Event Monitoring
5 minutes
5 Questions
Event Monitoring is a Salesforce feature, part of the Salesforce Shield suite (also available as an add-on), that gives administrators detailed visibility into how users interact with the org. For a Platform Administrator II candidate, it fits squarely within the Auditing and Monitoring domain alongside Setup Audit Trail, Field History Tracking, and Login History, but it goes much deeper than those native tools. At its core, Event Monitoring captures granular activity data in the form of Event Log Files (ELFs). These files are generated daily (or hourly, depending on your license) and are exposed through the EventLogFile object, which can be queried via SOQL or the REST API. Each file corresponds to a specific event type, and there are dozens of them, including Login, Logout, API, Report Export, URI (page views), Visualforce, Apex Execution, Lightning Interaction, Dashboard, and Document Attachment Downloads. Each record contains fields such as user ID, timestamp, client IP, browser, and operation performed. From an auditing perspective, this allows admins to answer questions like: Who exported a sensitive report? Which users are downloading large volumes of files? Are there logins from unusual locations? Which pages or Apex classes are performing poorly? This supports security investigations, compliance requirements (such as GDPR or SOX), user adoption analysis, and performance tuning. In addition to log files, Event Monitoring includes Real-Time Event Monitoring, which streams certain events (like LoginEvent, ReportEvent, ApiEvent) via platform events, and Transaction Security Policies, which let you define rules that block, require MFA, or notify when specific risky behavior occurs, for example, blocking a report export exceeding a record threshold. Analyzing the data typically involves exporting logs to tools such as the Event Monitoring Analytics App (CRM Analytics), Splunk, or a custom dashboard. Key exam points: ELFs are read-only, retained for 1 day on Developer edition or 30 days with the add-on, require the View Event Log Files and API Enabled permissions, and complement rather than replace Setup Audit Trail.
Event Monitoring: Auditing and Monitoring for the Salesforce Advanced Administrator Exam
Why Event Monitoring Matters
As a Salesforce Advanced Administrator, you are expected to go beyond basic configuration and understand how to protect, audit, and optimize the org. Event Monitoring is a key capability in the Auditing and Monitoring section of the exam because it answers questions that standard tools cannot: Who downloaded that report of 50,000 customer records? Which user is logging in from an unexpected location at 3 AM? Why is a particular Visualforce page running slowly? Which API integration is consuming the most calls?
Standard tools such as Setup Audit Trail, Login History, and Field History Tracking tell you what changed in configuration or data. Event Monitoring tells you what users and systems actually did inside the org: page views, report exports, API calls, Apex executions, logins, logouts, and much more. For security, compliance (GDPR, HIPAA, SOX), performance tuning, and adoption analysis, this granular visibility is critical. The exam tests whether you can identify when Event Monitoring is the correct solution and how it differs from the other auditing features.
What Is Event Monitoring?
Event Monitoring is a feature of Salesforce Shield (available as part of the Shield bundle or as a standalone add-on license) that gives administrators access to detailed activity data about their org. It has three main components:
1. Event Log Files - Historical, file-based logs (stored as CSV) that capture user activity. Each log file corresponds to one event type for one day (or one hour, with hourly log files enabled). These are exposed through the EventLogFile standard object and retrieved via the REST API or SOAP API.
2. Real-Time Event Monitoring - Streams event data as it happens using Platform Events (for immediate subscription and alerting) and stores it in Big Objects (for long-term querying). This allows you to react to threats within seconds rather than hours or days.
3. Transaction Security Policies - Policies built on Real-Time Event Monitoring that evaluate events against conditions and take automated actions such as blocking the action, requiring multi-factor authentication, or sending notifications.
Additionally, the Event Monitoring Analytics App (built on CRM Analytics, formerly Tableau CRM / Einstein Analytics) provides prebuilt dashboards to visualize event log data without writing code.
Key Point on Licensing: Every Salesforce org gets a limited version of Event Monitoring for free: Login and Logout event log files with 1 day of retention. With the Event Monitoring add-on or Salesforce Shield, you receive all event types with 30 days of retention for event log files. This distinction is a frequent exam target.
How Event Log Files Work
Generation: Salesforce generates event log files once per day (around 3:00 AM in the org time zone, covering the previous day). Orgs with the add-on can enable hourly event log files for faster access to near-real-time data. Note that hourly files are not guaranteed to be complete; the daily file is the authoritative record.
