Overview
User Interface covers four objectives: preventing user interface and data access security vulnerabilities, displaying custom components (Lightning components, Flow and Visualforce), the use cases and best practices for Lightning Web Components (LWC), and writing Apex that works with page components, flows and Agentforce. The emphasis is less on markup and more on the contract between the screen and the server.
The section exists because Apex runs in system mode by default, so the moment a component calls a controller, the developer becomes responsible for sharing, field-level security and injection risks. It applies the MVC and Lightning Component Framework ideas from Developer Fundamentals, calls the queries and logic written in Process Automation and Logic, and produces controllers and components that Testing, Debugging, and Deployment must cover with tests and ship between environments.
How it's tested
Questions combine short code fragments with design scenarios: an Apex controller with dynamic SOQL, an LWC JavaScript class with decorators, a js-meta.xml target list, or a Visualforce page. You choose the secure fix, the correct annotation or decorator, or the right component technology. Several questions ask for two or three correct answers, so check every option against the requirement.
-
Find the vulnerability
Code concatenates user input into a query, disables escaping, or ignores field-level security, and you choose the change that closes the gap.
-
Wire it correctly
An LWC needs Apex data or must talk to another component, and you pick the annotation, decorator, event or messaging approach that works.
-
Pick the surface
A requirement describes where users interact, such as a record page, a guided process or an agent, and you choose LWC, Flow, Visualforce or an Agentforce action and the Apex it needs.
A Lightning web component must show a contact list and refresh when the user changes a filter. The reactive need suggests @wire with the filter as a reactive parameter ($filter). Wired Apex must be @AuraEnabled(cacheable=true), static and free of DML. If the same component also had to update records, that call would be a separate imperative, non-cacheable method, followed by refreshApex on the wired result.
Objectives 4
Official objectives from the Salesforce outline, in outline order.
3.1 Given a scenario, prevent user interface and data access security vulnerabilities.Sharing, CRUD and field-level security, SOQL injection and cross-site scripting.
- What it means
- Apex runs in system mode, ignoring the running user's object and field permissions unless told otherwise, and the sharing keywords (with sharing, without sharing, inherited sharing) control only record-level access. Data access protection comes from WITH USER_MODE or WITH SECURITY_ENFORCED in SOQL, Security.stripInaccessible, and describe checks. UI protection means preventing SOQL injection and cross-site scripting (XSS).
- What to understand
- Use bind variables (or String.escapeSingleQuotes when binding is impossible) for dynamic SOQL built from user input. Keep Visualforce's default output escaping, avoid escape="false" on user data, and use encoding functions such as JSENCODE and HTMLENCODE when data lands in scripts or raw HTML.
- How it shows up
- A controller is shown building a query by string concatenation, or returning records with fields the user cannot see, and you choose the fix.
- Common confusion
- Candidates think with sharing enforces field-level security; it enforces record sharing only, so object and field permissions need separate enforcement.
3.2 Given a scenario, display and use custom user interface components, including Lightning components, Flow, and Visualforce.Placing components on pages and choosing the right UI technology.
- What it means
- Lightning web components appear in Lightning App Builder, Experience Builder, the utility bar, quick actions and Flow screens when their js-meta.xml sets isExposed to true and lists targets such as lightning__RecordPage or lightning__FlowScreen. Screen flows provide guided, admin-maintainable processes. Visualforce pages use standard controllers, extensions or custom controllers and remain supported, particularly for existing pages and pixel-specific needs such as rendering as PDF.
- What to understand
- Choose LWC for new interactive components, a screen flow when the requirement is a guided multi-step process that admins should maintain, and Visualforce when maintaining existing pages or using capabilities such as renderAs PDF. Base components such as lightning-record-form use Lightning Data Service and respect sharing and field-level security without Apex.
- How it shows up
- A requirement describes where a component must appear or who maintains it, and you choose the technology or the js-meta.xml target needed to make it available.
- Common confusion
- Candidates expect a deployed LWC to appear in Lightning App Builder automatically, forgetting isExposed and the target list in the configuration file.
3.3 Describe the use cases and best practices for Lightning Web Components, including the framework, benefits, and events.LWC decorators, reactivity, lifecycle hooks and component communication.
- What it means
- Lightning Web Components are built on web standards (custom elements, modules, shadow DOM), so most logic is standard JavaScript and they run with less framework overhead than Aura. Decorators define behavior: @api for public properties and methods, @wire for reactive data from wire adapters or Apex, and @track for observing internal changes to objects and arrays.
- What to understand
- Data flows down through @api properties and up through events: a child dispatches a CustomEvent that its parent handles, with bubbles and composed false by default. Lightning Message Service connects components that are not in the same DOM hierarchy, including across Aura and Visualforce. Know lifecycle hooks such as connectedCallback and renderedCallback, and that all component fields are reactive without @track for reassignment.
- How it shows up
- A parent must pass a value to a child, a child must notify its parent, or two unrelated components on one page must communicate, and you choose @api, a CustomEvent or Lightning Message Service.
- Common confusion
- Candidates have a child modify an @api property it received; public properties are owned by the parent, so the child should dispatch an event instead.
3.4 Given a scenario, implement Apex to work with various types of page components, including Lightning components, Flow, and Agentforce.@AuraEnabled controllers, Visualforce controllers, invocable Apex and agent actions.
- What it means
- Lightning components call Apex methods annotated @AuraEnabled, which must be static and public or global. A method used with @wire must add cacheable=true and cannot perform DML; methods that change data are called imperatively and return a Promise. Visualforce uses controller properties and action methods, Flow uses @InvocableMethod, and Agentforce agent actions can run invocable Apex.
- What to understand
- Know when to use @wire (reactive, cached reads) versus imperative calls (on demand, writes), and refreshApex to reload a wired result after an update. For Flow and Agentforce, invocable methods take lists, and their labels and descriptions tell admins and the agent's reasoning what the action does.
- How it shows up
- A component fails to load data or throws on save, and you identify the missing static modifier, cacheable flag or the illegal DML inside a cacheable method.
- Common confusion
- Candidates mark a method that inserts records as cacheable=true so it can be wired; cacheable methods cannot perform DML.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
System mode
Apex runs with access to all objects and fields regardless of the running user's profile and permission sets unless the code enforces them.
- Remember
- Sharing keywords do not change this for object and field permissions; you must enforce CRUD and field-level security explicitly.
- Tested as
- The root cause in most data-exposure questions.
- Trap
- Assuming a component only shows what the user could see in the standard UI.
-
with sharing / without sharing / inherited sharing
Class-level keywords that decide whether the running user's record sharing rules apply to the class's queries and DML.
- Remember
- inherited sharing runs in the caller's mode and defaults to with sharing when the class is the entry point, which makes it a safe explicit choice.
- Tested as
- Questions on why a user sees records they should not.
- Trap
- Believing with sharing also hides fields the user cannot read.
-
WITH USER_MODE and stripInaccessible
WITH USER_MODE runs a SOQL query with the running user's sharing, object and field permissions; Security.stripInaccessible removes fields the user cannot access from query results or records before DML.
- Remember
- WITH SECURITY_ENFORCED is the older clause that throws when a selected field is inaccessible.
- Tested as
- The expected fix when a controller returns fields the user lacks permission to see.
- Trap
- Relying only on describe checks scattered through the code and missing a field.
-
SOQL injection
An attack where user input concatenated into a dynamic SOQL string changes the query's logic.
- Remember
- Use bind variables, including with Database.query, or String.escapeSingleQuotes when input must be concatenated.
- Tested as
- A controller with Database.query and string concatenation is the classic setup.
- Trap
- Thinking input validation in the browser is enough, when the server-side query is what must be protected.
-
Cross-site scripting (XSS)
Injecting script into a page through unescaped user-controlled data.
- Remember
- Visualforce escapes merge fields by default; escape="false" or raw values inside script blocks need JSENCODE, HTMLENCODE or URLENCODE.
- Tested as
- Visualforce snippets that output user input are the typical scenario.
- Trap
- Turning off escaping to render formatting and opening an injection path.
-
@api
Marks a public property or method on a Lightning web component so a parent component or App Builder can set or call it.
- Remember
- The parent owns public property values; the child should not reassign them.
- Tested as
- Parent-to-child communication questions.
- Trap
- Having the child change an @api property to tell the parent something.
-
@wire
Provisions data reactively from a wire adapter (such as getRecord in Lightning Data Service) or an Apex method, re-running when a reactive parameter prefixed with $ changes.
- Remember
- Wired Apex methods must be @AuraEnabled(cacheable=true), and results are cached on the client.
- Tested as
- Questions on loading data that responds to a changing value.
- Trap
- Using @wire for an Apex method that writes data.
-
CustomEvent
The standard way a child Lightning web component sends information to its parent, via this.dispatchEvent(new CustomEvent('name', { detail })).
- Remember
- Events do not bubble or cross the shadow boundary unless bubbles and composed are set; parents listen with an onname handler.
