How to pass Salesforce Certified Administrator (ADM-201)

How this exam thinks

What each domain tests and how to study it

The ADM-201 blueprint is split across 8 domains. Weights are the official share of the exam; see the official exam guide for the authoritative breakdown.

1. Configuration and Setup

   15% of exam

   What you must be able to do. Navigate Setup with confidence, manage users through their whole lifecycle, and layer the security model so each user has exactly the object, field, and record access the scenario requires and no more.

   In one sentenceThe org-wide settings, user administration, and the layered security model of profiles, permission sets, org-wide defaults, the role hierarchy, and sharing rules that control who can see and do what.

   Recall check: answer these from memory first

   • Name the layer that controls object and field access and the layers that control record access, and say which of them can only open access wider.
   • Explain in one line when you grant access with a permission set instead of editing the profile.
   • Say why you deactivate a user rather than delete them, and what freezing does differently.

   What it tests. Company-wide settings such as fiscal year, business hours, and currency, the full user lifecycle from creation to deactivation, and above all the Salesforce security model. It checks that you can layer object and field access from profiles and permission sets on top of record access from organization-wide defaults, the role hierarchy, sharing rules, and manual sharing, and that you pick the least-privilege way to grant what a scenario needs.

   How to study it. Spend most of your time on the security model, because it is the hardest part of the exam and it recurs everywhere. Build the layered picture explicitly: profiles and permission sets control object and field access, while org-wide defaults, hierarchy, sharing rules, and manual sharing control record access. Practise the direction of sharing until it is automatic: org-wide defaults set the floor, and everything above only opens access wider. Learn why users are deactivated rather than deleted, and drill scenarios that tempt you to edit a profile when a permission set is the correct, narrower answer.

   Easy to confuse

   • Profiles versus permission sets. A profile is the baseline every assigned user shares, so editing it changes access for all of them; a permission set grants additional access to specific users without touching the profile. When a scenario needs to give some users extra access, the least-privilege answer is a permission set, not a cloned or edited profile.
   • Organization-wide defaults versus the role hierarchy and sharing rules. Org-wide defaults set the most restrictive baseline for record access, while the role hierarchy and sharing rules can only open that access wider, never tighten it. If a scenario needs to restrict access you lower the org-wide default; if it needs to widen access for a group you add a sharing rule or rely on the hierarchy.
   • Freezing versus deactivating a user. Freezing blocks a user from logging in immediately while you reassign their records, but it does not free up the licence; deactivating releases the licence but cannot be done until ownership is handled. Users are never deleted because they own records, so the exam tests which of freeze or deactivate a situation calls for.

   Worked example from the ADM-201 bank

   lock_openFree sampleConfiguration and Setuphard

   At Kalgoorlie Analytics, the organisation-wide default for the Contract object is Public Read Only. The compliance team, defined as a public group, must be able to edit every Contract record regardless of owner, but no other change to the baseline is wanted. Which configuration achieves this with the least disruption?

   • ACreate an owner-based sharing rule that shares Contract records owned by all internal users with the compliance public group at Read/Write access level.check_circle Correct
   • BChange the Contract organisation-wide default to Public Read/Write so that everyone, including the compliance group, can edit all Contract records without further configuration.
   • CCreate a criteria-based sharing rule on Contract that shares all records with the compliance public group at Read/Write access level.
   • DAssign the compliance group members a permission set with the Modify All permission for the Contract object, which grants edit access to all Contract records.

   Owner-based sharing rules keyed on all internal users grant a group access to every record while preserving the org-wide default for others. Sharing rules can only open access wider than the org-wide default, never restrict it. An owner-based rule sharing records owned by all internal users with the compliance group at Read/Write extends edit rights to that group alone, meeting the requirement without loosening the baseline for the whole organisation.

   Why A is correct: Correct. An owner-based sharing rule keyed on records owned by all internal users grants the compliance group Read/Write across every record while leaving the Public Read Only baseline untouched for everyone else.

   Why B is wrong: Tempting because it guarantees the compliance team can edit, but it grants edit access to the entire organisation, which contradicts the requirement to change nothing else about the baseline.

