Which statement accurately distinguishes a profile from a permission set in the Salesforce access model?
- AA user can be assigned many profiles simultaneously, whereas only one permission set can ever be active for that user at a time.
- BA permission set establishes the baseline access for a user, and the profile then extends that access for individuals who happen to need more.
- CBoth a profile and a permission set can remove an access a user has already gained through another profile assignment.
- DA user has one profile that establishes baseline permissions, while permission sets grant additional access on top without removing anything the profile already allows. Correct
Why A is wrong: This reverses the real behaviour: a user has a single profile but can hold many permission sets at once, so the multiplicity is attributed to the wrong feature.
Why B is wrong: The roles are swapped here: the profile is the baseline and the permission set is the additive layer, not the other way round, which makes this a common but incorrect framing.
Why C is wrong: Permission sets and profiles only grant access; neither revokes an access granted elsewhere, and a user cannot hold more than one profile for one to strip another's permissions.
Why D is correct: Each user is assigned exactly one profile as their baseline, and permission sets are purely additive, extending access to specific users without altering the profile or reducing its granted permissions.