Digital Marketing Proficiency13% of the exam
Data subject rights, tracking consent and encryption
Which Marketing Cloud Engagement tool answers each data subject request (Contact Delete, Contact Restriction, a portability extract, DoNotTrack), how Data at Rest Encryption, Field-Level Encryption and Key Management protect stored data, which data must never be stored, and the admin-account best practices that keep an account recoverable.
Recognize security best practices for data, permissions, and PII.
~8 min read · 13 practice questions ·
What the exam expects
- Map each data subject right (erasure, restriction of processing, portability, tracking consent) to the Marketing Cloud Engagement tool that fulfils it.
- Tell Email Studio's DoNotTrack attribute apart from MobilePush Do Not Track and from an unsubscribe.
- Choose between Data at Rest Encryption, Field-Level Encryption and Tokenized Sending for sensitive data, and name the data that must never be stored.
- Describe Key Management: its key types, the AMPscript symmetric functions' limits, and that it is on by default.
- Apply admin-user best practices for data and permission safety.
- Key terms: Contact Delete (removes contact information from Marketing Cloud Engagement); Contact Restriction (freezes a copy of contact data and blocks further activity); DoNotTrack (stops recording behavioral data for a subscriber); Field-Level Encryption (encrypts data extension fields at rest, decrypted at send time); Key Management (stores the keys used to encrypt, decrypt, sign and run SSO).
Key facts
Erasure
- Detail
- Contact Delete in Contact Builder or the Contact Delete REST resources
Restriction of processing
- Detail
- Contact Restriction REST API freezes a copy and blocks further activity
Portability
- Detail
- Automation Studio data extract on the contact's key or ID
DoNotTrack
- Detail
- Configure for the account, then set in Email Studio; stops recording behavior (an unsubscribe is separate)
Field-Level Encryption
- Detail
- Contact Builder data extensions only; decrypted at send time; Professional Services required
Key Management
- Detail
- On by default; Asymmetric, Symmetric, IV, Salt, SSH, SSO Metadata
AMPscript symmetric functions
- Detail
- Work only on data contained in Marketing Cloud Engagement
Never store
- Detail
- Government IDs, financial account numbers, PCI DSS identifiers
Admin redundancy
- Detail
- Multiple admins; at least one admin without SSO
- Why is Contact Restriction, not Contact Delete, the answer when records may be needed later?
- Why does DoNotTrack not replace an unsubscribe?
- Why can't a field-level-encrypted field be added to a data extension created in Email Studio?
- Which two Key Management types would an admin use for SFTP authentication and a passphrase-based AMPscript key?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Marketing Cloud Engagement Administrator pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 20 lessons of the Marketing Cloud Engagement Administrator guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (13 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams