SCAA logo
Focused certification exam prep
Start practice

SCAA Exam Domains 2026: Complete Guide to All 7 Content Areas

TL;DR
  • Security and Access and Process Automation are tied at 20% each, making them 40% of the exam combined.
  • The exam has 60 scored multiple-choice/multiple-select questions plus up to five unscored ones, in 105 minutes.
  • Passing requires 65%; the registration fee is US$200 and a retake costs US$100, plus applicable taxes.
  • Environment Management and Deployment is the lightest domain at 7%, but sandbox and change set questions are scenario-based.

The Exam Blueprint at a Glance

The Salesforce Certified Platform Administrator II exam is built for administrators who have already proven the fundamentals and now need to show they can handle complex, real-world configuration. Salesforce publishes seven weighted domains in its official exam outline, and every question you see maps back to one of them. Knowing the weights is the single fastest way to decide where your study hours should go.

DomainWeightCharacter of the Questions
1. Security and Access20%Access models, permissions, authentication
2. Objects and Applications19%Data model, relationships, UI/UX
3. Auditing and Monitoring10%Audit tools, sensitive data controls
4. Cloud Applications11%Sales, Service, Knowledge, Experience Cloud
5. Data and Analytics Management13%Data quality, reports, imports, external data
6. Environment Management and Deployment7%Sandboxes, change sets, AppExchange
7. Process Automation20%Declarative automation, order of execution

The format is 60 multiple-choice and multiple-select questions, with up to five additional unscored questions mixed in that you cannot tell apart from the real ones. You have 105 minutes and need 65% to pass. The exam is delivered through Pearson VUE, either at a testing center or via Pearson OnVUE online proctoring, and no reference materials of any kind are allowed. If you want a broader plan around these numbers, see our SCAA study guide for passing on your first attempt.

Multiple-select is where points leak: Many Platform Administrator II questions present a business scenario and ask you to choose two or three correct actions. Partial knowledge of a feature is rarely enough; you need to know why the wrong options fail, such as a limit, an access rule, or a sequencing constraint.

Domain 1: Security and Access (20%)

Tied for the heaviest domain, Security and Access rewards candidates who think in layers. The exam expects you to reason about who can see an object, who can see a record, and who can see a field, and to pick the right mechanism for each layer without over-granting access.

What to Master in Security and Access

The official objectives cover record and field access, the permission toolset, and authentication.

  • Record-level and field-level access, including how organization-wide defaults, role hierarchy, sharing rules, and manual sharing combine
  • Profiles versus permission sets and permission set groups, and when delegated administration is the right answer
  • Authentication options, including single sign-on concepts, login policies, and multi-factor authentication
  • Account and contact models, including how account relationships and sharing interact with contact visibility

Common Scenario Patterns

Expect questions where a user can see an object but not a particular record, or sees a record but cannot edit one field. The trick is to work from the most restrictive layer outward: object permissions first, then record access, then field-level security. Questions about delegated administration usually test whether you can hand off user management or specific setup tasks without giving someone full administrator rights.

Authentication questions tend to be practical rather than theoretical. You might be asked how to restrict logins by IP range or time, or which feature enforces a second verification factor. Because the exam is closed-book, you should be able to name the setting and describe its effect from memory.

Domain 2: Objects and Applications (19%)

This domain is the data-model heart of the exam. It tests whether you can design and adjust objects, fields, and relationships so that the org still behaves predictably as requirements grow.

What to Master in Objects and Applications

Candidates are expected to evaluate requirements and choose the right structural solution.

  • Object relationships: lookup, master-detail, many-to-many via junction objects, and the consequences of each for sharing and roll-up summary fields
  • Custom object and field configuration, including field types, dependent picklists, and validation rules
  • UI and UX customization: page layouts, record types, Lightning pages, compact layouts, and app configuration
  • How record types, business processes, and layouts work together for different user groups

A frequent exam theme is choosing between relationship types. Master-detail ties the child's sharing and deletion behavior to the parent, while lookup is looser and optional. When a scenario mentions roll-up summaries or cascading deletes, that is a signal to think master-detail. When it stresses independence of records, lookup is usually the better fit.

