A banking company uses a VIP Flag in the Contact Object that they want only...

Field-Level Security is the appropriate control because the requirement concerns whether a user may see a sensitive field anywhere in Salesforce, not merely whether the field appears on one page layout. If the VIP Flag is hidden through FLS for non-authorized users, Salesforce can suppress that field across record pages, reports, list views, search results, APIs, and other interfaces according to the user ' s effective permissions. Removing the field from a page layout is only a presentation change and is not a reliable security boundary; a user who retains FLS could still reach the value through another surface. Record types likewise select business processes and page layouts but do not provide authoritative field confidentiality. The architect should therefore grant field visibility only to the Private Banking population, preferably through the organization ' s chosen profile/permission-set strategy, and keep the field hidden from everyone else. This follows the principle that sensitive information must be protected at the data-access layer rather than by cosmetic UI configuration. Study Guide reference: Permissions to Standard Objects, Custom Objects, and Fields - Field-Level Security, page layouts, record types, profiles, permission sets, and protection of sensitive fields.