulnerability.

The Salesforce Secure Coding Guidelines explicitly warn against this practice: “Rendering unescaped user input, such as URL parameters, can allow attackers to inject scripts” (Salesforce Secure Coding Guidelines, Cross-Site Scripting).

The other options (A, C, D) either use default escaping ( in A) or inherently safe components ( in C and D), preventing XSS.

Handling Typos:

The question contains several typos, which were corrected for analysis:

Option A: “SCurrentPage” → ApexPages.currentPage().

Option B: “sCurrentPage” → ApexPages.currentPage().

Option C: “(!ctrl.userinput)” → {!ctrl.userInput}, “isfditable” → isEditable.

Option D: “{'ctrl.userInput}” → {!ctrl.userInput}.These corrections align with standard Visualforce and Apex syntax, ensuring the analysis reflects the intended functionality.

Example of the Vulnerability (Option B):

Consider a Visualforce page with option B’s code:

If a user accesses the page with a URL like:

https://example.salesforce.com/apex/MyPage?userInput=

The script is rendered as executable HTML, displaying an alert in the user’s browser, demonstrating an XSS attack. In contrast, option A (with default escaping) would render the script as plain text, preventing execution.

Mitigating the Vulnerability:

To fix option B, either:

Remove escape="false" to enable default escaping:

Sanitize the input in the controller using methods like String.escapeHtml4():

public String getUserInput() {

String input = ApexPages.currentPage().getParameters().get('userInput');

return input != null ? String.escapeHtml4(input) : '';

}

The Visualforce Developer Guide recommends: “Sanitize untrusted input or rely on Visualforce’s built-in escaping to prevent XSS” (Salesforce Visualforce Developer Guide, Secure Coding for Visualforce).

Why External ID?

The Order Number is used to identify records uniquely, both in Salesforce and in external systems.

Marking it as anExternal IDensures it can be matched or referenced during data imports and integrations.

Why Unique?

Setting the field as Unique ensures that duplicate values are not allowed for the Order Number.

Why Not Other Options?

A. Indirect Lookup: Used for external object relationships, which is not applicable here.

B. Direct Lookup: Not relevant for unique field identification.

D. Lookup: Used for creating relationships, not for identifying unique fields.

A: Thesave()method in the custom controller must be tested to ensure it works as intended and redirects to the correct page.

B: Setting parameters viaApexPages.currentPage().getParameters()is crucial to test scenarios where user input or URL parameters drive logic.

D: UsingTest.setCurrentPage(pageRef)is essential for simulating page context in unit tests.

Why not other options?

C: This statement does not belong to testing a custom controller.

B (second occurrence): It appears to be incorrectly formatted in the question.

Testing Apex Controllers

Comprehensive and Detailed Explanation From Exact Extract:

To determine the correct declaration of the class and methods for a custom SOAP Web Service in Apex, we need to evaluate the syntax and access modifiers required for SOAP Web Services, as well as the handling of helper methods that are not exposed to the external Web Application. Let’s analyze the problem and each option systematically, referencing Salesforce’s official Apex Developer Guide.

Understanding SOAP Web Services in Apex:

SOAP Web Service: Salesforce allows developers to create SOAP Web Services using Apex by defining methods that can be called externally via SOAP. The Apex Developer Guide states: “Apex SOAP Web Services allow external applications to invoke Apex methods over SOAP by exposing them with the webservice keyword” (Salesforce Apex Developer Guide, SOAP Web Services).

Class Declaration: For an Apex class to be a SOAP Web Service, it must be declared as global to allow external access. The Apex Developer Guide specifies: “The class containing SOAP Web Service methods must be declared as global to be accessible externally” (Salesforce Apex Developer Guide, SOAP Web Services).

Method Declaration:

Methods exposed as Web Service operations must be static and annotated with the webservice keyword. The Apex Developer Guide notes: “Methods defined as SOAP Web Service operations must be static and use the webservice keyword” (Salesforce Apex Developer Guide, SOAP Web Services).

The return type and parameters of webservice methods must be compatible with SOAP (e.g \String, Integer, sObjects, etc.).

Helper Methods: The question specifies that helper methods are included but not used by the Web Application, meaning they should not be exposed as part of the Web Service. Helper methods can be private or public and should not have the webservice keyword, ensuring they are not part of the WSDL (Web Service Definition Language) exposed to the external application.

Requirement Analysis:

Class: Must be global to expose the Web Service to external applications.

Web Service Method (updateRecords): Must be static, use the webservice keyword, and be part of the global class to be callable via SOAP.

Helper Method (helperMethod): Should be private (or not webservice) to ensure it’s not exposed in the WSDL and is only used internally within the class.