   Why C is wrong: Tempting because sharing rules can grant Read/Write, but a criteria-based rule keys off field values on the record; with no meaningful criterion to match every record this is the wrong sharing-rule type for an all-records share.

   Why D is wrong: Tempting because Modify All on an object does grant edit to all its records, but it also bypasses sharing entirely and is a broad object permission rather than the targeted record-sharing the requirement calls for; it cannot be assigned to a public group, only to profiles or permission sets per user.

2. Object Manager and Lightning App Builder

   15% of exam

   What you must be able to do. Model data with the right objects, fields, and relationships, and present it to each group of users through page layouts, record types, and Lightning pages without over-building the org.

   In one sentenceThe data model of standard and custom objects, lookup versus master-detail relationships, and the record types, page layouts, and Lightning App Builder pages that present the right fields to the right users.

   Recall check: answer these from memory first

   • Give the three behaviours a master-detail relationship has that a lookup does not.
   • Say what a record type controls versus what a page layout controls, in one line each.
   • Explain when dynamic forms or component visibility is a better answer than a second page layout.

   What it tests. Standard and custom object architecture, choosing between lookup, master-detail, and hierarchical relationships, and creating custom fields with the right data type. It also tests how you present data: page layouts for field placement, record types and business processes for different picklist values and stages, and Lightning App Builder for record, home, and app pages with dynamic forms and component visibility.

   How to study it. Get the relationship types exact first, because their behaviour drives sharing, deletion, and reporting. Learn that a master-detail child inherits the parent's sharing, is deleted with the parent, and enables roll-up summaries, while a lookup is loosely coupled with none of that. Then separate the three presentation tools that scenarios blur together: page layouts place fields, record types offer different picklist values and processes, and Lightning App Builder assembles the page. Prefer dynamic forms and component visibility over cloning layouts, because the exam rewards the answer that adds the least customisation.

   Easy to confuse

   • Master-detail versus lookup relationships. A master-detail child inherits the parent's sharing and ownership, is deleted when the parent is deleted, and lets the parent hold roll-up summary fields; a lookup is loosely coupled with independent sharing, no cascade delete, and no roll-up summaries. The exam signals master-detail when it mentions cascade delete, inherited sharing, or a roll-up.
   • Record types versus page layouts versus business processes. A record type controls which picklist values and which business process a record uses, a page layout controls field placement and related lists, and a business process controls the available stages such as sales or support steps. They work together, so the exam tests whether you attribute each behaviour to the right one rather than treating them as interchangeable.
   • Dynamic forms versus multiple page layouts. Dynamic forms place individual fields on a Lightning record page with visibility rules, so one page can show different fields by condition, whereas multiple page layouts require a separate layout per group assigned by profile and record type. When a scenario wants conditional fields with less maintenance, dynamic forms is the lower-customisation answer.

   Worked example from the ADM-201 bank

   lock_openFree sampleObject Manager and Lightning App Buildermedium

   How does deleting a parent record differ between a master-detail relationship and a lookup relationship when related child records exist?

   • AIn both relationship types the child records are automatically deleted along with the parent record.
   • BIn both relationship types the child records are retained and the relationship field is simply cleared.
   • CIn a master-detail relationship the child (detail) records are deleted with the parent, whereas in a lookup relationship the children are retained by default.check_circle Correct
   • DIn a lookup relationship the child records are deleted with the parent, whereas in a master-detail relationship they are retained.

   Understand that master-detail cascades deletion to child records while a lookup retains them by default. Master-detail is tightly coupled so a detail record cannot exist without its master, which forces a cascade delete of children, whereas a lookup is loosely coupled and leaves child records untouched when the parent is removed.

   Why A is wrong: This is tempting because both relationships link a child to a parent, but only master-detail cascades the delete. A lookup does not delete its child records by default.

   Why B is wrong: This describes only the lookup behaviour. In a master-detail relationship the detail records cannot survive without their master, so they are cascade-deleted rather than retained.

