Security7% of the exam
Securing API credentials, users and passwords
Security practices a developer applies: keeping client credentials and tokens server-side, reusing tokens instead of requesting one per call, API users and the inactivity setting, Salesforce's recommended session, lockout and password values, export allowlists, and firewall and partner IP ranges.
Describe security best practices in Marketing Cloud.
~5 min read · 9 practice questions ·
What the exam expects
- Keep client IDs, client secrets and access tokens out of browser and mobile code, and store them server-side.
- Reuse access tokens for their lifetime and refresh them before they expire, instead of requesting one per call.
- Set up API users so security settings such as Login Expires After Inactivity don't break integrations.
- Apply Salesforce's recommended values for session timeout, lockout, usernames, passwords and export allowlists, and know what a lockout blocks.
- Allow the right Salesforce IP addresses and domains on corporate firewalls, and have partners publish their own ranges for customer allowlists.
- Key terms: client credentials (the client ID and secret of a server-to-server API integration); access token (acts as a session ID for API requests); API user (a user flagged for XML, SOAP and REST API access); lockout (blocked access after too many wrong passwords); export email allowlist (addresses allowed to receive data exports).
Key facts
Client ID and secret
- Detail
- Never in client-side JavaScript or a mobile app
Token lifetime
- Detail
- 20 minutes;
expires_in1080 seconds
Inactivity expiry
- Detail
- 90 days or fewer; not recommended with API users
Lockout
- Detail
- 3 attempts; admin unlock needed before an activation code
Passwords
- Detail
- Minimum length 8 or more; history 8 or more; expire 90 days
Session timeout
- Detail
- 20 minutes
Firewall list
- Detail
- Allow the entire set; check quarterly
- Why does Salesforce say each extra password character matters?
- When does a short session timeout protect an account?
- What does the API User flag on a user record control?
- Why should a firewall rule for Salesforce IP addresses be reviewed on a schedule?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Marketing Cloud Engagement Developer pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 25 lessons of the Marketing Cloud Engagement Developer guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Practice exams purchase adds inline bank questions and topic practice (9 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Choose guide-only, practice-only, or save $4 with both