Storage: Each file is stored as a record of the EventLogFile object. Key fields include EventType (e.g., Login, ReportExport, URI), LogDate, LogFileLength, Interval (Hourly or Daily), and LogFile (the base64-encoded CSV content).
Retrieval: You cannot view event log file contents directly in Setup. You retrieve them using:
- The REST API (query the EventLogFile object via SOQL, then download the LogFile field)
- Command-line tools such as cURL or Python scripts
- The Event Log File Browser app on AppExchange (a free visual tool from Salesforce Labs)
- Third-party SIEM or analytics tools (Splunk, New Relic, Datadog) that have Salesforce connectors
- Salesforce Data Loader or Workbench for querying metadata about the files
Required Permissions: Users need the View Event Log Files and API Enabled user permissions to query and download event log files. Users with View All Data also have access.
Common Event Types You Should Know
- Login and Logout - Who logged in/out, from where, with what browser, success or failure (available free, 1-day retention)
- URI - Every page a user viewed in Salesforce Classic (page load times, user, timestamp)
- Lightning Interaction / Lightning Page View / Lightning Performance / Lightning Error - Equivalent activity tracking for Lightning Experience and the mobile app
- Report and Report Export - Who ran or exported reports and what data was included; essential for data loss prevention
- API and REST API and Bulk API - Integration activity, API usage by user and client
- Apex Execution / Apex Callout / Apex SOAP / Apex Trigger / Apex REST API - Performance and usage of custom code
- Visualforce Request - Visualforce page usage and performance
- Dashboard - Dashboard views and refreshes
- Document Attachment Downloads and Content Transfer / Content Distribution - File download and sharing activity
- Login As - When an admin logs in as another user
- Platform Encryption - Encryption key activity
- Setup Audit Trail (as an event type) - Changes made in Setup, also available as a log file
- Time-Based Workflow and Flow Execution - Automation activity
- Wave Change / Wave Interaction / Wave Performance - CRM Analytics usage
- Search - Search queries performed by users
- Insecure External Assets - Assets loaded over HTTP instead of HTTPS
You do not need to memorize every field of every event type, but you should be able to match a business scenario (e.g., tracking report exports) to the correct event type.
How Real-Time Event Monitoring Works
Real-Time Event Monitoring uses two storage mechanisms for each supported event:
1. Streaming (Platform Events): Events such as LoginEventStream, ReportEventStream, ApiEventStream, ListViewEventStream, LightningUriEventStream, and UriEventStream are published as platform events. You can subscribe with Apex triggers, Flows, CometD clients, or external systems to act immediately.
2. Storage (Big Objects): Events such as LoginEvent, ReportEvent, ApiEvent, and ListViewEvent are stored in big objects, which hold massive volumes of data and can be queried with Async SOQL or standard SOQL with restrictions. Default retention is typically 6 months and can be extended for certain events (up to 10 years for some, depending on configuration and licensing).
Real-Time Event Monitoring is enabled in Setup under Event Manager, where you choose for each event whether to enable Streaming, Storage, or both. Users need the View Real-Time Event Monitoring Data permission to query the big objects.
Enhanced Transaction Security Policies
Transaction Security policies are the automated enforcement layer. A policy consists of:
- An event it monitors (Login, Report, API, List View, Bulk API Result, Credential Stuffing, Session Hijacking, Permission Set, etc.)
- A condition defined with Condition Builder (declarative, point-and-click) or with an Apex class implementing the TxnSecurity.EventCondition interface for complex logic
- An action taken when the condition is met: Block the operation, require Multi-Factor Authentication, or take No Action (notify only)
- Notifications sent to specified users via email and/or in-app notification
Classic examples:
- Block any report export that returns more than 1,000 records containing a specific object
- Require MFA when a user logs in from an IP address outside a trusted range
- Notify the security team when a user views a list view with more than 2,000 rows of Lead data
- Block API logins from an unapproved client application
Transaction Security policies require Real-Time Event Monitoring to be enabled and are configured under Setup > Transaction Security Policies. A user needs the Customize Application permission to create them.
Event Monitoring Analytics App
For admins who want insights without scripting, the Event Monitoring Analytics App provides prebuilt CRM Analytics dashboards such as Login-As, Report Downloads, User Adoption, Apex Executions, API Usage, Page Views, Visualforce Requests, and Setup Audit Trail. It requires the Event Monitoring add-on and the CRM Analytics platform license, and it uses a scheduled dataflow to load event log files into datasets. It is typically the recommended answer when the question emphasizes visualizing event data without custom development.
