• Cert++
  • Practice
  • Certle
  • Review
  • Tracks
  • Checklist
  • Guides
  • Upgrade
Cert++
  1. Home
  3. Platform Developer

Platform Developer

Checklist progress

0/194Learned

Platform Developer

Study Checklist

  • Platform Administrator
  • Platform App Builder
  • Platform Foundations
  • Platform Developer
  • Platform Administrator II
  • Agentforce Sales Consultant
  • Agentforce Service Consultant
  • Platform Data Architect
  • Platform Development Lifecycle and Deployment Architect
  • Platform Identity and Access Management Architect
  • Platform Integration Architect
  • Platform Sharing and Visibility Architect
  • Heroku Architect
  • B2C Solution Architect
  • Experience Cloud Consultant
  • Agentforce Field Service and Operations Consultant
  • Agentforce Nonprofit Consultant
  • Data 360 Consultant
  • Omnistudio Consultant
  • CRM Analytics and Einstein Discovery Consultant
  • Platform User Experience Designer
  • Platform Strategy Designer
  • B2C Commerce Developer
  • JavaScript Developer
  • Omnistudio Developer
  • Platform Developer II
  • Marketing Cloud Engagement Administrator
  • Marketing Cloud Engagement Specialist
  • Marketing Cloud Engagement Consultant
  • Agentforce Sales Foundations
  • Business Analyst
  • Marketing Cloud Engagement Developer
  • Marketing Cloud Engagement Foundations
  • Agentforce Specialist
  • Agentforce Life Sciences Consultant
  • B2B Commerce Administrator AP
  • B2B Commerce Developer AP
  • Agentforce Consumer Goods AP
  • Agentforce Financial Services AP
  • Agentforce Health AP
  • Agentforce Manufacturing AP
  • MuleSoft Integration Foundations
  • MuleSoft Developer
  • MuleSoft Developer II
  • MuleSoft Platform Integration Architect
  • MuleSoft Platform Architect
  • Tableau Desktop Foundations
  • Tableau Data Analyst
  • Tableau Consultant
  • Tableau Server Administrator
  • Tableau Architect

