Two rounds decide most SFMC hires. The first is fundamentals: the data model, business units, subscriber identity and how a send is actually configured. The second is deliverability, compliance and security, usually taken by whoever owns delivery for the account. Both are configuration and governance rounds, so there is almost no code here. The 48 questions below come from a Marketing Cloud interview question bank used in live training batches, covering the core fundamentals set and the deliverability, compliance and security set.
Video walkthroughs
Two recorded sessions on this material. They were on the earlier version of this page and are kept here.
Platform, business units and account setup
What is Salesforce Marketing Cloud and how does it differ from Salesforce CRM?
Marketing Cloud is a separate platform for outbound and cross-channel engagement: email, SMS, push, advertising and web content. Salesforce CRM is a relational system of record built on Objects, Apex and SOQL. Marketing Cloud runs on its own infrastructure with Data Extensions instead of Objects, SQL and AMPscript instead of Apex, and Business Units instead of Profiles. They share no database and are linked only by Marketing Cloud Connect.
What are the key components of Salesforce Marketing Cloud?
Email Studio, Content Builder, Journey Builder, Automation Studio, Contact Builder, Mobile Studio, Advertising Studio, Web Studio with CloudPages, Analytics Builder and Setup. Underneath those sit the things you are actually judged on: the contact data model, the send infrastructure, and the configuration in Setup.
What are Business Units and why are they important?
Business Units are sub-accounts under an Enterprise 2.0 parent. Each has its own users, roles, sender profiles, send classifications, folders and subscriber statuses, while sharing the contact model and shared folders. In enterprise setups they separate brands, countries or lines of business so a sender address, an unsubscribe and a report belong to the right team. The consequence interviewers push on: an unsubscribe recorded in one business unit does not apply to another unless the account is configured for it.
What are the initial steps to set up a new SFMC account?
- Agree the business unit structure and create the hierarchy.
- Create roles and users, and assign each user to the correct business units.
- Complete the Sender Authentication Package: private domain, dedicated IP, DNS records, branded links.
- Verify sender addresses, then build Sender Profiles, Delivery Profiles and Send Classifications.
- Define the Contact Builder data model and fix the Subscriber Key strategy before loading data.
- Configure Enhanced FTP accounts, encryption keys and file naming conventions.
- Set data retention policies, security settings and login IP restrictions, then plan IP warming.
Step 5 is the one candidates skip and the one that cannot be undone cheaply later.
Subscribers, keys and lists
What is Subscriber Key and why is it important?
Subscriber Key is the unique identifier for a subscriber inside a business unit. If you do not set one, Marketing Cloud uses the email address, so one person with two addresses becomes two records and anyone who changes address loses their history. A stable key from the source system keeps tracking, suppression and preference data attached to the person rather than the mailbox.
What is the difference between Subscriber Key and Contact Key?
They usually hold the same value but belong to different layers of the platform.
| Subscriber Key | Contact Key | |
|---|---|---|
| Lives in | Email Studio, All Subscribers | Contact Builder, the contact model |
| Scope | Email channel, one business unit | All channels: email, SMS, push, ads, web |
| Created by | A subscriber added to a list or sendable data extension | Any channel record, or a contact created directly |
| Used for | Send targeting, subscriber status, list membership | Linking every channel record to one person |
| Relationship | Becomes the Contact Key when the subscriber is created | The parent identifier the Subscriber Key rolls up to |
Say it plainly: Subscriber Key is the email-side identifier, Contact Key is the cross-channel identifier, and Marketing Cloud treats them as the same person only when the values match exactly. Mismatches, usually caused by casing differences or trailing spaces in an import file, create duplicate contacts that inflate your contact count and split reporting. Interviewers use this question to separate people who have configured a data model from people who have only sent test emails.
What is the All Subscribers list?
All Subscribers is the master list of every subscriber record in a business unit, holding Subscriber Key, email address and status: Active, Held, Bounced or Unsubscribed. The status stored here overrides list and data extension membership at send time. An unsubscribe applied here is a master unsubscribe and stops all commercial mail from that business unit.