How Event Monitoring Compares with Other Auditing Tools
The exam frequently presents a scenario and asks you to choose among several auditing features. Know the boundaries:
- Setup Audit Trail - Tracks configuration changes in Setup (who changed a profile, created a field, modified a flow). Retains 180 days, viewable in Setup, downloadable as CSV. Does not track user activity like page views or exports.
- Login History - Tracks login attempts for the last 6 months, viewable in Setup. Shows status, IP, browser, login type. Limited compared to Login event log files and LoginEvent, which include additional details like geolocation and TLS protocol.
- Field History Tracking - Tracks changes to up to 20 fields per object, retained 18 months (24 via API). Shows old and new values. Does not track who viewed records.
- Field Audit Trail (Shield) - Extends field history retention up to 10 years with up to 60 fields per object, using retention policies.
- Debug Logs - Capture code execution details for troubleshooting a specific user for a limited time window. Not designed for audit or long-term monitoring.
- Event Monitoring - Tracks user and system activity (views, exports, API calls, performance). The only tool that answers questions about who viewed or downloaded data.
Exam Tips: Answering Questions on Event Monitoring
1. Look for activity keywords. If the question mentions report exports, downloads, page views, who accessed a record, API usage, performance of pages, user adoption, or data exfiltration, the answer is almost always Event Monitoring. If it mentions configuration changes, choose Setup Audit Trail. If it mentions field value changes, choose Field History Tracking or Field Audit Trail.
2. Know the free versus paid boundary. All orgs get Login and Logout event log files with 1-day retention. Shield or the Event Monitoring add-on unlocks all event types and 30-day retention. If a question says the org has no additional licenses and asks about tracking report exports via event logs, the correct answer is that it is not available without purchasing Event Monitoring.
3. Remember that event log files are not viewable in Setup. If an answer option says the admin can open event log files in the Setup menu, it is a distractor. The correct retrieval methods are the API, cURL/scripts, the Event Log File Browser, or an analytics/SIEM tool.
4. Match the permission to the task. View Event Log Files plus API Enabled for event log files; View Real-Time Event Monitoring Data for big object queries; Customize Application for creating Transaction Security policies.
5. Distinguish real-time from historical. If the scenario demands immediate action (block, require MFA, alert within seconds), the answer is Real-Time Event Monitoring with a Transaction Security policy. If the scenario is about analyzing trends, adoption, or investigating something that already happened, the answer is Event Log Files or the Event Monitoring Analytics App.
6. Know the Transaction Security actions. The available actions are Block, Multi-Factor Authentication, and No Action (with notifications by email or in-app). An option that says a policy can automatically deactivate a user or delete a report is a distractor.
7. Condition Builder versus Apex. Choose Condition Builder when the logic is simple (field comparisons such as record count, user, IP, object). Choose Apex when the logic requires cross-object lookups, complex calculations, or custom comparisons that Condition Builder cannot express. The exam favors the declarative approach when both would work.
8. Visualization without code points to the Analytics App. When the question stresses dashboards, prebuilt reports, or that the admin has no development skills, choose the Event Monitoring Analytics App (requires CRM Analytics).
9. Hourly versus daily files. Hourly event log files provide faster access but may be incomplete; daily files are the complete record. Both require the add-on license for non-login event types.
10. Think about the audience. Security and compliance teams typically need Event Monitoring integrated with a SIEM; performance-focused teams look at URI, Lightning Performance, Apex Execution, and Visualforce Request logs; adoption-focused teams use Lightning Page View and Login data. Reading the role of the requester in the question often points to the right event type.
11. Eliminate distractors systematically. Options that mention Login History for report tracking, Setup Audit Trail for data access, Field History Tracking for record views, or debug logs for long-term auditing are incorrect for Event Monitoring scenarios.
Summary
Event Monitoring gives advanced administrators deep visibility into user and system activity through event log files (historical, 30-day retention with Shield), Real-Time Event Monitoring (streaming platform events plus big object storage), and Transaction Security policies (automated block, MFA, or notify actions). It fills the gap left by Setup Audit Trail, Login History, and Field History Tracking by answering the question of who did what, when, and how. On the exam, identify the activity-related keywords, confirm the licensing situation, choose the appropriate component (log files, real-time, analytics app, or transaction security), verify the correct permissions, and eliminate options that confuse Event Monitoring with other auditing tools.
As a Salesforce Advanced Administrator, you are expected to go beyond basic configuration and understand how to protect, audit, and optimize the org. Event Monitoring is a key capability in the Auditing and Monitoring section of the exam because it answers questions that standard tools cannot: Who downloaded that report of 50,000 customer records? Which user is logging in from an unexpected location at 3 AM? Why is a particular Visualforce page running slowly? Which API integration is consuming the most calls?
Standard tools such as Setup Audit Trail, Login History, and Field History Tracking tell you what changed in configuration or data. Event Monitoring tells you what users and systems actually did inside the org: page views, report exports, API calls, Apex executions, logins, logouts, and much more. For security, compliance (GDPR, HIPAA, SOX), performance tuning, and adoption analysis, this granular visibility is critical. The exam tests whether you can identify when Event Monitoring is the correct solution and how it differs from the other auditing features.
What Is Event Monitoring?
Event Monitoring is a feature of Salesforce Shield (available as part of the Shield bundle or as a standalone add-on license) that gives administrators access to detailed activity data about their org. It has three main components:
1. Event Log Files - Historical, file-based logs (stored as CSV) that capture user activity. Each log file corresponds to one event type for one day (or one hour, with hourly log files enabled). These are exposed through the EventLogFile standard object and retrieved via the REST API or SOAP API.
2. Real-Time Event Monitoring - Streams event data as it happens using Platform Events (for immediate subscription and alerting) and stores it in Big Objects (for long-term querying). This allows you to react to threats within seconds rather than hours or days.
3. Transaction Security Policies - Policies built on Real-Time Event Monitoring that evaluate events against conditions and take automated actions such as blocking the action, requiring multi-factor authentication, or sending notifications.
Additionally, the Event Monitoring Analytics App (built on CRM Analytics, formerly Tableau CRM / Einstein Analytics) provides prebuilt dashboards to visualize event log data without writing code.
Key Point on Licensing: Every Salesforce org gets a limited version of Event Monitoring for free: Login and Logout event log files with 1 day of retention. With the Event Monitoring add-on or Salesforce Shield, you receive all event types with 30 days of retention for event log files. This distinction is a frequent exam target.
How Event Log Files Work
Generation: Salesforce generates event log files once per day (around 3:00 AM in the org time zone, covering the previous day). Orgs with the add-on can enable hourly event log files for faster access to near-real-time data. Note that hourly files are not guaranteed to be complete; the daily file is the authoritative record.
Storage: Each file is stored as a record of the EventLogFile object. Key fields include EventType (e.g., Login, ReportExport, URI), LogDate, LogFileLength, Interval (Hourly or Daily), and LogFile (the base64-encoded CSV content).
Retrieval: You cannot view event log file contents directly in Setup. You retrieve them using:
- The REST API (query the EventLogFile object via SOQL, then download the LogFile field)
- Command-line tools such as cURL or Python scripts
- The Event Log File Browser app on AppExchange (a free visual tool from Salesforce Labs)
- Third-party SIEM or analytics tools (Splunk, New Relic, Datadog) that have Salesforce connectors
- Salesforce Data Loader or Workbench for querying metadata about the files
Required Permissions: Users need the View Event Log Files and API Enabled user permissions to query and download event log files. Users with View All Data also have access.
Common Event Types You Should Know
- Login and Logout - Who logged in/out, from where, with what browser, success or failure (available free, 1-day retention)
- URI - Every page a user viewed in Salesforce Classic (page load times, user, timestamp)
- Lightning Interaction / Lightning Page View / Lightning Performance / Lightning Error - Equivalent activity tracking for Lightning Experience and the mobile app
- Report and Report Export - Who ran or exported reports and what data was included; essential for data loss prevention
- API and REST API and Bulk API - Integration activity, API usage by user and client
- Apex Execution / Apex Callout / Apex SOAP / Apex Trigger / Apex REST API - Performance and usage of custom code
- Visualforce Request - Visualforce page usage and performance
- Dashboard - Dashboard views and refreshes
- Document Attachment Downloads and Content Transfer / Content Distribution - File download and sharing activity
- Login As - When an admin logs in as another user
- Platform Encryption - Encryption key activity
- Setup Audit Trail (as an event type) - Changes made in Setup, also available as a log file
- Time-Based Workflow and Flow Execution - Automation activity
- Wave Change / Wave Interaction / Wave Performance - CRM Analytics usage
- Search - Search queries performed by users
- Insecure External Assets - Assets loaded over HTTP instead of HTTPS
You do not need to memorize every field of every event type, but you should be able to match a business scenario (e.g., tracking report exports) to the correct event type.
How Real-Time Event Monitoring Works
Real-Time Event Monitoring uses two storage mechanisms for each supported event:
1. Streaming (Platform Events): Events such as LoginEventStream, ReportEventStream, ApiEventStream, ListViewEventStream, LightningUriEventStream, and UriEventStream are published as platform events. You can subscribe with Apex triggers, Flows, CometD clients, or external systems to act immediately.
2. Storage (Big Objects): Events such as LoginEvent, ReportEvent, ApiEvent, and ListViewEvent are stored in big objects, which hold massive volumes of data and can be queried with Async SOQL or standard SOQL with restrictions. Default retention is typically 6 months and can be extended for certain events (up to 10 years for some, depending on configuration and licensing).
Real-Time Event Monitoring is enabled in Setup under Event Manager, where you choose for each event whether to enable Streaming, Storage, or both. Users need the View Real-Time Event Monitoring Data permission to query the big objects.
Enhanced Transaction Security Policies
Transaction Security policies are the automated enforcement layer. A policy consists of:
- An event it monitors (Login, Report, API, List View, Bulk API Result, Credential Stuffing, Session Hijacking, Permission Set, etc.)
- A condition defined with Condition Builder (declarative, point-and-click) or with an Apex class implementing the TxnSecurity.EventCondition interface for complex logic
- An action taken when the condition is met: Block the operation, require Multi-Factor Authentication, or take No Action (notify only)
- Notifications sent to specified users via email and/or in-app notification
Classic examples:
- Block any report export that returns more than 1,000 records containing a specific object
- Require MFA when a user logs in from an IP address outside a trusted range
- Notify the security team when a user views a list view with more than 2,000 rows of Lead data
- Block API logins from an unapproved client application
Transaction Security policies require Real-Time Event Monitoring to be enabled and are configured under Setup > Transaction Security Policies. A user needs the Customize Application permission to create them.
Event Monitoring Analytics App
For admins who want insights without scripting, the Event Monitoring Analytics App provides prebuilt CRM Analytics dashboards such as Login-As, Report Downloads, User Adoption, Apex Executions, API Usage, Page Views, Visualforce Requests, and Setup Audit Trail. It requires the Event Monitoring add-on and the CRM Analytics platform license, and it uses a scheduled dataflow to load event log files into datasets. It is typically the recommended answer when the question emphasizes visualizing event data without custom development.
How Event Monitoring Compares with Other Auditing Tools
The exam frequently presents a scenario and asks you to choose among several auditing features. Know the boundaries:
- Setup Audit Trail - Tracks configuration changes in Setup (who changed a profile, created a field, modified a flow). Retains 180 days, viewable in Setup, downloadable as CSV. Does not track user activity like page views or exports.
- Login History - Tracks login attempts for the last 6 months, viewable in Setup. Shows status, IP, browser, login type. Limited compared to Login event log files and LoginEvent, which include additional details like geolocation and TLS protocol.
- Field History Tracking - Tracks changes to up to 20 fields per object, retained 18 months (24 via API). Shows old and new values. Does not track who viewed records.
- Field Audit Trail (Shield) - Extends field history retention up to 10 years with up to 60 fields per object, using retention policies.
- Debug Logs - Capture code execution details for troubleshooting a specific user for a limited time window. Not designed for audit or long-term monitoring.
- Event Monitoring - Tracks user and system activity (views, exports, API calls, performance). The only tool that answers questions about who viewed or downloaded data.
Exam Tips: Answering Questions on Event Monitoring
1. Look for activity keywords. If the question mentions report exports, downloads, page views, who accessed a record, API usage, performance of pages, user adoption, or data exfiltration, the answer is almost always Event Monitoring. If it mentions configuration changes, choose Setup Audit Trail. If it mentions field value changes, choose Field History Tracking or Field Audit Trail.
