Important Salesforce Plat-Dev-201 Exam Questions

CertPrep • Salesforce • Plat-Dev-201 Exam Questions

Select Certification Providers

Select Certification Exam

Get Full Version

Salesforce Certified Platform Developer Plat-Dev-201 Exam

Attempt the Salesforce Developer practice test and solve real exam-like Plat-Dev-201 questions to prepare efficiently and increase your chances of success. Our Salesforce Plat-Dev-201 practice questions match the actual Salesforce Certified Platform Developer exam format, helping you enhance confidence and improve performance. With our Plat-Dev-201 practice exam software, you can analyze your performance, identify weak areas, and work on them effectively to boost your final Salesforce Developer exam score.

Vendor:	Salesforce
Exam Name:	Salesforce Certified Platform Developer
Registration Code:	Plat-Dev-201
Related Certification:	Salesforce Developer Certification
Exam Audience:	Salesforce Developer,

Total Questions

204

Last Updated

10-07-2026

Upgrade to Premium

GET FULL PDF

Question: 1

As part of new feature development, a developer is asked to build a responsive application capable of responding to touch events, that will be executed on stateful clients.

Which two technologies are built on a framework that fully supports the business requirement? Choose 2 answers

ALightning Web Components

BVisualforce Components

CVisualforce Pages

DAura Components

Answer: A, D

Explanation:

Lightning Web Components (LWC):

Fully responsive and designed to handle touch events.

Executes on stateful clients with high performance.

Aura Components:

Supports responsive designs and touch events but is slightly less efficient than LWC.

Why Not Other Options?

B . Visualforce Components: Not designed for responsiveness or touch event handling.

C . Visualforce Pages: Primarily server-rendered and not stateful for touch interactions.

Question: 2

Which code in a Visualforce page and/or controller might present a security vulnerability?

A. B. C. D.

A
Component: Uses to display a URL parameter (userInput) accessed via ApexPages.currentPage().getParameters().get('userInput').
Escaping: The escape attribute is not specified, so defaults to escape='true'. The Visualforce Developer Guide confirms: ''The apex:outputText component escapes HTML characters by default, converting characters like < to < to prevent script execution'' (Salesforce Visualforce Developer Guide, apex:outputText).
Security: Even though userInput is untrusted (coming from a URL parameter), the default escaping ensures that any malicious content (e.g., <script>alert('hack');</script>) is rendered as plain text (e.g., <script>alert('hack');</script>), preventing XSS.
Conclusion: Safe, as default escaping mitigates XSS risks.
Note on Typo: The question likely contains a typo in ''SCurrentPage'' (should be ApexPages.currentPage()). For analysis, we assume the correct syntax, as the intent is clear.

B
Component: Uses to display the userInput URL parameter.
Escaping: Explicitly sets escape='false', disabling HTML escaping. The Visualforce Developer Guide warns: ''Setting escape='false' on apex:outputText allows unescaped output, which can lead to XSS vulnerabilities if the data is not sanitized'' (Salesforce Visualforce Developer Guide, Secure Coding for Visualforce).
Security: With escape='false', any malicious input in userInput (e.g., <script>alert('hack');</script>) is rendered as executable HTML, enabling XSS. For example, a URL like ?userInput=<script>alert('hack');</script> would execute the script in the user's browser. The Salesforce Secure Coding Guidelines explicitly state: ''Avoid setting escape='false' on apex:outputText when rendering untrusted input, such as URL parameters'' (Salesforce Secure Coding Guidelines, Cross-Site Scripting).
Conclusion: Presents a security vulnerability (XSS) due to disabled escaping with untrusted input.
Note on Typo: The question has a typo in ''sCurrentPage'' (should be ApexPages.currentPage()). We assume the correct syntax for analysis.