Send configuration: classifications, profiles and send types
What is a Send Classification?
A Send Classification is the reusable send configuration you pick on a send definition. It packages three things: a Sender Profile, which sets the From name and From address and governs reply handling; a Delivery Profile, which sets the header, footer and the IP or IP pool the send uses; and the class of mail, either Commercial or Transactional.
The class is what changes platform behaviour, because Commercial sends honour unsubscribes and carry the CAN-SPAM footer while Transactional sends do not. A dynamic sender profile sets the From name and address per subscriber using AMPscript or a data extension lookup, which is how account-manager and store-manager sends are built. This is a question where memorised definitions collapse the moment the interviewer says "give me a real project example", so have one ready: which brand, which From address, which footer, and why the transactional footer was different.
What is the difference between Commercial and Transactional emails?
Commercial mail promotes a product or service. Transactional mail completes something the subscriber already started: order confirmations, password resets, shipping updates, statements. The distinction is legal before it is technical, and the send classification is how Marketing Cloud enforces it.
| Commercial | Transactional | |
|---|---|---|
| Unsubscribe link | Required | Not required |
| Physical postal address | Required | Not required |
| All Subscribers unsubscribes | Honoured | Bypassed |
| Publication list opt-outs | Honoured | Bypassed |
| Held and hard-bounced records | Excluded | Excluded |
| Delivery route | Commercial IP or pool | Separate transactional IP |
The unsubscribe consequence is what the round turns on. Because a Transactional classification bypasses unsubscribe status, misclassifying a promotional email as transactional delivers marketing mail to people who opted out, which is a compliance breach rather than a configuration mistake. Bounce statuses are the exception: a held or hard-bounced address stays suppressed either way, because that is delivery protection, not consent. The defensible answer is that Transactional is used only for mail a subscriber cannot reasonably opt out of, and it runs on its own IP so promotional complaints never slow down password resets.
Promotional versus transactional is the same distinction in business language. Promotional describes the content, Commercial is the setting that enforces the rules.
What are the different types of email sends in SFMC?
User-initiated sends run manually through the guided send flow in Email Studio. Automated sends run from Automation Studio using an Email Send Definition, usually after an import or SQL activity. Triggered sends fire one message at a time against a Triggered Send Definition, Journey Builder sends are driven by the entry source and send activity, and API sends go through the SOAP or REST endpoints.
What is Throttling in email sends?
Throttling spreads a send across a defined time window instead of releasing the full volume at once. You set the period on the send definition and Marketing Cloud paces the deployment to fit. It protects a warming IP, avoids tripping receiver rate limits, and matches volume to what a call centre can absorb afterwards.
What are standard email performance metrics?
Sent, delivered and delivery rate measure whether mail reached the provider. Opens, unique opens, clicks, click-through rate and click-to-open rate measure engagement, and bounces by type, unsubscribes and complaints measure list quality. Add that open rate is no longer reliable because privacy features pre-fetch tracking pixels, so you judge on click-to-open rate and conversion.
What the interviewer is actually checking
- Whether you know that classification, not content, drives unsubscribe behaviour.
- Whether you can describe a Sender Profile and a Delivery Profile as separate objects.
- Whether you chose a Subscriber Key deliberately or inherited email address as the key.
- Whether you can name the send type you used last and say why.
Compliance and consent
What is CAN-SPAM compliance and how does SFMC ensure compliance?
CAN-SPAM is the United States law governing commercial email. It requires accurate header information, an honest subject line, a valid physical postal address, a working opt-out and prompt processing of it. Marketing Cloud supports this structurally: the Commercial classification forces the profile footer with address and unsubscribe link onto the send, and opt-outs are written to All Subscribers immediately.
What are key email compliance requirements?