2. Know the free versus paid boundary. All orgs get Login and Logout event log files with 1-day retention. Shield or the Event Monitoring add-on unlocks all event types and 30-day retention. If a question says the org has no additional licenses and asks about tracking report exports via event logs, the correct answer is that it is not available without purchasing Event Monitoring.
3. Remember that event log files are not viewable in Setup. If an answer option says the admin can open event log files in the Setup menu, it is a distractor. The correct retrieval methods are the API, cURL/scripts, the Event Log File Browser, or an analytics/SIEM tool.
4. Match the permission to the task. View Event Log Files plus API Enabled for event log files; View Real-Time Event Monitoring Data for big object queries; Customize Application for creating Transaction Security policies.
5. Distinguish real-time from historical. If the scenario demands immediate action (block, require MFA, alert within seconds), the answer is Real-Time Event Monitoring with a Transaction Security policy. If the scenario is about analyzing trends, adoption, or investigating something that already happened, the answer is Event Log Files or the Event Monitoring Analytics App.
6. Know the Transaction Security actions. The available actions are Block, Multi-Factor Authentication, and No Action (with notifications by email or in-app). An option that says a policy can automatically deactivate a user or delete a report is a distractor.
7. Condition Builder versus Apex. Choose Condition Builder when the logic is simple (field comparisons such as record count, user, IP, object). Choose Apex when the logic requires cross-object lookups, complex calculations, or custom comparisons that Condition Builder cannot express. The exam favors the declarative approach when both would work.
8. Visualization without code points to the Analytics App. When the question stresses dashboards, prebuilt reports, or that the admin has no development skills, choose the Event Monitoring Analytics App (requires CRM Analytics).
9. Hourly versus daily files. Hourly event log files provide faster access but may be incomplete; daily files are the complete record. Both require the add-on license for non-login event types.
10. Think about the audience. Security and compliance teams typically need Event Monitoring integrated with a SIEM; performance-focused teams look at URI, Lightning Performance, Apex Execution, and Visualforce Request logs; adoption-focused teams use Lightning Page View and Login data. Reading the role of the requester in the question often points to the right event type.
11. Eliminate distractors systematically. Options that mention Login History for report tracking, Setup Audit Trail for data access, Field History Tracking for record views, or debug logs for long-term auditing are incorrect for Event Monitoring scenarios.
Summary
Event Monitoring gives advanced administrators deep visibility into user and system activity through event log files (historical, 30-day retention with Shield), Real-Time Event Monitoring (streaming platform events plus big object storage), and Transaction Security policies (automated block, MFA, or notify actions). It fills the gap left by Setup Audit Trail, Login History, and Field History Tracking by answering the question of who did what, when, and how. On the exam, identify the activity-related keywords, confirm the licensing situation, choose the appropriate component (log files, real-time, analytics app, or transaction security), verify the correct permissions, and eliminate options that confuse Event Monitoring with other auditing tools.
Test mode:
Admin II - Event Monitoring Example Questions
Test your knowledge of Event Monitoring
Question 1
The security team at Universal Containers asks an advanced administrator which feature captures granular user activity across the org. The team needs records of which users exported reports and how long Lightning pages took to load over the past several days. The team wants to review this data in downloadable files or an analytics app. Which feature provides this data?
Question 2
Which statement best describes what Real-Time Event Monitoring provides that standard Event Monitoring event log files do not?
Question 3
Northern Trail Outfitters' security team asks an advanced administrator which users exported large report results last week. The administrator reviews the Setup Audit Trail and each user's login history but finds no record of any export activity. What explains this outcome?
Unlock Premium Access
Salesforce Certified Platform Administrator II
- Access to ALL Certifications: Study for any certification on our platform with one subscription
- 2973 Superior-grade Salesforce Certified Platform Administrator II practice questions
- Unlimited practice tests across all certifications
- Detailed explanations for every question
- Admin II: 5 full exams plus all other certification exams
- 30-Day Money-Back Guarantee: Full refund within 30 days if unsatisfied
- Risk-Free: 7-day free trial with all premium features!
More Event Monitoring questions
60 questions (total)
Other Auditing and Monitoring concepts
Data Classification Settings for Sensitive FieldsDebug Logs and Trace FlagsEncryption of Sensitive Data at RestField History Tracking and Field Audit TrailLogin History and Identity Verification HistoryMasking Sensitive Data in SandboxesRelease Updates That Change System AccessSecurity Health CheckSetup Audit Trail