Which of the following is a best practice for handling credentials in Salesforce?

Keeping external app credentials off the Salesforce platform is a best practice because it helps to enhance security and reduces the risk of data breaches. By not storing sensitive credentials within Salesforce, organizations minimize the potential for exposure in the event of a security vulnerability or data leak within the Salesforce environment. This approach allows for external systems to manage their credentials securely, often leveraging specialized tools designed for secure storage and access controls.

Utilizing separate systems for credentials management ensures that these sensitive data points are protected by their own security measures, such as encryption and access restrictions, which may not be replicated within Salesforce. Additionally, this practice aligns with the principle of least privilege, promoting an environment where users have access only to the resources they genuinely need.

The other options pose significant security risks. Storing credentials directly in Salesforce opens up potential access points for unauthorized users, while using plaintext storage compromises the confidentiality of sensitive information. Sharing credentials through email is also insecure, as emails can be intercepted, leading to unauthorized access to critical systems. By understanding the importance of not integrating sensitive credentials directly within Salesforce and leveraging external management systems, organizations can significantly bolster their security posture.