Four things must be true of every commercial send: permission you can evidence, honest identification of sender and subject, an opt-out that works on the first click, and a physical postal address in the footer. Regional rules add conditions, such as GDPR requiring a lawful basis and a consent record, and Indian TRAI rules governing SMS templates and sending windows.
What is GDPR and CCPA compliance in SFMC?
GDPR is the European regulation requiring a lawful basis for processing and giving rights of access, rectification, portability and erasure. CCPA gives California consumers the right to know what is held, to have it deleted, and to opt out of its sale. Marketing Cloud supports both through Contact Delete in Contact Builder, Data Retention Policies, Audit Trail, field-level encryption and role-based access. The platform supplies the tools; the compliance is your data model and process.
What are Data Retention Policies?
A Data Retention Policy is set on a data extension and deletes data automatically after a defined period. It can apply to individual records by age, to all records, or to the whole data extension including its definition. It answers the requirement to keep personal data no longer than needed, and it stops staging extensions growing until queries time out.
What is Reply Mail Management?
Reply Mail Management processes mail coming back to your sending address. It filters automatic and out-of-office replies, forwards genuine human replies to a monitored mailbox, and handles replies asking to be removed. It is configured as part of the Sender Authentication Package and referenced on the Sender Profile.
How do you configure auto-unsubscribe keywords?
Auto-unsubscribe keywords sit inside Reply Mail Management. You define the words that signal an opt-out request, such as unsubscribe, remove or stop, and when they appear in the subject or body of a reply the subscriber is unsubscribed automatically. The point is legal as much as operational: an unread reply mailbox is not a defence.
How does SFMC manage unsubscribes?
Naming the levels in order is the whole answer. A list or data extension unsubscribe removes the subscriber from that audience only. A publication list unsubscribe removes them from one category of mail, which is how a preference centre works. A master unsubscribe at the All Subscribers level stops all commercial mail from that business unit, and in Enterprise 2.0 accounts unsubscribes are recorded per business unit unless configured to apply across the account.
What the interviewer is actually checking
- Whether you treat the footer as a legal requirement or as a template block.
- Whether you can explain unsubscribe scope across business units without guessing.
- Whether you know Contact Delete exists and what it actually removes.
- Whether retention is configured or data simply accumulates.
Authentication, IP reputation and deliverability
What is Sender Authentication Package (SAP)?
SAP is the paid configuration that makes your sending identity your own instead of shared. It provides a private sending domain with the required authentication records, a dedicated IP, branded link wrapping, a branded domain for images and CloudPages, and Reply Mail Management. Without it you send on shared reputation and your links point at a domain the subscriber does not recognise.
What is DKIM, SPF, and DMARC?
These are the three DNS-based checks a receiving server runs before deciding where your mail goes.
| Record | What it does | Failure means |
|---|---|---|
| SPF | TXT record listing the servers allowed to send for your domain | The sending IP is not authorised |
| DKIM | Signs the message so the receiver can verify it against a published public key | The message was altered or not signed by you |
| DMARC | Policy at _dmarc.yourdomain saying what to do when SPF or DKIM alignment fails |
Your policy applies: none, quarantine or reject |
SPF and DKIM prove the mail is authorised and intact. DMARC adds alignment between the visible From domain and the authenticated domain, plus a published policy and reporting. Major providers now expect all three from bulk senders.
What is IP Warming and why is it important?
IP warming is building reputation on a new dedicated IP by increasing volume gradually rather than sending the full list on day one. A new IP has no history, and receivers treat sudden high volume from an unknown IP as a spam signal, so mail is deferred, throttled or filtered. The ramp normally runs four to eight weeks.
How you do it matters more than the definition:
- Start with the most engaged subscribers, usually those who opened or clicked in the last 30 to 60 days.
- Send small volumes daily and step up, roughly doubling while results stay clean.
- Warm the major receiving domains separately, because Gmail, Yahoo and Outlook respond differently.
- Keep the cadence consistent, since gaps let the IP cool again.
- Watch bounce rate, complaint rate, deferrals and delivery rate at every step, and hold or step back rather than push through.