C
Component: Uses to display a controller variable (ctrl.userInput), with a rendered attribute based on isEditable.
Escaping: is designed to display field values from sObjects and automatically escapes output to prevent XSS. The Visualforce Developer Guide states: ''The apex:outputField component renders field data with automatic HTML escaping, ensuring safe output'' (Salesforce Visualforce Developer Guide, apex:outputField). Even if ctrl.userInput contains malicious content, it's rendered as plain text.
Security: The value attribute expects a field reference (e.g., {!object.FieldName}), but here it's bound to a controller variable (ctrl.userInput). This is unconventional, as is typically used for sObject fields. However, even if ctrl.userInput is untrusted, the automatic escaping prevents XSS. The rendered attribute (isEditable) controls visibility and does not affect escaping.
Conclusion: Safe, as escapes output, though the usage is atypical.
Note on Typo: The question has a typo in the value attribute: ''(!ctrl.userinput)'' should be {!ctrl.userInput} (curly braces instead of parentheses), and ''isfditable'' should be isEditable. We assume the corrected syntax: .

D
Component: Uses to display a controller variable (ctrl.userInput).
Escaping: As with option C, automatically escapes output, preventing XSS. The Visualforce Developer Guide confirms: ''apex:outputField ensures safe rendering by escaping special characters'' (Salesforce Visualforce Developer Guide, apex:outputField).
Security: Even if ctrl.userInput contains malicious content, it's rendered as plain text, mitigating XSS risks. Like option C, using for a controller variable is unusual, but it does not introduce a vulnerability.
Conclusion: Safe, as escapes output.
Note on Typo: The question has a typo in the value attribute: ''{'ctrl.userInput}'' should be {!ctrl.userInput} (correct merge field syntax). We assume the corrected syntax: .
Why Option B is Correct:
Option B presents a security vulnerability because:
It uses with escape='false', disabling HTML escaping.
It renders untrusted user input (ApexPages.currentPage().getParameters().get('userInput')) directly, allowing malicious scripts to execute, which is a classic XSS vulnerability.
The Salesforce Secure Coding Guidelines explicitly warn against this practice: ''Rendering unescaped user input, such as URL parameters, can allow attackers to inject scripts'' (Salesforce Secure Coding Guidelines, Cross-Site Scripting).
The other options (A, C, D) either use default escaping ( in A) or inherently safe components ( in C and D), preventing XSS.
Handling Typos:
The question contains several typos, which were corrected for analysis:
Option A: ''SCurrentPage'' ApexPages.currentPage().
Option B: ''sCurrentPage'' ApexPages.currentPage().
Option C: ''(!ctrl.userinput)'' {!ctrl.userInput}, ''isfditable'' isEditable.
Option D: ''{'ctrl.userInput}'' {!ctrl.userInput}.
These corrections align with standard Visualforce and Apex syntax, ensuring the analysis reflects the intended functionality.
Example of the Vulnerability (Option B):
Consider a Visualforce page with option B's code:

If a user accesses the page with a URL like:
https://example.salesforce.com/apex/MyPage?userInput=<script>alert('Hacked!');</script>
The script <script>alert('Hacked!');</script> is rendered as executable HTML, displaying an alert in the user's browser, demonstrating an XSS attack. In contrast, option A (with default escaping) would render the script as plain text, preventing execution.
Mitigating the Vulnerability:
To fix option B, either:
Remove escape='false' to enable default escaping:

Sanitize the input in the controller using methods like String.escapeHtml4():
public String getUserInput() {
String input = ApexPages.currentPage().getParameters().get('userInput');
return input != null ? String.escapeHtml4(input) : '';
}

The Visualforce Developer Guide recommends: ''Sanitize untrusted input or rely on Visualforce's built-in escaping to prevent XSS'' (Salesforce Visualforce Developer Guide, Secure Coding for Visualforce).

Answer: B

Explanation:

Comprehensive and Detailed Explanation From Exact Extract: To determine which Visualforce code snippet presents a security vulnerability, we need to evaluate each option for potential risks, such as cross-site scripting (XSS), based on Salesforce's Visualforce security best practices. XSS vulnerabilities occur when user input is rendered on a page without proper sanitization, allowing malicious scripts to execute. Let's analyze each option systematically, referencing Salesforce's official documentation, particularly the Visualforce Developer Guide and Secure Coding Guidelines.