   Why C is correct: Master-detail is a tightly coupled relationship where the detail record cannot exist without its master, so deleting the master cascades the delete to the children, while a standard lookup leaves the child records in place.

   Why D is wrong: This reverses the two behaviours. Cascade delete belongs to master-detail because of its tight coupling, not to the loosely coupled lookup relationship.

3. Sales and Marketing Applications

   10% of exam

   What you must be able to do. Configure the sales pipeline with opportunities, stages, products, and price books, and the lead and campaign features that capture and attribute demand.

   In one sentenceThe sales pipeline of opportunities, stages, sales paths, products, and price books, plus lead capture, conversion, assignment rules, and campaign influence.

   Recall check: answer these from memory first

   • Say what happens to standard and custom lead fields when a lead is converted.
   • Explain how opportunity stage relates to forecast category and the sales path.
   • Name the tool that attributes pipeline back to the marketing touches that generated it.

   What it tests. Configuring the sales process with opportunities, opportunity stages, sales paths, forecast categories, products, and price books, and understanding how stage drives forecasting and reporting. It also tests lead management and campaigns: web-to-lead capture, lead assignment and auto-response rules, field mapping on conversion to account, contact, and opportunity, and campaign influence for attributing pipeline.

   How to study it. Learn the opportunity as the centre of the sales cloud: stage drives the sales path, forecast category, and most reporting, so tie those together. Understand what happens on lead conversion, because the exam probes how standard and custom fields map forward to the account, contact, and opportunity. Remember that lead assignment rules, like all rule-entry automation, apply the first matching entry, and that campaign influence is how marketing touches get credited to pipeline.

   Easy to confuse

   • Products and price books versus opportunity amount. Products and price books let you itemise what is being sold and at what list price, while the opportunity amount is the headline revenue figure that can be rolled up from those line items or entered directly. The exam tests whether a requirement to capture multiple items at defined prices calls for products and price books rather than a single amount.
   • Lead assignment rules versus lead auto-response rules. A lead assignment rule sets who owns a new lead, routing it to a user or queue, while an auto-response rule chooses which email template is sent back to the lead. Both evaluate rule entries top down and apply the first match, so the exam checks that you route ownership with assignment and acknowledgement with auto-response.

   Worked example from the ADM-201 bank

   lock_openFree sampleSales and Marketing Applicationsmedium

   What must be true about a product before it can be given a price in a custom price book and sold on an opportunity?

   • AThe product must first have a standard price recorded in the Standard Price Book before it can be given a list price in any custom price book.check_circle Correct
   • BThe product must be defined as a master-detail child of the price book so that deleting the price book also deletes the product.
   • CThe product must be assigned to a forecast category so that the revenue it generates rolls up into the pipeline correctly.
   • DThe product must be owned by the same user who owns the opportunity on which it will eventually be sold.

   Know that a product needs a standard price in the Standard Price Book before it can be added with a list price to a custom price book. The Standard Price Book holds each product's standard price, and a custom price book entry references that product, so a product without a standard price cannot be given a list price in a custom price book or sold.

   Why A is correct: Correct: a product needs an active standard price before a custom price book entry can be created, so the Standard Price Book underpins every custom price book.

   Why B is wrong: Tempting because master-detail governs many parent-child links, but products relate to price books through price book entries, not a master-detail relationship.

   Why C is wrong: Forecast categories apply to opportunity stages, not to products, so this is an unrelated requirement invented for the product record.

   Why D is wrong: Product and price book setup is org-wide reference data; record ownership of the opportunity has no bearing on whether a product can be priced.

4. Service and Support Applications

   10% of exam

   What you must be able to do. Configure case capture across channels and the automation, entitlements, and agent tools that route, escalate, and resolve cases within service-level commitments.

   In one sentenceCase management across web, email, and other channels, plus assignment and escalation rules, entitlements, and the productivity tools that support service agents.

   Recall check: answer these from memory first

   • Say which case rule routes ownership and which one acts when a case ages past a threshold.
   • Explain what entitlements and milestones enforce on a case.
   • Name two channels that create cases automatically and what each captures.