Because Objects and Applications is the second-largest domain, weak spots here are costly. Pair this material with the security layers above, since relationship choices directly change how sharing behaves. Our breakdown of how hard the SCAA exam is explains why these cross-domain scenarios feel harder than isolated feature questions.

Domain 3: Auditing and Monitoring (10%)

At 10%, this domain is smaller but highly learnable, because the tool set is finite. The exam wants to see that you know which audit or monitoring tool answers which question.

What to Master in Auditing and Monitoring

Focus on matching a tracking need to the correct tool.

  • Audit and monitoring tools: setup audit trail, field history tracking, login history, and event monitoring concepts
  • Understanding what each tool records, how far back it goes, and what it cannot capture
  • Sensitive-data controls, including how to restrict or protect fields that hold regulated information

A typical question describes an incident, such as an unexpected configuration change or a user who accessed the org at an odd hour, and asks which feature reveals what happened. The sensitive-data portion often overlaps with Domain 1, so reviewing field-level security and encryption options together is efficient.

Know the limits, not just the features: Questions in this domain often hinge on retention periods and scope. Be ready to say what a tool does not track, since distractor answers frequently name a real feature that simply cannot answer the question being asked.

Domain 4: Cloud Applications (11%)

Cloud Applications is the breadth domain. Rather than going deep on one product, it samples across the Salesforce clouds an administrator is likely to support, so your goal is dependable working knowledge of each.

What to Master in Cloud Applications

The official objectives span sales, service, and community-facing capabilities.

  • Sales functionality, including forecasting and Territory Management concepts
  • Salesforce Knowledge and entitlements for support teams
  • Agentforce Service capabilities and Experience Cloud features for customer and partner access
  • Current Salesforce materials also reference Agentforce Sales capabilities within the broader objectives

Since this domain touches many products, use it to find gaps rather than to chase depth. Forecasting and territory questions tend to be configuration-focused: how a forecast hierarchy relates to roles, or how territory assignment differs from role-based sharing. Knowledge and entitlements questions usually revolve around controlling which articles users see and which support terms apply to which customers.

For candidates who work mainly in one cloud, this domain is a reminder to build at least a lab-level familiarity with the others. If you are weighing whether that effort is worthwhile for your career, our ROI analysis of the SCAA certification covers the trade-offs.

Domain 5: Data and Analytics Management (13%)

This domain blends data stewardship with reporting. It asks whether you can keep data clean, bring data in safely, and surface it in ways that answer business questions.

What to Master in Data and Analytics Management

Think of it as the lifecycle of data from entry to insight.

  • Data quality: duplicate management, validation, and standardization practices
  • Reporting and analytics: report types, custom report types, joined reports, dashboards, and filters
  • External data access, including how Salesforce can reference data that lives outside the org
  • Data imports: choosing between import tools, handling record matching, and understanding what each tool can and cannot do

Reporting Details That Trip People Up

Report questions often turn on which records are visible to which user, since reports respect sharing. If a scenario says a dashboard shows different numbers to different people, think about the running user setting and underlying access. Custom report types come up when the standard types cannot express the object relationships a stakeholder needs.

For imports, learn the practical differences between the available tools, such as record limits, supported objects, and whether updates and upserts are possible. Exam writers like scenarios where one tool is the only one that fits.

Domain 6: Environment Management and Deployment (7%)

The smallest domain by weight, but do not skip it. A handful of questions here can decide a borderline result, and the content is highly deterministic: either you know what a sandbox type supports or you do not.

What to Master in Environment Management and Deployment

The objectives center on moving changes safely from development to production.

  • Sandbox types and what each is suited for, including differences in data and storage
  • Change sets: what they can and cannot include, deployment connections, and how inbound and outbound sets work
  • AppExchange deployment: installing, managing, and governing packaged solutions

Typical questions describe a team that needs to test a change, train users, or deploy a component, and ask for the right environment or method. Pay particular attention to what a change set cannot carry, because dependency and component-support gaps are classic distractors.

Domain 7: Process Automation (20%)

Sharing the top spot with Security and Access, Process Automation is where the exam's complexity peaks. The emphasis is on declarative tools, meaning you are expected to solve problems with configuration rather than code, and to understand how automations interact.

What to Master in Process Automation

Know each tool's purpose, strengths, and limits, and how they sequence.