Checklist progress

0/194Learned

  • Multi-tenant architecture on the Lightning Platform
  • Metadata-driven architecture
  • Governor limits as multi-tenant resource controls
  • MVC architecture on the Lightning Platform
  • Lightning Component Framework capabilities
  • Aura versus Lightning Web Components programming models
  • Flow versus Apex for automation
  • Validation rules versus Apex triggers for data enforcement
  • Formula fields versus Apex for computed values
  • Formula fields versus roll-up summary fields
  • Roll-up summary relationship rules
  • Supported roll-up aggregate functions
  • SOQL and DML per-transaction governor limits
  • Heap size and CPU time governor limits
  • Standard versus custom objects
  • Custom field types for data requirements
  • Lookup versus master-detail relationships
  • Self-relationships and hierarchical relationships
  • Junction objects for many-to-many
  • Accessing related records through relationships
  • External ID fields for matching and upsert
  • Relating records by External ID in Apex
  • Agentforce for Developers in Apex development environments
  • Natural-language Apex generation with Agentforce for Developers
  • Limitations of Agentforce for Developers
  • Workflow and Process Builder versus Flow
  • Salesforce Flow types and launch methods
  • Create update and delete records in Flow
  • Flow decisions loops and formulas
  • Record-triggered flow before-save versus after-save
  • Record-triggered flow create update and delete events
  • Scheduled flows versus record-triggered scheduled paths
  • Approval process capabilities
  • Apex primitive data types
  • Apex collection variable declaration
  • sObject variables and casting
  • Apex class member variables
  • Apex constants and the final keyword
  • Apex method declaration and argument passing
  • Apex class constructors
  • Access modifiers for Apex classes and members
  • Static versus instance members in Apex
  • Apex properties versus member variables
  • Apex interfaces and implementing classes
  • Virtual, abstract, and override class modifiers
  • Apex inner class declarations
  • Sharing keywords on Apex class declarations
  • Transient members and Apex serialization
  • If-else branch selection and nesting
  • Logical operators and short-circuit evaluation
  • Switch statement matching and when blocks
  • If-else versus switch for branching
  • Traditional for-loop execution order
  • List and set for-loop iteration
  • While versus do-while loop execution
  • break and continue in Apex loops
  • SOQL versus SOSL for a retrieval requirement
  • Inline SOQL queries in Apex
  • SOQL result types in Apex
  • Unselected fields on queried sObjects
  • Apex bind variables in SOQL and SOSL
  • Child-to-parent SOQL relationship queries
  • Parent-to-child SOQL relationship queries
  • SOQL for loops versus list queries
  • SOQL aggregate queries in Apex
  • Inline SOSL queries and result lists
  • Dynamic SOQL versus inline SOQL
  • Dynamic SOSL versus inline SOSL
  • Apex DML statement operations
  • Bulk DML versus DML in a loop
  • DML statements versus Database class methods
  • Upsert and external ID fields
  • DML on related parent and child records
  • Mixed DML operations on setup and non-setup objects
  • Apex trigger definition syntax
  • Before versus after Apex triggers
  • Trigger context variable availability
  • Calling a class method from a trigger
  • Bulk-safe Apex trigger and class design
  • Callouts from Apex triggers
  • Bulk SOQL and DML in Apex transactions
  • Governor limit exceptions and transaction rollback
  • System.Limits methods for transaction usage
  • Synchronous versus asynchronous Apex governor limits
  • Shared governor limits for Flow and Apex
  • Apex transaction boundaries
  • Apex transaction atomicity and rollback
  • Record save order of execution
  • Before-save versus after-save automation
  • Validation rules versus Apex triggers in the save order
  • Field updates that re-enter the save order
  • Trigger recursion and recursion guards
  • Cascading DML and nested save orders
  • Savepoints and transaction rollback control
  • Immediate versus asynchronous work across transactions
  • Apex try, catch, and finally execution
  • Built-in Apex exception types
  • Catching specific versus generic Exception
  • DML exception handling in try-catch
  • Custom Apex exception classes
  • Unhandled exception effects on the transaction
  • Trigger addError versus thrown exceptions
  • Extending Flow with Apex
  • Invocable Apex method contracts
  • Starting autolaunched Flow from Apex
  • Record-triggered Flow and Apex trigger coordination
  • Validation rules combined with Apex triggers
  • Formula and roll-up fields with Apex automation
  • Approval processes combined with Apex

Given a scenario, prevent user interface and data access security vulnerabilities.

0/11

CRUD and FLS enforcement in Apex

Learn this concept
Unseen

with sharing versus without sharing on UI Apex

Learn this concept
Unseen

Lightning Data Service versus Apex for data access security

Learn this concept
Unseen

Visualforce standard versus custom controller data access

Learn this concept
Unseen

CRUD and FLS checks in Visualforce expressions

Learn this concept
Unseen

SOQL injection prevention in dynamic queries

Learn this concept
Unseen

Visualforce output encoding against XSS

Learn this concept
Unseen

Lightning component XSS and Locker protections

Learn this concept
Unseen

Cross-site request forgery protections in Visualforce and Lightning

Learn this concept
Unseen

Insecure direct object references in UI controllers

Learn this concept
Unseen

Flow system context and data access risks

Learn this concept
Unseen

Given a scenario, display and use custom user interface components, including Lightning components, Flow, and Visualforce.

0/15

  • Lightning components versus Flow versus Visualforce for custom UI
  • Visualforce page hosting surfaces
  • Visualforce expressions and merge fields
  • Visualforce standard controllers
  • Visualforce controller extensions versus custom controllers
  • Visualforce standard list controllers
  • Visualforce Lightning Experience container and navigation
  • Visualforce features to avoid in Lightning Experience
  • Standard action overrides with Visualforce or Lightning
  • Lightning component targets for App Builder pages
  • Lightning base record forms versus custom data UI
  • Screen flow distribution surfaces
  • Embedding a flow in a Visualforce page
  • Embedding a flow in Lightning web and Aura components
  • Custom Lightning components as Flow screen components

Describe the use cases and best practices for Lightning Web Components, including the framework, benefits, and events.