   What it tests. Configuring case management through channels such as web-to-case and email-to-case, using case fields, queues, and case feed to track resolution. It also tests case automation: assignment rules to route ownership, escalation rules to act when a case ages past a threshold, entitlements and milestones to enforce service-level agreements, and agent tools such as macros and quick text.

   How to study it. Treat the support side as the mirror of sales automation, with the same first-matching-rule behaviour. Learn the channels and what each captures, then focus on the difference between assignment and escalation, because scenarios pair a routing need with one and an ageing or breach need with the other. Understand entitlements and milestones as the way service-level agreements are enforced on the platform, and keep the agent productivity tools straight so you can pick the lightest one that meets the need.

   Easy to confuse

   • Case assignment rules versus case escalation rules. An assignment rule sets the initial owner or queue when a case is created, while an escalation rule fires later when a case has aged past a defined time without resolution, reassigning or notifying. Both apply the first matching rule entry, so the exam tests whether the trigger is creation (assignment) or ageing (escalation).
   • Web-to-case versus email-to-case. Web-to-case captures a case from a form on a public website, while email-to-case creates a case from a message sent to a monitored support address and can thread ongoing replies. The channel named in the scenario, a form versus an inbox, tells you which one the requirement needs.

   Worked example from the ADM-201 bank

   lock_openFree sampleService and Support Applicationsmedium

   A company wants to accept customer emails as cases without installing any agent software behind its firewall, accepting the trade-off of a smaller limit on attachment and message size. Which capability meets this requirement?

   • AOn-Demand Email-to-Case, which processes inbound email in the cloud with no locally installed agent, subject to lower size limits.check_circle Correct
   • BWeb-to-Case, because it forwards every inbound customer email through the website form engine before a case is created.
   • CThe standard Email-to-Case agent, because it must be installed locally to receive any inbound email that becomes a case.
   • DAuto-response rules, which convert each acknowledgement email that Salesforce sends back to the customer into a new case.

   Identify On-Demand Email-to-Case as the agentless option for turning inbound email into cases, at the cost of lower size limits. On-Demand Email-to-Case processes inbound messages in the Salesforce cloud without any agent installed behind the firewall, which is why it carries smaller attachment and message size limits than the standard installed agent.

   Why A is correct: On-Demand Email-to-Case runs entirely in Salesforce with no agent behind the firewall and trades that convenience for smaller message and attachment size limits, matching the requirement exactly.

   Why B is wrong: Web-to-Case handles website form submissions, not inbound email, so it does not turn emails into cases and does not fit the requirement at all.

   Why C is wrong: This is tempting, but the standard agent is the option the company is trying to avoid, since it requires software behind the firewall; it does not satisfy the stated constraint.

   Why D is wrong: Auto-response rules only send acknowledgement emails to customers; they do not ingest inbound email or create cases, so they cannot deliver this capability.

5. Productivity and Collaboration

   10% of exam

   What you must be able to do. Configure activities, Chatter, mobile, and reusable productivity features so users log work, collaborate, and act quickly from any device.

   In one sentenceThe activity and collaboration tools of tasks, events, the activity timeline, and Chatter, plus the mobile app, email templates, quick actions, and list views that speed everyday work.

   Recall check: answer these from memory first

   • Say what a compact layout controls in the mobile app and on record highlights.
   • Explain when an AppExchange managed package is a better answer than building the feature yourself.
   • Name the difference between a task and an event as activities.

   What it tests. Configuring activity management with tasks, events, and the activity timeline, and collaboration through Chatter feeds, groups, and feed tracking. It also tests the mobile app experience with compact layouts and quick actions, when an AppExchange managed package is the right way to extend the org, and productivity features such as email templates, quick actions, and list views.

   How to study it. This is a lighter, largely practical domain, so secure it with focused practice rather than long study. Know what tasks and events are and how the activity timeline surfaces them, and understand Chatter as internal collaboration with feed tracking. For mobile, learn how compact layouts and quick actions shape what a field user sees and can do. Recognise the AppExchange as the buy-versus-build option: when a proven managed package meets the need, installing it beats custom configuration.

   Easy to confuse

   • Compact layouts versus page layouts. A compact layout controls the key fields shown in the highlights panel and at the top of a mobile record, while a page layout controls the full arrangement of fields and related lists on the record page. The exam signals a compact layout when the need is what a user sees at a glance, especially on mobile.
   • Tasks versus events. A task is a to-do item with a due date and no set duration, while an event is a calendared item with a start and end time. When a scenario describes scheduling time on a calendar it is an event, and when it describes an action to complete by a date it is a task.

   Worked example from the ADM-201 bank

   lock_openFree sampleProductivity and Collaborationeasy

   In Salesforce activity management, what is the key distinction between a task and an event?

   • AA task can be logged against a record, whereas an event can only exist on a user's personal calendar and cannot relate to any record.
   • BA task is a to-do item with a due date and a status, whereas an event is a scheduled activity that occupies a block of time with a start and an end.check_circle Correct
   • CA task appears on the activity timeline, whereas an event appears only in reports and is never shown on a record's timeline.
   • DA task can be assigned to another user, whereas an event is always owned by the person who created it and cannot be reassigned.

   Distinguish a task as a status-bearing to-do from an event as a time-blocked calendar activity. Tasks represent work to complete and carry a status and due date, while events represent scheduled time and require a start and end, which is why they render differently on the calendar and timeline.

   Why A is wrong: This is tempting because events are calendar items, but it is wrong: events can be related to records through the Name and Related To fields just as tasks can.

   Why B is correct: Correct: tasks track work to be completed and carry a status such as Not Started or Completed, while events are calendared items with a specific start and end time.

   Why C is wrong: This is tempting because timelines emphasise tasks, but it is wrong: both open events and open tasks appear on the activity timeline of a related record.

   Why D is wrong: This is tempting because tasks are often reassigned, but it is wrong: events also have an owner and assigned user and can be reassigned like other activities.

6. Data and Analytics Management

   17% of exam

   What you must be able to do. Move and clean data with the right import tool, maintain quality with validation and duplicate rules, and answer business questions with reports and dashboards that show each viewer the correct data.

   In one sentenceThe largest domain: importing and exporting data with the right tool, maintaining data quality, and building reports and dashboards, including who a dashboard runs as.

   Recall check: answer these from memory first

   • State the record-volume and object-support line that decides between the Data Import Wizard and the Data Loader.
   • Explain what the report type controls before you even add filters.
   • Say whose data a standard dashboard shows, and how a dynamic dashboard differs.

   What it tests. Data management and analytics together. On data, it covers importing and exporting with the Data Import Wizard and Data Loader, choosing by volume and object support, matching on upsert with external IDs, and maintaining quality with validation rules and duplicate management. On analytics, it covers report types, summary and matrix formats, bucket fields and formulas, and dashboards including the running user, dynamic dashboards, and folder sharing.

   How to study it. This carries the most weight, so give it the most time. Fix the import decision firmly: the Data Import Wizard is the guided, in-browser tool for standard objects and modest volumes with built-in duplicate handling, while the Data Loader handles large volumes, more objects, and scheduled loads. Learn that the report type decides which objects and fields are available and whether records without related records appear, because that resolves many report questions. For dashboards, drill the running user concept until the difference between a single running user and a dynamic dashboard is automatic.

   Easy to confuse

   • Data Import Wizard versus Data Loader. The Data Import Wizard is a guided browser tool for standard objects and smaller volumes with built-in duplicate matching, while the Data Loader is a client application for large volumes, a wider set of objects, and scheduled or command-line loads. The exam points to the Data Loader when the volume is large or the object is unsupported by the wizard, and to the wizard when duplicate handling and simplicity matter.
   • Standard single running user versus dynamic dashboards. A standard dashboard shows every viewer the data visible to one fixed running user, while a dynamic dashboard shows each viewer the data they themselves can see. When a scenario needs personalised figures per viewer the answer is a dynamic dashboard, and when everyone should see one consistent view it is the single running user.
   • Validation rules versus duplicate management. A validation rule blocks a save when field values fail a condition you define, enforcing data correctness, while duplicate and matching rules warn or block when a new record resembles an existing one, enforcing uniqueness. The exam tests whether the data-quality need is about correct values (validation) or repeated records (duplicate management).