- Add less engaged segments only once the engaged base delivers cleanly, and keep transactional mail on a separate IP throughout.
This is where specificity creates credibility. "Yes, I have done IP warming" is worth nothing. "We warmed over six weeks from 5,000 a day to 30-day openers, split the ramp by domain because Outlook was deferring, and held volume flat for four days when complaints moved" is worth the offer.
What is Dedicated IP vs Shared IP?
| Dedicated IP | Shared IP | |
|---|---|---|
| Reputation | Yours alone | Pooled across several senders |
| Control | Full, including exposure to your own mistakes | Limited, others affect your delivery |
| Volume needed | Consistent volume required | Suits low or irregular volume |
| Warming | Must be warmed first | Already warm |
| Best for | Regular high-volume and transactional mail | Occasional senders, small lists, new accounts |
The judgement point is volume consistency. A dedicated IP used occasionally goes cold and performs worse than a shared pool, so recommending one for a low-volume client is the wrong answer.
How do you improve deliverability score?
Fix list quality first and configuration second. Remove hard bounces, apply a sunset policy to long-term non-openers, send more often to engaged segments, and never load purchased lists. Then confirm authentication is complete, separate commercial and transactional IPs, hold cadence steady, offer a preference centre, and treat complaint rate as your leading indicator. Seed testing tells you where mail lands, which delivery rate alone never will.
What is Complaint Feedback Loop?
A Feedback Loop is an arrangement with a mailbox provider under which a subscriber marking your mail as spam is reported back to the sender. Marketing Cloud is enrolled with the major providers and processes these automatically, unsubscribing the complainer. Complaint rate carries heavy weight with receivers, so a rising rate is the earliest sign that targeting or frequency is wrong.
What is IP Allowlisting?
IP allowlisting restricts access to your Marketing Cloud account to defined IP ranges, configured in Setup and applied to logins, API access and SFTP connections. It is the standard control where administrators and integration users should only connect from the corporate network. Watch the direction of the term: it restricts who can log in to your account, not who accepts your mail.
What the interviewer is actually checking
- Whether you can explain SPF, DKIM and DMARC separately rather than as one blur.
- Whether your IP warming answer contains volumes, segments and a decision to slow down.
- Whether you know complaint rate matters more than open rate for reputation.
- Whether you would put a low-volume client on a dedicated IP.
Bounces, suppression and troubleshooting
What is Bounce Management?
Bounce management is how Marketing Cloud reads the receiving server's response, classifies the failure and protects future sends by updating subscriber status.
| Bounce type | Cause | Platform response |
|---|---|---|
| Hard | Permanent: the address or domain does not exist | Subscriber moved to Held and excluded from future sends |
| Soft | Temporary: mailbox full, server unavailable, message too large | Retried during the send window; sustained failure moves the subscriber to Held |
| Block | Refused on reputation, content or policy grounds | Logged as a block bounce and investigated as a sender problem |
Held status is the part candidates miss. A held subscriber stays on the list and looks targetable but is excluded at send time, which is why a segment of 100,000 sends to 94,000 with nothing apparently wrong. Block bounces deserve separate handling: they are not bad addresses, they are a provider telling you something about your reputation or your content, so review them by domain rather than in the total.
What is Suppression Management?
A suppression list holds email addresses or subscriber keys excluded from a send even when they are in the target audience. You apply it on the send definition, on a send classification, or at business unit level, and it works as an exclusion layer without changing subscriber status. That is the difference from unsubscription: a suppressed subscriber stays Active and consented and will receive mail again if the suppression is lifted, which makes it right for temporary exclusions such as competitors, internal staff or people already contacted this week. An unsubscribe records the subscriber's decision and must never be implemented as a suppression list, because a suppression list can be switched off by anyone editing the send.
What is Send Log?
The send log is a data extension, created from the send log template and registered in Email Studio setup, that writes one row per subscriber per send. It records Job ID, List ID, Batch ID, Subscriber ID, Subscriber Key and event date, and you can add columns populated by AMPscript to capture the values actually used in personalisation. It answers "what did this customer receive", supports resends, and needs a retention policy because it grows fast.
