What is the difference between a profile and a permission set, and how would you use them together?

Every user has exactly one profile, which sets baseline settings such as login hours, IP ranges, default apps and page layout assignments, along with object and system permissions. Permission sets are additive: a user can have many, and each grants extra permissions without changing the profile.

My approach is to keep profiles minimal and grant most functional access through permission sets and permission set groups organized by job persona. That reduces profile sprawl and makes access easier to audit and change.

Interviewers want to hear that permissions are additive and that permission sets cannot remove access granted elsewhere. Strong candidates mention the industry move toward minimal profiles and permission set groups. A common pitfall is claiming a permission set can restrict access that a profile grants.