Understanding Visualforce Security:

Visualforce Components: Components like and are used to display data on a Visualforce page. Their behavior regarding HTML escaping (sanitizing output to prevent script injection) is critical to security.

XSS Vulnerability: XSS occurs when untrusted user input (e.g., from URL parameters or controller variables) is rendered as HTML without escaping special characters (e.g., <, >, &). The Visualforce Developer Guide states: ''To prevent XSS, Visualforce automatically escapes output unless explicitly disabled, but developers must be cautious with user input'' (Salesforce Visualforce Developer Guide, Secure Coding for Visualforce).

Key Security Features:

: By default, escapes HTML characters unless escape='false' is set.

: Automatically escapes output and is designed for bound fields, reducing XSS risk.

User input (e.g., ApexPages.currentPage().getParameters()) must be sanitized to prevent injection of scripts like <script>alert('hack');</script>.

Evaluating the Options:

Salesforce Visualforce Developer Guide:

''apex:outputText'' section: Details default escaping and the escape attribute's impact.

''apex:outputField'' section: Confirms automatic escaping for field output.

''Secure Coding for Visualforce'' section: Explains XSS prevention and best practices. (Available at: https://developer.salesforce.com/docs/atlas.en-us.pages.meta/pages/)

Salesforce Secure Coding Guidelines:

''Cross-Site Scripting (XSS)'' section: Warns against rendering unescaped user input and disabling escaping. (Available at: https://developer.salesforce.com/docs/atlas.en-us.secure_coding_guide.meta/secure_coding_guide/)

Salesforce Apex Developer Guide:

''ApexPages Class'' section: Describes ApexPages.currentPage().getParameters() for accessing URL parameters. (Available at: https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/)

Platform Developer I Study Guide:

Section on ''Salesforce Platform and Declarative Features'': Emphasizes secure Visualforce development and XSS prevention. (Available at: https://trailhead.salesforce.com/en/content/learn/modules/platform-developer-i-certification-study-guide)

Question: 3

(Full question statement)

A developer must create a CreditCardPayment class that provides an implementation of an existing Payment class.

public virtual class Payment {

public virtual void makePayment(Decimal amount) {

// implementation

}

Which is the correct implementation?

Apublic class CreditCardPayment extends Payment { public virtual void makePayment(Decimal amount) { /* implementation */ } }

Bpublic class CreditCardPayment implements Payment { public virtual void makePayment(Decimal amount) { /* implementation */ } }

Cpublic class CreditCardPayment implements Payment { public override void makePayment(Decimal amount) { /* implementation */ } }

Dpublic class CreditCardPayment extends Payment { public override void makePayment(Decimal amount) { /* implementation */ } }

Answer: D

Explanation:

Comprehensive and Detailed Explanation From Exact Extract:

D (Correct):Since Payment is avirtual class, it can beextended(not implemented like an interface), and its makePayment method is also virtual, which allows it to be overridden using the override keyword.

The use of override is required to redefine a virtual or abstract method from the parent class.

This maps to'Developer Fundamentals'in the PD1 exam, specifically aroundobject-oriented programming principles.

Question: 4

A developer needs to make a custom Lightning Web Component available in the Salesforce Classic user interface Which approach can be used to accomplish this?

AEmbed the Lightning Web Component is a Visualforce Component and add directly to the page layout.

BUse the Lightning Out JavaScript library to embed the Lightning Web Component in a Visualforce page and add to the page layout.

CUse a Visualforce page with a custom controller to invoke the Lightning Web Component using a call to an Apex method.

DWrap the Lightning Web Component in an Aura Component and surface the Aura Component as a Visualforce tab.

Answer: B

Explanation:

The Lightning Out library allows a Lightning Web Component to be embedded in a Visualforce page. This approach is the most suitable to make the LWC accessible in Salesforce Classic.

Question: 5

For which three items can a trace flag be configured?

Choose 3 answers

AApex Class

BFlow

CUser

DVisualforce

EApex Trigger

Answer: A, C, E

Explanation:

Option A (Apex Class): Trace flags can be configured for specific Apex classes to debug issues during their execution.

Option C (User): Trace flags can be set for specific users to debug issues occurring in their transactions.