Overview
Governance, Security and Compliance carries 22% of the exam across six objectives: configure security policies, meet compliance standards for an individual's message history, track a security concern in Enterprise Grid, assess PII sharing, decide when to migrate a workspace into Enterprise Grid, and moderate conversations that break the code of conduct.
Security policies include SSO enforcement, two-factor authentication, session duration, mobile and desktop controls such as blocking downloads or requiring approved devices, and Slack Connect restrictions. Compliance for message history centers on retention settings, legal holds, exports and eDiscovery integrations. Tracking concerns relies on audit logs and their integration with security tools. PII protection uses data loss prevention, information barriers and Enterprise Key Management where available. Moderation covers message reporting, admin removal of content and channel posting controls.
How it's tested
Questions start with a stakeholder requirement: legal needs a person's history preserved, security sees suspicious activity, or HR receives a complaint about a message. You pick the control that meets the requirement precisely, on the plan described, and without over-collecting or over-restricting data for everyone else.
-
Preserve or delete
A legal or policy requirement about message history appears, and you choose retention settings, legal holds or exports for the right scope.
-
Investigate
Suspicious behavior is reported, and you identify the audit log events or security integrations that reveal what happened.
-
Prevent exposure
Sensitive data such as card numbers or health details may be posted, and you choose DLP, Slack Connect limits or information barriers.
Legal must keep all messages from one employee involved in litigation, while the org deletes messages after one year. Changing the org retention to keep everything forever preserves far more data than required. A legal hold on that employee preserves their messages and files regardless of the retention policy, and requires the Enterprise plan level with a Legal Holds admin role, so it is the precise answer.
Objectives 6
Official objectives from the Salesforce outline, in outline order.
5.1 Given a scenario, determine how to configure security policies.Authentication, session, device and sharing controls.
- What it means
- Security policies in Slack include requiring SSO or two-factor authentication, setting session duration, forcing sign-out, controlling desktop and mobile behavior such as file downloads or copy and paste, approving devices, and limiting external sharing through Slack Connect settings. On Enterprise Grid these are typically set at the org level.
- What to understand
- Match the control to the risk. Lost or unmanaged phones point to mobile session limits, device approval or enterprise mobility management integration. Credential risk points to required SSO or two-factor authentication. External data leakage points to Slack Connect and file-sharing restrictions. Org-level policies ensure every workspace follows the same rule.
- How it shows up
- Security wants to reduce the risk of data on personal phones, and you choose the mobile session and download controls.
- Common confusion
- Choosing a policy that blocks the mobile app entirely when the requirement is only to protect downloaded files.
5.2 Given a scenario, assess how to meet compliance standards for an individual's message history.Retention, legal holds and exports for one person.
- What it means
- Message retention settings define how long Slack keeps messages and files, at the workspace or org level and optionally per channel when allowed. Legal holds preserve a specific person's messages and files regardless of retention. Exports and eDiscovery integrations let compliance teams collect data.
- What to understand
- When one person's history must be kept, a legal hold is the targeted tool; changing org retention affects everyone. Full exports of all conversations start at Business+, while exporting a single user's data and legal holds are Enterprise+ features. Discovery APIs let approved eDiscovery and archiving tools collect messages. Retention can also be set to delete data after a period to reduce risk.
- How it shows up
- Counsel needs a departing employee's messages preserved for litigation, and you choose the precise preservation tool and plan.
- Common confusion
- Extending retention for the whole organization when only one person's data must be preserved.
5.3 Given a scenario, determine how to track a security concern in the Enterprise Grid environment.Audit logs and security integrations.
- What it means
- Audit logs on Enterprise Grid record events such as sign-ins, file downloads, app installs, permission changes, channel exports and Slack Connect activity. They are available through an admin interface and an API that security tools such as SIEM platforms can ingest.
- What to understand
- Use audit logs to answer who did what and when across the organization. Feeding them into a SIEM supports alerting and correlation with other systems. Anomaly events can flag unusual sign-ins or downloads. Access to audit logs can be limited to people holding a dedicated audit logs role rather than full admins.
