What is the appropriate action to restrict sales representatives from creating leads or sending mass emails?

Creating a custom profile is the correct action to restrict sales representatives from creating leads or sending mass emails because profiles in Salesforce control user permissions and access levels. By creating a custom profile, you can tailor specific permissions according to the needs of your organization, ensuring that sales representatives do not have access to create leads or utilize mass email functionality.

With a custom profile, you have the flexibility to set precise permissions, which is essential for managing the different roles within your organization effectively. This allows you to maintain control over what sales representatives can or cannot do, thus aligning their capabilities with your operational strategies.

While modifying a standard profile is another approach, it is less recommended because this could affect other users assigned to that profile who may require those permissions. The organization-wide default settings primarily manage sharing rules and record visibility, rather than specific user capabilities. Finally, sharing rules do not restrict user actions; they merely control access to records, making them ineffective for the intended restriction on creating leads and sending emails.