Data-Con-101 · Domain 2 of 6

Data-Con-101 Domain 2: Data 360 Setup and Administration

Data 360 Setup and Administration covers provisioning and securing a Data 360 org: permission sets and org-wide settings, governance built into configuration, moving work between orgs with data kits and packages, and diagnosing common issues.

Exam weight
13%
Official objectives
4
Estimated questions estimate
~8
Suggested study time estimate
9–11 hrs

About 13 min read Reviewed October 2026

Overview

This section is about running Data 360 as an administrator. Its four objectives ask you to configure Data 360 permissions, permission sets and organization-wide settings, apply data governance requirements to the platform configuration, manage the development lifecycle with available tooling, and use tooling to diagnose and troubleshoot common issues.

Setup starts in Data 360 Setup, where the org is provisioned and the standard Data 360 permission sets are assigned by role, such as administrators, marketing managers, specialists and data-aware users. Governance covers data spaces that partition data by brand, region or business unit, data classification and policy controls on sensitive fields, and consent handling. Lifecycle topics include sandboxes, data kits and packages that move streams, mappings, insights and segments between orgs. Troubleshooting uses Data Explorer, Query Editor, Profile Explorer, refresh history and processing status pages.

How it's tested

Questions describe an admin task or a problem report. A new analyst needs read access, a second brand must be isolated, a configuration must move from sandbox to production, or a stream shows zero records. You pick the permission, governance feature, deployment approach or diagnostic tool that fits.

  • Least access

    A user role is described, and you choose the Data 360 permission set or data space assignment that grants only what the job needs.

  • Partition and protect

    A business requires separation by brand or region, or protection of sensitive fields, and you pick data spaces, classification or policies.

  • Find the cause

    A symptom such as missing records or failed refreshes is given, and you choose the tool that reveals the cause.

Reasoning it through

A holding company runs two retail brands in one Data 360 org. Each brand's marketers must build segments only on their own customers, while a central team sees both. Creating a data space per brand, filtering shared objects into each space and assigning marketers to their brand's space gives the separation. The central team gets access to both spaces instead of a second org.

Objectives 4

Official objectives from the Salesforce outline, in outline order.

2.1 Configure Data 360 permissions, permission sets, and organization-wide settings.Provisioning, standard permission sets and org settings.
What it means
After Data 360 is provisioned, administrators complete Data 360 Setup, connect the Salesforce CRM org and assign the standard Data 360 permission sets. These sets map to roles such as admin, marketing manager, marketing specialist and data-aware specialist, and control who can create streams, mappings, segments and activations.
What to understand
Assign the narrowest permission set that fits the job, and use permission set groups or custom sets when a role needs a mix. The admin set grants full configuration rights, so it should stay with a few people. Org-wide items include connector setup, data space defaults, feature settings such as the Einstein and Agentforce integrations, and the connected CRM orgs. Data 360 respects platform user management, so profiles and permission sets still apply.
How it shows up
A user's job is described, and you choose the Data 360 permission set or setting that lets them do it without over-granting.
Common confusion
Giving the admin permission set to every analyst, which also allows changes to streams, mappings and identity rules.
2.2 Apply data governance requirements to platform configuration.Data spaces, sensitive data controls and consent.
What it means
Governance requirements become configuration choices: data spaces separate data and metadata by brand, region or department; data classification tags identify sensitive fields; policies and permissions restrict who can query or activate them; and consent and contact point data control who may be contacted on which channel.
What to understand
Data spaces let one org serve several business units, with objects filtered or assigned to each space and users granted access per space. Sensitive data controls work alongside field-level access so that, for example, only approved roles see health or financial attributes. Consent mapped into the data model lets segments and activations exclude people who opted out. Deletion and data subject requests must flow through the supported processes so that unified profiles are also cleaned up.
How it shows up
A legal, regional or brand separation requirement is given, and you choose the configuration that enforces it.
Common confusion
Creating a separate Data 360 org per brand by default when data spaces already provide logical separation.
2.3 Manage the development lifecycle with available tooling.Sandboxes, data kits and packaging.
What it means
Data 360 configuration such as data streams, mappings, calculated insights, segments and activation targets can be built in a sandbox and moved to production. Data kits bundle Data 360 metadata so it can be added to a package or deployed, and DevOps tooling and the Metadata API support repeatable releases.
What to understand
Use a sandbox with Data 360 enabled to build and test, then package the configuration with a data kit and deploy it. A data kit carries the definitions, not the ingested records, so production streams still pull their own data after deployment. Partners use managed packages with data kits to distribute reusable Data 360 solutions, including through AgentExchange. Order matters: deploy the streams and mappings that later objects depend on first.
How it shows up
A team wants to move or reuse Data 360 configuration across orgs, and you pick the lifecycle tool.
Common confusion
Expecting a data kit to copy the actual customer records between orgs.
2.4 Use tooling to diagnose and troubleshoot common issues.Data Explorer, Query Editor, Profile Explorer and status pages.
What it means
Data 360 provides tools for inspection: Data Explorer to view records in data lake objects, data model objects and calculated insights; Query Editor to run SQL; Profile Explorer to inspect a unified profile and its source records; and refresh history, processing history and status details on streams, identity rulesets, insights, segments and activations.
What to understand
Match the symptom to the tool. A stream showing fewer rows than expected calls for refresh history and error details. A person who did not merge calls for Profile Explorer and the identity resolution summary. Odd insight values call for Query Editor or Data Explorer on the source objects. A segment that never reaches its target calls for activation status and target configuration. Also check credit consumption, since exhausted capacity can stop processing.
How it shows up
A symptom is described, and you choose the screen or tool that shows its cause first.
Common confusion
Rebuilding a stream or ruleset before checking status pages and processing history for the real error.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Data 360 Setup