0/13

  • Lightning Web Components programming model
  • Benefits of Lightning Web Components
  • When to use Lightning Web Components versus Aura
  • Base Lightning components
  • Parent-to-child communication via public properties
  • Child-to-parent communication via custom events
  • Unrelated Lightning web component communication
  • Lightning web component and Aura composition
  • Lightning web component lifecycle hooks
  • Lightning web component data retrieval and caching
  • Lightning web component rendering performance
  • Third-party JavaScript in Lightning web components
  • Lightning web component actions versus JavaScript buttons

Given a scenario, implement Apex to work with various types of page components, including Lightning components, Flow, and Agentforce.

0/5

  • Apex entry points for page component types
  • AuraEnabled Apex for Lightning components
  • Cacheable AuraEnabled versus imperative Apex
  • Invocable Apex methods for Flow
  • Apex invocable methods as Agentforce actions
  • Apex test class and test method syntax
  • Code coverage requirements for Apex deployment
  • Executing Apex tests and test suites
  • Test data isolation versus SeeAllData
  • TestSetup methods for shared test data
  • Test utility classes for reusable test data
  • Static resource CSV files as test data
  • Test.startTest and Test.stopTest
  • Unit tests for Apex triggers
  • Positive, negative, and bulk Apex tests
  • Tests for Visualforce and Lightning Apex controllers
  • Permission-based Apex tests
  • Fixed SOSL results in Apex tests
  • Flow Builder tests before activation
  • Salesforce DX versus Developer Console
  • Developer Console Query Editor
  • Execute Anonymous Apex in Developer Console
  • Scratch orgs and Developer Hub
  • Salesforce CLI retrieve, deploy, and org authorization
  • Debug log generation and recorded events
  • Debug log categories and logging levels
  • Debug log size, retention, and volume limits
  • Developer Console Log Inspector
  • Developer Console checkpoints
  • Monitoring asynchronous Apex jobs
  • Monitoring scheduled Apex jobs
  • Flex Queue for batch Apex
  • Flow Builder debugger
  • Flow Trigger Explorer for record-triggered flows
  • Flow runtime error emails
  • Paused and failed flow interviews
  • Time-Based Automations for pending flow actions
  • Flow logs and version analytics
  • Sandbox types for development and release
  • Environments for authoring versus deploying Apex
  • Production requirements for deploying Apex
  • Change sets and deployment connections
  • Metadata API manifest deployments and promotion
  • Validate-only deployments and Quick Deploy
  • Deploying Apex with associated configuration
  • Change sets versus Metadata API versus DevOps Center

Prepare for the Exam

Play Today's Certle
Back to track

Study Community

Ask questions and get the latest info from other Platform Developer studiers.

Go to Discord

Visualforce output encoding against XSS

Explainer

Learn More

Practice Question

Keep going

Next conceptLightning component XSS and Locker protections

Checklist progress

0/194 (0%)

0 of 194 concepts learned

Tip: You can filter concepts by status.

Prepare for the Exam

Play Today's Certle
Back to track

Study Community

Ask questions and get the latest info from other Platform Developer studiers.

Go to Discord

Explainer

Cross-site scripting (XSS) is when a Visualforce page includes attacker-supplied HTML or client-side script in a response and a victim's browser runs it in a trusted context. The Lightning Platform filters harmful characters in most standard output methods, but formula expressions, escape="false", custom JavaScript, and apex:includeScript can still emit executable content. Encode merge-field and formula values for the context they land in, such as HTML, JavaScript, JavaScript inside HTML, or a URL, so reserved characters cannot break out and run.

Core information
  • An XSS attacker uses your page as the middleman: they submit malicious HTML or script, the page reflects it to another user, and that user's browser executes it, from opening windows to stealing session cookies so the attacker can act as the victim.
More details and nuances
  • If you set apex:outputText escape="false", wrap the value in HTMLENCODE (for example value="{!HTMLENCODE(myTextField)}") so HTML reserved characters are still encoded; leaving escape unspecified makes the character escape sequence display as written rather than as live HTML.