Security7% of the exam
Encryption, tokenization, IP allowlists and SSO
The options that protect data and access in Marketing Cloud Engagement: Field-Level Encryption and its keys, Shield's Data at Rest Encryption, Tokenized Sending, the login IP allowlist and its modes (with blocking mode becoming mandatory), SAML single sign-on, and Audit Trail records.
Identify different options to secure data in Marketing Cloud.
~6 min read · 12 practice questions ·
What the exam expects
- Choose between Field-Level Encryption, Data at Rest Encryption and Tokenized Sending from where sensitive data may live and what code must change.
- Plan Field-Level Encryption: Professional Services, Contact Builder data extensions, per-business-unit keys, Journey Builder settings and key rotation.
- Configure the login IP allowlist's three modes, populate it, and avoid locking yourself out.
- Describe SAML 2.0 single sign-on limits and setup order.
- Retrieve Audit Trail records for investigations and outside tools.
- Key terms: Field-Level Encryption (encrypts chosen data extension fields at rest, decrypted at send time); Data at Rest Encryption (Shield's file-system encryption, transparent to the application); Tokenized Sending (sensitive data passed by API at send time, never stored); monitoring mode and blocking mode (the allowlist settings that log, or log and deny, unlisted logins); KEK (the key encryption key that protects other keys).
Key facts
Field-Level Encryption
- Detail
- Requires Professional Services; decrypted at send time
Encrypted data extensions
- Detail
- Contact Builder only; text or email address data
KEK rotation
- Detail
- At least one time per year
Shield versions
- Detail
- Shared or dedicated database; both include Encryption at Rest and Advanced Audit Trail
Suggested IP ranges
- Detail
- Based on the past 6 months of logins
Allowlist permission
- Detail
- Marketing Cloud Administrator
Mandatory blocking
- Detail
- By January 2027; covers UI and API access
SAML
- Detail
- Up to one SAML key per account
Sources for this section (5)
- Field-Level Encryptionhelp.salesforce.com (opens in a new tab)
- Marketing Cloud Engagement Shieldhelp.salesforce.com (opens in a new tab)
- Login IP Allowlisthelp.salesforce.com (opens in a new tab)
- Mandatory IP Allowlistinghelp.salesforce.com (opens in a new tab)
- Security Settings and Toolshelp.salesforce.com (opens in a new tab)
- Does the login IP allowlist restrict API calls as well as UI logins?
- When can't Salesforce offer recommended IP ranges for an account?
- Why must an SSO setup support single logout?
- Which time zone do Audit Trail records use?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Marketing Cloud Engagement Developer pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 25 lessons of the Marketing Cloud Engagement Developer guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Practice exams purchase adds inline bank questions and topic practice (12 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Choose guide-only, practice-only, or save $4 with both