How do you troubleshoot email delivery issues?
Work outwards from the audience instead of guessing.
- Compare targeted count against sent count. A gap means exclusions: Held, Unsubscribed, a suppression list or an exclusion script.
- Check the specific subscriber's status in All Subscribers.
- Check tracking for that job: delivered, bounced, or never attempted.
- Read the bounce reason text. Hard, soft and block point at three different owners.
- If the contact is in the automation or Journey Builder canvas but never in the send, check entry criteria, wait activity and the send activity audience, not the email.
- Check the send classification, since Transactional and Commercial behave differently for the same subscriber.
- Establish whether it is one domain or all domains. One domain means reputation or authentication, all domains means configuration.
Interviewers use debugging questions on purpose. "This contact is not receiving the send, what do you check" tells them far more than "what is a send definition", and candidates who know every definition often have no method for it. Answer with an order of checks, not a list of possibilities.
What the interviewer is actually checking
- Whether you know Held status exists and why the counts do not match.
- Whether you can separate a subscriber problem from a sender problem.
- Whether you would ever record an unsubscribe as a suppression.
- Whether you have a diagnostic sequence or a set of guesses.
Security, encryption and access control
What is Shield Platform Encryption?
Shield Platform Encryption is a Salesforce core feature, not a Marketing Cloud one. It encrypts data at rest in Sales and Service Cloud using tenant secrets and a key management service. Say that plainly, then name the Marketing Cloud equivalent: field-level encryption on data extension fields, with keys held in Marketing Cloud's own Key Management.
What is Enhanced Transaction Security?
Transaction Security is also a core Salesforce Shield capability. It evaluates events as they happen against policies you define and then acts: block the action, require multi-factor authentication, or notify an administrator. The Marketing Cloud counterparts are the security settings in Setup, session and password policy, login IP restrictions and Audit Trail.
What is Real-Time Event Monitoring?
Another Shield feature, streaming platform event data such as logins, report exports and API activity so it can be acted on immediately rather than pulled from a daily log file. In Marketing Cloud the comparable record is Audit Trail, which captures configuration and security-relevant changes in the account.
What is Field-Level Encryption?
Field-level encryption encrypts the values in selected data extension fields at rest, using a key you create in Key Management under Setup. Values are decrypted when the platform needs them, so sends and personalisation still work. Plan it early, because encrypted fields are restricted in how they can be used as primary keys and in filtering, which affects segmentation SQL.
How do you configure file encryption before import?
Files arriving on the Enhanced FTP can be encrypted by the source system with PGP or GPG. You generate the key pair, upload the relevant key in Key Management, and give the public key to the source system. In Automation Studio a File Transfer activity decrypts and unzips the file, and only then does Import File load it. The order is File Transfer, Import, SQL.
How do you manage SFTP storage limits?
Treat the Enhanced FTP as a transfer point, not a data store. Files are purged automatically after a retention window and the allocation is fixed, so an automation writing daily extracts without cleanup will eventually fail on space. Move processed files to a dated archive folder with a File Transfer activity, compress large extracts, and keep long-term archives in your own storage.
What is Role-Based Access Control in SFMC?
Access is controlled through roles, which are sets of permissions assigned to users per business unit. Standard roles cover the common patterns such as Administrator, Marketing Cloud Channel Manager, Content Creator, Data Manager and Viewer, and custom roles can be built where the standard set is too wide. The role decides what a user can do, the business unit assignment decides where, and folder sharing decides what they see.
What the interviewer is actually checking
- Whether you can tell a core Salesforce Shield feature from a Marketing Cloud one.
- Whether you know encryption changes what you can filter on.
- Whether your automations decrypt before importing, in the right order.
- Whether you have ever restricted a role instead of granting Administrator.
Platform capabilities and integration points
What is Multi-Channel Marketing in SFMC?
