Explanation
Removing Read permission on the Driver profile will prevent the driver from seeing any feedback records, regardless of ownership. Having feedback ownership transferred to the driver when feedback is submitted will not prevent the driver from seeing their own feedback records. Using the Role Hierarchy to give access to a driver's manager will not work if the driver changes managers, as the feedback records will still be owned by the previous manager. The best option is to create an ownership-based sharing rule that grants Read access to the feedback records owned by drivers in a specific role or public group to users in roles above them

Explanation
Assigning users profiles and unlocking users are two capabilities that the delegated administrator permission provides. Delegated administrators are users who can perform certain administrative tasks on behalf of administrators. These tasks include assigning users to specified profiles or permission sets, creating and editing users in specified roles or groups, unlocking users who have exceeded their login attempts limit, resetting passwords for users in specified roles or groups, logging in as users who have granted login access to administrators. Option C is incorrect, since setting OWD is not a capability that delegated administrators have.
Option D is incorrect, since creating profiles is not a capability that delegated administrators have.

Explanation
Cross-Site Scripting (XSS) and SOQL Injection are two common types of security vulnerabilities that can affect Salesforce applications. XSS occurs when malicious code is injected into a web page that can execute in the browser of a user who visits that page6. SOQL Injection occurs when user input is used to construct a SOQL query without proper validation or escaping, which can allow an attacker to manipulate the query and access unauthorized data7. To prevent XSS, developers should use appropriate encoding methods when displaying user input on custom pages8. To prevent SOQL Injection, developers should use bind variables or the escapeSingleQuotes() method when building SOQL queries with user input9. Option A is incorrect, since Apex queries are not vulnerable to XSS. Option D is incorrect, since testing for invalid user access attempts is not related to security vulnerabilities within the Salesforce organization.