Evaluating the Options:

A.

apex

Copy

webservice class WebServiceClass {

private Boolean helperMethod() { /* implementation ... */ }

global static String updateRecords() { /* implementation ... */ }

}

Class Declaration: Uses webservice class instead of global class. The webservice keyword is not a valid modifier for a class in Apex. The Apex Developer Guide clarifies: “The webservice keyword is used for methods, not classes. The class itself must be global” (Salesforce Apex Developer Guide, SOAP Web Services). This results in a compilation error.

Helper Method: private Boolean helperMethod() is correct, as it’s not exposed to the Web Service (no webservice keyword).

Web Service Method: global static String updateRecords() uses global, which is incorrect for a method. Methods in a global class should use webservice to be exposed as Web Service operations, not global. The Apex Developer Guide states: “Methods in a Web Service class use the webservice keyword, not global” (Salesforce Apex Developer Guide, SOAP Web Services).

Conclusion: Incorrect due to invalid class declaration (webservice class) and incorrect method modifier (global instead of webservice).

B.

apex

Copy

global class WebServiceClass {

private Boolean helperMethod() { /* implementation ... */ }

webservice static String updateRecords() { /* implementation ... */ }

}

Class Declaration: Uses global class, which is correct. A SOAP Web Service class must be global to be accessible externally.

Helper Method: private Boolean helperMethod() is correct, as it’s not exposed to the Web Service (no webservice keyword), fulfilling the requirement that it’s not used by the Web Application.

Web Service Method: webservice static String updateRecords() is correct. It uses the webservice keyword to expose the method as a Web Service operation, is static as required, and returns a SOAP-compatible type (String).

Conclusion: Correct, as it meets all requirements for a SOAP Web Service class, exposes the updateRecords method properly, and keeps the helper method internal.

C.

apex

Copy

webservice class WebServiceClass {

private Boolean helperMethod() { /* implementation ... */ }

webservice static String updateRecords() { /* implementation ... */ }

}

Class Declaration: Uses webservice class, which, as noted in option A, is invalid. The class must be global, not webservice.

Helper Method: private Boolean helperMethod() is correct (not exposed).

Web Service Method: webservice static String updateRecords() is correct in syntax, but the class declaration error makes the entire code segment invalid.

Conclusion: Incorrect due to the invalid class declaration (webservice class).

D.

apex

Copy

global class WebServiceClass {

private Boolean helperMethod() { /* implementation ... */ }

global String updateRecords() { /* implementation ... */ }

}

Class Declaration: Uses global class, which is correct.

Helper Method: private Boolean helperMethod() is correct (not exposed).

Web Service Method: global String updateRecords() is incorrect. The method uses global instead of webservice, and it’s not static. For a method to be exposed as a SOAP Web Service operation, it must be webservice and static. Additionally, global is not a valid modifier for methods in this context; it’s used for the class. The Apex Developer Guide warns: “Non-static methods or methods without the webservice keyword are not exposed in the WSDL” (Salesforce Apex Developer Guide, SOAP Web Services).

Conclusion: Incorrect, as the updateRecords method is not properly exposed as a Web Service operation (missing webservice and static).

Why Option B is Correct:

Option B is correct because:

The class is declared as global class WebServiceClass, making it accessible to external applications as required for a SOAP Web Service.

The updateRecords method is declared as webservice static String updateRecords(), correctly exposing it as a Web Service operation that can be called via SOAP.

The helper method helperMethod is private and lacks the webservice keyword, ensuring it’s not exposed in the WSDL and is only used internally, meeting the requirement that it’s not used by the Web Application.

This aligns with Salesforce best practices for SOAP Web Services as outlined in the Apex Developer Guide.

Example for Clarity:

Here’s how option B would be implemented in a complete Apex class:

apex

Copy

global class WebServiceClass {

// Helper method, not exposed in the WSDL

private Boolean helperMethod() {

return true; // Example implementation

}

// Web Service method, exposed in the WSDL

webservice static String updateRecords() {

if (helperMethod()) {

return 'Records updated successfully';

}

return 'Update failed';

}

}

When this class is deployed, Salesforce generates a WSDL that includes the updateRecords method but excludes helperMethod, allowing the external Web Application to call updateRecords via SOAP while keeping helperMethod internal.

Handling Typos:

The options are syntactically correct in the provided image, with no typos to address. The placeholders (/* implementation ... */) are standard for indicating omitted code and do not affect the analysis.

The question’s phrasing is clear, and the options align with typical Apex syntax patterns for Web Services.

Why Quick Actions?

Quick Actions allow developers to create prepopulated forms for creating or updating records.

They are a modern alternative to JavaScript buttons in Lightning Experience.

Why Not Other Options?

A: Validation rules enforce data integrity but do not create records.

B: Apex triggers automate processes but are not used for user-initiated actions.

C: Record-triggered flows execute automatically when records are created or updated, but they do not replace JavaScript buttons for user-initiated actions.