- How it shows up
- A large file download from an unfamiliar location is reported, and you identify how to investigate it.
- Common confusion
- Looking in the analytics dashboard, which reports usage trends rather than security events.
5.4 Given a scenario, assess and determine personally identifiable information (PII) sharing in Slack.Preventing and handling sensitive data exposure.
- What it means
- PII includes data such as government ID numbers, card numbers, health details and personal contact information. Slack's native data loss prevention on Enterprise plans scans messages and files against rules and can alert admins or hide matching content. Information barriers and Slack Connect restrictions reduce where data can travel.
- What to understand
- Choose prevention over cleanup. DLP rules can detect patterns such as card numbers and act automatically. Enterprise Key Management gives customers control of encryption keys for stronger data control. Slack Connect file and sharing limits stop PII from crossing to partners. When PII has already been posted, admins can remove content under the retention and moderation settings.
- How it shows up
- Employees sometimes paste customer card numbers into channels, and you choose the control that detects and blocks this automatically.
- Common confusion
- Relying on a policy reminder in a channel instead of a DLP rule when automatic detection is required.
5.5 Given a scenario, determine when to initiate a workspace migration into Enterprise Grid.Signals that call for Enterprise Grid.
- What it means
- Organizations that have grown into several separate workspaces, often through acquisitions or department-led adoption, may migrate them into one Enterprise Grid organization. Migration brings central administration, org-wide policies, shared channels across workspaces and enterprise compliance tools.
- What to understand
- Migration makes sense when the company needs unified security and compliance, has many workspaces with overlapping members, needs audit logs, DLP or legal holds, or wants one identity and policy layer across business units. A single small team without those needs rarely benefits. Migration needs planning for workspace design, channel moves, app reinstalls and user communication.
- How it shows up
- After acquisitions, a company runs five unconnected workspaces with inconsistent policies, and you decide whether and why to move to Enterprise Grid.
- Common confusion
- Choosing migration simply because headcount grew, without the governance or multi-workspace drivers.
5.6 Given a scenario, determine how to moderate conversations that violate an organization's Slack code of conduct.Reporting, removing and preventing harmful content.
- What it means
- Moderation covers how members report problematic messages, how owners and admins review and remove them, and how channel settings reduce repeat issues. Slack supports message reporting to designated reviewers, admin deletion of messages, posting restrictions and channel management tools.
- What to understand
- A good answer combines a clear code of conduct with a reporting path and an admin response. Enable members to flag messages to the right reviewers, remove violating content, and restrict posting in high-risk channels. Message edit and deletion permissions can be tightened so evidence is not erased. Repeated violations are an HR process supported by deactivation if needed.
- How it shows up
- Members complain about offensive posts in a large public channel, and you choose how to let them report it and how admins respond.
- Common confusion
- Archiving the whole channel to stop one person's behavior, which punishes everyone and does not address the violation.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Data retention settings
Rules for how long messages and files are kept.
- Remember
- Custom retention starts on Pro; channel-level overrides can be allowed or blocked.
- Tested as
- Compliance and data minimization scenarios.
- Trap
- Changing org retention to solve one person's case.
-
Legal hold
Preserves a specific user's messages and files regardless of retention.
- Remember
- Enterprise+ feature managed by a Legal Holds admin role.
- Tested as
- Litigation or investigation scenarios.
- Trap
- Exporting data manually instead.
-
Exports
Downloads of workspace data for compliance.
- Remember
- Full exports of all conversations start at Business+; single-user exports are Enterprise+.
- Tested as
- Data collection questions.
- Trap
- Assuming Pro can export private channels and DMs.
-
Audit logs
Enterprise+ record of security-relevant actions, viewable in the admin interface or by API.
- Remember
- They feed SIEM tools for alerting.
- Tested as
- Security investigation scenarios.
- Trap
- Using analytics for a security incident.
-
Data loss prevention (DLP)
Rules that scan messages and files for sensitive patterns and act on matches.
- Remember
- Native DLP is an Enterprise+ feature.
- Tested as
- PII and card data scenarios.
- Trap
- Relying on user training alone.
-
Information barriers
Rules preventing specific groups from communicating in Slack.
- Remember
- Used for regulatory separation such as research and trading.
- Tested as
- Conflict-of-interest scenarios.
- Trap
- Using private channels to enforce separation.
-
Enterprise Key Management (EKM)
Customer-controlled encryption keys for Slack data.
- Remember
- Offered as an add-on for the top plan; revoking keys cuts access to data.
- Tested as
- Strict data-control requirements.
- Trap
- Confusing EKM with DLP.
-
Session and mobile controls
Settings for session duration, forced sign-out, downloads and device approval.
- Remember
- Target the mobile risk without blocking the app.
- Tested as
- Lost device and BYOD scenarios.
- Trap
- Blocking mobile Slack entirely.
-
Enterprise Grid migration drivers
Multiple workspaces, central policy and compliance needs.
- Remember
- Plan channel moves, app reinstalls and communication.
- Tested as
- When-to-migrate questions.
- Trap
- Migrating for headcount alone.
-
Message reporting
Members flag messages to designated reviewers for moderation.
- Remember
- Pairs with a published code of conduct and admin action.
- Tested as
- Harassment or misconduct scenarios.
- Trap
- Expecting admins to monitor every channel manually.
-
Edit and delete permissions
Settings controlling whether members can edit or delete their own messages and for how long.
- Remember
- Tightening them helps preserve evidence.
- Tested as
- Moderation and compliance scenarios.
- Trap
- Leaving unlimited deletion when records must be kept.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Preserving and collecting message history
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Retention settings | How long data is kept for everyone | Broad policy | Using it for one person's case |
| Legal hold | Preserves named users' data | Overrides retention for those users | Assuming it is available on Business+ |
| Exports | One-time data download | Collection, not preservation | Treating an export as a hold |
| Discovery API integrations | Third-party archiving and eDiscovery tools | Continuous collection by approved tools | Granting broad app scopes without review |
Protecting sensitive data
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| DLP | Detects sensitive patterns in content | Automatic detection and action | Using it to separate groups |
| Information barriers | Blocks communication between defined groups | Regulatory separation | Using it to catch card numbers |
| EKM | Customer-held encryption keys | Controls access to stored data | Expecting it to scan content |
| Slack Connect restrictions | Limits on external sharing | Stops data crossing to partners | Applying them to internal channels |
Security visibility tools
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Audit logs | Security and admin events | Who did what and when | Assuming they are on every plan |
| Analytics dashboard | Usage and adoption trends | Not built for investigations | Using it to investigate an incident |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Retention for one person
- What candidates pick
- Set org retention to keep everything forever.
- Why it looks right
- It guarantees nothing is lost.
- Why it's wrong
- It retains everyone's data indefinitely and increases risk; a legal hold preserves only the named person's data.
Clue to watch for Only one person or a small group is involved.
-
Export as preservation
- What candidates pick
- Run an export of the person's messages now.
- Why it looks right
- It captures the data immediately.
- Why it's wrong
- An export is a snapshot; later messages and edits are not preserved, and retention can still delete the originals.
Clue to watch for The requirement is to preserve data going forward.
-
Analytics for incidents
- What candidates pick
- Check the analytics dashboard for the suspicious activity.
- Why it looks right
- It shows member activity.
- Why it's wrong
- Analytics reports usage trends, not security events like file downloads or sign-in locations, which are in audit logs.
Clue to watch for The scenario is an investigation.
-
Training instead of DLP
- What candidates pick
- Remind employees not to share card numbers.
- Why it looks right
- Education is part of good governance.
- Why it's wrong
- Reminders do not detect or block content; DLP rules identify sensitive patterns automatically when the plan supports it.
Clue to watch for The requirement says detect or prevent automatically.
-
Block mobile entirely
- What candidates pick
- Disable Slack on mobile devices.
- Why it looks right
- It removes the mobile risk.
- Why it's wrong
- Session limits, download restrictions and device approval reduce the risk while keeping a critical work channel available.
Clue to watch for The concern is about lost or unmanaged devices, not mobile use itself.
-
Migrate because big
- What candidates pick
- Move to Enterprise Grid because the company passed 1,000 users.
- Why it looks right
- Large size sounds like an enterprise signal.
- Why it's wrong
- The drivers are multiple workspaces, central policy, and compliance tooling, not headcount alone.
Clue to watch for The scenario has one workspace and no compliance gap.
-
Archive the channel
- What candidates pick
- Archive the channel where harassment occurred.
- Why it looks right
- It stops further posts.
- Why it's wrong
- It silences legitimate members and does not deal with the offender; reporting, removal and HR action address the conduct.
Clue to watch for One person's behavior is the problem.
Answer framework
Use this sequence for any security, compliance or moderation requirement.
- Name the stakeholder goal precisely: prevent, detect, investigate, preserve, collect or delete, and for whom; the verb usually points straight at the right feature.
- Check the plan, removing options such as audit logs, DLP, legal holds or single-user exports when the plan lacks them.
- Choose the narrowest control that fits the scope, preferring a legal hold or DLP rule over org-wide changes, because broad changes disrupt members the requirement never mentioned.
- Set the control at the right level, usually the org level on Enterprise Grid, and assign the dedicated admin role where one exists.
- Add process around the tool: reporting paths, SIEM alerting, review cadence and communication to members, so the control keeps working after the initial rollout.
Practice question
Want more like this? The Slack-Admn-201 practice test has questions for every domain.
Checklist
0 of 13
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Give this section the most time, since it is the largest. Organize your notes around verbs: prevent, detect, investigate, preserve, collect, delete and moderate. Under each verb, list the Slack feature, the plan that includes it, and the admin role that manages it. This turns long compliance scenarios into a quick lookup.
Work through the Data Protection with Slack badge and the Audit Log UI quick look on Trailhead, then read Slack's articles on data security and privacy, retention, legal holds, exports, DLP and security for AI features. If you cannot access an Enterprise+ org, use screenshots and help articles to learn where each control lives in the admin dashboard.
Highest-yield topics are the legal hold versus retention distinction, plan gating of compliance features and audit logs for investigations. Commonly underestimated topics are moderation and the Enterprise Grid migration decision, which each have their own objective. During practice, mark the scope of every requirement, such as one person, one channel or the whole org, and discard any answer that acts on a wider scope than needed.
FAQ
How much of the exam is Governance, Security and Compliance?
Governance, Security and Compliance is 22% of the exam, the largest section, about thirteen of the 60 scored questions as a planning estimate.
Which compliance features need Enterprise+?
Audit logs, native DLP, legal holds, single-user exports and information barriers are Enterprise+ features under the current plan lineup. EKM is an add-on at that level.
What is the difference between a legal hold and retention?
Retention applies broadly and decides how long data is kept. A legal hold preserves specific users' data regardless of retention until the hold is released.
Do I need to know SIEM products?
No specific product is required. Know that audit logs can be pulled by API into security tools for alerting and correlation.
How is moderation tested?
Expect scenarios about offensive or policy-breaking messages where you choose a reporting path, admin removal, posting restrictions or HR escalation rather than drastic channel-wide actions.
Why is Enterprise Grid migration in a security section?
Migration is usually justified by governance: central policies, org-wide security controls and compliance tools that separate workspaces cannot provide.
Does Slack Connect affect compliance?
Yes. Each organization keeps its own copy under its own retention, so restricting what can be shared externally matters for PII and confidentiality.
Other CRM & Business Applications certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
- HubSpot Inbound Marketing Certification Study guide
- Salesforce Certified Platform Developer I Study guide
- Google Ads Search Certification Study guide
- ServiceNow Certified System Administrator Study guide
- Salesforce Certified Platform Administrator Study guide
- ServiceNow Certified Application Developer Study guide
Test your Domain 5 knowledge
You have covered security policies, message history compliance, audit logs, PII protection, Enterprise Grid migration and moderation. Test yourself on stakeholder-driven compliance scenarios.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the Slack-Admn-201 AI tutor Get any concept explained your way