    The setup area where Data 360 is provisioned, connectors are configured and features are enabled.

    Remember
    Initial provisioning connects the home CRM org.
    Tested as
    First-time configuration scenarios.
    Trap
    Looking for Data 360 settings only in standard Setup menus.

  • Standard Data 360 permission sets

    Predefined sets for admins, marketing managers, marketing specialists and data-aware users.

    Remember
    Choose by job, and keep the admin set rare.
    Tested as
    Least-privilege access questions.
    Trap
    Assigning the admin set to read-only analysts.

  • Data space

    A logical partition of data and metadata within one Data 360 org.

    Remember
    Users see only the spaces they are granted.
    Tested as
    Brand, region and business unit separation.
    Trap
    Assuming a new org is needed for each brand.

  • Data space filters

    Rules that decide which records from shared objects belong to a data space.

    Remember
    Filters keep each brand's records separate when sources are shared.
    Tested as
    Partitioning scenarios with one shared source.
    Trap
    Forgetting filters and exposing all records to every space.

  • Data classification and policies

    Tags and rules that mark sensitive fields and restrict their use.

    Remember
    They support governance in addition to permissions.
    Tested as
    Sensitive attribute protection questions.
    Trap
    Relying only on user training to protect sensitive fields.

  • Consent data

    Contact point and consent objects in the data model that record opt-ins and opt-outs.

    Remember
    Segments and activations should respect them.
    Tested as
    Governance and activation scenarios.
    Trap
    Leaving consent in the source system only.

  • Data kit

    A container for Data 360 metadata that can be packaged and deployed.

    Remember
    It moves definitions, not records.
    Tested as
    Sandbox to production and partner distribution.
    Trap
    Expecting ingested data to travel with it.

  • Data Explorer

    A tool for viewing records in DLOs, DMOs and calculated insights.

    Remember
    First stop for checking whether data landed and mapped.
    Tested as
    Troubleshooting questions.
    Trap
    Using reports before data is confirmed in the model.

  • Query Editor

    A SQL workspace for querying Data 360 objects.

    Remember
    Useful for validating joins, counts and insight logic.
    Tested as
    Diagnosing unexpected values.
    Trap
    Treating it as a way to change records.

  • Profile Explorer

    A view of a unified profile and its linked source records and insights.

    Remember
    Shows which records merged and why.
    Tested as
    Identity resolution troubleshooting.
    Trap
    Checking only the source system when a profile looks wrong.

  • Refresh and processing history

    Status pages that list runs, record counts and errors for streams, rulesets, insights and segments.

    Remember
    They reveal failures and timing issues.
    Tested as
    Symptom-to-tool questions.
    Trap
    Assuming silent failure means no records exist.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Separating data for different teams

ConceptMeaningKey differenceCommon trap
Data spaces Logical partitions inside one org Shared platform, separated access Forgetting to filter shared objects
Separate Data 360 org Fully separate tenant Strongest isolation, more overhead Choosing it when spaces would do
Permission sets Control which features a user can use Feature access, not data partitioning Expecting them to split records by brand

Troubleshooting tools

ConceptMeaningKey differenceCommon trap
Refresh history Run status and errors for data streams Ingestion problems Skipping it when counts look low
Data Explorer Browse records in lake and model objects Confirms data landed and mapped Using it to edit data
Query Editor Run SQL across Data 360 objects Validates logic and joins Treating it as a report builder
Profile Explorer Inspect one unified profile Shows merged sources and insights Using it for bulk counts

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Admin for everyone

    What candidates pick
    Assign the Data 360 admin permission set to a marketer who only builds segments.
    Why it looks right
    It removes all access errors at once.
    Why it's wrong
    It also lets the user change streams, mappings and identity rules; a marketing set grants segment work only.

    Clue to watch for The user's tasks are limited to segments and activations.

  2. New org per brand

    What candidates pick
    Provision a second Data 360 org for a second brand.
    Why it looks right
    Separate orgs feel safest.
    Why it's wrong
    Data spaces separate brands inside one org with less overhead, unless legal rules demand full isolation.

    Clue to watch for The requirement is brand-level separation with a shared central team.

  3. Data kits move data

    What candidates pick
    Deploy a data kit to copy customer records to production.
    Why it looks right
    The kit contains the stream definitions.
    Why it's wrong
    Data kits carry metadata only; production streams ingest their own records after deployment.

    Clue to watch for The question mentions moving configuration between orgs.

  4. Rebuild first

    What candidates pick
    Delete and recreate a failing data stream.
    Why it looks right
    A fresh start seems quicker.
    Why it's wrong
    The refresh history usually names the cause, such as a schema change or file issue, which rebuilding does not fix.

    Clue to watch for A stream that worked before suddenly shows errors or zero rows.

  5. Spaces cover everything

    What candidates pick
    Assume creating data spaces automatically splits every shared object.
    Why it looks right
    The feature name suggests separation.
    Why it's wrong
    Objects must be assigned or filtered into each space; otherwise access can be broader than intended.

    Clue to watch for Two brands share one source system.

  6. Consent lives elsewhere

    What candidates pick
    Leave opt-out status in the email platform and ignore it in Data 360.
    Why it looks right
    The email platform already enforces it.
    Why it's wrong
    Segments built in Data 360 can reach other channels, so consent must be modeled and applied there too.

    Clue to watch for Activations go to advertising or several channels.

Answer framework

Use these steps for setup, governance and troubleshooting scenarios.

  1. Identify whether the scenario is about who can do something, which data they may see, moving configuration, or a failure symptom.
  2. For access, map the job to the narrowest Data 360 permission set and add data space access only where needed.
  3. For governance, choose data spaces for separation, classification and policies for sensitive fields, and consent objects for contact rules.
  4. For lifecycle, build and test in a sandbox, package the metadata in a data kit and deploy dependencies in order, starting with data streams and mappings before identity rules and segments.
  5. For failures, open the status page or explorer tool closest to the symptom before changing any configuration, such as the data stream refresh history or identity resolution run summary.

Practice question

After a nightly file import, a Data 360 consultant notices that a loyalty data stream processed zero rows, although it worked the previous night. Segments using loyalty tiers are now empty. What should the consultant check first?

Want more like this? The Data-Con-101 practice test has questions for every domain.

Checklist

0 of 12

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

This section rewards hands-on familiarity more than theory, so use a Trailhead Data 360 playground or developer environment if you can. Walk through Data 360 Setup, open the permission sets list and read what each standard set allows. Write a one-line job description next to each so you can match them quickly in scenarios.

Then study data spaces in depth: how to create one, how objects and records are assigned or filtered, and how users are granted access. Practice designing spaces for a two-brand company and for a company that separates regions. Review the governance quick looks in the prep trail for classification, policies and consent.

For lifecycle, read the packaging and data kits module and make a short list of what a data kit can carry. Finally, build a symptom table with three columns: symptom, first tool, likely cause. Include zero rows ingested, profiles not merging, insight values wrong, segment count zero and activation failed. Review it until each row feels automatic.

FAQ

How much of the exam is Data 360 Setup and Administration?

Data 360 Setup and Administration is 13% of the exam, the smallest section, roughly eight of the 60 scored questions as a planning estimate.

Do I need to memorize every permission set's exact permissions?

Not every checkbox, but you should know which standard set fits an admin, a marketing manager, a marketing specialist and a user who only needs to view Data 360 data.

When should I use data spaces instead of separate orgs?

Use data spaces when brands or regions share a platform but need separate access to data and metadata. Separate orgs suit strict legal isolation or completely independent operations.

Can Data 360 be configured in a sandbox?

Yes. Data 360 supports sandboxes, so teams can build and test configuration there and then deploy it, often using data kits and packages.

What does a data kit contain?

Data 360 metadata such as stream definitions, mappings, calculated insights and segments. It does not contain the customer records that streams ingest.

Which tool shows why two records did not merge?

Profile Explorer shows the unified profile and its source records, and the identity resolution summary and processing history show ruleset results.

Other CRM & Business Applications certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 2 knowledge

You have covered Data 360 permissions, governance configuration, lifecycle tooling and troubleshooting. Check whether you pick the right setting or tool under time pressure.

Take the Data-Con-101 practice test Check your Data-Con-101 readiness

Keep going