What should a Salesforce architect recommend to make sure that users that gained access to a custom object record through Apex managed sharing do not lose access to it when its owner is changed?

Get Cloudy Consulting uses a strict security model. They enforce this model through object, field, and row- based security mechanisms. The Chief Technology Officer (CTO) at Get Cloudy Consulting wants to thoroughly test the security model, and an Architect decides to use Apex automated tests to fulfill the CTO's request.
What are three considerations for the Architect when using the runAs() method to design Apex unit tests?
(Choose three.)

Universal Containers (UC) provides shipment tracking for its customers on a custom Shipment object. The .. yearly by the customers should be available on the Account record to the Marketing team, but the Marketing Shipment records.
What recommend should an Architect provide to accomplish this?

Universal Containers is updating its Organization-Wide Sharing Settings for the Account Object from a "Public Read/Write" model to a "Private" model, so that they can hide certain national accounts from sales reps and sales managers. These national accounts should only be accessible by sales directors and above. Universal Container's Role Hirerarchy matches its organizational hierarchy.
Which two options should the Architect consider when designing the solution?
Choose 2 answers

What is the security vulnerability in the following code snippet? <apex:form>
<apex:commandButtonrerender="outputIt" value="Update It"/> <apex:inputText value="{!myTextField}"/>
<apex:form> <apex:outputPanel id="outputIt"> Value of my Textfield is <apex:outputText Value="{!myTextField}" escape="false"/> <apex:outputPanel>