  • Declarative automation options, including Flow, approval processes, validation rules, and workflow-era concepts you may still encounter in existing orgs
  • The order of execution: which operations fire before and after a record save, and how they can conflict
  • Choosing the right tool for a business requirement, such as when an approval process fits versus an automated flow
  • Diagnosing why an automation did not fire or produced an unexpected result

Order of execution deserves dedicated study time. Scenarios may describe a field update that appears to be overwritten or a validation rule that blocks an automation, and the correct answer depends on knowing which step runs first. Memorize the sequence well enough to reason through a conflict without notes, since none are allowed on exam day.

Key Takeaway

Security and Access plus Process Automation account for 40% of the exam. If you can only deepen two areas, make them these, and practice scenarios where the two overlap, such as an automation that runs in a context where a user lacks field access.

Sequencing Your Prep Around the Weights

You do not need a generic study plan here, just a sensible order that respects both the weights and the dependencies between domains. Security concepts underpin almost everything else, and the data model shapes both security and automation, so start there.

Week 1

Security and Access

  • Layer object, record, and field access until you can predict visibility
  • Review permission sets, delegated administration, and authentication settings
Week 2

Objects and Applications

  • Build relationships of each type in a practice org and observe the sharing effects
  • Configure record types and layouts for distinct user groups
Week 3

Process Automation

  • Build flows and approvals, then trace the order of execution on a test record
Week 4

Data, Clouds, Auditing, and Deployment

  • Cover reporting, imports, Knowledge, forecasting, audit tools, and change sets
  • Finish with timed mixed-domain practice

Because the exam assumes significant hands-on experience, time in a Developer Edition or sandbox org is worth more than rereading notes. Salesforce's stated candidate profile includes completion of Administer, Extend, and Automate Salesforce (ADX211) or equivalent experience and knowledge. Our SCAA requirements guide covers eligibility and prerequisites in detail, and the SCAA cheat sheet is useful for a final-days review of the facts that must be recalled from memory. When you are ready to test yourself under realistic conditions, try the SCAA practice tests.

The Summer '22 Version Caveat

One detail worth understanding before you study: the current official Platform Administrator II exam guide states that exam questions align to the Summer '22 release. Salesforce still lists the certification as active in its 2026 materials, and the seven weighted domains remain authoritative. However, the product has changed since that release, and newer capabilities such as Agentforce appear in current objectives.

How to handle the mismatch: Treat the official exam guide as your scope document and use current documentation to understand features, but be cautious when a newer UI or behavior differs from older descriptions. If a practice question seems to reflect older behavior, check it against the exam guide objective rather than assuming it is wrong. We did not find a newer public exam-outline version in the official sources reviewed, so confirm the latest on Salesforce's own pages before you register.

Cost and logistics matter too. The registration fee is US$200 and a retake is US$100, each plus applicable taxes, as detailed in our SCAA certification cost breakdown. Remember that certification maintenance applies: the exam guide states the Administrator maintenance badge must be completed three times a year, and the certification expires if required maintenance is not completed. For score specifics, see the SCAA passing score guide.

Frequently Asked Questions

Which SCAA exam domains carry the most weight?

Security and Access and Process Automation are tied at 20% each, followed by Objects and Applications at 19%. Together these three domains make up 59% of the exam, so they deserve the largest share of your study time.

How many questions are on the exam and how long do I have?

The exam contains 60 multiple-choice and multiple-select questions plus up to five unscored questions, with 105 minutes to complete it. You need 65% to pass, and no reference materials are permitted.

Do I need another certification before attempting Platform Administrator II?

Yes. The prerequisite is the Salesforce Certified Platform Administrator certification. Salesforce also describes the ideal candidate as having significant hands-on administrator experience.

Is the smallest domain safe to skip?

It is risky to skip. Environment Management and Deployment is only 7%, but its questions about sandboxes, change sets, and AppExchange deployment are factual and learnable, which makes them efficient points to secure.

Is the pass rate published?

No. Salesforce does not publicly disclose a pass rate for this exam. Our SCAA pass rate article explains what can and cannot be said from available data.

Ready to pass your SCAA exam?

Put this into practice with free SCAA questions across every exam domain.