Salesforce Interview Questions 2026

Design a multi-tenant SaaS database architecture like Salesforce's. Thousands of enterprise customers share the same infrastructure but must never see each other's data. Compare silo (one DB per tenant), pool (shared DB, tenant_id column), and bridge models. Discuss query performance, schema customisation, and compliance isolation.

Design Salesforce's governor limits enforcement system. Every Apex code execution is limited (SOQL queries, CPU time, heap). How do you track and enforce these limits in real time across millions of concurrent org executions?

Design Salesforce Flow (visual process automation). Users define business workflows (if-then rules, send emails, create records) in a UI. How do you store, version, execute, and debug millions of active flows in a multi-tenant environment?

Explain Salesforce's metadata-driven architecture. Why does storing field definitions as data (instead of schema changes) enable the multi-tenant model? What are the trade-offs in query performance?

What is Salesforce's SOQL and how does it differ from SQL? Explain relationship queries (parent-to-child and child-to-parent), the 100-SOQL governor limit, and how you optimise queries to avoid hitting it.

Salesforce emphasises trust as its #1 value. Describe a situation where you discovered a potential security vulnerability or data leak. What did you do and how did you balance urgency with transparency?

Salesforce emphasizes "trust" as a core value. Tell me about a time you found a bug in production that no one else had noticed yet. What did you do?

Design a multi-tenant database architecture for a CRM SaaS product with 100,000 customers, where each customer's data must be strictly isolated but the schema is largely shared. Compare separate databases per tenant vs. shared schema with a tenant_id column.

Write a query to find customers who placed an order in each of the last 3 consecutive months, using an Orders table with customer_id and order_date.

Explain the difference between role-based access control (RBAC) and attribute-based access control (ABAC). Give an example permission requirement that RBAC alone can't express cleanly.

When would you use the Builder pattern in Java instead of a constructor with many parameters? Sketch a builder for a User class with 6 optional fields.

In a shared-schema multi-tenant database, what specific bug pattern most commonly causes cross-tenant data leaks, and how do you prevent it at the code level, not just by convention?