- Tested as
- Child-to-parent communication questions.
- Trap
- Naming the event with uppercase letters or an on prefix, which breaks the handler binding.
-
Lightning Message Service
A publish-subscribe service that lets components communicate across the DOM through a message channel, including between LWC, Aura and Visualforce.
- Remember
- Use it for unrelated components on the same Lightning page, not for a simple parent-child relationship.
- Tested as
- Scenarios with sibling or cross-technology components.
- Trap
- Using CustomEvent bubbling to reach a component that is not an ancestor.
-
@AuraEnabled(cacheable=true)
Exposes a static Apex method to Lightning components and marks its results as cacheable so it can be used with @wire.
- Remember
- Cacheable methods cannot perform DML; call write methods imperatively and refresh wired data with refreshApex.
- Tested as
- Annotation and runtime-error questions.
- Trap
- Leaving the method non-static or adding DML to a cacheable method.
-
Visualforce controllers
A standard controller provides built-in record behavior, an extension adds logic to it through a constructor that takes ApexPages.StandardController, and a custom controller replaces it entirely.
- Remember
- Extensions keep the standard controller's built-in actions such as save and edit while adding custom ones; extension code itself runs in system mode unless declared with sharing.
- Tested as
- Questions on adding logic to an existing Visualforce page.
- Trap
- Writing a full custom controller when only one extra action is needed.
-
Invocable Apex for Flow and Agentforce
A static method annotated @InvocableMethod becomes an action available to Flow and to Agentforce agent actions.
- Remember
- Inputs and outputs are lists; clear labels and descriptions help admins and the agent's reasoning select the action.
- Tested as
- Questions about exposing Apex logic to declarative tools and agents.
- Trap
- Writing an @AuraEnabled method and expecting Flow or an agent to call it.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
with sharing vs. WITH USER_MODE vs. stripInaccessible
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| with sharing | Applies the running user's record sharing to the class | Record visibility only; no object or field permissions | Assuming it hides restricted fields |
| WITH USER_MODE | SOQL clause that runs the query as the user | Enforces sharing, object and field permissions for that query | Forgetting DML needs its own user-mode handling |
| Security.stripInaccessible | Removes inaccessible fields from records | Sanitizes results or inputs instead of throwing an error | Not checking which fields were removed before using them |
@api vs. CustomEvent vs. Lightning Message Service
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| @api | Public property or method set by a parent | Data flows down from parent to child | Child reassigning the property to talk back |
| CustomEvent | Event dispatched by a child component | Data flows up from child to parent | Expecting it to reach unrelated components |
| Lightning Message Service | Publish-subscribe over a message channel | Connects components across the DOM and technologies | Using it for a simple parent-child link |
@wire vs. imperative Apex
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| @wire | Reactive, declarative data provisioning | Requires cacheable=true; read-only; reruns when $ parameters change | Wiring a method that performs DML |
| Imperative call | Calling the imported Apex function in JavaScript, returning a Promise | On-demand; can perform DML when not cacheable | Forgetting refreshApex after updating wired data |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Sharing equals security
- What candidates pick
- Add with sharing to fix a controller that exposes a confidential field.
- Why it looks right
- with sharing is the best-known Apex security keyword.
- Why it's wrong
- Sharing controls which records are visible, not which fields; field-level security needs WITH USER_MODE, WITH SECURITY_ENFORCED or stripInaccessible.
Clue to watch for The problem is a field the user should not see, not a record.
-
Escape on the client
- What candidates pick
- Validate or sanitize the search box with JavaScript to stop SOQL injection.
- Why it looks right
- It blocks bad input before it reaches the server.
- Why it's wrong
- Client-side checks can be bypassed; the server-side query must use bind variables or escaping.
Clue to watch for Dynamic SOQL in Apex built from a user-supplied string.
-
DML in a cacheable method
- What candidates pick
- Mark a save method @AuraEnabled(cacheable=true) so the component can wire it.
- Why it looks right
- It makes the method usable with the simpler @wire syntax.
- Why it's wrong
- Cacheable methods cannot perform DML; writes must be called imperatively from a non-cacheable method.
Clue to watch for The method inserts, updates or deletes records.
-
Child edits public property
- What candidates pick
- The child component reassigns its @api value to notify the parent.
- Why it looks right
- The value is shared, so changing it looks like a direct way to communicate.
- Why it's wrong
- The parent owns public properties; the child should dispatch a CustomEvent with the data in detail.
Clue to watch for Information needs to flow from child to parent.
