Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

Salesforce Accredited B2B Commerce Developer Professional (AP-202) Exam - Topic 4 Question 94 Discussion

Although Salesforce B2B Commerce and Salesforce recommend against using"without sharing classes" whenever possible, sometimes it is unavoidable. Which threeitems will open up a major security hole? (3 answers)
A) Executing dynamic SOQL inside a without sharing class with a bind variable fromPageReference.getParameters(). and C) Executing dynamic SOQL inside a without sharing class with a bind variable fromPageReference.getCookies(). and D) Executing dynamic SOQL inside a without sharing class with a bind variable fromcc_RemoteActionContentex class.
B) Executing dynamic SOQL inside a without sharing class with a bind variable from theUserInfo class.
E) Executing dynamic SOQL inside a without sharing class with a bind variable fromccAPI.CURRENT_VERSION.

Salesforce Accredited B2B Commerce Developer Professional (AP-202) Exam - Topic 4 Question 94 Discussion

Actual exam question for Salesforce's Salesforce Accredited B2B Commerce Developer Professional (AP-202) exam
Question #: 94
Topic #: 4
[All Salesforce Accredited B2B Commerce Developer Professional (AP-202) Questions]

Although Salesforce B2B Commerce and Salesforce recommend against using

"without sharing classes" whenever possible, sometimes it is unavoidable. Which three

items will open up a major security hole? (3 answers)

Show Suggested Answer Hide Answer
Suggested Answer: A, C, D

Executing dynamic SOQL inside a without sharing class with a bind variable from PageReference.getParameters(), PageReference.getCookies(), or cc_RemoteActionContext class will open up a major security hole because these sources of input are not sanitized and can be manipulated by malicious users to inject SOQL queries that bypass the sharing rules and access data that they are not supposed to see. For example, a user can modify the URL parameters or cookies to include a SOQL query that returns sensitive data from the database. To prevent this, it is recommended to use static SOQL or escape the bind variables before executing dynamic SOQL.


by Bettina at Jun 01, 2026, 09:25 AM

Limited Time Offer

25%

Off

Get Premium Salesforce Accredited B2B Commerce Developer Professional (AP-202) Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Magda
3 days ago
C is a big no too. Cookies can be manipulated easily.
upvoted 0 times
...
Shay
8 days ago
Right! B is also risky because UserInfo can reveal sensitive info.
upvoted 0 times
...
Mi
13 days ago
Definitely A! Using PageReference parameters can expose data.
upvoted 0 times
...
Magda
18 days ago
Agreed! I think A, B, and C are the major risks.
upvoted 0 times
...
Shay
23 days ago
This question is tricky. I feel like it's testing our understanding of security.
upvoted 0 times
...
Janessa
29 days ago
Totally agree with A) and C) being major security holes!
upvoted 0 times
...
Jenelle
1 month ago
Wait, are we really saying D) is safe? That surprises me!
upvoted 0 times
...
Portia
1 month ago
C) seems sketchy too, but I’m not sure.
upvoted 0 times
...
Jeniffer
1 month ago
I think B) is also risky, but not as bad as A).
upvoted 0 times
...
Kristal
2 months ago
A) is definitely a big no-no!
upvoted 0 times
...
Leonardo
2 months ago
I recall that using PageReference parameters can expose data, so I’d lean towards A and C being correct, but I need to double-check my notes on that.
upvoted 0 times
...
Arlene
2 months ago
I’m a bit confused about the implications of using UserInfo as a bind variable. Is it really that risky in a "without sharing" context?
upvoted 0 times
...
Harrison
2 months ago
I think options A and C sound familiar, but I'm not entirely sure about D. I feel like we practiced a similar question before.
upvoted 0 times
...
Ronna
2 months ago
I remember discussing how using dynamic SOQL in "without sharing" classes can lead to security risks, especially with user input.
upvoted 0 times
...

Save Cancel