Setup38% of the exam
Login security, password policies and Audit Trail
The Marketing Cloud Engagement security settings and their recommended values (session timeout, login expiry, lockout, username and password rules, FTP exemption), MFA that most tenants can't turn off and step-up reauthentication, the Login IP Allowlist, Connection Security, the Export Email Allowlist, and Basic versus Advanced Audit Trail.
Given a scenario, implement the configuration of business units, users/permissions, and security/passwords.
~7 min read · 17 practice questions ·
What the exam expects
- Pick the security setting and recommended value for a login threat: Session Timeout, Login Expires After Inactivity, Invalid Logins Before Lockout, Minimum Username Length.
- Configure Password Policies, including the FTP user exemption and password change emails.
- Explain MFA in Marketing Cloud Engagement: why most tenants can't disable it, which methods resist phishing, and when step-up authentication fires.
- Restrict where logins come from and where exports go, and confirm TLS 1.2 connections.
- Compare Basic and Advanced Audit Trail and say who can see which records and how to get them out.
- Key terms: step-up authentication (MFA again before a critical change); PR-MFA (phishing-resistant MFA); Login IP Allowlist (only listed IP ranges can log in); Audit Trail (access and activity records).
Key facts
Session Timeout
- Detail
- Recommended 20 minutes
Login expiry
- Detail
- 90 days or fewer; expired user needs an admin reset
Lockout
- Detail
- Three attempts; admin unlocks
Username and password length
- Detail
- Eight characters or more each
Password history and expiry
- Detail
- History 8 or more; expire every 90 days
MFA
- Detail
- Can't be disabled for most tenants
PR-MFA methods
- Detail
- Physical security keys and platform authenticators
- Source
- MFA (opens in a new tab)
Login IP Allowlist
- Detail
- Off by default; covers UI and API logins
Basic vs Advanced retention
- Detail
- 30 days vs 60 days
Audit Trail visibility and time zone
- Detail
- Parent sees itself and all children; CST
- Why isn't Login Expires After Inactivity recommended when the account has API users?
- When will an admin who already passed MFA be prompted again?
- Which MFA methods are phishing-resistant?
- How do you keep Audit Trail records longer than the retention window?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Marketing Cloud Engagement Administrator pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 20 lessons of the Marketing Cloud Engagement Administrator guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (17 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams