A00 — Start Here: Passing Accenture Round 1

🎯 Why this matters for Accenture: you have never passed a round 1. That is not a knowledge problem — your theory is strong. Every rejection came on the practical, "show me / write it / where would you click" turn. This guide is built to fix exactly that, against the exact job description you were sent.

🧠 One-screen mental model

        ACCENTURE R1 — "CUSTOM SOFTWARE ENGINEER (SFMC)"

   THE JD SAYS                          SO THEY WILL PROBE
   ─────────────────────────────────    ──────────────────────────
   Must-have: SFMC                  →   architecture + data model
   Journey Builder, Email Studio,   →   the Core 4 — biggest cluster
     Mobile Studio, Social Studio       (~16% of all questions)
   HTML, CSS, JavaScript for        →   "write me a button"
     email + landing pages              "why is Outlook broken?"
   SFMC APIs and integrations       →   REST vs SOAP, OAuth, WSProxy
   Lead design + technical          →   "tell me about a time you led"
     leadership, delivery               (5-6 yr role = leadership signal)
   5 yrs min / 6+ preferred         →   depth, not just familiarity

   YOUR EDGE                YOUR RISK
   ──────────────────       ─────────────────────────────────
   4+ yrs real GAP Inc.     "Write the code" moments
   Certified MC Email Sp.   Freezing instead of scoping out loud
   Multi-brand, high vol.   Under-claiming your own experience

🔑 Read this order if you are short on time

You have limited hours. Read in this order, not cover to cover.

The scenario banks (A18–A22) hold 114 scenarios. Practise them out loud, ten a day — see A18 for the method.

🔑 The one behaviour change that passes round 1

Your notes already diagnosed this: you fail on "where / how would you click," not on theory. The fix is a habit, not more facts.

Never answer a practical question with a definition. Answer with a sequence.

❌ "Journey Builder is used for customer journeys and orchestration."

✅ "I'd go to Journey Builder → Create New Journey → pick a Data Extension entry source, point it at the audience DE, set re-entry to No re-entry, drop an Email activity, add a 3-day Wait, then a Decision Split on Opened. Then I'd validate and publish. If contacts weren't entering, my first check would be the entry source DE actually having rows."

Same knowledge. Completely different verdict.

⭐ The rule: if a question starts with how, where, walk me through, or what would you do — your answer must contain numbered steps or an ordered chain, and it must end with how you'd verify it worked.

🔑 Your 60-second opener (adapt, don't recite)

They will open with "tell me about yourself." This is scored, and it sets the frame for everything after.

Structure it: who you are → where you've done it → what you're strongest at → why this role.

"I'm Akash — an SFMC Email Developer with 4+ years at GAP Inc., and a certified Marketing Cloud Email Specialist.

I work in a high-volume, multi-brand retail environment, so most of my day is Email Studio and Content Builder, AMPscript personalisation, SQL in Automation Studio, and Journey Builder orchestration — plus the deliverability side, because at our volumes sender reputation is a real constraint.

The work I'm proudest of is on the developer-tooling side — for example building an SSJS and WSProxy data-extension lookup tool that cut how long metadata retrieval took for the team.

This role interests me because it's explicitly a build-and-lead role across the full SFMC stack, and the API and integration side is where I've been deepening — I want to be designing the solution, not just implementing the brief."

🔍 Why this works: - Opens with the certification — instant credibility filter passed. - "High-volume, multi-brand retail" gives them a concrete context to ask into. You want them asking about ground you know. - One specific artefact (the WSProxy tool) beats five vague claims. - Closes by connecting to the JD's own language ("lead the design"), which shows you read it.

⭐ Honesty rule: adapt every line to what is actually true for you. Never claim a title or a deliverable you don't have. If you influenced a design without owning it, say "I drove the approach on X" — true, and still strong. Fabrication collapses the moment they probe, and these panels always probe.

🔑 Handling the JD's gaps honestly

The JD names four studios. You are strong on two. Do not bluff — bridge.

⭐ Saying "I haven't done X, here's the closest thing I have done, and here's why I'd ramp fast" is a strength signal. Interviewers are testing whether you can be trusted in front of a client. Bluffing fails that test instantly.

🔑 Questions to ask them

Round 1 usually ends with "any questions?" Having none reads as low interest. Two or three of these:

• "Is this role client-facing from day one, or is there a bench/ramp period first?"
• "What does the SFMC estate look like — single BU or a multi-BU enterprise setup?"
• "Is the team greenfield-building, or maintaining and optimising an existing implementation?"
• "How much of the role is hands-on development versus solution design and leading others?"
• "What does the delivery model look like — Agile squads, or a more traditional waterfall structure?"

⭐ These are engineer's questions, not candidate's questions. They signal you're already thinking about the work.

🔑 Logistics — do not lose marks here

• Join 5 minutes early. Test camera, mic and network first.
• Have a notepad and pen visible — write while they talk. It reads as diligent.
• Have your certification ready to reference; know its exact title.
• If it's a shared-screen coding task, narrate every line as you type. Silence is scored as uncertainty.
• If you don't know something: "I haven't hit that specific case — my approach would be to check X first." Never invent. Never freeze silently.
• If you blank: buy time honestly — "Let me think about that for a second." That is completely acceptable and far better than filler.

⭐ The mindset that actually matters

You have failed round 1 before, so you will walk in expecting to fail. That expectation is itself a risk — it produces hedging, over-qualifying, and trailing off mid-answer.

Two counters:

1. You are not underqualified. 4+ years hands-on at a high-volume multi-brand retailer, plus the certification, is a real profile. The gap has been delivery, not substance.
2. Finish your answers. Your pattern is likely to start well and then trail off into "…but I'm not sure." Land the plane: stop at the end of your point, in silence. Let them ask the follow-up.

The single highest-leverage thing you can do today: answer every practical question as an ordered sequence, and end it with how you'd verify.

➡️ Next: A01_The_Two_Questions_You_Failed.md

A01 — The Two Questions You Failed (solved cold)

🎯 Why this matters for Accenture: these two exact questions ended a TCS round. They are the single most common "write the code" pair in Indian-IT SFMC screens, and Accenture panels ask the same two. This chapter makes both automatic — not "I know the concept," but hands on keyboard, correct on the first pass, explained out loud while you type.

🧠 One-screen mental model

   THE TWO QUESTIONS THAT DECIDE THE ROUND

   Q1 "Write AMPscript to look up data from a DE"
        │
        ├─ ONE value?      → Lookup()
        ├─ MANY rows?      → LookupRows()          (cap 2,000, UNORDERED)
        └─ LATEST / TOP N? → LookupOrderedRows()   (sorted — the senior answer)
                              always: RowCount() guard → Row() → Field()

   Q2 "Write SQL to extract latest records for an email"
        │
        ├─ ⚠ AMBIGUOUS. Say which reading you're taking. THEN answer.
        ├─ Reading A: latest row per EMAIL ADDRESS (dedup a DE)
        │     → ROW_NUMBER() OVER (PARTITION BY key ORDER BY date DESC) = 1
        └─ Reading B: latest send/open/click for an EMAIL ASSET
              → _Job + _Sent / _Open / _Click data views

🔑 Question 1 — "Write AMPscript to look up data from a Data Extension"

Why you froze

The question is deliberately open. There are three lookup functions and the interviewer wants to know whether you pick the right one and guard it. Candidates who blurt one function without a RowCount() guard get marked as juniors.

Open your answer by scoping it out loud. This alone reads as senior:

"Depends what I'm retrieving. For a single value I'd use Lookup. For multiple rows, LookupRows — remembering it's capped at 2,000 and unordered. If I need the newest record or a top-N, LookupOrderedRows, because it sorts. Let me write the multi-row one since it shows the full pattern."

Then write it. Never write code silently.

🧪 Answer 1a — single value (the 20-second answer)

%%[
  VAR @firstName
  SET @firstName = Lookup("Customer_Master", "FirstName", "SubscriberKey", _subscriberkey)
]%%
<p>Hello %%=v(@firstName)=%%,</p>

🔍 Line by line: - %%[ — opens an AMPscript logic block. Nothing here renders to the page. - VAR @firstName — declare the variable before use. Good AMPscript discipline and interviewers notice. - Lookup("Customer_Master", "FirstName", "SubscriberKey", _subscriberkey) — the four arguments are, in order: DE name, column to return, column to match on, value to match. It returns the value from the first matching row only. - _subscriberkey — a built-in system variable holding the current subscriber's key at send time. No quotes; it's a variable, not a string. - ]%% — closes the block and drops back to HTML. - %%=v(@firstName)=%% — the inline output syntax. v() renders a variable's value into the HTML.

⭐ The trap: when multiple rows match, Lookup returns a value from an unspecified row — not reliably the first physical row or the newest. If you genuinely need the newest, you must use LookupOrderedRows. Say that sentence out loud in the interview; it is a differentiator.

🧪 Answer 1b — multiple rows, the full pattern (write this cold)

This is the version to write if they don't specify. It demonstrates the entire competency.

%%[
  VAR @rows, @row, @count, @i, @productName, @price

  SET @rows  = LookupRows("Recent_Orders", "SubscriberKey", _subscriberkey)
  SET @count = RowCount(@rows)

  IF @count > 0 THEN
]%%
    <table role="presentation" cellpadding="0" cellspacing="0" border="0">
%%[
    FOR @i = 1 TO @count DO
      SET @row         = Row(@rows, @i)
      SET @productName = Field(@row, "ProductName")
      SET @price       = Field(@row, "Price")
]%%
      <tr>
        <td>%%=v(@productName)=%%</td>
        <td>%%=FormatCurrency(@price, "en-US")=%%</td>
      </tr>
%%[
    NEXT @i
]%%
    </table>
%%[
  ELSE
]%%
    <p>You have no recent orders.</p>
%%[
  ENDIF
]%%

🔍 Line by line: - VAR @rows, @row, @count, @i, @productName, @price — declare everything up front in one statement. - LookupRows("Recent_Orders", "SubscriberKey", _subscriberkey) — returns a rowset: every row where SubscriberKey matches. Three arguments: DE, match column, match value. - RowCount(@rows) — how many rows came back. You need this both to guard and to bound the loop. - IF @count > 0 THEN — 🔑 the guard. Without it, an empty rowset renders an empty table shell — or worse, a broken layout. Interviewers look for this. - ]%% then raw HTML — you step out of AMPscript to emit the table opening tag, then back in. This in/out weaving is the part candidates fumble; practise it. - FOR @i = 1 TO @count DO — ⭐ AMPscript loops are 1-based, not 0-based like JavaScript. Starting at 0 throws an error. - Row(@rows, @i) — you cannot index a rowset directly; Row() extracts row i. - Field(@row, "ProductName") — pulls a named column out of that row. - NEXT @i — AMPscript's loop-increment keyword (not END FOR). - ELSE / ENDIF — the fallback branch. Always give the empty case real content.

🧪 Answer 1c — the latest record (the senior answer)

If they ask for "the most recent order," LookupRows is wrong — it's unordered.

%%[
  VAR @rows, @row, @orderDate, @orderId

  /* 1 = return one row; sort newest first */
  SET @rows = LookupOrderedRows("Orders_DE", 1, "OrderDate DESC", "SubscriberKey", _subscriberkey)

  IF RowCount(@rows) > 0 THEN
    SET @row       = Row(@rows, 1)
    SET @orderId   = Field(@row, "OrderID")
    SET @orderDate = Field(@row, "OrderDate")
]%%
    <p>Your last order %%=v(@orderId)=%% shipped on
       %%=FormatDate(@orderDate, "dd/MM/yyyy")=%%.</p>
%%[
  ELSE
]%%
    <p>Welcome — this looks like your first visit!</p>
%%[
  ENDIF
]%%

🔍 Line by line: - LookupOrderedRows("Orders_DE", 1, "OrderDate DESC", "SubscriberKey", _subscriberkey) — arguments are: DE, number of rows, sort clause, then match column / match value pairs. - 1 — return just the single newest row. Pass 0 or a negative number for "all rows, up to 2,000". Pass a number greater than 2,000 to exceed the default cap. - "OrderDate DESC" — the sort string, written like a SQL ORDER BY. DESC = newest first, so row 1 is the latest. - Row(@rows, 1) — take the first row of the sorted set: the most recent order. - FormatDate(@orderDate, "dd/MM/yyyy") — format for display; never render a raw datetime to a customer.

The numbers they will test

Multi-criteria and case sensitivity

%%[
  VAR @rows
  SET @rows = LookupRows("Offers_DE", "Region", "West", "Status", "Active")
]%%

🔍 Line by line: - Match columns and values are supplied as pairs, so this reads Region = 'West' AND Status = 'Active'. You can chain several pairs. - Case-sensitive variants exist — LookupRowsCS, LookupOrderedRowsCS — when your matching must respect case. Mentioning these unprompted is a nice senior touch.

🔑 Question 2 — "Write SQL to extract latest records for an email"

Why you froze — and the move that fixes it

This question is ambiguous, and that is almost certainly what sank it. "For an email" has two completely different readings:

• Reading A — the latest row per email address in a Data Extension. This is a deduplication task.
• Reading B — the latest send/open/click activity for an email asset (a campaign). This is a Data Views task.

🔑 Do not guess. Ask. In an interview, this single sentence turns a stumble into a strength:

"Quick clarification — do you mean the latest row per email address, so deduplicating a data extension? Or the most recent send activity for a particular email campaign from the data views? I'll show you the dedup one, it's the more common ask."

Asking a scoping question is what a senior engineer does. It is not a sign you don't know.

🧪 Answer 2a — latest record per email address (dedup) — the one to default to

SELECT
    SubscriberKey,
    EmailAddress,
    FirstName,
    LastName,
    ModifiedDate
FROM (
    SELECT
        SubscriberKey,
        EmailAddress,
        FirstName,
        LastName,
        ModifiedDate,
        ROW_NUMBER() OVER (
            PARTITION BY EmailAddress
            ORDER BY ModifiedDate DESC
        ) AS rn
    FROM Customer_Staging
) AS ranked
WHERE rn = 1;

🔍 Line by line: - SELECT SubscriberKey, EmailAddress, ... — the outer query returns your final, de-duplicated columns. ⭐ Note it does not select rn; you filter on it but don't need it in the target DE. - FROM ( ... ) AS ranked — a subquery (also called a derived table). This wrapper is mandatory: you cannot filter on a window function directly in WHERE, because WHERE is evaluated before ROW_NUMBER() is assigned. This is the thing interviewers check. - ROW_NUMBER() OVER (...) — a window function. It numbers rows 1, 2, 3… within each group without collapsing them the way GROUP BY would. - PARTITION BY EmailAddress — restart numbering for every distinct email address. This is your dedup key. Swap in SubscriberKey if that's the identity you're deduping on. - ORDER BY ModifiedDate DESC — within each email address, the newest row gets rn = 1. - AS rn — alias the computed row number so the outer query can filter it. - WHERE rn = 1 — keep only the newest row per email address; every older duplicate is dropped.

Say this while you write it: "I wrap it in a subquery because you can't filter a window function in the WHERE clause — the row number isn't assigned yet at that point." That one sentence signals you actually understand it rather than having memorised a snippet.

Handling ties

        ROW_NUMBER() OVER (
            PARTITION BY EmailAddress
            ORDER BY ModifiedDate DESC, SubscriberKey DESC
        ) AS rn

🔍 Line by line: - Adding a second ORDER BY column breaks ties deterministically. If two rows share the exact same ModifiedDate, without a tiebreaker the winner is arbitrary and your results are unstable between runs. - ⭐ Bonus credit: if you wanted to keep all tied rows rather than pick one, you'd use RANK() instead of ROW_NUMBER() and filter WHERE rank = 1. Knowing the difference between ROW_NUMBER, RANK and DENSE_RANK is a common follow-up.

The alternative they may push you toward

Some interviewers want to see the aggregate approach:

SELECT s.SubscriberKey, s.EmailAddress, s.ModifiedDate
FROM Customer_Staging AS s
INNER JOIN (
    SELECT EmailAddress, MAX(ModifiedDate) AS MaxDate
    FROM Customer_Staging
    GROUP BY EmailAddress
) AS latest
    ON s.EmailAddress = latest.EmailAddress
   AND s.ModifiedDate = latest.MaxDate;

🔍 Line by line: - The inner query collapses to one row per email address holding only that address's newest ModifiedDate. - The INNER JOIN back to the full table on both the address and the max date re-attaches the remaining columns. - ⭐ Its weakness — say this: if two rows share the identical max date, this returns both, reintroducing the duplicate. ROW_NUMBER() guarantees exactly one. That comparison is a strong senior answer.

🧪 Answer 2b — latest activity for an email asset (Data Views)

If they meant the campaign reading:

SELECT
    j.EmailName,
    s.SubscriberKey,
    s.EventDate
FROM _Sent AS s
INNER JOIN _Job AS j
    ON s.JobID = j.JobID
WHERE j.EmailName = 'Summer_Sale_2026'
  AND s.EventDate > DATEADD(DAY, -30, GETDATE());

🔍 Line by line: - _Sent — the data view holding one row per send, per subscriber. Its grain is the thing to state out loud. - _Job — one row per send job, carrying the email name and send definition. JobID is the join key between them. - INNER JOIN ... ON s.JobID = j.JobID — 🔑 JobID is the standard bridge from a tracking event to the email that produced it. - DATEADD(DAY, -30, GETDATE()) — last 30 days. SFMC SQL is a T-SQL subset, so these standard functions work. - ⭐ Critical constraint to mention: data views hold only about 6 months (180 days) of rolling data, and they are invisible system tables — they never appear in your DE folders. You can query them only from a Query Activity in Automation Studio or from Query Studio. For anything older than 180 days you must persist events into your own rollup DE on a schedule.

The SFMC SQL rules that catch people out

⭐ If asked "how would you make this run nightly?" — Automation Studio → new Automation → Schedule → add a SQL Query Activity → set the target DE and Update mode → add a Verification activity to fail loudly if row counts look wrong. Naming that verification step is a senior signal.

⭐ How to answer any "write the code" question

The code is only half the mark. The delivery is the rest.

1. Scope it out loud. "Are we retrieving one value or many?" / "Dedup, or campaign activity?"
2. Name the approach before typing. "I'll use ROW_NUMBER partitioned by email, ordered by date descending."
3. Narrate as you write. Silence reads as uncertainty.
4. Guard it. RowCount() > 0 in AMPscript; a tiebreaker column in SQL. Unguarded code is the #1 junior tell.
5. State the limit. "LookupRows caps at 2,000." / "Data views only hold 180 days."
6. Close with the production concern. "In production I'd schedule this with a Verification activity so it fails loudly rather than silently sending to an empty audience."

Step 6 is what makes a 5-year candidate sound like a lead — which is exactly what this JD is asking for.

➡️ Next: A02_HTML_for_Email.md

A02 — HTML for Email (tables, Outlook, and the SFMC layer)

🎯 Why this matters for Accenture: the JD literally says "Experience with HTML, CSS, and JavaScript for email and landing page development." Round 1 for a "Custom Software Engineer — SFMC" role is a practical round: they will ask you to describe (or write) a bulletproof button, a two-column layout that survives Outlook, and where AMPscript is allowed to live inside that HTML. Every technique below is written so you can say it out loud and type it cold.

🧠 One-screen mental model

Email HTML is a 1998 document rendered by six different engines, then pasted into Content Builder where AMPscript expands it at send time. Everything in this module is one of those three layers.

   YOU WRITE                    SFMC RENDERS                 CLIENTS DISPLAY
 ┌────────────────┐          ┌──────────────────┐         ┌──────────────────────┐
 │ XHTML skeleton │  paste   │ Content Builder  │  send   │ CLASSIC OUTLOOK      │
 │ + tables       │ ───────▶ │ HTML / Code      │ ──────▶ │  Word engine → VML,  │
 │ + inline CSS   │  block   │ Snippet block    │ expand  │  ghost tables, mso-* │
 │ + %%[AMPscript]│          │  ↓               │ AMPscript├──────────────────────┤
 │ + %%subs_strs%%│          │ link-rewrite     │         │ APPLE / GMAIL / NEW  │
 └────────────────┘          │ + open pixel     │         │ OUTLOOK → real HTML  │
        │                    └──────────────────┘         │  in the [if !mso]    │
        │                             │                   │  branch              │
        │                             ▼                   └──────────────────────┘
        │                    rendered HTML must stay              │
        └── role=presentation, alt, lang ──▶ under ~102KB ───▶ screen readers read
                                            (Gmail clip)         DOM order

Three layers, one artefact. Interviewers probe layer 1 (craft), layer 3 (Outlook), and — because it is an SFMC role — layer 2 (Content Builder + AMPscript + compliance footer).

1. Why email HTML is stuck in ~1998 🔑

Email clients are not browsers. There is no shared rendering engine, no DevTools, no console, and no way to ship a fix after send. The four hard consequences:

• Layout = nested <table>s. No flexbox, no CSS grid, no position. Tables are the only box model every engine agrees on.
• Styling = inline style attributes. <style> in <head> survives in many clients but is progressive enhancement only (details in A03).
• No JavaScript. Every mainstream client strips <script> for security. "Interactive" email is CSS-only (checkbox hack) or AMP for Email.
• Everything must degrade. If a technique fails, the fallback must still be a sendable email — not a broken one.

The Word engine (the reason tables never died) ⭐

Classic Outlook for Windows (2007–2019/2021 and classic Microsoft 365 desktop) renders HTML with Microsoft Word's rendering engine, not with a browser engine. Microsoft swapped Internet Explorer's engine for Word's in Outlook 2007. Word does not implement: float reliably, background-image on non-table elements, max-width, position, CSS margin on many elements, display:inline-block reflow, or modern selectors.

⚠️ The 2026 nuance that makes you sound senior. There is no longer one "Outlook." Say this in the room:

Client	Engine	VML	CSS quality
Classic Outlook for Windows (2007–2021)	Word (mso)	✅ honours VML	poor
New Outlook for Windows (Monarch, WebView2)	Blink	❌ strips VML	good
Outlook.com (webmail)	Blink	❌	good
Outlook for Mac	WebKit-ish	❌	good
Outlook iOS / Android	web-ish	❌	decent

The practical consequence: your [if mso] VML branch only fires in classic Outlook. New Outlook and Outlook.com fall through to the [if !mso] branch — so that branch must itself be production-quality, not a throwaway fallback.

2. The correct document skeleton 🔑🧪

This is the block you must be able to type from memory. Nothing here is decoration.

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
  "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en" xmlns="http://www.w3.org/1999/xhtml"
      xmlns:v="urn:schemas-microsoft-com:vml"
      xmlns:o="urn:schemas-microsoft-com:office:office">
<head>
  <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
  <meta name="viewport" content="width=device-width, initial-scale=1" />
  <meta name="x-apple-disable-message-reformatting" />
  <meta name="color-scheme" content="light dark" />
  <meta name="supported-color-schemes" content="light dark" />
  <title>Spring Sale</title>
  <!--[if mso]>
  <noscript>
    <xml>
      <o:OfficeDocumentSettings>
        <o:PixelsPerInch>96</o:PixelsPerInch>
      </o:OfficeDocumentSettings>
    </xml>
  </noscript>
  <style>
    table, td, div, p, a { font-family: Arial, Helvetica, sans-serif !important; }
  </style>
  <![endif]-->
  <style type="text/css">
    body { margin:0 !important; padding:0 !important; }
    @media only screen and (max-width:600px) {
      .container { width:100% !important; }
      .stack     { display:block !important; width:100% !important; }
    }
  </style>
</head>
<body style="margin:0;padding:0;background-color:#f4f4f4;">
  ...content...
</body>
</html>

🔍 Line by line:

• <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" ...> — the traditional email doctype. Three reasons it won: (1) it forces standards mode rather than quirks mode, so box sizing and margins behave predictably in the browser-based clients; (2) Transitional (not Strict) legally permits the presentational attributes email depends on — align, bgcolor, cellpadding, cellspacing, border, valign, width on <td> — which Strict forbids; (3) it is the doctype most webmail clients have been tested against for two decades. <!DOCTYPE html> (HTML5) is also standards-mode and increasingly common; the honest interview answer is "XHTML 1.0 Transitional is the conservative default and what most SFMC templates carry, HTML5 doctype is fine for modern clients — but note many webmail clients strip your doctype entirely and impose their own, which is a further reason not to depend on doctype-specific behaviour."
• <html lang="en" ...> — lang tells screen readers which language to pronounce; it is a genuine accessibility requirement, not boilerplate.
• xmlns="http://www.w3.org/1999/xhtml" — declares the default XHTML namespace, matching the doctype.
• xmlns:v="urn:schemas-microsoft-com:vml" — registers the VML namespace so classic Outlook understands <v:roundrect>, <v:rect>, <v:fill>. Without this declaration your VML buttons silently render as nothing.
• xmlns:o="urn:schemas-microsoft-com:office:office" — registers the Office namespace for <o:OfficeDocumentSettings> below.
• <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> — sets UTF-8 so accented characters, curly quotes, ™ and emoji render instead of mojibake. (<meta charset="utf-8"> is the HTML5 equivalent; the long form matches the XHTML doctype and the self-closing /> syntax XHTML expects.)
• <meta name="viewport" content="width=device-width, initial-scale=1" /> — tells mobile clients to use the real device width at 1:1 zoom, so your media queries actually fire instead of the client rendering a zoomed-out desktop page.
• <meta name="x-apple-disable-message-reformatting" /> — stops iOS/Apple Mail auto-scaling your font sizes and re-flowing the layout.
• <meta name="color-scheme" content="light dark" /> and <meta name="supported-color-schemes" content="light dark" /> — declare "I have designed for dark mode," which makes Apple/iOS Mail apply your prefers-color-scheme rules instead of guessing. Covered fully in A03.
• <title>Spring Sale</title> — required for a valid document; most clients never show it, but the "View in browser" page can, and empty titles trip some HTML validators used in spam scoring.
• [if mso] — opens an MSO conditional comment. Because it starts as a real HTML comment, only classic Word-engine Outlook "opens" it; every other client treats the whole thing as a comment and skips it. This is downlevel-hidden syntax.
• <noscript> — a defensive wrapper (from Microsoft's own boilerplate) so any engine that does peek inside doesn't try to parse the XML.
• <o:PixelsPerInch>96</o:PixelsPerInch> — forces classic Outlook to treat the display as 96 DPI. Without it, on a Windows machine at 125% scaling Outlook blows every pixel-sized image up ~25% and blurs it. Load-bearing for classic Outlook only.
• table, td, div, p, a { font-family: Arial, Helvetica, sans-serif !important; } — inside the MSO block: when classic Outlook cannot load your web font it falls back to Times New Roman, which looks broken. This forces a clean Arial fallback in Outlook only, leaving the real web font untouched everywhere else.
• <![endif]--> — closes the Outlook-only conditional.
• <style type="text/css"> — the embedded stylesheet: media queries, hover, dark mode live here because they cannot be inlined. Treat everything in here as optional enhancement.
• body { margin:0 !important; padding:0 !important; } — several clients inject their own body margin; zeroing it stops a stray white gutter around your email.
• @media only screen and (max-width:600px) { ... } — the mobile overrides: .container goes full width, .stack cells drop from side-by-side to full-width blocks. !important is required because these must beat the inline styles on the same elements.
• <body style="margin:0;padding:0;background-color:#f4f4f4;"> — body styling is inlined as well as declared in <style>, because clients that strip <style> would otherwise show the default white body behind your grey design.

Which head items are genuinely load-bearing ⭐

A senior is expected to know the difference between essential and cargo-cult:

3. Table-based layout done properly 🔑

The three-table pattern

Every professional email is: wrapper table (100% wide, paints the background) → centring cell → container table (600px) → content rows.

<table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0"
       style="background-color:#f4f4f4;">
  <tr>
    <td align="center" style="padding:24px 12px;">
      <table role="presentation" class="container" width="600" cellpadding="0" cellspacing="0"
             border="0" style="width:600px;max-width:600px;background-color:#ffffff;">
        <tr>
          <td style="padding:24px;font-family:Arial,Helvetica,sans-serif;font-size:16px;
                     line-height:24px;color:#333333;">
            Body copy goes here.
          </td>
        </tr>
      </table>
    </td>
  </tr>
</table>

🔍 Line by line:

• <table role="presentation" ...> — the wrapper. role="presentation" tells screen readers "this is layout scaffolding, read it linearly" instead of announcing "table, 1 row, 1 column" before every section. Without it a layout email becomes unusable audio.
• width="100%" — the HTML attribute, not CSS, because classic Outlook reads attributes more reliably than CSS width on tables.
• cellpadding="0" cellspacing="0" border="0" — the three defaults that must always be zeroed. Browsers default cellspacing to 2px and border to 0, but Outlook adds its own gaps; leaving these off is the single most common cause of mysterious 1–3px seams between stacked images.
• style="background-color:#f4f4f4;" — paints the "outside" area. Use background-color (longhand), not the background shorthand, on table elements — the shorthand is dropped by some clients.
• <td align="center" style="padding:24px 12px;"> — the centring cell. align="center" is the reliable way to centre a fixed-width table because classic Outlook ignores margin:0 auto. Padding here creates the outer gutter — critically, padding is on the <td>, never a margin on the table.
• <table role="presentation" class="container" width="600" ... style="width:600px;max-width:600px;..."> — the container. width="600" (attribute) is what Outlook obeys; the inline width/max-width cover modern clients; .container is the hook the media query uses to go full-width on mobile. Belt and braces on purpose.
• <td style="padding:24px;font-family:...;font-size:16px;line-height:24px;color:#333333;"> — the content cell. Every text cell restates the font stack, size, line-height and colour inline because classic Outlook does not inherit body-level typography. Padding on the <td> is the email-safe replacement for CSS margin.
• The closing </td></tr></table> pairs unwind container → centring cell → wrapper.

Why 600px? ⭐

The honest, complete answer — say all three parts:

1. Historical: the classic Outlook desktop reading pane at 1024×768 with the folder list open left roughly 600–640px of usable width. Anything wider triggered a horizontal scrollbar in the pane.
2. Print/Word heritage: Word's default page width at 96 DPI is about 624px of content area, so classic Outlook clips wider tables.
3. Practical today: 600px is still the industry default because it maps cleanly to a 320–375px phone at ~2× and because every template library, QA suite and stakeholder expects it. 640px is a defensible modern alternative; anything above ~700px is asking for trouble.

align vs margin — the rule ⭐

Outlook-safe vertical spacing 🧪

<tr>
  <td height="24" style="height:24px;font-size:0;line-height:0;
             mso-line-height-rule:exactly;">&nbsp;</td>
</tr>

🔍 Line by line:

• <tr> — a dedicated row whose only job is to create vertical space. This replaces margin entirely.
• height="24" — the HTML attribute Outlook honours for a fixed 24px gap.
• style="height:24px;..." — the CSS twin for modern clients.
• font-size:0;line-height:0 — collapse the   so the cell's height comes only from the height declaration, not from a stray text line adding ~18px.
• mso-line-height-rule:exactly — by default Word uses "at least" line spacing and silently adds leading; exactly forces it to honour your stated line-height. Without this your 24px gap can render as 30px+.
•   — gives the cell content so it actually paints. Completely empty cells collapse to zero height in several clients.

4. Bulletproof buttons 🧪 (the highest-frequency practical question)

An image is not a button (image blocking kills it). A padded the anchor tag alone is not a button (classic Outlook ignores padding on inline elements and only makes the text clickable). The production answer is two branches.

<!--[if mso]>
<v:roundrect xmlns:v="urn:schemas-microsoft-com:vml"
             xmlns:w="urn:schemas-microsoft-com:office:word"
             href="https://www.example.com/sale"
             style="height:44px;v-text-anchor:middle;width:220px;"
             arcsize="9%" strokecolor="#1a73e8" fillcolor="#1a73e8">
  <w:anchorlock/>
  <center style="color:#ffffff;font-family:Arial,Helvetica,sans-serif;
                 font-size:16px;font-weight:bold;">Shop the sale</center>
</v:roundrect>
<![endif]-->
<!--[if !mso]><!-->
<a href="https://www.example.com/sale"
   style="background-color:#1a73e8;border-radius:4px;color:#ffffff;display:inline-block;
          font-family:Arial,Helvetica,sans-serif;font-size:16px;font-weight:bold;
          line-height:44px;text-align:center;text-decoration:none;width:220px;
          mso-hide:all;">Shop the sale</a>
<!--<![endif]-->

🔍 Line by line:

• [if mso] — downlevel-hidden conditional: only classic Outlook renders the VML shape.
• <v:roundrect ...> — a VML rounded rectangle standing in for a CSS button. Word has no border-radius, so a vector shape is the only way to get rounded corners there.
• xmlns:v / xmlns:w re-declared locally — belt and braces in case Content Builder or a marketer strips the <html> tag attributes (it happens more often than you would like).
• href="https://www.example.com/sale" — makes the whole shape clickable, which is the entire point: in Outlook a plain the anchor tag only makes the text clickable, so users tapping the padded area miss.
• style="height:44px;...;width:220px;" — VML ignores CSS padding, so the button must be sized with explicit pixel dimensions. 44px height is also the accessibility minimum touch target.
• v-text-anchor:middle — vertically centres the label inside the shape; Word has no reliable vertical-align here.
• arcsize="9%" — VML's corner radius is a percentage of the shorter side, not pixels. On a 44px-tall button, 9% ≈ 4px, matching the CSS border-radius:4px in the other branch. ⭐ The trap: people copy arcsize="10%" everywhere and their tall and short buttons look inconsistent against the CSS branch.
• strokecolor / fillcolor — the border and fill colours. Set strokecolor equal to fillcolor for a flat button, or use stroked="false".
• <w:anchorlock/> — locks the text so Outlook cannot reflow or let the user select/edit it; stabilises the click target.
• <center style="...">Shop the sale</center> — the visible label. <center> is used because it is the most reliable way to centre text inside a VML shape in Word, and the font must be declared here since VML inherits nothing.
• <![endif]--> — closes the Outlook branch.
• <!--[if !mso]><!--> — opens the downlevel-revealed branch. The trailing <!--> deliberately closes the comment for non-Outlook clients so they render what follows; classic Outlook evaluates !mso as false and keeps it hidden.
• background-color + border-radius + color — the real CSS button for every modern client, including New Outlook and Outlook.com, which strip VML and land here.
• display:inline-block — lets an anchor accept a width and behave like a box.
• line-height:44px + width:220px — gives the anchor its height and vertically centres a single line of text, exactly matching the VML dimensions. Keep the two branches in sync or the button changes size between clients.
• text-decoration:none — removes the default underline.
• mso-hide:all — a second safety net hiding this anchor from classic Outlook in case any build leaks past the conditional, so you never get a doubled button.
• <!--<![endif]--> — closes the downlevel-revealed branch.

Say this out loud in the interview: "A bulletproof button is a VML roundrect for classic Outlook plus a padded or line-height'd inline-block anchor for everyone else, kept dimensionally in sync — because the modern Outlooks strip VML and fall through to the anchor, that anchor has to be production quality on its own."

The padding-based variant (no VML)

If the design has square corners you can skip VML entirely — Outlook honours padding on a <td>:

<table role="presentation" cellpadding="0" cellspacing="0" border="0">
  <tr>
    <td align="center" bgcolor="#1a73e8"
        style="background-color:#1a73e8;border-radius:4px;">
      <a href="https://www.example.com/sale"
         style="display:inline-block;padding:13px 28px;font-family:Arial,Helvetica,sans-serif;
                font-size:16px;font-weight:bold;color:#ffffff;text-decoration:none;">Shop the sale</a>
    </td>
  </tr>
</table>

🔍 Line by line:

• <table role="presentation" cellpadding="0" ...> — a one-cell table; the table (not the anchor) carries the button's background so Outlook paints it.
• <td align="center" bgcolor="#1a73e8" style="background-color:#1a73e8;border-radius:4px;"> — bgcolor is the HTML attribute version of the fill; classic Outlook and some forced-dark-mode clients respect the attribute when they ignore the CSS, so declare both. border-radius is simply ignored by Outlook, degrading to square corners — an acceptable graceful failure.
• <a ... style="display:inline-block;padding:13px 28px;..."> — the padding creates the button size. 13px top/bottom plus a 18px line box ≈ 44px tall. display:inline-block makes the padding apply in the clients that need it.
• Trade-off: Outlook only makes the anchor's text area clickable here, not the full padded box. That is the reason the VML version exists.

5. Ghost tables — multi-column layouts that survive Outlook 🔑

Classic Outlook cannot reflow inline-block elements, and it ignores max-width. A ghost table is a fixed-width table that exists only inside an MSO conditional, scaffolding Outlook while every other client uses the fluid markup.

<div style="font-size:0;text-align:center;">
  <!--[if mso]>
  <table role="presentation" width="600" align="center" cellpadding="0" cellspacing="0" border="0">
    <tr><td width="300" valign="top">
  <![endif]-->
  <div class="stack" style="width:100%;max-width:300px;display:inline-block;
              vertical-align:top;font-size:16px;font-family:Arial,Helvetica,sans-serif;">
    <table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0">
      <tr><td style="padding:12px;">Column one</td></tr>
    </table>
  </div>
  <!--[if mso]>
    </td><td width="300" valign="top">
  <![endif]-->
  <div class="stack" style="width:100%;max-width:300px;display:inline-block;
              vertical-align:top;font-size:16px;font-family:Arial,Helvetica,sans-serif;">
    <table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0">
      <tr><td style="padding:12px;">Column two</td></tr>
    </table>
  </div>
  <!--[if mso]>
    </td></tr>
  </table>
  <![endif]-->
</div>

🔍 Line by line:

• <div style="font-size:0;text-align:center;"> — the parent. font-size:0 is load-bearing: the newline between two inline-block divs renders as a real space character; that phantom ~4px space makes 300 + 300 + space > 600 and the second column wraps a line early. Zeroing the parent font-size collapses it. text-align:center centres the inline-blocks — the reliable centring technique when margin:auto fails.
• <!--[if mso]><table role="presentation" width="600" align="center" ...><tr><td width="300" valign="top"><![endif]--> — the ghost table's opening tags, visible only to classic Outlook: a 600px centred table with a 300px first cell. valign="top" top-aligns the column so unequal-length columns do not vertically centre.
• <div class="stack" style="width:100%;max-width:300px;display:inline-block;vertical-align:top;font-size:16px;..."> — the live column for every other client. width:100%;max-width:300px makes it fluid up to 300px, so on a narrow screen the two columns reflow and stack with no media query at all — that is the whole point of the hybrid approach. font-size:16px resets the readable size the parent zeroed. .stack is the extra media-query hook for clients that do support @media.
• The inner <table> — content inside a column goes in a table, not raw in the div, so padding and typography behave identically in Outlook (which sees the ghost <td>) and elsewhere.
• <!--[if mso]></td><td width="300" valign="top"><![endif]--> — closes ghost cell one and opens ghost cell two, mirroring the live columns. Keep the ghost widths and the live max-width values in sync — they describe the same two columns to two different engines.
• <!--[if mso]></td></tr></table><![endif]--> — the ghost table's closing tags. They live in their own conditional so non-Outlook clients, which never saw the opening <table>, do not choke on orphan </table> tags.
• </div> — closes the parent wrapper.

The three mechanics to name when asked: (1) font-size:0 on the parent kills inline-block whitespace; (2) width:100%;max-width:Npx reflows without a media query; (3) text-align:center + inline-block centres where margin:auto cannot.

6. Images 🔑

The non-negotiable <img> attributes

<a href="https://www.example.com/sale" aria-label="Shop the summer sale"
   style="text-decoration:none;">
  <img src="https://cdn.example.com/hero@2x.jpg" width="600" height="300"
       alt="Summer sale — up to 50% off"
       style="width:100%;max-width:600px;height:auto;display:block;border:0;
              outline:none;text-decoration:none;-ms-interpolation-mode:bicubic;" />
</a>

🔍 Line by line:

• <a href="..." aria-label="Shop the summer sale" style="text-decoration:none;"> — wrapping link. aria-label makes the screen reader announce the destination/action, not the filename; text-decoration:none removes the underline linked images inherit.
• src="https://cdn.example.com/hero@2x.jpg" — an absolute URL. Relative URLs never resolve in an inbox. The @2x file is 1200×600 physical pixels.
• width="600" height="300" — the HTML attributes. Three jobs: classic Outlook obeys them (it ignores max-width); they reserve layout space before the image loads so the email does not jump; and they instruct the client to downsample the 2× asset, which is what makes it crisp on Retina/high-DPI screens.
• alt="Summer sale — up to 50% off" — the accessible name and the images-blocked fallback. Describe the offer, not the file. Decorative images take alt="" (present but empty) so readers skip them; a missing alt makes some readers announce the filename.
• width:100%;max-width:600px;height:auto — fluid on mobile, capped on desktop, aspect ratio preserved. Outlook ignores all three and uses the attributes above — deliberate redundancy.
• display:block — removes the ~3px gap under images. Images are inline by default, so they sit on the text baseline and the descender space below becomes a visible white line between stacked slices. This one property causes more "mystery gap" bugs than anything else in email.
• border:0;outline:none;text-decoration:none — strip the blue border/underline some clients draw around linked images.
• -ms-interpolation-mode:bicubic — improves image resampling quality in older Internet Explorer-based rendering; harmless elsewhere, still commonly shipped.

Background images with VML (classic Outlook) 🧪

<!--[if gte mso 9]>
<v:rect xmlns:v="urn:schemas-microsoft-com:vml" fill="true" stroke="false"
        style="width:600px;height:300px;">
  <v:fill type="frame" src="https://cdn.example.com/hero.jpg" color="#1b1b1b" />
  <v:textbox inset="0,0,0,0">
<![endif]-->
<div style="background-color:#1b1b1b;
            background-image:url('https://cdn.example.com/hero.jpg');
            background-position:center;background-repeat:no-repeat;background-size:cover;
            width:600px;max-width:600px;height:300px;">
  <table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0">
    <tr><td style="padding:40px;font-family:Arial,Helvetica,sans-serif;color:#ffffff;">
      Overlay headline
    </td></tr>
  </table>
</div>
<!--[if gte mso 9]>
  </v:textbox>
</v:rect>
<![endif]-->

🔍 Line by line:

• <!--[if gte mso 9]> — gte = greater-than-or-equal. VML support arrived at the mso 9 (Office 2000) baseline, so this correctly targets every VML-capable classic Outlook. (mso 12=2007, 14=2010, 15=2013, 16=2016+. New Outlook reports no mso version at all, which is why [if lte mso 16] is the way to scope a fix to classic builds only.)
• <v:rect fill="true" stroke="false" style="width:600px;height:300px;"> — a VML rectangle that will carry the image. Explicit pixel dimensions are mandatory; VML has no auto-sizing.
• <v:fill type="frame" src="..." color="#1b1b1b" /> — paints the image. type="frame" scales it to cover the box; color is the fallback fill if the image is blocked or 404s.
• <v:textbox inset="0,0,0,0"> — a VML text container layered over the fill so overlay content sits on top of the image; the zero inset removes VML's default internal padding so your own padding controls spacing.
• background-color:#1b1b1b declared before background-image — this is the fallback that keeps white overlay text readable when images are off. ⭐ Never ship a hero with white text over an image and no background colour.
• background-size:cover — scales the image to fill without distortion. Note it is written as longhand properties, not the background shorthand, because several clients drop the shorthand.
• The inner role="presentation" table — positions the overlay content reliably; div padding is less predictable across clients.
• The closing </v:textbox></v:rect> in a second conditional — balances the VML opening tags for Outlook only.

Image-blocking defences ⭐

Many clients block images by default until the user clicks "display images." Design for the blocked state:

• Styled alt text — alt inherits the <img>'s inline font styles in most clients, so style="font-family:Arial;font-size:16px;color:#333333;" on the <img> makes the blocked-state text legible instead of tiny blue Times New Roman.
• Never put critical content in images only — offer, code, CTA and deadline must exist as real HTML text somewhere.
• Give every image cell a bgcolor so a blocked hero shows a brand colour, not a white hole.
• Never an image-only email — image-to-text ratio is a spam-scoring factor and an accessibility failure.

7. Preheader (hidden preview text) 🧪

The snippet the inbox shows after the subject line. If you do not set one, the client grabs whatever text comes first — usually "View in browser" or an alt tag.

<div style="display:none;font-size:1px;line-height:1px;max-height:0;max-width:0;
            opacity:0;overflow:hidden;mso-hide:all;color:#f4f4f4;">
  Free shipping ends tonight — your cart is waiting.
  &zwnj;&nbsp;&zwnj;&nbsp;&zwnj;&nbsp;&zwnj;&nbsp;&zwnj;&nbsp;&zwnj;&nbsp;&zwnj;&nbsp;
</div>

🔍 Line by line:

• display:none — hides it in most clients while leaving it in the DOM, which is what the inbox preview generator reads.
• font-size:1px;line-height:1px — if a client ignores display:none, any leak renders as an invisible hairline rather than a line of text.
• max-height:0;max-width:0;overflow:hidden — clamps the box to nothing for the clients that ignore both of the above.
• opacity:0 — a fourth independent hide lever.
• mso-hide:all — the classic Outlook-specific hide.
• color:#f4f4f4 — matched to the body background so that if it does leak, it is invisible against the background instead of showing as a stray grey line.
• Free shipping ends tonight — your cart is waiting. — the crafted snippet. It should extend the subject line, never repeat it: screen readers read subject then preheader back-to-back, and duplicates make the user hear the same phrase twice.
• ‌  repeated — zero-width-non-joiner and non-breaking-space pairs forming an invisible spacer that fills out the rest of the preview window, pushing your real body copy out of the preview so it does not bleed in after your snippet.

⚠️ Be honest about the trade-off: perfect cross-client preheader hiding is not fully solvable. display:none + mso-hide:all can make Outlook omit the preheader from its own preview pane, and hidden preheader text occasionally leaks visibly. Frame it as "a known imperfect area — here is the recipe I standardise on and the trade-offs," not as bulletproof.

8. Accessibility 🔑 (the senior differentiator)

<h1 style="margin:0 0 12px 0;font-family:Arial,Helvetica,sans-serif;font-size:28px;
           line-height:34px;font-weight:bold;color:#111111;">Summer sale is here</h1>
<p style="margin:0;font-family:Arial,Helvetica,sans-serif;font-size:16px;
          line-height:24px;color:#333333;">Up to 50% off everything, until Sunday.</p>

🔍 Line by line:

• `

  ` — a **real heading element**, not a styled `

  `, so screen-reader users can navigate by heading. `margin:0 0 12px 0` resets the browser's default heading margin (which varies wildly per client) and sets the spacing explicitly; margins are acceptable here because this sits inside a `` whose padding does the structural work. - `font-size:28px;line-height:34px;font-weight:bold;color:#111111` — everything inlined because Outlook does not inherit typography. `#111111` rather than pure `#000000` because some dark-mode inverters leave exact black untouched, producing black-on-black. - `

  ` — `margin:0` on paragraphs is essential: default `

  ` margins differ between clients and are the second-biggest source of inconsistent vertical rhythm after image gaps. --- ## 9. The SFMC layer — how this HTML actually lives in Content Builder 🔑🔑 This is what separates an SFMC developer from a generic email coder, and it is where an Accenture SFMC round will go. ### Three ways to author an email | Approach | What it is | AMPscript | When | |---|---|---|---| | **Paste HTML** | one full-document HTML block; you own everything | ✅ executes | full control, developer-owned templates | | **Template-based** | a template defines **Slots** and locked vs editable regions; marketers drop blocks in | ✅ in HTML/Code Snippet blocks placed in slots | governed marketer self-service | | **Content Blocks** (drag-and-drop) | reusable **HTML block**, **Code Snippet block**, Image, Button, Text | ✅ **only** in HTML and Code Snippet blocks | modular systems — fix the footer once, every email updates | ⭐ **The trap:** AMPscript does **not** reliably execute in Text / WYSIWYG / Free-form blocks. Keep all logic in **HTML or Code Snippet** blocks. If a marketer pastes `%%[ ]%%` into a text block and it renders literally, that is the bug. ### AMPscript sitting inside the HTML

  %%[
    VAR @fname, @tier
    SET @fname = AttributeValue("FirstName")
    SET @tier  = Lookup("Loyalty", "Tier", "SubscriberKey", _subscriberkey)
    IF Empty(@fname) THEN SET @fname = "there" ENDIF
  ]%%
  <td style="padding:24px;font-family:Arial,Helvetica,sans-serif;font-size:16px;
             line-height:24px;color:#333333;">
    Hi %%=v(@fname)=%%, you're a %%=ProperCase(@tier)=%% member.
  </td>
  

  **🔍 Line by line:** - `%%[` — opens an **AMPscript statement block**. Everything inside runs at send time and outputs nothing by itself. This must sit inside an HTML or Code Snippet block. - `VAR @fname, @tier` — declares variables; AMPscript variables always start with `@`. - `SET @fname = AttributeValue("FirstName")` — reads a send-context attribute from the sendable Data Extension. - `SET @tier = Lookup("Loyalty", "Tier", "SubscriberKey", _subscriberkey)` — single-value lookup: from DE `Loyalty`, return column `Tier` where `SubscriberKey` matches the built-in `_subscriberkey`. - `IF Empty(@fname) THEN SET @fname = "there" ENDIF` — the **null guard**. Without it you ship *"Hi ,"* — the single most common personalization bug in production. - `]%%` — closes the block; what follows is literal HTML. - `%%=v(@fname)=%%` — **inline output** of a variable. `v()` resolves it safely. - `%%=ProperCase(@tier)=%%` — inline output of a function result. - Note the three syntaxes you must distinguish cold: **`%%[ ]%%`** = logic block, **`%%=Fn()=%%`** = inline output, **`%%fieldName%%`** = direct output of a send-context attribute. ### The required compliance footer 🧪

  <p style="margin:0;font-family:Arial,Helvetica,sans-serif;font-size:12px;
            line-height:18px;color:#888888;">
    <a href="%%profile_center_url%%" style="color:#888888;">Update preferences</a> &nbsp;|&nbsp;
    <a href="%%unsub_center_url%%" style="color:#888888;">Unsubscribe</a> &nbsp;|&nbsp;
    <a href="%%view_email_url%%" style="color:#888888;">View in browser</a><br />
    Example Retail Ltd., 2 Folsom Street, San Francisco, CA 94105
  </p>
  

  **🔍 Line by line:** - `

  ` — the footer, styled small and grey; inlined because Content Builder does not auto-inline. - `%%profile_center_url%%` — an SFMC **substitution string** the platform replaces per subscriber with their Profile Center URL. - `%%unsub_center_url%%` — resolves to the Subscription Center / opt-out flow. A **working unsubscribe is a CAN-SPAM legal requirement**, and since the Feb-2024 Gmail/Yahoo bulk-sender rules it must be consistent with the RFC 8058 `List-Unsubscribe` / `List-Unsubscribe-Post` headers configured at account level. - `%%view_email_url%%` — the View-As-Web-Page link, hosted on the same landing-page infrastructure as CloudPages. - `style="color:#888888;"` on each the anchor tag — links must restate their colour inline or clients apply their own default blue (and iOS auto-links). - `Example Retail Ltd., 2 Folsom Street, ...` — the **physical postal address**, also a CAN-SPAM legal requirement, not optional polish. ### How Content Builder can mangle your HTML ⭐ Real things that happen — name two or three and you sound like you have shipped: - **The WYSIWYG rewrites the source.** Opening a full-document email in the drag-and-drop editor, or switching a block's type, can re-serialise your markup — reordering attributes, closing tags "helpfully," and occasionally dropping conditional comments. **Lock developer templates and edit HTML in the code view only.** - **Conditional comments are fragile.** Some editors strip or "clean" `[if mso]` blocks. Always re-test Outlook after a marketer edits. - **Link rewriting adds bytes.** At send time SFMC rewrites every `href` to route through the click-tracking redirect domain, and injects the 1×1 open pixel late in the document. - **The 102KB Gmail clip is on the RENDERED HTML.** A lean 60KB template can blow past 102KB after AMPscript `FOR`-loop expansion plus link rewriting — and the clipped tail can drop the footer *and* the open pixel, under-counting opens. Measure the rendered output, not the source. - **Slots and locked regions.** Define them deliberately so marketers can only edit inside your guardrails. - **Emails sent from a template do not retroactively update** when you change the template unless the block is a shared Content Block reference — that is the argument for modular reusable blocks. --- ## 🎤 Interview angles **Q1 ⭐⭐⭐ — "Why do we still use tables and inline CSS in email?"** Because there is no shared rendering engine. Classic Outlook for Windows renders with **Microsoft Word's engine** — no flexbox, grid, `position`, `max-width` or reliable `float` — and several webmail clients strip or ignore the head and style blocks. Nested tables plus inline styles are the lowest common denominator every engine agrees on. *…and in practice:* I code to that lowest denominator and treat modern CSS as enhancement, so the email degrades to something sendable rather than something broken. **Q2 ⭐⭐⭐ — "Which doctype do you use and why?"** XHTML 1.0 Transitional traditionally, because it forces standards mode while still permitting the presentational attributes email needs (`align`, `bgcolor`, `cellpadding`, `valign`). HTML5's `` is also fine for modern clients. The caveat worth stating: **many webmail clients strip your doctype and impose their own**, so nothing critical should depend on it. **Q3 ⭐⭐⭐ — "Build me a bulletproof button."** Two branches: a `` with `arcsize`, `v-text-anchor:middle` and `` inside `[if mso]` for classic Outlook, and an `inline-block` anchor with `line-height` for height inside `[if !mso]`. Keep the widths in sync. The reason both exist: VML gives Outlook rounded corners and a fully clickable box; the anchor is what New Outlook, Outlook.com, Gmail and Apple Mail actually render. **Q4 ⭐⭐⭐ — "Why 600px?"** The classic Outlook reading pane at 1024×768 left roughly 600–640px usable, and Word's page width clips wider tables. It has stuck as the industry default because it maps cleanly onto phone widths at 2× and every QA suite expects it. 640px is a defensible modern alternative. **Q5 ⭐⭐ — "What is a ghost table?"** A fixed-width table that exists only inside `[if mso]`, scaffolding classic Outlook — which ignores `max-width` and cannot reflow `inline-block` — while every other client renders the fluid markup. The opening and closing tags live in separate conditionals so non-Outlook clients never see orphan `

  ` tags. **Q6 ⭐⭐ — "Why `display:block` on every image?"** Images are inline by default, so they sit on the text baseline and the descender space renders as a ~3px white gap under the image — visible as seams between stacked slices. `display:block` removes it. I pair it with `border:0` to kill the link border. **Q7 ⭐⭐ — "How do you do a background image in Outlook?"** Classic Outlook ignores CSS `background-image`, so it takes a `` + `` inside `[if gte mso 9]`, paired with a real CSS background using **longhand** properties for everyone else — and always a `background-color` fallback declared first so overlay text stays readable when images are blocked. Note New Outlook and Outlook.com strip VML and use the CSS half. **Q8 ⭐⭐⭐ — "Where can AMPscript live in Content Builder?"** Only in **HTML blocks and Code Snippet blocks** (and in the subject line / preheader field). It does not reliably execute in Text, WYSIWYG or Free-form blocks. `%%[ ]%%` is a statement block, `%%=Fn()=%%` is inline output, `%%field%%` outputs a send-context attribute directly. **Q9 ⭐⭐ — "What must every commercial email footer contain?"** A working unsubscribe (`%%unsub_center_url%%`) and a physical postal address — both CAN-SPAM legal requirements — plus typically `%%profile_center_url%%` and `%%view_email_url%%`. Since the 2024 Gmail/Yahoo bulk-sender rules, the in-body unsubscribe must land in the same outcome as the RFC 8058 one-click `List-Unsubscribe` header. **Q10 ⭐⭐ — "How do you make an email accessible?"** `role="presentation"` on every layout table, `lang` on ``, meaningful `alt` on content images and **empty** `alt=""` on decorative ones, `aria-label` on image links, real `

  `/`

  ` in order, source order matching visual order, WCAG 2.2 AA contrast (4.5:1 body / 3:1 large), descriptive link text, and a preheader that extends rather than repeats the subject. --- ## ⭐ Gotchas a senior is expected to know 1. **"Outlook" is not one client.** Classic Windows Outlook = Word engine + VML; New Outlook, Outlook.com and Outlook Mac = Blink/WebKit and **strip VML**. Saying "Outlook uses Word" without the qualifier dates you. 2. **Missing `xmlns:v` / `xmlns:o` on ``.** Your VML silently renders as nothing and you spend an hour blaming the conditional comment. 3. **Forgetting `cellpadding="0" cellspacing="0" border="0"`.** Outlook adds default spacing — this is the cause of mystery seams between image slices. 4. **`margin` on anything structural.** Outlook ignores it. Use `padding` on `` and spacer rows. 5. **Empty spacer cells collapse.** Always put ` ` in them and zero the `font-size`/`line-height`. 6. **`mso-line-height-rule:exactly` omitted.** Word defaults to "at least" spacing and *adds* leading, so your 24px gaps render taller than designed. 7. **The ~1728px tall-image clip.** Classic Outlook clips a **single image taller than about 1728px** from the bottom — a Word page-size limit. It is a **height** limit, not a width limit; interviewers ask this specifically to see if you know which. Fix: slice long heroes into stacked rows. 8. **Outlook ignores `max-width`.** Always set explicit pixel `width`/`height` **attributes** as well as inline CSS. 9. **The DPI blow-up.** Without `96`, images render ~25% oversized and blurry on Windows machines at 125% scaling. 10. **Relative image URLs.** They never resolve in an inbox. Absolute CDN URLs only. 11. **Image-only emails.** Break under image blocking, fail accessibility, and score worse on spam filters. Keep real text. 12. **The 102KB Gmail clip is measured on the RENDERED HTML** after AMPscript expansion and SFMC link rewriting — the clipped tail can drop your footer *and* the open pixel, silently under-counting opens. 13. **Pure `#000000` in dark mode.** Some inverters leave exact black untouched, producing black-on-black. Use `#111111`. 14. **AMPscript in a Text/WYSIWYG block.** It renders literally. HTML or Code Snippet blocks only. 15. **Letting a marketer open a coded email in the drag-and-drop editor.** The WYSIWYG can re-serialise your markup and strip conditional comments. Lock the template. --- **Sources:** Salesforce Help — Content Builder & Email Studio · Microsoft Office VML reference · Campaign Monitor / Litmus CSS support tables · Email on Acid — bulletproof buttons & ghost tables · Gmail/Yahoo bulk sender requirements (Feb 2024) · WCAG 2.2 AA ➡️ Next: A03_CSS_for_Email.md

A03 — CSS for Email (inlining, responsive, dark mode, Outlook)

🎯 Why this matters for Accenture: the JD asks for "HTML, CSS, and JavaScript for email and landing page development," and CSS is where practical rounds separate people who have built emails from people who have read about them. The single highest-value fact you can state in this interview: SFMC Content Builder does NOT auto-inline your CSS — unlike Mailchimp or Campaign Monitor, which do. Everything below builds on that.

🧠 One-screen mental model

Two buckets. Inline what must survive; embed what cannot be inlined and accept it may be dropped.

                 ┌───────────────────────── YOUR CSS ─────────────────────────┐
                 │                                                             │
      ┌──────────▼──────────┐                          ┌──────────────────────▼─────────┐
      │  INLINE  style="…"  │                          │  EMBEDDED  <head><style>        │
      │  layout · colour ·  │                          │  @media · :hover · dark mode ·  │
      │  font · padding ·   │                          │  @font-face · classes           │
      │  width · line-height│                          │  (CANNOT be inlined — not       │
      └──────────┬──────────┘                          │   element-level rules)          │
                 │                                     └──────────────┬─────────────────┘
                 │ survives everywhere                                │ may be stripped
                 ▼                                                    ▼
     ┌────────────────────────┐                        ┌──────────────────────────────┐
     │ CLASSIC OUTLOOK        │                        │ GANGA (non-Gmail account in   │
     │ Word engine · no @media│                        │ the Gmail app) · some webmail │
     │ needs mso-* + VML      │                        │ → NO media queries at all     │
     └────────────────────────┘                        └──────────────────────────────┘

      RULE: the NON-media-query rendering must already be an acceptable email.
      SFMC does not inline for you  →  hand-inline, or run Premailer/juice/MJML first.

Design the inline layer to be shippable on its own; everything in <style> is a bonus.

1. The three ways to include CSS 🔑

Why external CSS never works

• Email is a MIME message, not a web page. There is no page load, no document base URL, and the message body is delivered as a self-contained blob.
• Clients strip <link> and @import for security: an external fetch would leak the open, the recipient's IP, and allow the sender to change the message content after delivery.
• Webmail clients render your HTML inside their own DOM, so an external stylesheet would be able to restyle their interface.
• Gmail specifically drops any <style> block containing an @import.

Say it as: "External CSS is stripped by essentially every client because email is a self-contained MIME part with no page context, and an external fetch would be both a privacy leak and a way to mutate the message after delivery."

2. Inlining: why it matters, and the SFMC fact ⭐⭐

What actually strips or breaks <style>

• Classic Outlook (Word engine) — honours a simple <style> block but ignores @media entirely and supports only a narrow CSS 2.1 subset (no attribute selectors, no reliable descendant combinators, no max-width).
• Gmail historically stripped <style> completely. That changed around September/October 2016, when Gmail added support for embedded <style> and media queries — but with rules you must know:
• Gmail removes the specific <style> block containing an invalid or unsupported rule; other separate <style> blocks survive.
• A block larger than about 8KB (8192 characters) is dropped.
• A nested at-rule — @import or @font-face inside @media — kills the whole block.
• GANGA (a Gmail App with a Non-Gmail Account — e.g. a Yahoo or corporate IMAP account configured in the Gmail mobile app) still does not support <style> or media queries. This is the single most-cited "Gmail ignores my media query" cause.
• Outlook.com rewrites your class names, prefixing them with x_ (it rewrites both the selector and the element's class attribute, so simple class rules keep working — but any selector that matches on the class string breaks).
• Some corporate/legacy webmail and preview panes strip <head> wholesale.

🔑 SFMC does not auto-inline

Mailchimp, Campaign Monitor and several other ESPs run an inliner over your HTML at send time. Salesforce Marketing Cloud does not. Whatever you put in <head><style> stays embedded exactly as written. So your options are:

1. Hand-inline critical styles on every element — most reliable, and what you do for the core skeleton.
2. Run an inliner before pasting — Premailer, juice, the Litmus or Email on Acid inliner.
3. Author in MJML, which compiles to already-inlined, Outlook-safe HTML (ghost tables and VML included), then paste the compiled output into an HTML or Code Snippet block.

And the split you must articulate: inline everything element-level; keep media queries, :hover, dark mode and @font-face in <head><style> because they are not element-level rules and physically cannot be inlined.

The specificity fact that makes !important mandatory

@media only screen and (max-width:600px) {
  .container { width:100% !important; }
  .stack     { display:block !important; width:100% !important; }
  .h1        { font-size:24px !important; line-height:30px !important; }
  .pad       { padding:16px !important; }
  .hide-sm   { display:none !important; max-height:0 !important; overflow:hidden !important; }
}

🔍 Line by line:

• @media only screen and (max-width:600px) { — fires on viewports 600px wide or narrower. only screen excludes print and shields ancient clients that cannot parse media queries from applying the rules unconditionally.
• .container { width:100% !important; } — the 600px container fills the phone screen. !important is not optional: an inline style="width:600px" has higher specificity than any selector in <style>, and !important is the only thing that beats it. Every rule that overrides an inlined property needs it.
• .stack { display:block !important; width:100% !important; } — flips side-by-side columns to full-width stacked blocks.
• .h1 { font-size:24px !important; line-height:30px !important; } — shrinks a desktop headline. Always change line-height with font-size or you get cramped or airy mobile type.
• .pad { padding:16px !important; } — tightens gutters so copy is not crushed against the screen edge.
• .hide-sm { display:none !important; max-height:0 !important; overflow:hidden !important; } — hides an element on mobile. display:none alone is ignored by some clients on images, so max-height:0 + overflow:hidden is the belt-and-braces version.
• } — closes the query. Remember: in classic Outlook and GANGA none of this runs, so the inline defaults must already be acceptable.

3. Client support matrix 🔑

The one-line summary to say: "Apple and the modern Blink clients support most of CSS 2.1 and a lot of CSS3; classic Outlook supports a narrow CSS 2.1 subset with no media queries; and GANGA supports no embedded CSS at all — so I inline the layer that must survive and treat <style> as enhancement."

4. Responsive email 🔑

The three strategies — know all three

(a) Fluid / spongy. Percentage widths plus max-width, minimal media queries. Survives where <style> is stripped, but classic Outlook ignores max-width so it needs ghost tables.

(b) Responsive (media-query driven). Fixed desktop layout; @media (max-width:600px) overrides stack and resize. Simple to author, but it does nothing in classic Outlook or GANGA.

(c) Hybrid / fluid-hybrid — the robust choice at scale. Fluid widths + max-width + inline-block columns that reflow naturally + MSO ghost tables for Outlook. Media queries become an optional polish layer rather than the load-bearing mechanism.

<div style="font-size:0;text-align:center;">
  <!--[if mso]><table role="presentation" width="600" align="center" cellpadding="0"
       cellspacing="0" border="0"><tr><td width="300" valign="top"><![endif]-->
  <div class="stack" style="display:inline-block;width:100%;max-width:300px;
       vertical-align:top;font-size:16px;font-family:Arial,Helvetica,sans-serif;">
    Column one
  </div>
  <!--[if mso]></td><td width="300" valign="top"><![endif]-->
  <div class="stack" style="display:inline-block;width:100%;max-width:300px;
       vertical-align:top;font-size:16px;font-family:Arial,Helvetica,sans-serif;">
    Column two
  </div>
  <!--[if mso]></td></tr></table><![endif]-->
</div>

🔍 Line by line:

• <div style="font-size:0;text-align:center;"> — font-size:0 collapses the whitespace between the two inline-block divs. That newline in your source renders as a real space character; 300 + 300 + ~4px space exceeds 600px and the second column wraps a line early. text-align:center centres the inline-blocks, which is also the reliable centring technique when margin:0 auto is ignored.
• <!--[if mso]><table … width="600" align="center">…<td width="300" valign="top"><![endif]--> — the ghost table opening, visible only to classic Outlook, which cannot reflow inline-blocks and ignores max-width.
• display:inline-block;width:100%;max-width:300px — the mechanism: each column is fluid up to 300px, so on a narrow screen two of them cannot fit side by side and they reflow to stacked with no media query at all. This is why hybrid survives GANGA and Outlook.
• vertical-align:top — aligns column tops; without it unequal columns centre against each other.
• font-size:16px — resets the readable text size that the parent's font-size:0 zeroed. Forgetting this reset makes your text vanish — a classic hybrid bug.
• class="stack" — the optional media-query hook for clients that do support @media, letting you force full width earlier than the natural reflow point.
• <!--[if mso]></td></tr></table><![endif]--> — the ghost closing tags in their own conditional, so non-Outlook clients never see orphan </table> tags.

Mobile-first vs desktop-first ⭐

Why email inverts the web convention: on the web, mobile-first is standard because every browser supports media queries. In email, classic Outlook and GANGA do not, so the un-queried default is what a large share of your audience sees. You therefore make the un-queried default the safe, fixed, desktop layout and use max-width queries to adapt downwards. Say that reasoning — it is exactly the kind of "why" an interviewer is fishing for.

Why the Gmail app historically ignored media queries

Two separate stories, do not conflate them:

1. Before ~2016, Gmail stripped <style> entirely — so no media query, no embedded CSS, in any Gmail context.
2. After 2016, Gmail supports embedded CSS and media queries — except GANGA. A non-Gmail account added to the Gmail mobile app is rendered by a different, older path that still strips <head> CSS.

The engineering answer to both: hybrid layout, which reflows via max-width without needing @media, plus inline defaults that look correct unstyled.

5. Dark mode 🔑

The taxonomy — three classes of behaviour

Do not say "I use prefers-color-scheme." That is only true for one class.

<meta name="color-scheme" content="light dark" />
<meta name="supported-color-schemes" content="light dark" />

🔍 Line by line:

• <meta name="color-scheme" content="light dark" /> — declares the email is designed for both schemes. Supporting clients then apply your rules instead of blindly auto-inverting.
• <meta name="supported-color-schemes" content="light dark" /> — the companion declaration some clients look for by that exact name. Ship both; together they tell Apple/iOS Mail "hand me control."

@media (prefers-color-scheme: dark) {
  .body-bg    { background-color:#121212 !important; }
  .card       { background-color:#1e1e1e !important; }
  .card-text  { color:#f5f5f5 !important; }
  .light-logo { display:none !important; max-height:0 !important; overflow:hidden !important; }
  .dark-logo  { display:block !important; max-height:none !important; width:160px !important; }
}

[data-ogsb] .card      { background-color:#1e1e1e !important; }
[data-ogsc] .card-text { color:#f5f5f5 !important; }

🔍 Line by line:

• @media (prefers-color-scheme: dark) { — fires only in Class-2 clients that honour the OS dark-mode signal. Apple Mail is the one that matters most.
• .body-bg { background-color:#121212 !important; } — repaints the outer background near-black rather than pure black; pure #000000 makes text edges harsh and some inverters skip exact black.
• .card { background-color:#1e1e1e !important; } — the content card, one step lighter than the page so hierarchy survives.
• .card-text { color:#f5f5f5 !important; } — off-white text; pure #ffffff on near-black causes halation for many readers.
• .light-logo { display:none !important; max-height:0 !important; overflow:hidden !important; } — hides the dark-on-light logo. The extra max-height/overflow exist because several clients ignore display:none on images.
• .dark-logo { display:block !important; max-height:none !important; width:160px !important; } — reveals the light-on-dark variant, undoing the collapse trick used to hide it by default.
• [data-ogsb] .card { … } — a Class-3 hook. Outlook.com and New Outlook ignore the media query but, when their forced inversion changes an element, they stamp it with an attribute recording the original value: data-ogsb = original style background, data-ogsc = original style colour, data-ogab/data-ogac = the original HTML attribute background/colour. Targeting those attributes lets you re-assert your intended colours under forced inversion. Note there is no @media wrapper — it is a plain attribute selector.

What actually breaks, and the fixes

• Black logos disappear. Fix: put the logo in a <td> with an explicit light bgcolor and background-color, so the inverter recolours the cell, not the transparent PNG.
• Transparent PNGs. A dark-on-transparent PNG is invisible on a dark background. Ship either a light-on-dark variant swapped by media query, or a PNG with a baked-in light halo.
• Pure #000000 text. Many inverters flip near-black to near-white but leave exact black alone → black on dark. Use #111111.
• Borders vanish. A #eeeeee divider on white becomes invisible after inversion. Use mid-tone borders that read in both schemes.
• Coloured buttons get recoloured. Test your CTA in Outlook.com dark specifically.
• The pragmatic stance for Class 3: you cannot fully control forced-inversion clients. Design an inversion-tolerant palette and accept variance. Also remember browser-level dark mode and the Dark Reader extension are further inverters you do not control.
• Static previews lie. Litmus and Email on Acid screenshots do not always reproduce forced inversion — confirm on a real device.

<td align="center" bgcolor="#ffffff"
    style="background-color:#ffffff;padding:16px;border-radius:8px;">
  <img src="https://cdn.example.com/logo.png" width="160" alt="Example Retail"
       style="display:block;border:0;" />
</td>

🔍 Line by line:

• bgcolor="#ffffff" — the HTML attribute version of the background. Some inverters respect the attribute when they ignore the CSS, so declaring both is the halo trick's whole mechanism.
• background-color:#ffffff — the CSS twin, for the clients that read CSS.
• padding:16px — gives the logo breathing room so the white halo reads as intentional design.
• border-radius:8px — softens the halo in modern clients; classic Outlook ignores it and shows a square, which is fine.
• <img … style="display:block;border:0;" /> — the logo sits on the white cell, so even an aggressive inverter keeps it legible.

6. Typography 🔑

Web-safe font stacks

font-family: Arial, Helvetica, sans-serif;                          /* the safest sans */
font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif;        /* Apple-leaning sans */
font-family: Georgia, 'Times New Roman', Times, serif;              /* the safest serif */
font-family: 'Segoe UI', Roboto, Arial, Helvetica, sans-serif;      /* platform UI sans */
font-family: 'Brand Sans', Arial, Helvetica, sans-serif;            /* web font + fallback */

🔍 Line by line:

• Arial, Helvetica, sans-serif — Arial exists on Windows, Helvetica on macOS/iOS, and the generic sans-serif catches everything else. The only stack guaranteed everywhere.
• 'Helvetica Neue', Helvetica, Arial, sans-serif — prefers the Apple face, degrades to Arial on Windows. Quoted because the name contains a space.
• Georgia, 'Times New Roman', Times, serif — Georgia is the safest screen serif and ships on both major platforms.
• 'Segoe UI', Roboto, Arial, … — picks up the native Windows and Android UI faces for a modern look with a universal fallback.
• 'Brand Sans', Arial, Helvetica, sans-serif — a web font first, then always a websafe fallback. Never end a stack at the web font.

@font-face support — get the list right ⭐

• ✅ Supported: Apple Mail, iOS Mail, Outlook for Mac, some Android/Samsung native clients.
• ❌ Not supported: Gmail (all contexts), Outlook.com (strips embedded web fonts — do not list it as a supporter), Windows Outlook classic and new, Yahoo Mail.
• So: a web font is a progressive enhancement for roughly Apple's share of your audience. Design the fallback first, and check that your layout does not break when the fallback's metrics differ.

<!--[if mso]>
<style>
  table, td, div, p, a, h1, h2, span {
    font-family: Arial, Helvetica, sans-serif !important;
  }
</style>
<![endif]-->

🔍 Line by line:

• <!--[if mso]> — classic-Outlook-only. Notably, classic Outlook does honour a simple <style> block, which is exactly what makes this fix possible.
• table, td, div, p, a, h1, h2, span { font-family: Arial, Helvetica, sans-serif !important; } — when Word cannot resolve your web font it falls back to Times New Roman, which looks broken in a sans-serif design. Listing the elements explicitly (rather than *) is safer in Word, and !important beats the inline font declaration on each element. This applies in Outlook only; the real web font is untouched elsewhere.

Line-height quirks in Outlook 🧪

<td style="font-family:Arial,Helvetica,sans-serif;font-size:16px;line-height:24px;
           mso-line-height-rule:exactly;color:#333333;padding:0 24px;">
  Body copy with predictable leading.
</td>

🔍 Line by line:

• font-size:16px;line-height:24px — always declare line-height in px or a unitless number, never a percentage; Outlook handles % line-heights unpredictably.
• mso-line-height-rule:exactly — the fix. Word's default line-spacing rule is "at least", which silently adds leading beyond your stated value, so a 24px line-height can render at 28–30px and your carefully spaced block grows. exactly forces Word to honour the number. Put it on every text cell and every spacer cell.
• color:#333333 — restated inline because classic Outlook does not inherit typography from <body>.
• padding:0 24px — horizontal inset on the <td>, the email-safe replacement for margin.

Other typography details worth naming: body copy ≥14–16px (iOS auto-bumps smaller text anyway); avoid letter-spacing on Outlook-critical text (Word support is patchy); text-transform is fine but write the copy in the correct case for screen readers rather than relying on text-transform:uppercase.

7. Outlook-specific CSS 🔑

The mso-* property family

<table role="presentation" width="600" cellpadding="0" cellspacing="0" border="0"
       style="mso-table-lspace:0pt;mso-table-rspace:0pt;border-collapse:collapse;">
  <tr>
    <td style="mso-padding-alt:20px 24px;padding:20px 24px;
               font-family:Arial,Helvetica,sans-serif;font-size:16px;line-height:24px;
               mso-line-height-rule:exactly;color:#333333;">
      Content
    </td>
  </tr>
</table>

🔍 Line by line:

• mso-table-lspace:0pt;mso-table-rspace:0pt — Word adds left and right spacing around tables by default; this zeroes it. Without it, nested tables drift a few pixels and full-width elements do not reach the edge.
• border-collapse:collapse — collapses cell borders so adjacent cells share one border instead of doubling it, and removes residual spacing some clients apply.
• mso-padding-alt:20px 24px paired with padding:20px 24px — the mso- version is Word's own padding property; declaring both means Outlook and everyone else agree. mso-padding-alt is the standard fix when padding on a wrapping element is dropped.
• mso-line-height-rule:exactly — again, on every text cell.

Why margin fails and what to use instead ⭐

Word's engine has no reliable margin support on table cells, divs or images — it silently drops it, or applies it to only one side. Rules:

• Vertical space between blocks → a spacer <tr> with height, font-size:0, line-height:0, mso-line-height-rule:exactly and  .
• Space inside a block → padding on the <td>.
• Centring → align="center" on the parent <td>, or text-align:center + inline-block. Never margin:0 auto.
• margin:0 on <p> and <h1> is still worth declaring, because you are removing the client's default, not adding your own.

Conditional CSS

<!--[if mso]>
<style>
  .fluid-only { display:none !important; }
  .outlook-fix { width:600px !important; }
</style>
<![endif]-->
<!--[if !mso]><!-->
<div class="fluid-only">Rendered by everything except classic Outlook.</div>
<!--<![endif]-->

🔍 Line by line:

• <!--[if mso]> — downlevel-hidden: the content sits inside a real HTML comment, so only classic Word-engine Outlook opens it. Everything else sees a comment.
• <style> inside it — an Outlook-only stylesheet. Use it to patch widths, hide fluid-only elements, and force fonts.
• <![endif]--> — closes the downlevel-hidden block.
• <!--[if !mso]><!--> — downlevel-revealed: the trailing <!--> deliberately closes the comment for non-Outlook clients so they render what follows, while classic Outlook evaluates !mso as false and keeps it hidden.
• <!--<![endif]--> — closes the revealed block; the leading <!-- re-opens a comment for non-Outlook clients so the marker itself is not displayed.
• Version gating: [if gte mso 9] targets every VML-capable classic Outlook (mso 9 = the Office 2000 VML baseline; 12 = 2007, 14 = 2010, 15 = 2013, 16 = 2016+). [if lte mso 16] scopes a fix to classic builds only, because New Outlook reports no mso version at all and therefore never matches.

8. Buttons, spacing and borders without modern CSS 🧪

<table role="presentation" width="600" cellpadding="0" cellspacing="0" border="0"
       style="border-collapse:collapse;">
  <tr>
    <td height="1" style="height:1px;font-size:0;line-height:0;
               background-color:#dddddd;">&nbsp;</td>
  </tr>
  <tr>
    <td style="padding:20px;border-left:4px solid #1a73e8;background-color:#f7f9fc;
               font-family:Arial,Helvetica,sans-serif;font-size:15px;line-height:22px;
               mso-line-height-rule:exactly;color:#333333;">
      A callout box built with a cell border, not a CSS box-shadow.
    </td>
  </tr>
</table>

🔍 Line by line:

• border-collapse:collapse on the table — prevents doubled borders and stray spacing between the divider row and the callout row.
• <td height="1" style="height:1px;font-size:0;line-height:0;background-color:#dddddd;"> — a horizontal rule built as a 1px-tall filled cell, because <hr> renders inconsistently and ignores your styling in classic Outlook. font-size:0;line-height:0 stop the   inflating the row past 1px.
•   — content so the cell actually paints; empty cells collapse to zero height.
• padding:20px on the callout cell — the only spacing mechanism Outlook honours reliably.
• border-left:4px solid #1a73e8 — borders on a <td> do work in Outlook (unlike box-shadow, outline or pseudo-elements). This is how you build accent bars, cards and separators.
• background-color:#f7f9fc — longhand, not the background shorthand, so it is not dropped.
• mso-line-height-rule:exactly — pins the leading inside the callout.

The substitution table to memorise:

9. CSS that is banned or unreliable ⭐

🎤 Interview angles

Q1 ⭐⭐⭐ — "How do you handle CSS in SFMC — inline or embedded?" Both, deliberately split. SFMC Content Builder does not auto-inline, unlike Mailchimp or Campaign Monitor, so anything layout- or colour-critical is hand-inlined or run through Premailer/juice/MJML before pasting. Media queries, :hover, dark-mode rules and @font-face cannot be inlined at all — they are not element-level rules — so they live in <head><style> as progressive enhancement, and I make sure the un-queried inline layer is already a shippable email.

Q2 ⭐⭐⭐ — "Why doesn't external CSS work in email?" Email is a self-contained MIME part with no page context or base URL, and clients strip <link>/@import for privacy and security — an external fetch would leak the open and the recipient's IP, and would let a sender mutate the message after delivery. Gmail additionally drops any <style> block containing an @import.

Q3 ⭐⭐⭐ — "My media query isn't working in Gmail. Why?" Four candidates, in order: (1) GANGA — a non-Gmail account inside the Gmail app strips embedded CSS entirely; (2) the <style> block contains an invalid or unsupported rule, so Gmail dropped that whole block; (3) the block is over ~8KB; (4) there is a nested at-rule — @font-face or @import inside @media. Fix: split CSS across smaller blocks, keep them valid, no nested at-rules — and use a hybrid layout so stacking does not depend on @media at all.

Q4 ⭐⭐ — "Mobile-first or desktop-first for email?" Desktop-first, with max-width queries. The web convention inverts in email because classic Outlook and GANGA ignore media queries entirely, so the un-queried default is what a large share of the audience actually sees. Making the default the fixed desktop layout means the worst case is "small but correct" rather than "a stretched mobile layout on a desktop screen."

Q5 ⭐⭐⭐ — "Explain dark mode across clients." Three classes. Apple Mail and iOS Mail honour prefers-color-scheme — pair the media query with the color-scheme and supported-color-schemes metas. Outlook.com, New Outlook and Windows 10 Mail force their own inversion and ignore the media query; there you use the [data-ogsc]/[data-ogsb] attribute hooks they stamp on inverted elements, or design an inversion-tolerant palette. Gmail is mixed. Practical fixes: white halo cells behind logos, off-black #111111 instead of #000000, mid-tone borders, and a real-device test rather than a static preview.

Q6 ⭐⭐ — "Why mso-line-height-rule:exactly?" Word's default line-spacing rule is "at least", so it adds leading beyond your stated line-height — a 24px line-height renders at 28–30px and spacer rows grow. exactly forces Word to honour the number. I put it on every text cell and every spacer cell.

Q7 ⭐⭐ — "Why can't you use margin?" Word's engine drops margin on most elements, or applies it to one side only. The email vocabulary is: spacer <tr> with an explicit height for vertical rhythm, padding on the <td> for inset, and align="center" or text-align:center + inline-block for centring. margin:0 on <p>/<h1> is still worth declaring because that removes the client's default rather than adding my own.

Q8 ⭐⭐ — "Can you use web fonts?" As an enhancement only. @font-face works in Apple Mail, iOS Mail, Outlook for Mac and some Android native clients; Gmail, Outlook.com, Windows Outlook and Yahoo do not support it. So I always end the stack with a websafe fallback, verify the layout with the fallback metrics, and add an MSO-conditional <style> forcing Arial so classic Outlook does not drop to Times New Roman.

Q9 ⭐⭐ — "Which CSS is off-limits?" position, flexbox, grid, calc(), CSS variables, pseudo-elements and negative margins — Outlook has no support and Gmail/Yahoo actively strip several of them. float and background-image are partial and need align/VML equivalents. Shorthands (background, font) are risky enough that I use longhand. And !important belongs in <style>, not in inline styles, since Gmail has historically stripped it from inline declarations.

Q10 ⭐ — "How do you build a divider or a card without modern CSS?" A divider is a 1px-tall <td> with a background-color, font-size:0, line-height:0 and   — not <hr>, which classic Outlook renders on its own terms. A card is a <td> with padding, background-color and a real border (borders on cells do work in Outlook); box-shadow is decoration only and must never be load-bearing.

⭐ Gotchas

1. Assuming SFMC inlines your CSS. It does not. This is the fact most likely to be tested in an SFMC-specific CSS question.
2. Media-query rules without !important. Inline styles outrank anything in <style>; without !important your mobile overrides do nothing.
3. Blaming "Gmail" when the culprit is GANGA. A non-Gmail account in the Gmail app strips embedded CSS entirely. Name it.
4. One giant <style> block. Over ~8KB Gmail drops it, and one invalid rule takes the whole block with it. Split into several smaller blocks.
5. @font-face nested inside @media. A nested at-rule kills the entire block in Gmail.
6. Claiming Outlook.com supports web fonts. It strips them. The supporters are Apple Mail, iOS Mail, Outlook for Mac and some Android native clients.
7. Forgetting mso-line-height-rule:exactly. Your vertical rhythm quietly inflates in classic Outlook.
8. Percentage line-height. Unpredictable in Outlook — use px or unitless.
9. background shorthand with an image. Dropped by several clients. Use background-color + background-image longhand, and always declare a fallback colour.
10. A background image with no fallback colour. Blocked images plus white overlay text equals an invisible hero.
11. max-width as the only width control. Classic Outlook ignores it — always pair with a ghost table or a fixed width attribute.
12. Forgetting the font-size reset on hybrid columns. The parent's font-size:0 cascades and your text disappears.
13. prefers-color-scheme assumed to cover Outlook. It does not — Outlook.com and New Outlook force inversion and ignore it. Use [data-ogsc]/[data-ogsb].
14. Pure #000000 and pure #ffffff. Inverters treat exact black inconsistently and pure white on near-black causes halation. Use #111111 and #f5f5f5.
15. !important inside an inline style attribute. Gmail has historically stripped it there; keep !important in <style>.
16. Trusting Litmus/Email on Acid screenshots for dark mode. Static previews do not reliably reproduce forced inversion — do a real device send.

Sources: Campaign Monitor & Litmus CSS support tables · Gmail CSS support and <style> limits documentation · Salesforce Help — Content Builder · Microsoft Office mso- and VML references · Email on Acid — hybrid layouts and dark mode

➡️ Next: A04_JavaScript_for_Email_and_CloudPages.md

A04 — JavaScript for Email and CloudPages

🎯 Why this matters for Accenture: the JD asks for "HTML, CSS, and JavaScript for email and landing page development." That single sentence hides the trap the interviewer will spring on you: JavaScript does not run in email clients. Say that clearly, then show you know the two places JS does run in Marketing Cloud — server-side (SSJS) at send/render time, and client-side in the browser on a CloudPage. Candidates who fumble this sound junior in the first 90 seconds. Candidates who draw the line cleanly and then write a working SSJS CRUD block sound like the 4-year engineer Accenture is paying for.

🧠 One-screen mental model

                    THE WORD "JAVASCRIPT" IN SFMC MEANS THREE THINGS
                    ================================================

  (1) JS INSIDE AN EMAIL            (2) SSJS  <script runat="server">     (3) CLIENT-SIDE JS ON A CLOUDPAGE
      <script>alert(1)</script>         Platform.Load("Core","1.1.1")         <script> document.querySelector(...)
              |                                   |                                       |
              v                                   v                                       v
      +---------------+                 +-------------------+                   +----------------------+
      | Gmail/Outlook |                 | SFMC RENDER ENGINE|                   |  SUBSCRIBER'S BROWSER|
      | Apple Mail    |                 | (Rhino, ES3)      |                   |  (Chrome/Safari)     |
      | STRIPS <script>|                | runs at SEND time |                   |  runs at PAGE LOAD   |
      +---------------+                 +-------------------+                   +----------------------+
              |                                   |                                       |
        DEAD. Never runs.              Output is plain HTML                    Full DOM, fetch(), events
        Security policy.               No DOM. No window.                      NO access to SFMC objects
                                       Talks to DEs + SOAP API                 unless you call an endpoint

  ------------------------------------------------------------------------------------------------
   EMAIL  =  HTML + CSS + AMPscript/SSJS   (server-rendered, static on arrival)
   CLOUDPAGE = HTML + CSS + AMPscript/SSJS (server) + JavaScript (client)  <-- both halves available
  ------------------------------------------------------------------------------------------------

   REQUEST LIFECYCLE OF A CLOUDPAGE FORM (memorize this order):

   browser GET  ->  SFMC renders AMPscript/SSJS  ->  HTML+JS delivered  ->  user types
        ->  client JS validates (UX only)  ->  POST  ->  SFMC re-renders page
        ->  SSJS/AMPscript reads RequestParameter()  ->  VALIDATES AGAIN (security)
        ->  UpsertData/UpsertDE writes the DE  ->  confirmation HTML returned

1. 🔑 THE HEADLINE ANSWER — "Can you use JavaScript in an email?"

No. JavaScript does not execute in email clients. Say it in one breath, then justify it:

• Gmail strips <script> tags entirely before rendering — the web client sanitizes the HTML into its own restricted subset.
• Outlook (desktop) renders with the Microsoft Word HTML engine, which has no JavaScript engine at all. Nothing to run it with.
• Apple Mail / iOS Mail are WebKit-based, so they technically have an engine, but the mail renderer disables scripting for security.
• Yahoo, Outlook.com, Yandex and effectively every other major client sanitize <script>, <iframe>, on* event attributes (onclick, onload), and javascript: URLs.

Why: an email is untrusted content delivered directly into a logged-in session. Allowing script would mean XSS against the mail client, cookie theft, silent tracking beyond the pixel, and drive-by exploits. Every vendor independently reached the same conclusion. There is no "but if you set the right header" escape hatch — treat it as an absolute.

⭐ Classic trap: an interviewer says "I've seen JavaScript in emails, how would you do a countdown timer with JS?" This is bait. The correct answer: "You can't — a countdown timer in email is an animated GIF generated by an external service at open time, or AMPscript-computed static text at send time. If someone says 'JS in email' they mean either SSJS running server-side before delivery, or client-side JS on the landing page the email links to."

So what DOES give you interactivity in email?

Model answer to memorize:

"JavaScript is stripped by every major email client for security, so no client-side JS in email. In SFMC the word 'JavaScript' normally means Server-Side JavaScript — <script runat="server"> — which runs on SFMC's Rhino interpreter at send or render time and emits plain HTML. The subscriber never receives code, only the output. Real browser JavaScript is available on CloudPages and landing pages, which is where I put forms, validation, and AJAX. In email itself I get interactivity from CSS and from externally-generated images."

2. Server-Side JavaScript (SSJS) — the environment 🔑

SSJS runs on a Salesforce-customized Mozilla Rhino interpreter built to the ECMAScript 3 specification. It executes on SFMC's servers at send/render time in three contexts: email content, CloudPages, and Script Activities in Automation Studio.

<script runat="server">
    Platform.Load("Core", "1.1.1");
    var name = "Akash";
    Write("Hello " + name);
</script>

🔍 Line by line:

• <script runat="server"> — the runat="server" attribute is the entire difference between SSJS and browser JS. With it, SFMC executes the block on its own servers and the tag never reaches the recipient. Without it, the tag is treated as ordinary client-side JavaScript and shipped to the browser (fine on a CloudPage, stripped in email).
• Platform.Load("Core", "1.1.1"); — loads the Core object library, which gives you DataExtension, List, Subscriber, Folder, TriggeredSend, and Script.Util.WSProxy. The Platform library (Platform.Function.*, Write, Variable) is available without loading anything; only Core needs this line. Omit it and DataExtension.Init(...) throws "DataExtension is not defined". "1.1.1" is the standard version string — treat it as boilerplate you type every time.
• var name = "Akash"; — var is the only declaration keyword. No let, no const, no arrow functions, no template literals, no destructuring. Assume ES3.
• Write("Hello " + name); — the global output function. String concatenation with +. On a CloudPage this writes into the page body; in an email it injects into the content; in a Script Activity the output is discarded (there is no response target), which is why you log to a DE there instead.
• </script> — closes the block. Everything inside runs in one server-side pass before the asset is delivered.

⭐ Gotcha to name out loud: some ES5 helpers (Array.forEach, Object.keys, native JSON) appear to exist but are unreliable and behave differently across contexts. Use classic indexed for loops and Platform.Function.ParseJSON / Stringify instead of native JSON. Saying "I treat it as ES3 because the ES5 surface is partial and inconsistent" lands much better than "it's ES3."

The two libraries

Output and serialization

<script runat="server">
Platform.Load("Core", "1.1.1");
var obj = { sku: "ABC-1", qty: 2 };
Write("<p>Short form</p>");
Platform.Response.Write("<p>Explicit form</p>");
Write(Stringify(obj));
var back = Platform.Function.ParseJSON('{"a":1}');
Write(back.a);
</script>

🔍 Line by line:

• var obj = { sku: "ABC-1", qty: 2 }; — a plain object literal. Object literals and array literals work fine in ES3; it's the methods on them that are unreliable.
• Write("<p>Short form</p>"); — the global shorthand for emitting output. No library prefix required.
• Platform.Response.Write("<p>Explicit form</p>"); — the fully-qualified equivalent. Identical behaviour. Know both forms so an interviewer showing the long one doesn't throw you.
• Write(Stringify(obj)); — Stringify is SSJS's built-in JSON serializer. Use this, never JSON.stringify, which is unreliable in Rhino. Emits {"sku":"ABC-1","qty":2}.
• var back = Platform.Function.ParseJSON('{"a":1}'); — the safe parser, the counterpart to Stringify. Turns a JSON string into a real object. Never use eval() or native JSON.parse.
• Write(back.a); — dot access on the parsed object emits 1.

3. 🧪 Data Extension CRUD in SSJS — write this cold

This is the "write the code" question in JavaScript form. There are two APIs and you should be able to write both.

3a. Core library — DataExtension.Init(...).Rows.*

<script runat="server">
Platform.Load("Core", "1.1.1");
try {
    var de = DataExtension.Init("Preference_Center");

    var rows = de.Rows.Lookup(["SubscriberKey"], ["12345"]);
    if (rows && rows.length > 0) {
        Write("Current status: " + rows[0].Status + "<br>");
    } else {
        Write("No row found<br>");
    }

    var added = de.Rows.Add({
        SubscriberKey: "12345",
        EmailAddress: "test@example.com",
        Status: "Active",
        ModifiedDate: Platform.Function.Now()
    });
    Write("Rows added: " + added + "<br>");

    var updated = de.Rows.Update({ Status: "Unsubscribed" }, ["SubscriberKey"], ["12345"]);
    Write("Rows updated: " + updated + "<br>");

    var filter = { Property: "Status", SimpleOperator: "equals", Value: "Active" };
    var actives = de.Rows.Retrieve(filter);
    Write("Active rows: " + actives.length + "<br>");

    var removed = de.Rows.Remove(["SubscriberKey"], ["12345"]);
    Write("Rows removed: " + removed + "<br>");
} catch (e) {
    Write("Error: " + Stringify(e));
}
</script>

🔍 Line by line:

• Platform.Load("Core", "1.1.1"); — required before DataExtension exists.
• try { — wrap all DE I/O. There is no console in SFMC; an uncaught error renders a raw error page on a CloudPage or fails the automation step. Try/catch is the single biggest reason to pick SSJS over AMPscript.
• var de = DataExtension.Init("Preference_Center"); — gets a handle by DE Name or CustomerKey. Init does not hit the database; it just builds the object. A bad name doesn't throw here — it throws on the first .Rows call, which confuses people debugging.
• var rows = de.Rows.Lookup(["SubscriberKey"], ["12345"]); — READ. First array = match columns, second = match values, paired positionally; multiple pairs are ANDed. Returns an array of row objects, empty array if nothing matched.
• if (rows && rows.length > 0) { — the mandatory guard. Never index into a result you haven't length-checked.
• Write("Current status: " + rows[0].Status + "<br>"); — column access by dot notation on the first row. rows[0]["Status"] is equivalent and is what you use when the column name is in a variable.
• var added = de.Rows.Add({ ... }); — CREATE. A flat {column: value} object. Insert-only: it will not update an existing row and will error or duplicate on a primary-key clash. Returns the number of rows added.
• ModifiedDate: Platform.Function.Now() — Platform.Function.Now() is the AMPscript Now() exposed to SSJS; it returns SFMC system time (Central Standard, UTC−6, no DST — see A05).
• var updated = de.Rows.Update({ Status: "Unsubscribed" }, ["SubscriberKey"], ["12345"]); — UPDATE. Arg 1 = the columns to set; args 2 and 3 = the match column(s) and value(s). Update-only: no-op if nothing matches. Returns rows affected.
• var filter = { Property: "Status", SimpleOperator: "equals", Value: "Active" }; — a simple filter object: which column, which comparison, which value. This is the same shape WSProxy uses, so learn it once.
• var actives = de.Rows.Retrieve(filter); — the filtered read. Retrieve(filter) is the flexible form; Lookup(cols, vals) is the equals-only shorthand.
• var removed = de.Rows.Remove(["SubscriberKey"], ["12345"]); — DELETE. Same positional match arrays. Deletes every matching row and returns the count.
• } catch (e) { / Write("Error: " + Stringify(e)); — serialize the caught error. On a real CloudPage you'd log this to an Error DE rather than leaking internals to a visitor.

3b. Platform.Function — the AMPscript functions from JavaScript

<script runat="server">
var v  = Platform.Function.Lookup("Preference_Center", "Status", "SubscriberKey", "12345");
var rs = Platform.Function.LookupRows("Order_Items", "OrderID", "SO-9001");
var ro = Platform.Function.LookupOrderedRows("Orders", 1, "OrderDate DESC", "CustID", "C-77");
Platform.Function.UpsertDE("Preference_Center", 1, "SubscriberKey", "12345", "Status", "Active");
Platform.Function.InsertDE("Audit_Log", "LogId", Platform.Function.GUID(), "Msg", "ran ok");
Platform.Function.UpdateDE("Preference_Center", 1, "SubscriberKey", "12345", "Status", "Lapsed");
Platform.Function.DeleteDE("Preference_Center", "SubscriberKey", "12345");
</script>

🔍 Line by line:

• Platform.Function.Lookup(...) — returns a single scalar: the Status column from the first row where SubscriberKey == "12345". Empty string if no match. Literally AMPscript's Lookup() exposed to JS.
• Platform.Function.LookupRows(...) — returns a rowset of every row where OrderID == "SO-9001". Case-insensitive match, unordered, hard-capped at 2,000 rows.
• Platform.Function.LookupOrderedRows("Orders", 1, "OrderDate DESC", "CustID", "C-77"); — the "give me the latest order" idiom: at most 1 row, sorted newest-first. LookupRows has no ordering at all, so this is the only correct way to get "the latest".
• Platform.Function.UpsertDE(..., 1, "SubscriberKey", "12345", "Status", "Active"); — update-or-insert. The 1 is numKeys: "the next 1 name/value pair is the matching key." Getting numKeys wrong silently duplicates or overwrites rows.
• Platform.Function.InsertDE(...) — insert-only. Platform.Function.GUID() generates a unique id, handy for log row keys.
• Platform.Function.UpdateDE(...) — update-only, same numKeys shape.
• Platform.Function.DeleteDE("Preference_Center", "SubscriberKey", "12345"); — deletes every matching row.

🔑 Which do you use? Platform.Function.* for quick single-row work with AMPscript parity. Core DataExtension.Init().Rows.* for object-style work on a CloudPage. WSProxy for bulk, cross-BU, or anything above the row caps.

4. Error handling — why SSJS beats AMPscript 🔑

AMPscript has no try/catch. SSJS does. This one sentence answers "when do you use SSJS instead of AMPscript?" better than any list.

<script runat="server">
Platform.Load("Core", "1.1.1");
function logError(context, e) {
    Platform.Function.UpsertDE("Error_Log", 1,
        "LogId", Platform.Function.GUID(),
        "Context", context,
        "Message", Stringify(e),
        "LoggedAt", Platform.Function.Now());
}

try {
    var de = DataExtension.Init("Preference_Center");
    var n = de.Rows.Add({ SubscriberKey: Platform.Request.GetQueryStringParameter("sk") });
    if (n === 0) {
        throw "Insert affected 0 rows";
    }
    Write("OK");
} catch (e) {
    logError("PrefCentre:insert", e);
    Write("<p>Sorry, we couldn't save that. Please try again.</p>");
}
</script>

🔍 Line by line:

• function logError(context, e) { — SSJS supports reusable functions, which AMPscript cannot define at all. This alone is a strong reason to reach for SSJS in anything non-trivial.
• Platform.Function.UpsertDE("Error_Log", 1, ...) — persist the error to a DE. There is no console and no log file in SFMC, so a DE is your log sink. GUID() guarantees a unique key so concurrent renders don't collide.
• try { — begin the protected region.
• var n = de.Rows.Add({ SubscriberKey: Platform.Request.GetQueryStringParameter("sk") }); — reads a query-string parameter and inserts. Platform.Request.GetQueryStringParameter is CloudPage-only (email has no Request object).
• if (n === 0) { throw "Insert affected 0 rows"; } — you can throw your own errors to force the catch branch, turning a silent no-op into a handled failure.
• } catch (e) { — catches both platform exceptions and your own throws.
• logError("PrefCentre:insert", e); — record what failed and where.
• Write("<p>Sorry, we couldn't save that...</p>"); — degrade gracefully: the visitor sees a friendly message, not a stack trace.

Platform.Function.RaiseError — fail loudly on purpose

if (resp.OverallStatus != "OK") {
    Platform.Function.RaiseError("Upsert failed: " + resp.Results[0].StatusMessage, true);
}

🔍 Line by line:

• if (resp.OverallStatus != "OK") { — check the envelope status, not just the row status. A SOAP call can "return" while some rows failed.
• Platform.Function.RaiseError(msg, true); — deliberately raises a platform error. The second parameter is boolSkipCurrentOnly: true = skip only the current subscriber and continue the send; false/omitted = abort the entire job. In a Script Activity, RaiseError fails the activity so the automation surfaces the problem instead of silently succeeding. (Full signature detail is in A05 §9 — expect it to be asked in AMPscript terms.)

5. AMPscript ↔ SSJS interop 🔑

They share one variable namespace within a single asset, and blocks execute top to bottom in document order.

%%[
  VAR @subscriberKey, @tier
  SET @subscriberKey = RequestParameter("sk")
]%%
<script runat="server">
    Platform.Load("Core", "1.1.1");
    var sk = Variable.GetValue("@subscriberKey");
    var tier = Platform.Function.Lookup("Loyalty", "Tier", "SubscriberKey", sk);
    if (tier == "" || tier == null) { tier = "Standard"; }
    Variable.SetValue("@tier", tier);
</script>
<p>Your tier: %%=v(@tier)=%%</p>

🔍 Line by line:

• %%[ VAR @subscriberKey, @tier ]%% — the variables must be declared in AMPscript first. This is the rule people forget: Variable.SetValue("@tier", ...) from SSJS only reaches AMPscript if @tier was declared in an AMPscript block earlier in the document. Setting an undeclared variable from SSJS silently does nothing on output.
• SET @subscriberKey = RequestParameter("sk") — populates the inbound value in AMPscript. Could equally be done in SSJS; shown here to prove the round trip.
• var sk = Variable.GetValue("@subscriberKey"); — SSJS reads the AMPscript variable. The @ is part of the name and must be inside the string. Platform.Variable.GetValue(...) is the identical namespaced form.
• var tier = Platform.Function.Lookup("Loyalty", "Tier", "SubscriberKey", sk); — the lookup, done in JS.
• if (tier == "" || tier == null) { tier = "Standard"; } — defaulting, easier in JS than nested IIF.
• Variable.SetValue("@tier", tier); — writes back into the AMPscript namespace.
• <p>Your tier: %%=v(@tier)=%%</p> — AMPscript renders the value the SSJS computed. This is the canonical division of labour: heavy logic in SSJS, rendering in AMPscript.

🔑 Also useful: Platform.Function.TreatAsContent("%%=v(@x)=%%") runs AMPscript from inside SSJS and returns the rendered string.

6. WSProxy 🔑 — the SOAP API without leaving the platform

WSProxy is a lightweight SSJS wrapper (Script.Util.WSProxy) around SFMC's SOAP API, executing operations in-session.

Why it's faster than an external HTTP SOAP/REST call — be precise, because interviewers push on a hand-wavy "it's faster":

1. No external HTTPS round-trip — the call never leaves SFMC's infrastructure.
2. No OAuth token exchange per call — it inherits the executing session's auth context.
3. No JSON↔XML↔object marshaling that an external client pays.

It is not magic: it still runs the same SOAP operations, still pages at 2,500 rows, and still consumes render time.

<script runat="server">
Platform.Load("Core", "1.1.1");
var prox = new Script.Util.WSProxy();

var cols   = ["Name", "CustomerKey", "CategoryID"];
var filter = { Property: "Name", SimpleOperator: "like", Value: "Promo%" };
var res    = prox.retrieve("DataExtension", cols, filter);

for (var i = 0; i < res.Results.length; i++) {
    Write(res.Results[i].Name + " — " + res.Results[i].CustomerKey + "<br>");
}
</script>

🔍 Line by line:

• var prox = new Script.Util.WSProxy(); — constructs the proxy. No URL, no credentials — it inherits the current session. Script.Util comes from Core, so Platform.Load is required first.
• var cols = ["Name", "CustomerKey", "CategoryID"]; — SOAP retrieves have no SELECT *; you must name every property you want back.
• var filter = { Property: "Name", SimpleOperator: "like", Value: "Promo%" }; — a simple filter. Valid operators: equals, notEquals, greaterThan, lessThan, greaterThanOrEqual, lessThanOrEqual, isNull, isNotNull, between (array), IN (array), like (% wildcard).
• var res = prox.retrieve("DataExtension", cols, filter); — signature is retrieve(type, cols, filter, options). "DataExtension" is the metadata/schema object (the list of DEs), not their rows.
• for (var i = 0; i < res.Results.length; i++) { — classic indexed loop; never forEach in Rhino.
• Write(res.Results[i].Name + ...) — the payload always lives on .Results, never on res directly. The envelope also carries OverallStatus, HasMoreRows, and RequestID.

Compound filters (AND/OR)

var filter = {
    LeftOperand:     { Property: "CategoryID", SimpleOperator: "equals", Value: 12345 },
    LogicalOperator: "AND",
    RightOperand:    { Property: "Name", SimpleOperator: "like", Value: "Promo%" }
};

🔍 Line by line:

• LeftOperand: {...} — the left half, itself a simple filter object (or another complex one, allowing arbitrary nesting).
• LogicalOperator: "AND" — "AND" or "OR". This is the only thing a simple filter cannot express.
• RightOperand: {...} — the right half. The engine detects simple vs complex by the keys present, so both shapes go in the same third argument slot.

🧪 Paging past 2,500 rows with ContinueRequest

<script runat="server">
Platform.Load("Core", "1.1.1");
var prox  = new Script.Util.WSProxy();
var TYPE  = "DataExtensionObject[Preference_Center]";
var COLS  = ["SubscriberKey", "Status"];
var all   = [], reqID = null, res, guard = 0;

do {
    res = (reqID == null)
        ? prox.retrieve(TYPE, COLS)
        : prox.retrieve(TYPE, COLS, null, { ContinueRequest: reqID });
    if (res && res.Results) { all = all.concat(res.Results); }
    reqID = res ? res.RequestID : null;
    guard++;
} while (res && res.HasMoreRows && guard < 1000);

Write("Total rows: " + all.length);
</script>

🔍 Line by line:

• var TYPE = "DataExtensionObject[Preference_Center]"; — DataExtensionObject[...] is the type for the rows inside a DE (as opposed to DataExtension, which is the table definition). Store it in a variable because continuation calls must pass a byte-for-byte identical type string. It accepts DE Name or CustomerKey; prefer CustomerKey (immutable, unambiguous across BUs).
• var all = [], reqID = null, res, guard = 0; — accumulator, continuation token (null = "first call"), current response, and a runaway-loop guard.
• do { — a do/while, not a while. The first retrieve may already be the only batch; a top-of-loop while would skip processing it.
• res = (reqID == null) ? prox.retrieve(TYPE, COLS) : prox.retrieve(TYPE, COLS, null, { ContinueRequest: reqID }); — first pass starts the retrieve; every later pass passes the prior RequestID as ContinueRequest in the 4th (options) argument, with the filter slot null (the filter is remembered with the RequestID). prox.getNextBatch(TYPE, reqID) is the older equivalent — know both.
• if (res && res.Results) { all = all.concat(res.Results); } — append this page's rows, guarded against an empty/failed batch.
• reqID = res ? res.RequestID : null; — save the continuation token. It is single-use and ordered — you cannot jump to page 3.
• } while (res && res.HasMoreRows && guard < 1000); — keep paging while the server says more rows remain, with a hard 1,000-batch ceiling (2.5M rows) so a buggy HasMoreRows can't spin forever.

Create / update / delete rows, and cross-BU

var resp = prox.createItem("DataExtensionObject", {
    CustomerKey: "Preference_Center",
    Properties: [
        { Name: "SubscriberKey", Value: "12345" },
        { Name: "Status",        Value: "Active" }
    ]
}, [
    { Name: "SaveOptions", Value: [ { PropertyName: "*", SaveAction: "UpdateAdd" } ] }
]);

prox.setClientId({ ID: 5551212 });
var childRows = prox.retrieve(TYPE, COLS, null, { QueryAllAccounts: true });
prox.resetClientIds();

🔍 Line by line:

• prox.createItem("DataExtensionObject", {...}, [...]) — writes rows, not a table. Three arguments: type, payload, options array.
• CustomerKey: "Preference_Center", — identifies which DE to write into, by CustomerKey.
• Properties: [ { Name: ..., Value: ... } ] — column values as an array of {Name, Value} pairs, not a flat object. This shape is the thing candidates forget.
• { Name: "SaveOptions", Value: [ { PropertyName: "*", SaveAction: "UpdateAdd" } ] } — the upsert switch. "UpdateAdd" = update if the primary key matches, otherwise insert. Without it, createItem is insert-only. The other actions are UpdateOnly and AddOnly.
• prox.setClientId({ ID: 5551212 }); — re-scopes every subsequent call on this proxy to the child BU with MID 5551212. Only works if the executing context has rights to that BU.
• { QueryAllAccounts: true } — includes rows from shared / parent-BU data extensions.
• prox.resetClientIds(); — always reset. Forgetting this means later calls silently keep hitting the child BU — a classic production bug.

7. Decision table — AMPscript vs SSJS vs client-side JS 🔑

8. Client-side JavaScript on CloudPages 🔑 — this one DOES run

A CloudPage is a real web page served from SFMC over HTTPS. The browser gets it, so normal DOM JavaScript works: document.querySelector, event listeners, fetch(), localStorage, third-party libraries, everything.

The mental split you must be able to state:

• Server-side (AMPscript/SSJS) runs once, before the HTML leaves SFMC. It can read DEs and the SOAP API. It has no DOM and no window.
• Client-side JS runs after the HTML arrives. It has the full DOM but no access to Data Extensions, no Lookup, no SFMC objects — it must call back to a server endpoint to reach data.

8a. Progressive-enhancement form validation

<form id="prefForm" method="post" action="">
    <label for="email">Email</label>
    <input type="email" id="email" name="email" required>
    <label for="freq">Frequency</label>
    <select id="freq" name="freq" required>
        <option value="">Choose…</option>
        <option value="weekly">Weekly</option>
        <option value="monthly">Monthly</option>
    </select>
    <p id="err" role="alert" style="color:#c00;display:none"></p>
    <button type="submit">Save preferences</button>
</form>

<script>
(function () {
    var form = document.getElementById('prefForm');
    var err  = document.getElementById('err');

    form.addEventListener('submit', function (e) {
        var email = document.getElementById('email').value.trim();
        var freq  = document.getElementById('freq').value;
        var messages = [];

        if (!/^[^@\s]+@[^@\s]+\.[^@\s]{2,}$/.test(email)) { messages.push('Enter a valid email address.'); }
        if (!freq) { messages.push('Choose a frequency.'); }

        if (messages.length > 0) {
            e.preventDefault();
            err.textContent = messages.join(' ');
            err.style.display = 'block';
        }
    });
})();
</script>

🔍 Line by line:

• <form id="prefForm" method="post" action=""> — method="post" posts back to the same CloudPage URL (action=""), which is the standard SFMC self-posting pattern: the page renders, posts to itself, and the server-side block detects the POST and writes the DE.
• <input type="email" ... required> — native HTML5 validation first. This is the progressive-enhancement base layer: if JavaScript is disabled or fails to load, the browser still enforces the type and requiredness, and the form still posts and still saves.
• <p id="err" role="alert" ...> — the error region. role="alert" makes screen readers announce it when populated (accessibility matters on a client project).
• (function () { ... })(); — an IIFE, so nothing leaks into the global scope.
• var form = document.getElementById('prefForm'); — grab the form node. This is the DOM — completely unavailable to SSJS.
• form.addEventListener('submit', function (e) { — intercept submission. e is the submit event.
• .value.trim() — read the field and strip whitespace. Trimming before validating avoids the "looks valid but has a trailing space" class of bug.
• if (!/^[^@\s]+@[^@\s]+\.[^@\s]{2,}$/.test(email)) — a pragmatic email regex: something, @, something, ., at least two more characters, no spaces. Deliberately loose — over-strict email regexes reject valid addresses.
• e.preventDefault(); — only called when validation fails, stopping the POST so the user can correct the field. If everything passes, we do nothing and the normal POST proceeds.
• err.textContent = messages.join(' '); — textContent (not innerHTML) so any user-supplied text is inserted as text, never parsed as HTML. This is XSS prevention in one keyword.
• err.style.display = 'block'; — reveal the error region.

🔑 Client-side validation is UX, not security. Anyone can disable JS, edit the DOM, or curl a POST straight at your CloudPage URL. You must validate again server-side. Say this sentence unprompted in the interview.

8b. AJAX to a Code Resource returning JSON

A Code Resource is a CloudPages asset type that serves raw content at its own URL with a chosen content type: JSON, JavaScript, CSS, Text, XML, RSS, or HTML. It is how you build a lightweight API endpoint inside SFMC — and it can run AMPscript/SSJS before emitting.

The Code Resource (/lookup-loyalty, type = JSON):

<script runat="server">
Platform.Load("Core", "1.1.1");
Platform.Response.SetResponseHeader("Access-Control-Allow-Origin", "https://pages.example.com");
Platform.Response.SetResponseHeader("Content-Type", "application/json");
try {
    var sk = Platform.Request.GetQueryStringParameter("sk");
    if (sk == null || sk == "" || sk.length > 50) {
        Write(Stringify({ ok: false, error: "bad_request" }));
    } else {
        var tier   = Platform.Function.Lookup("Loyalty", "Tier",   "SubscriberKey", sk);
        var points = Platform.Function.Lookup("Loyalty", "Points", "SubscriberKey", sk);
        Write(Stringify({ ok: true, tier: (tier || "Standard"), points: (points || 0) }));
    }
} catch (e) {
    Write(Stringify({ ok: false, error: "server_error" }));
}
</script>

🔍 Line by line:

• Platform.Response.SetResponseHeader("Access-Control-Allow-Origin", "https://pages.example.com"); — the CORS header. A browser will block a cross-origin fetch() unless the responding server sends this. Name a specific origin, not *, whenever the response contains anything remotely personal. (The AMPscript equivalent is HTTPHeader.SetValue("Access-Control-Allow-Origin", "...").) Headers must be set before any output is written.
• Platform.Response.SetResponseHeader("Content-Type", "application/json"); — declares JSON so response.json() in the browser parses cleanly. Choosing the JSON Code Resource type also sets this, but being explicit is safe.
• var sk = Platform.Request.GetQueryStringParameter("sk"); — reads ?sk= from the URL. This is untrusted input and is treated as such on the very next line.
• if (sk == null || sk == "" || sk.length > 50) { — validate presence and bound the length. Bounding length is cheap and stops a whole class of abuse.
• Write(Stringify({ ok: false, error: "bad_request" })); — return a structured error the client can branch on. Never leak the exception text to a public endpoint.
• var tier = Platform.Function.Lookup("Loyalty", "Tier", "SubscriberKey", sk); — the actual DE read, on the server, where the browser can't see the DE name or the query.
• Write(Stringify({ ok: true, tier: (tier || "Standard"), points: (points || 0) })); — emit the JSON payload with sensible defaults. Return only the fields the page needs — never dump the whole row.
• } catch (e) { Write(Stringify({ ok: false, error: "server_error" })); } — a generic error shape. The real detail goes to an Error DE, not to the wire.

The page-side fetch:

<script>
function loadLoyalty(sk) {
    fetch('https://pages.example.com/lookup-loyalty?sk=' + encodeURIComponent(sk))
        .then(function (r) {
            if (!r.ok) { throw new Error('HTTP ' + r.status); }
            return r.json();
        })
        .then(function (data) {
            if (!data.ok) { throw new Error(data.error); }
            document.getElementById('tier').textContent   = data.tier;
            document.getElementById('points').textContent = data.points;
        })
        .catch(function (err) {
            document.getElementById('tier').textContent = 'Unavailable';
        });
}
</script>

🔍 Line by line:

• fetch('...?sk=' + encodeURIComponent(sk)) — issues the GET. encodeURIComponent escapes anything that would break the query string or inject an extra parameter — mandatory whenever you concatenate a value into a URL.
• .then(function (r) { if (!r.ok) { throw new Error('HTTP ' + r.status); } return r.json(); }) — fetch does not reject on 4xx/5xx. You must check r.ok yourself; forgetting this is the single most common fetch bug. r.json() parses the body and returns another promise.
• .then(function (data) { if (!data.ok) { throw new Error(data.error); } ... }) — check the application-level status inside the payload, separate from the HTTP status.
• document.getElementById('tier').textContent = data.tier; — inject with textContent, never innerHTML, so server data can't execute as markup.
• .catch(function (err) { ... 'Unavailable'; }) — one catch handles network failure, non-2xx, JSON parse errors, and thrown application errors. The page degrades: it shows "Unavailable" rather than breaking.

⭐ Note the function() syntax, not arrow functions. Arrow functions are fine here (this is the browser, ES6+), but writing browser JS in ES5 style keeps one habit across both halves of SFMC and never breaks in an older client. If the interviewer asks, say: "Arrow functions are fine client-side; I keep to var/function in SSJS because Rhino is ES3."

9. 🧪 Complete worked example — a CloudPage preference centre

Both halves in one page: client-side validation for UX, server-side validation and write for correctness.

%%[
  VAR @sk, @email, @freq, @isPost, @saved, @errorMsg
  SET @isPost   = IIF(NOT EMPTY(RequestParameter("submitted")), 1, 0)
  SET @sk       = RequestParameter("sk")
  SET @saved    = 0
  SET @errorMsg = ""
]%%
<script runat="server">
Platform.Load("Core", "1.1.1");
try {
    var isPost = Variable.GetValue("@isPost");
    var sk     = Variable.GetValue("@sk");

    if (sk == null || sk == "") {
        Variable.SetValue("@errorMsg", "Missing or invalid link. Please use the link from your email.");
    } else if (isPost == 1) {
        var email = String(Platform.Request.GetFormField("email")).replace(/^\s+|\s+$/g, "");
        var freq  = String(Platform.Request.GetFormField("freq"));
        var allowed = { weekly: true, monthly: true };

        if (email.indexOf("@") < 1 || email.length > 254) {
            Variable.SetValue("@errorMsg", "Please enter a valid email address.");
        } else if (allowed[freq] !== true) {
            Variable.SetValue("@errorMsg", "Please choose a valid frequency.");
        } else {
            Platform.Function.UpsertDE("Preference_Center", 1,
                "SubscriberKey", sk,
                "EmailAddress",  email,
                "Frequency",     freq,
                "ModifiedDate",  Platform.Function.Now());
            Variable.SetValue("@saved", 1);
        }
    }
} catch (e) {
    Platform.Function.UpsertDE("Error_Log", 1,
        "LogId", Platform.Function.GUID(),
        "Context", "PrefCentre",
        "Message", Stringify(e));
    Variable.SetValue("@errorMsg", "Something went wrong. Please try again.");
}
</script>
%%[ IF @saved == 1 THEN ]%%
  <p>Thanks — your preferences are saved.</p>
%%[ ELSE ]%%
  %%[ IF NOT EMPTY(@errorMsg) THEN ]%%<p class="err">%%=v(@errorMsg)=%%</p>%%[ ENDIF ]%%
  <form id="prefForm" method="post" action="">
    <input type="hidden" name="submitted" value="1">
    <input type="hidden" name="sk" value="%%=v(@sk)=%%">
    <input type="email" id="email" name="email" required>
    <select id="freq" name="freq" required>
      <option value="">Choose…</option>
      <option value="weekly">Weekly</option>
      <option value="monthly">Monthly</option>
    </select>
    <button type="submit">Save</button>
  </form>
%%[ ENDIF ]%%

🔍 Line by line:

• SET @isPost = IIF(NOT EMPTY(RequestParameter("submitted")), 1, 0) — the self-post detection. A hidden field named submitted is present only on the POST, so its presence tells the page which pass it is on. RequestParameter reads both GET and POST values.
• SET @sk = RequestParameter("sk") — the identifier from the link. In production this should be an encrypted token (EncryptSymmetric), not a raw subscriber key — see §10.
• var isPost = Variable.GetValue("@isPost"); — SSJS reads the AMPscript variables declared above. This is why the VAR line comes first.
• if (sk == null || sk == "") { ... } — no identity means no write. Fail closed.
• } else if (isPost == 1) { — only process the form on the POST pass; the first GET just renders the form.
• String(Platform.Request.GetFormField("email")).replace(/^\s+|\s+$/g, "") — reads the POSTed field and trims it. String(...) coerces a possible null into a string so .replace can't throw; the regex is a manual trim because ES3 has no String.trim.
• var allowed = { weekly: true, monthly: true }; — an allow-list. This is the correct way to validate a value that comes from a <select>: the browser sent it, so it can be anything.
• if (email.indexOf("@") < 1 || email.length > 254) — server-side re-validation of the email, independently of the client check. < 1 rejects both a missing @ and an address starting with @. 254 is the practical maximum length.
• } else if (allowed[freq] !== true) { — reject anything not on the allow-list. A regex or an if/else chain would also work; the map is O(1) and hard to get wrong.
• Platform.Function.UpsertDE("Preference_Center", 1, "SubscriberKey", sk, ...) — the write. numKeys = 1 means the first pair (SubscriberKey) is the match key and everything after it is data. Upsert means a returning visitor updates their row rather than duplicating it.
• Variable.SetValue("@saved", 1); — flag success back into the AMPscript namespace so the markup below can branch.
• catch (e) { ... UpsertDE("Error_Log", ...) ... } — log the real error to a DE; show the visitor a generic message.
• %%[ IF @saved == 1 THEN ]%% — AMPscript decides which markup to render. The form is not re-rendered after a successful save, which prevents an accidental double submit.
• <input type="hidden" name="submitted" value="1"> — the flag the first line looks for.
• <input type="hidden" name="sk" value="%%=v(@sk)=%%"> — carries the identifier through the POST. Note it is echoed via v(), whose output should be HTML-encoded in a hardened build (%%=HTMLEncode(v(@sk))=%%).
• The <script> block from §8a would sit below this form to provide the client-side layer.

10. Security on CloudPages 🔑

• Never trust RequestParameter / GetQueryStringParameter / GetFormField. Everything from the browser is attacker-controlled. Validate type, length, and allowed values server-side, every time.
• Never pass a raw SubscriberKey or email in a URL. Anyone can increment it and read someone else's data (an IDOR). Use CloudPagesURL(pageId, "sk", @sk), which produces a signed, tamper-evident link, and/or EncryptSymmetric / DecryptSymmetric to tokenize the identifier.
• Injection: AMPscript/SSJS DE functions are parameterized, so classic SQL injection into Lookup is not the risk — the real risk is AMPscript injection via TreatAsContent, which re-runs the interpreter on a string. Feeding it a RequestParameter lets an attacker execute Lookup, UpsertDE, or HTTPGet with your render's privileges. Only ever TreatAsContent content you authored.
• XSS: any value you echo back into the page must be encoded — %%=HTMLEncode(v(@userInput))=%% server-side, and textContent (never innerHTML) client-side.
• CORS: name a specific origin in Access-Control-Allow-Origin. * on an endpoint that returns personal data means any site on the internet can read it from a victim's browser.
• Don't put secrets in client JS. API keys, DE names, and endpoints in page source are public. Anything sensitive stays in the server-side block or a Code Resource.
• Rate/abuse: a public Code Resource endpoint can be enumerated. Require a signed token, bound the input, and return only the minimum fields.
• Honour privacy: log only what you need; don't put personal data in query strings that end up in referrer headers and access logs.

11. Interview angles — likely questions and model answers

Q1. Can you use JavaScript in an email?

"No — every major email client strips <script>, on* attributes and javascript: URLs for security, and Outlook desktop has no JS engine at all because it renders with Word. Interactivity in email comes from CSS, from externally-generated images like GIF countdowns, or from linking to a CloudPage. When people say 'JavaScript in SFMC' they usually mean Server-Side JavaScript, which runs on SFMC's servers at send time and delivers plain HTML."

Q2. What is SSJS and how is it different from browser JavaScript?

"SSJS runs on a Salesforce-customized Mozilla Rhino interpreter to the ECMAScript 3 spec, server-side at render time, inside <script runat="server">. No DOM, no window, no let/const/arrow functions; but it does have DE access, the SOAP API through WSProxy, and try/catch. Browser JS has the DOM and none of the SFMC objects."

Q3. Why does everyone write Platform.Load("Core","1.1.1")?

"It loads the Core library, which is what defines DataExtension, List, Subscriber, Folder and Script.Util.WSProxy. The Platform library is available without loading. Skip that line and DataExtension.Init throws 'not defined'."

Q4. Write SSJS to read a row from a Data Extension.

Write §3a from memory: Platform.Load → try → DataExtension.Init → de.Rows.Lookup([col],[val]) → length guard → Write(rows[0].Col) → catch with Stringify(e).

Q5. When do you use SSJS instead of AMPscript?

"When I need try/catch, reusable functions, JSON parsing, real data structures, or API access via WSProxy — none of which AMPscript has. I stay in AMPscript for straightforward personalization and lookups because it's lighter at render and more readable for the marketing team. Typical pattern: heavy lifting in SSJS, then Variable.SetValue the result back and render it with %%=v(@x)=%%."

Q6. How do AMPscript and SSJS share data?

"They share one variable namespace within an asset. Variable.GetValue('@x') reads and Variable.SetValue('@x', v) writes, with the @ inside the string. The rule people miss is that the variable must be declared in an AMPscript block earlier in the document — otherwise the SetValue silently has no effect on output. Blocks execute in document order."

Q7. What is WSProxy and why is it faster?

"It's an SSJS wrapper around the SOAP API that runs in-session. It's faster than an external client because it skips the HTTPS round-trip, skips the OAuth token exchange on every call, and skips JSON/XML marshaling. It's the same SOAP underneath — it still pages at 2,500 rows and still costs render time."

Q8. How do you retrieve more than 2,500 rows?

"Page it. Do a do/while: first call prox.retrieve(TYPE, COLS), then on each subsequent pass prox.retrieve(TYPE, COLS, null, { ContinueRequest: reqID }) — or getNextBatch(TYPE, reqID) — accumulating res.Results while res.HasMoreRows is true, carrying res.RequestID forward. The type string must be byte-identical across calls, so I store it in a variable. do/while rather than while because the first batch may be the only one."

Q9. How do you operate on a different business unit from a script?

"prox.setClientId({ ID: <MID> }) re-scopes the proxy to that BU, and { QueryAllAccounts: true } in the options includes shared/parent-BU rows. Then prox.resetClientIds() before doing anything back in the parent — forgetting that is a classic bug where later calls silently hit the child BU."

Q10. A CloudPage form needs validation. Where does it go?

"Both places. Client-side JS on submit for instant feedback and fewer round-trips — that's UX. Then server-side re-validation in SSJS/AMPscript on the POST before the DE write — that's security, because anyone can disable JS or POST directly to the URL. I also keep HTML5 required/type attributes so the form still works if JS fails to load."

Q11. How would a CloudPage fetch data without a page reload?

"Publish a Code Resource of type JSON that runs SSJS, reads a validated query-string parameter, does the Lookup, and Writes Stringify(payload). Set Access-Control-Allow-Origin to the specific calling origin with Platform.Response.SetResponseHeader before any output. Then fetch() it from the page, check r.ok because fetch doesn't reject on 4xx, parse r.json(), and inject with textContent."

Q12. How do you stop someone reading another subscriber's preferences?

"Never put a raw subscriber key in the URL. Generate the link with CloudPagesURL, which signs it, and tokenize the identifier with EncryptSymmetric, decrypting server-side. Then validate that the decrypted key actually resolves before writing anything, and return only the fields the page needs."

12. ⭐ Gotchas

• ⭐ <script> without runat="server" in an email is silently stripped by clients — and in a CloudPage it becomes client-side JS with no DE access. One attribute, completely different behaviour.
• ⭐ Forgetting Platform.Load("Core","1.1.1") → "DataExtension is not defined". The error names the object, not the missing load, so it wastes a lot of debugging time.
• ⭐ JSON.stringify / JSON.parse / Array.forEach appear to work sometimes. Use Stringify and Platform.Function.ParseJSON, and indexed for loops.
• ⭐ Variable.SetValue on a variable never declared in AMPscript does nothing visible. Declare with VAR in an AMPscript block first, above the SSJS.
• ⭐ Request/Response do not exist in an email context — Platform.Request.GetQueryStringParameter is CloudPages-only. In a Script Activity, Write output is discarded entirely, so log to a DE.
• ⭐ fetch() does not reject on HTTP 404/500. Check response.ok explicitly.
• ⭐ innerHTML with server or user data is an XSS hole. Use textContent.
• ⭐ Access-Control-Allow-Origin: * on a Code Resource returning personal data exposes it to every site on the web.
• ⭐ Response headers must be set before any output is written — a stray Write or even whitespace above the header call breaks it.
• ⭐ prox.setClientId without resetClientIds leaves the proxy pointed at the child BU for the rest of the script.
• ⭐ The 2,500-row SOAP page size is not configurable upward — a BatchSize above 2,500 is silently ignored.
• ⭐ A CloudPage that posts to itself re-runs the whole server-side block. Guard writes with a submitted flag or you'll write on every render, including the first GET.
• ⭐ Automation Script Activities have a 30-minute runtime limit and run under the automation's own permission context — a script that works when you preview the page as yourself can fail there.

➡️ Next: A05_AMPscript_Essentials.md

A05 — AMPscript Essentials

🎯 Why this matters for Accenture: AMPscript is the language every SFMC developer is expected to write on a whiteboard, cold, without autocomplete. The single most common practical question in the industry is "write AMPscript to look up data from a Data Extension." If that question has cost you an interview before, §4 of this chapter is the fix — it is deliberately over-drilled, with five complete runnable patterns and a line-by-line breakdown of every one. Learn §4 until you can reproduce the LookupRows → RowCount → Row → Field loop from memory in under 60 seconds, and you will never lose that question again.