   Worked example from the ADM-201 bank

   lock_openFree sampleData and Analytics Managementmedium

   When does a validation rule evaluate its formula and potentially block a record from being saved?

   • AWhen the record is saved, whether the save comes from the UI, the API, or a data import, if the formula evaluates to true.check_circle Correct
   • BOnly when a user edits the record manually through a Lightning record page, not during any automated process.
   • CAfter the record is committed to the database, so the record saves first and the error appears on the next edit.
   • DOnly during Data Loader operations, because the UI relies on required-field settings instead of validation rules.

   Recognise that validation rules fire on every save across UI, API, and import when the formula is true. A validation rule evaluates its formula each time a record is saved from any source, and when the formula returns true it blocks the save and shows the error message, ensuring bad data is stopped before it is committed.

   Why A is correct: Validation rules run on every save regardless of source, and the record is blocked when the formula returns true, so this correctly states both the timing and the trigger condition.

   Why B is wrong: It is tempting to think validation only guards manual edits, but rules also fire on API and automation-driven saves, so limiting them to manual edits is wrong.

   Why C is wrong: This misplaces the timing: validation runs before commit and stops the save outright, rather than allowing the record to save and surfacing an error later.

   Why D is wrong: Validation rules apply to UI saves as well as Data Loader, and required-field settings are a separate control, so restricting rules to Data Loader is incorrect.

7. Automation

   15% of exam

   What you must be able to do. Automate the org with the current tool, choosing the right flow type and before-save or after-save timing, and configure approval processes for records that need sign-off.

   In one sentenceDeclarative automation with Flow Builder, choosing the flow type and before-save versus after-save, plus approval processes for routing records through sign-off.

   Recall check: answer these from memory first

   • Say why Flow is the answer over Workflow Rules or Process Builder in a current scenario.
   • Give the rule for choosing before-save versus after-save on a record-triggered flow.
   • Name the four action points in an approval process where automation can fire.

   What it tests. Building automation in Flow Builder and distinguishing record-triggered, screen, scheduled, and autolaunched flows, including before-save versus after-save timing on record-triggered flows. It also tests approval processes: entry criteria, ordered approval steps, assigned approvers including delegated approvers and queues, and the initial submission, final approval, final rejection, and recall actions that fire as a record moves through.

   How to study it. Learn Flow as the strategic tool and treat any question that offers it against Workflow Rules or Process Builder as pointing to Flow, since those older tools are being retired. Then get the flow types and timing exact: a same-record field update on create or edit is a before-save record-triggered flow because it is fastest and needs no extra update, while an action on related records or an email is after-save. For approvals, walk a record through submission, steps, and the four action points so you can place a field update or email alert at the right moment.

   Easy to confuse

   • Flow versus the retired Workflow Rules and Process Builder. Flow is Salesforce's current, strategic automation tool that handles screens, scheduling, and complex logic, while Workflow Rules and Process Builder are older tools being retired and no longer the recommended choice. When a scenario offers Flow against either older tool, the exam wants Flow.
   • Before-save versus after-save record-triggered flows. A before-save flow updates fields on the same record as it is created or edited, running fast with no extra database write, while an after-save flow can act on related records, send emails, or call other automation. If the requirement only changes the triggering record's own fields, before-save is the correct, cheaper answer.
   • Record-triggered flow versus screen flow. A record-triggered flow runs automatically in the background when a record is created or edited, with no user interface, while a screen flow guides a user through steps in a visible interface. The exam signals a screen flow when a person needs to enter or confirm data, and a record-triggered flow when the automation should run on its own.

   Worked example from the ADM-201 bank

   lock_openFree sampleAutomationhard

   A record-triggered flow must update a field on the same record that caused it to run. Which run timing performs this update most efficiently, and why?