Coordinating email, SMS through MobileConnect, push and in-app through MobilePush, advertising audiences through Advertising Studio, and web content through CloudPages against one contact record. Journey Builder is the orchestration layer deciding which channel a contact gets and when.
What is Distributed Marketing?
A managed package that lets a central marketing team build and control campaign content in Marketing Cloud while partners, franchisees or field sales users send it from Sales, Service or Experience Cloud. Brand control, consent and tracking stay central. It is the standard answer for insurance, banking and dealership networks.
What is Predictive Intelligence in SFMC?
Delivered through Personalization Builder and Einstein, it uses behavioural data such as browsing, purchases and engagement to predict what a contact is likely to want, and returns product or content recommendations for email and web. Mention the catalogue and the tracking collect code, because without collected behaviour there is nothing to predict from.
What is Einstein Engagement Scoring?
It scores each contact's likelihood to open, click, unsubscribe and bounce, then groups them into personas such as loyalists, window shoppers, selective subscribers and dormant contacts. The practical use is frequency control: send more to engaged personas, reduce pressure on those likely to unsubscribe, and build a winback track for the dormant.
What is Marketing Cloud Connect and how does SFMC integrate with Salesforce CRM?
Marketing Cloud Connect is the managed package and configuration linking Marketing Cloud to Sales or Service Cloud. It gives you Synchronized Data Sources replicating CRM objects such as Contact, Lead, Account and Campaign, sends to CRM reports and campaigns, tracking written back to CRM records, and Sales Cloud entry sources in Journey Builder. It depends on a dedicated connected API user, and that user is the first thing to check when synchronisation stops.
What is the role of Analytics Builder?
Analytics Builder holds the reporting layer: standard email and web reports, custom report building against tracking data, Einstein reports, and report scheduling. It sits over the same tracking data exposed by data views, which is what you query with SQL when a standard report cannot answer the question.
What is the purpose of Interaction Studio?
Interaction Studio, now called Marketing Cloud Personalization, personalises web and mobile experiences in real time based on what the visitor is doing in the current session, and builds affinity profiles from that behaviour. It works on an inbound visit in the moment, where Journey Builder orchestrates outbound messages over time.
What is Audience Builder?
A segmentation tool that works on the Contact Builder data model through attribute groups, letting marketers build audiences visually instead of writing SQL. It needs the contact model properly linked and populated. Treat it as a legacy tool, since Salesforce has been directing new segmentation work toward Data Cloud.
What is Data Studio?
Data Studio is the data-sharing marketplace inside Marketing Cloud where organisations share or acquire audience data under agreed permissions and consent controls. It is used for audience expansion and lookalike targeting, most often in advertising.
What are Microsites?
Collections of hosted landing pages published under a branded domain, used for preference centres, sign-up forms, event registration and campaign pages. Current implementations build these as CloudPages in Web Studio on a branded domain from the Sender Authentication Package.
What is a Portfolio in Content Builder?
Portfolio is the asset storage area for images, documents and other files referenced in emails and landing pages by URL. In current accounts this content sits in Content Builder alongside emails and templates, which is why replacing one shared image asset updates every email that references it.
What the interviewer is actually checking
- Whether you know which capability belongs to which product and licence.
- Whether you can name the connected user as the usual cause of a Connect failure.
- Whether you place Journey Builder against Personalization correctly.
- Whether you have used a capability or only read the release notes.
How to prepare for this round
Fundamentals and deliverability reward an honest, specific answer over a polished one. Pick three things you have actually configured, a send classification, an IP warming plan, a bounce and suppression process, and be ready to say what you chose, what broke, and what you would change. Then answer in a fixed shape: the situation, your approach, the reason for that approach, and the result. That structure alone puts you ahead of candidates who open with "basically in our project we had one requirement".
To build these on a real account with guided practice on business unit setup, send configuration, deliverability and compliance, see the Salesforce Marketing Cloud training programme at RizeX Labs.