-
Bubbling to a stranger
- What candidates pick
- Dispatch a bubbling, composed CustomEvent so an unrelated component elsewhere on the page receives it.
- Why it looks right
- Bubbling feels like a way to broadcast.
- Why it's wrong
- Events only travel up through ancestors; components outside that path need Lightning Message Service.
Clue to watch for The receiving component is a sibling in another region or a Visualforce or Aura component.
-
Turn off escaping
- What candidates pick
- Use escape="false" on an outputText to render user-entered formatting in Visualforce.
- Why it looks right
- It makes the formatting display as intended.
- Why it's wrong
- Disabling escaping on user-controlled data creates a cross-site scripting risk.
Clue to watch for The output value comes from a field or parameter a user can edit.
-
Custom controller for one button
- What candidates pick
- Replace the standard controller with a custom controller to add a single custom action.
- Why it looks right
- Custom controllers give full control.
- Why it's wrong
- A controller extension adds the action while keeping standard controller behavior and less code to test.
Clue to watch for The page already uses a standard controller and needs only one extra action.
Answer framework
For any User Interface scenario, use these steps to choose the secure, working solution.
- Identify the surface: record page, guided process, existing Visualforce page or agent, and choose LWC, Flow, Visualforce or an Agentforce action accordingly.
- Check data access: decide record sharing with a sharing keyword, then enforce object and field permissions with user mode or stripInaccessible.
- Remove injection paths by binding user input in dynamic SOQL and keeping Visualforce output escaping on for any user-controlled value.
- Match the Apex contract: @AuraEnabled static methods, cacheable=true only for read-only wired data, and @InvocableMethod with lists for Flow and agents.
- Choose communication: @api downward, CustomEvent upward, Lightning Message Service across unrelated components, and refreshApex after imperative updates.
Practice question
Want more like this? The Salesforce PD1 practice test has questions for every domain.
Checklist
0 of 13
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Begin with security, because it carries across every UI technology and is the most underestimated area. Learn the split between record sharing and object and field permissions until you can say which tool enforces each, then practice rewriting a concatenated dynamic query with bind variables.
Next, build one small Lightning web component end to end in a Developer Edition org or scratch org: expose it in js-meta.xml, wire a cacheable Apex method with a reactive parameter, add an imperative save method, and refresh the wired data afterwards. Add a child component that receives an @api property and sends a CustomEvent back. Doing this once makes the decorator and annotation rules stick.
Then review Visualforce at the controller level: standard controllers, extensions and custom controllers, and where escaping applies. Finish with invocable Apex for Flow screens and Agentforce actions, focusing on list-based inputs and clear descriptions.
Afterwards, practice mixed questions that pair a code fragment with a requirement, and for each miss write down which rule (security, decorator, annotation or communication) you misapplied.
FAQ
How much of the Platform Developer I exam is User Interface?
User Interface is 25% of the exam. Applied to the 60 scored questions that suggests about 15 questions as a planning estimate; Salesforce does not publish per-section counts.
Is Visualforce still on the exam?
Yes. The exam guide lists Visualforce alongside Lightning components and Flow for displaying custom UI, so know standard controllers, extensions, custom controllers and output escaping, even though new development generally favors Lightning Web Components.
Does with sharing enforce field-level security?
No. Sharing keywords control record visibility only. Enforce object and field permissions with WITH USER_MODE or WITH SECURITY_ENFORCED in SOQL, Security.stripInaccessible, or describe checks.
Why must a wired Apex method be cacheable?
The wire service caches results on the client and may serve them without a server call, so it requires methods marked @AuraEnabled(cacheable=true). Because they can be cached, those methods are not allowed to perform DML.
How do Lightning web components communicate?
Parents pass data down through @api properties, children send data up with CustomEvent, and components outside a parent-child path use Lightning Message Service, which also reaches Aura and Visualforce.
What does Agentforce have to do with a developer UI section?
The guide includes implementing Apex that works with Agentforce. In practice that means exposing logic as invocable Apex, with list-based inputs and clear descriptions, so it can be used as an agent action, just as it can be used from Flow.
How does this section relate to testing?
Every Apex controller and invocable method you write here needs test coverage before deployment, and security choices such as sharing and user mode change what those tests should assert.
Other CRM & Business Applications certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 3 knowledge
You have covered UI and data access security, LWC decorators and events, Visualforce controllers, and exposing Apex to components, Flow and Agentforce. Check whether you can spot the secure, working option in timed questions.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the Salesforce PD1 AI tutor Get any concept explained your way