   • AAfter-save, because only after-save flows are able to read the field values on the record that triggered the flow.
   • BAfter-save, because a before-save flow is not permitted to assign values to fields on the triggering record at all.
   • CBefore-save, because the change is applied in the same transaction before the record is committed, avoiding a second save operation.check_circle Correct
   • DBefore-save, because a before-save flow can call Apex and email actions that write the field more quickly than a save.

   Same-record field updates in a record-triggered flow belong in the before-save timing because they avoid an extra save. A before-save record-triggered flow runs while the record is still in the current transaction and not yet committed, so setting a field on that record requires no additional DML and is markedly faster than an after-save update, which re-saves the record.

   Why A is wrong: Tempting because after-save flows are common, but wrong: both before-save and after-save flows can read the triggering record's field values, so this is not a reason to prefer after-save.

   Why B is wrong: Tempting through confusion over before-save limits, but wrong: assigning to the triggering record's own fields is exactly what before-save flows are designed to do.

   Why C is correct: Correct: a before-save flow modifies the triggering record in memory before it is written, so the same-record field update needs no extra DML and runs fastest.

   Why D is wrong: Tempting because before-save is the right timing, but the reason is wrong: before-save flows cannot invoke actions such as Apex or email, which is why they are limited to fast field updates.

8. Agentforce

   8% of exam

   What you must be able to do. Describe what Agentforce agents do, the administrator's role in enabling and monitoring them safely, and how Agent Builder and Prompt Builder configure grounded, scoped agents.

   In one sentenceA smaller, newer domain on Agentforce AI agents: what they are, how an administrator enables, scopes, and monitors them, and how Agent Builder and Prompt Builder configure grounded topics, actions, and prompts.

   Recall check: answer these from memory first

   • Explain what grounding does for an Agentforce agent and why it matters for safety.
   • Say which tool configures an agent's topics and actions and which one manages prompt templates.
   • Name the administrator's main responsibilities for keeping an agent safe and aligned with the org.

   What it tests. Describing Agentforce as autonomous AI agents that act on Salesforce data within defined topics and actions, and the administrator's role in enabling, assigning, scoping, and monitoring them safely. It also tests maintaining agents in Agent Builder and managing grounded prompt templates in Prompt Builder, and how testing in the conversation preview and refining instructions improves accuracy before an agent is activated.

   How to study it. This is the smallest and newest domain, so aim for confident coverage rather than depth. Learn the vocabulary: an agent is scoped by topics and the actions available within them, grounding ties its answers to CRM data and Data Cloud, and the administrator keeps behaviour safe by scoping permissions to the org's security model. Separate the two build tools: Agent Builder configures the agent's topics, instructions, and actions, while Prompt Builder creates the grounded prompt templates the agent and users invoke. Remember that agents inherit the platform's security, so an agent cannot see data the running context cannot.

   Easy to confuse

   • Agent Builder versus Prompt Builder. Agent Builder configures an agent's topics, instructions, and the actions it can take, while Prompt Builder creates and manages the grounded prompt templates that the agent or users invoke. The exam tests whether a task is shaping the agent's scope and behaviour (Agent Builder) or authoring a reusable grounded prompt (Prompt Builder).
   • Agent grounding versus agent scoping. Grounding connects an agent's responses to real CRM data and Data Cloud so answers reflect the org's records, while scoping limits which topics, actions, and permissions the agent has so it cannot act beyond its remit. Grounding is about accuracy of what it says, scoping is about the safety of what it can do, and the exam expects both named correctly.

   Worked example from the ADM-201 bank

   lock_openFree sampleAgentforcemedium

   Which statement about how an Agentforce agent respects Salesforce security when it executes an action is true?

   • AThe agent runs its actions as a defined agent user and is constrained by that user's profile and permission set access.check_circle Correct
   • BThe agent bypasses object and field-level security because it is an internal platform process rather than a user.
   • CThe agent inherits the profile of whichever end user is chatting, changing its access on every conversation.
   • DThe agent enforces organisation-wide defaults only and disregards field-level security entirely when it reads data.

   An Agentforce agent executes actions as a defined agent user and is limited by that user's profile and permission set access. Agentforce actions run in the security context of a configured agent user, so the platform enforces that user's object permissions, field-level security, and record access when the agent reads or writes data, meaning an agent can never expose information the assigned user lacks access to.

   Why A is correct: Correct. Agent actions execute in the context of an assigned user, so object, field, and record access follow that user's profile and permission sets, and the agent cannot surface data the user could not see.

   Why B is wrong: Agents do not bypass the security model. This tempts candidates who assume automation ignores permissions, but agent actions are bound to a user's access.

   Why C is wrong: The agent operates under its own configured agent user, not the chatting user's profile. The option is plausible because access does matter, but the running context is fixed to the agent user.

   Why D is wrong: Field-level security still applies to agent actions, so ignoring it is incorrect. Naming org-wide defaults makes this sound informed while omitting the layers that also apply.

A study plan that works

1. Map the blueprint and set a date

   Day 1

   Read the official exam guide and the eight sections with their weights. Book a provisional exam date now: a fixed date turns open-ended study into a plan and is the single biggest predictor of actually sitting the exam. Set up a free Developer Edition org or a Trailhead playground so you can click through every feature you study.

2. Master the security model (Configuration and Setup)

   Week 1

   Get the layered security model solid before anything else, because it is the hardest material and it recurs across the exam. Learn profiles and permission sets for object and field access, then org-wide defaults, role hierarchy, and sharing rules for record access. Use the recall prompts in this guide: cover the summary, answer from memory, then reveal.

3. Build the data model and its presentation (Object Manager and Lightning App Builder)

   Week 2

   Create custom objects, fields, and both relationship types by hand so master-detail versus lookup becomes second nature. Then practise presenting data with record types, page layouts, business processes, and Lightning App Builder, always reaching for the lowest-customisation option such as dynamic forms.

4. Cover the applications and productivity features (Sales, Service, Productivity)

   Week 3

   Work through the sales pipeline, case management, and the collaboration and mobile features. These are lighter, more practical sections, so a focused pass with hands-on clicks plus scenario practice is enough. Keep the first-matching-rule behaviour of assignment and escalation rules front of mind.

5. Go deep on data, analytics, and automation (Data and Analytics, Automation)

   Week 4

   These two carry the most combined weight, so spend the bulk of this week here. Drill the Data Import Wizard versus Data Loader decision, report types, and the dashboard running user, then build record-triggered, screen, and scheduled flows and an approval process. Use scenario questions, not flashcards alone.

6. Practise on scenarios with worked explanations

   Week 5

   Move to full practice sets and read the explanation for every question, including the ones you got right. The exam tests judgement between plausible declarative options, so understanding why a distractor over-grants access, over-builds, or uses a retired tool is where the marks are.

7. Sit a timed mock and close weak sections

   Week 6

   Take at least one full timed mock to rehearse pacing and flag-and-return, then use your per-section accuracy to drill the two sections dragging you down rather than re-reading what you already know. Repeat until every section clears the pass line with margin on unseen questions.

Know when you're ready

Exam-day tips

• Read the last line of the question first. It tells you what is actually being asked, so you can read the scenario looking for the answer rather than memorising detail.
• Choose the single best option, which usually means the least-privilege and least-customisation solution. Several options often work; the exam wants the narrowest one that fully meets the requirement.
• When a scenario needs to grant extra access to some users, reach for a permission set before editing or cloning a profile. Permission sets add access without changing everyone on the profile.
• Remember the direction of sharing: org-wide defaults set the most restrictive baseline, and the role hierarchy and sharing rules can only open access wider, never tighten it.
• Prefer Flow over Workflow Rules and Process Builder in any current scenario, and choose before-save when a flow only updates the triggering record's own fields.
• Flag and move on. Do not lose time on one hard item when easier marks are waiting; the timer rewards covering every question first.
• Eliminate two options fast. Most questions have two clearly weaker choices, often the ones that over-build or over-grant, and removing them turns a guess into a coin flip at worst.

Frequently asked questions