🧠 One-screen mental model

                       THE THREE WAYS AMPSCRIPT APPEARS IN AN ASSET
                       ============================================

  %%[  LOGIC BLOCK  ]%%        %%=v(@var)=%%           %%FieldName%%
  no output, just code         INLINE OUTPUT           PERSONALIZATION STRING
  VAR / SET / IF / FOR         prints a value          reads the send data source
  Lookup / UpsertDE            "=" makes it print      errors if the field is absent


                       THE LOOKUP FAMILY  (memorize this shape)
                       ========================================

   ONE VALUE                 Lookup(DE, returnCol, matchCol, matchVal)          -> scalar
   MANY ROWS (unordered)     LookupRows(DE, matchCol, matchVal)                 -> ROWSET (cap 2000)
   MANY ROWS (sorted)        LookupOrderedRows(DE, n, "Col DESC", mCol, mVal)   -> ROWSET, ordered
   CASE-SENSITIVE            LookupCS / LookupRowsCS / LookupOrderedRowsCS

                 ROWSET  --RowCount()-->  n
                    |
                    +-- Row(@rowset, i)  -->  ROW      (i is 1-BASED, not 0)
                                                |
                                                +-- Field(@row, "Col")  -->  value


                       THE MANDATORY DEFENSIVE SHAPE
                       =============================

     SET @rows  = LookupRows("DE","Col",@val)
     SET @count = RowCount(@rows)          <-- ALWAYS capture the count
     IF @count > 0 THEN                    <-- ALWAYS guard before looping
        FOR @i = 1 TO @count DO            <-- ALWAYS start at 1
           SET @row = Row(@rows, @i)
           SET @x   = Field(@row, "Col", 0)   <-- 0 = don't error on missing column
        NEXT @i
     ELSE
        (fallback copy — never render a blank block)
     ENDIF

1. Syntax fundamentals 🔑

AMPscript is SFMC's proprietary scripting language. It runs server-side at send/render time in emails, CloudPages, landing pages, SMS and push. The recipient never receives code — only the rendered output.

The four places you can write it

%%[
  /* 1. LOGIC BLOCK — runs code, outputs nothing by itself */
  VAR @firstName, @greeting
  SET @firstName = AttributeValue("FirstName")
  SET @greeting  = IIF(Empty(@firstName), "Hi there", Concat("Hi ", @firstName))
]%%
<p>%%=v(@greeting)=%%</p>
<p>Your order: %%OrderNumber%%</p>
<script runat="server" language="ampscript">
  SET @x = 1
</script>

🔍 Line by line:

• %%[ — opens a logic block. Everything until ]%% executes server-side and emits nothing on its own. This is where declarations, lookups, branching and write-backs live.
• /* 1. LOGIC BLOCK ... */ — the only comment syntax in AMPscript: /* ... */. There is no //.
• VAR @firstName, @greeting — declares variables. Every AMPscript variable name starts with @. VAR takes a comma-separated list and reserves the names without assigning. Declaration is technically optional but always do it — it's the habit that makes SSJS interop work (see A04 §5).
• SET @firstName = AttributeValue("FirstName") — assigns. SET is the only assignment keyword. AttributeValue("Col") pulls a column from the subscriber/send context and returns empty rather than erroring if it's absent.
• SET @greeting = IIF(Empty(@firstName), "Hi there", Concat("Hi ", @firstName)) — IIF(cond, ifTrue, ifFalse) is the inline conditional. Empty(x) is true for both null and "". Concat joins strings — AMPscript has no + or & string operator.
• ]%% — closes the logic block.
• <p>%%=v(@greeting)=%%</p> — inline output. The %%= ... =%% wrapper prints into the rendered HTML; v(@greeting) means "the value of the variable @greeting". This is how a script variable reaches the page.
• <p>Your order: %%OrderNumber%%</p> — a personalization string, resolved directly from the send data source (sendable DE row or subscriber attributes). Shorter than AttributeValue, but it errors if the field doesn't exist in this context.
• <script runat="server" language="ampscript"> — the tag form, functionally equivalent to %%[ ]%%. Rarely used for AMPscript in practice; the tag form is the norm for SSJS. Recognize it, but write %%[ ]%%.

Rules to state confidently

• Case-insensitive for functions, keywords and variable names.
• No semicolons. Statements are separated by whitespace/newlines.
• Strings use double quotes.
• No arithmetic operators. Use Add(), Subtract(), Multiply(), Divide(), Mod().
• No string concatenation operator. Use Concat(). "a" & "b" and "a" + "b" are both wrong.
• Equality is == (a single = also works inside IF, but write ==).
• Logical operators: AND, OR, NOT — with && and || valid as aliases in conditionals.
• Comparison: !=, >, <, >=, <=.
• Data types are loose: strings, numbers, dates, booleans, and rowsets. Values are coerced as needed; comparisons of a numeric-looking string to a number generally work.

Conditionals and loops

%%[
  IF @tier == "Gold" THEN
     SET @discount = 20
  ELSEIF @tier == "Silver" THEN
     SET @discount = 10
  ELSE
     SET @discount = 0
  ENDIF

  FOR @i = 1 TO 5 DO
     Output(Concat("Item ", @i, "<br>"))
  NEXT @i

  FOR @j = 10 DOWNTO 1 DO
     /* countdown */
  NEXT @j
]%%

🔍 Line by line:

• IF @tier == "Gold" THEN — THEN is required and marks the start of the body.
• ELSEIF @tier == "Silver" THEN — chained test, evaluated only if the previous ones were false. Note it is one word: ELSEIF, not ELSE IF.
• ELSE — optional catch-all branch.
• ENDIF — mandatory terminator. AMPscript has no braces, so ENDIF is the only way the parser knows the block is over. A missing ENDIF is the number-one syntax error.
• FOR @i = 1 TO 5 DO — a counted loop. @i starts at 1 and increments automatically by 1 each pass; there is no @i = @i + 1. DO opens the body.
• Output(Concat("Item ", @i, "<br>")) — Output() emits a value without leaving the logic block. OutputLine() does the same and adds a line break. Concat takes many arguments, not just two.
• NEXT @i — closes the loop; the variable name must match the FOR counter.
• FOR @j = 10 DOWNTO 1 DO — the descending form. DOWNTO replaces TO.

2. 🔑🧪 THE LOOKUP FAMILY — the section that wins the interview

This is the question you must never lose again. Read the signatures, then write all five patterns from memory.

The signatures

🔑 The row caps, exactly. LookupRows and its CS variant are hard-capped at 2,000 rows. LookupOrderedRows with numRows <= 0 means "all matching rows, still capped at 2,000" — but passing an explicit numRows greater than 2,000 is how you retrieve more than 2,000. That asymmetry is a favourite senior question. Beyond that, move the work to a SQL Query Activity or SSJS + WSProxy paging.

Pattern 1 🧪 — single value lookup

%%[
  VAR @sk, @region
  SET @sk     = AttributeValue("SubscriberKey")
  SET @region = Lookup("Store_Master", "Region", "StoreID", @storeId)
]%%
<p>Your nearest region: %%=v(@region)=%%</p>

🔍 Line by line:

• VAR @sk, @region — declare both variables up front.
• SET @sk = AttributeValue("SubscriberKey") — read the subscriber key from send context; AttributeValue returns empty rather than erroring if it's not there.
• SET @region = Lookup("Store_Master", "Region", "StoreID", @storeId) — the four arguments in order: (1) the Data Extension name Store_Master; (2) the column to return Region; (3) the column to match on StoreID; (4) the value to match @storeId. Reads as: "in Store_Master, find the row where StoreID = @storeId and give me its Region." Returns a single value, or "" if nothing matched.
• <p>...%%=v(@region)=%%</p> — print the result inline.

⭐ The Lookup trap: when multiple rows match, Lookup returns the value from an unspecified row — not reliably the first physical row, not the newest. If you need "the latest", you must use LookupOrderedRows with an explicit sort (Pattern 3).

Multi-criteria form — extra match pairs are ANDed:

SET @price = Lookup("Product_Prices", "Price", "SKU", @sku, "Region", @region, "Currency", "GBP")

🔍 Line by line:

• Lookup("Product_Prices", "Price", ...) — DE, then return column, as always.
• "SKU", @sku — first match pair.
• "Region", @region — second match pair, ANDed with the first.
• "Currency", "GBP" — a third pair, using a literal. You can chain as many column/value pairs as you need; the return column stays a single scalar.

Pattern 2 🧪 — multi-row loop with a RowCount guard (THE one to memorize)

%%[
  VAR @rows, @count, @i, @row, @name, @qty, @price
  SET @rows  = LookupRows("Order_Items", "OrderID", @orderId)
  SET @count = RowCount(@rows)

  IF @count > 0 THEN
]%%
    <table>
      <tr><th>Product</th><th>Qty</th><th>Price</th></tr>
%%[
    FOR @i = 1 TO @count DO
      SET @row   = Row(@rows, @i)
      SET @name  = Field(@row, "ProductName")
      SET @qty   = Field(@row, "Qty")
      SET @price = Field(@row, "Price")
]%%
      <tr>
        <td>%%=v(@name)=%%</td>
        <td>%%=v(@qty)=%%</td>
        <td>%%=FormatCurrency(v(@price), "en-GB", 2)=%%</td>
      </tr>
%%[
    NEXT @i
]%%
    </table>
%%[
  ELSE
]%%
    <p>You have no items on this order.</p>
%%[
  ENDIF
]%%

🔍 Line by line:

• VAR @rows, @count, @i, @row, @name, @qty, @price — declare every variable the loop touches.
• SET @rows = LookupRows("Order_Items", "OrderID", @orderId) — LookupRows(DE, matchCol, matchVal) returns a rowset — whole rows, not one value. Note the argument shape differs from Lookup: there is no return column, because you get every column of every matching row. Mixing these two signatures up is the most common slip under pressure.
• SET @count = RowCount(@rows) — capture the row count before looping. Calling RowCount inside the loop condition works but is wasteful and harder to debug.
• IF @count > 0 THEN — the mandatory guard. Without it you can render an empty <table> or, worse, error when Row() is called on an empty rowset.
• ]%% — close the logic block mid-flow so the next lines emit as literal HTML. This "pop out to HTML, pop back in" rhythm is how AMPscript interleaves markup with logic.
• <table> / <tr><th>... — the table header, emitted only when there is at least one row.
• %%[ — re-open the logic block to write the loop.
• FOR @i = 1 TO @count DO — iterate once per row. Rowsets are 1-indexed — the first row is 1, not 0. Starting at 0 is a runtime error, and this is exactly the detail interviewers watch for.
• SET @row = Row(@rows, @i) — Row(rowset, n) extracts the nth row object so you can read its columns.
• SET @name = Field(@row, "ProductName") — Field(row, "Col") reads one column out of the current row. You cannot read a column off the rowset directly — you must go through Row() first.
• SET @qty = Field(@row, "Qty") / SET @price = Field(@row, "Price") — the same for the other two columns.
• ]%% — pop out to HTML again, inside the loop body.
• <td>%%=v(@name)=%%</td> — print the current row's product name. Every iteration emits one <tr>.
• %%=FormatCurrency(v(@price), "en-GB", 2)=%% — format the number as currency: FormatCurrency(number, culture, decimalPlaces [, symbol]). Functions nest inside the output wrapper freely.
• %%[ / NEXT @i — pop back in and advance the counter. Control returns to the matching FOR.
• ]%% </table> — close the table after the loop.
• %%[ ELSE ]%% — the zero-rows branch of the IF @count > 0 guard.
• <p>You have no items on this order.</p> — fallback copy. Never render a silently blank region; always have an empty state.
• %%[ ENDIF ]%% — close the guard.

🔑 This LookupRows → RowCount → guard → FOR → Row → Field sequence is the AMPscript interview task. Write it out three times from memory before the interview.

Pattern 3 🧪 — the "latest record" ordered lookup

%%[
  VAR @orders, @n, @latest, @orderDate, @orderTotal
  SET @orders = LookupOrderedRows("Orders", 1, "OrderDate DESC", "CustomerID", @custId)
  SET @n      = RowCount(@orders)

  IF @n > 0 THEN
     SET @latest     = Row(@orders, 1)
     SET @orderDate  = Field(@latest, "OrderDate")
     SET @orderTotal = Field(@latest, "Total")
     SET @msg = Concat("Your last order was on ", FormatDate(@orderDate, "d MMMM yyyy"))
  ELSE
     SET @msg = "You haven't ordered from us yet."
  ENDIF
]%%
<p>%%=v(@msg)=%%</p>

🔍 Line by line:

• SET @orders = LookupOrderedRows("Orders", 1, "OrderDate DESC", "CustomerID", @custId) — the five arguments: (1) the DE Orders; (2) numRows = 1, so at most one row comes back; (3) the sort clause "OrderDate DESC", written exactly like a SQL ORDER BY — DESC = newest first, ASC = oldest first, and multi-column sorts like "Total DESC, OrderDate ASC" are allowed; (4) the match column CustomerID; (5) the value @custId.
• SET @n = RowCount(@orders) — count first, always.
• IF @n > 0 THEN — guard, even though you asked for one row: a customer with no orders returns zero.
• SET @latest = Row(@orders, 1) — take row 1 (1-based). Because of the DESC sort, row 1 is the newest order. This is the only reliable way to get "the latest" — Lookup and LookupRows give you no ordering guarantee at all.
• SET @orderDate = Field(@latest, "OrderDate") / SET @orderTotal = Field(@latest, "Total") — read the columns off the extracted row.
• SET @msg = Concat("Your last order was on ", FormatDate(@orderDate, "d MMMM yyyy")) — build the sentence with Concat (no +) and format the date, e.g. "3 July 2026".
• ELSE / SET @msg = "You haven't ordered from us yet." — the empty-state copy.
• <p>%%=v(@msg)=%%</p> — one output line handles both branches, which keeps the markup clean.

⭐ If the interviewer asks "what does LookupOrderedRows("Orders", 0, "OrderDate DESC", "CustID", @c) return when 5,000 rows match?" the answer is 2,000 — numRows <= 0 means "all, capped at 2,000". Pass 5000 explicitly to exceed the cap.

Pattern 4 🧪 — multi-criteria rowset lookup

%%[
  VAR @promos, @pc, @i, @r
  SET @promos = LookupOrderedRows("Promotions", 3, "Priority ASC",
                   "Region", @region, "Segment", @segment, "IsActive", "true")
  SET @pc = RowCount(@promos)

  IF @pc > 0 THEN
     FOR @i = 1 TO @pc DO
        SET @r = Row(@promos, @i)
        Output(Concat("<li>", Field(@r, "Headline"), "</li>"))
     NEXT @i
  ELSE
     Output("<li>Explore our latest arrivals.</li>")
  ENDIF
]%%

🔍 Line by line:

• SET @promos = LookupOrderedRows("Promotions", 3, "Priority ASC", ...) — top 3 promotions by ascending Priority (1 = most important).
• "Region", @region, "Segment", @segment, "IsActive", "true" — three match pairs, ANDed. Both LookupRows and LookupOrderedRows accept unlimited additional column/value pairs after the first — this is the multi-criteria answer, and it is the same pattern as multi-criteria Lookup. Note "true" is passed as a string because Boolean DE columns compare as text in AMPscript.
• SET @pc = RowCount(@promos) — count.
• IF @pc > 0 THEN — guard.
• FOR @i = 1 TO @pc DO — loop, 1-based.
• SET @r = Row(@promos, @i) — extract the row.
• Output(Concat("<li>", Field(@r, "Headline"), "</li>")) — Output() emits without leaving the logic block, so you can build markup entirely inside %%[ ]%%. Field() is called inline inside Concat — you don't have to assign it to a variable first.
• ELSE / Output("<li>Explore our latest arrivals.</li>") — the fallback item, so the list is never empty.

Pattern 5 🧪 — the null-guarded defensive version

%%[
  VAR @rows, @count, @row, @tier, @points, @label
  SET @rows  = LookupRows("Loyalty", "SubscriberKey", AttributeValue("_subscriberkey"))
  SET @count = RowCount(@rows)

  IF @count > 0 THEN
     SET @row    = Row(@rows, 1)
     SET @tier   = Field(@row, "Tier", 0)
     SET @points = Field(@row, "Points", 0)
     SET @tier   = IIF(Empty(@tier), "Standard", @tier)
     SET @points = IIF(Empty(@points), 0, @points)
  ELSE
     SET @tier   = "Standard"
     SET @points = 0
  ENDIF

  SET @label = Concat(@tier, " member — ", FormatNumber(@points, "N0"), " points")
]%%
<p>%%=v(@label)=%%</p>

🔍 Line by line:

• SET @rows = LookupRows("Loyalty", "SubscriberKey", AttributeValue("_subscriberkey")) — _subscriberkey is the system variable holding the current subscriber's key; wrapping it in AttributeValue keeps it safe in contexts where it might not resolve.
• SET @count = RowCount(@rows) — guard input.
• SET @row = Row(@rows, 1) — first row.
• SET @tier = Field(@row, "Tier", 0) — the third argument is boolException, and it defaults to true. With the default, a missing column throws a runtime error that can blank the whole email. Passing 0 (false) suppresses the error and returns "" instead. Use this whenever a DE's schema might differ between environments — dev DEs drift from prod constantly.
• SET @points = Field(@row, "Points", 0) — same protection on the second column.
• SET @tier = IIF(Empty(@tier), "Standard", @tier) — null-coalesce. A row can exist with a blank column, so a row guard alone is not enough; guard the values too. Empty() covers both null and "".
• SET @points = IIF(Empty(@points), 0, @points) — same for the numeric field, so FormatNumber below can't choke on an empty string.
• ELSE branch — defaults when no row exists at all. The three no-data cases are genuinely different and must be handled separately: RowCount == 0 (no row), Field returns "" (row exists, column blank), Lookup returns "" (no match or matched a blank).
• SET @label = Concat(@tier, " member — ", FormatNumber(@points, "N0"), " points") — build the sentence. FormatNumber(n, "N0") renders 1450 as 1,450.
• <p>%%=v(@label)=%%</p> — one output path, always populated, never blank.

🔑 Say this out loud in the interview: "Every lookup I write has three guards — RowCount() > 0 before I loop, Field(..., 0) so a missing column can't blank the send, and an IIF/Empty default so a blank value still renders sensible copy."

3. Write-back — UpsertData vs UpsertDE 🔑

There are two families and the difference is an exam question.

%%[
  /* SEND CONTEXT — queued, returns nothing */
  UpsertDE("Send_Log", 1, "SubscriberKey", @sk, "LastSent", Now(), "JobID", _jobid)

  /* CLOUDPAGE CONTEXT — synchronous, returns rows affected */
  SET @affected = UpsertData("Preference_Center", 1,
                    "SubscriberKey", @sk,
                    "Frequency",     @freq,
                    "ModifiedDate",  Now())

  IF @affected > 0 THEN
     SET @confirm = "Saved."
  ELSE
     SET @confirm = "We couldn't save that — please try again."
  ENDIF
]%%

🔍 Line by line:

• UpsertDE("Send_Log", 1, "SubscriberKey", @sk, "LastSent", Now(), "JobID", _jobid) — update-or-insert one row. Arg 1 is the DE. Arg 2 is numKeys = 1, meaning "the next 1 name/value pair is the matching key". So "SubscriberKey", @sk is the match; everything after it (LastSent, JobID) is data written to the row. _jobid is the system variable for the current send job. Returns nothing — there is no way to confirm it in this render.
• SET @affected = UpsertData("Preference_Center", 1, ...) — the CloudPage equivalent, same numKeys grammar, but it returns the number of rows affected, which you can branch on. This is why forms use UpsertData.
• "Frequency", @freq / "ModifiedDate", Now() — data pairs beyond numKeys.
• IF @affected > 0 THEN ... ELSE ... ENDIF — the confirmation branch that UpsertDE simply cannot give you.

The rest of the family:

InsertDE("Audit", "AuditId", GUID(), "Event", "click", "At", Now())
UpdateDE("Preference_Center", 1, "SubscriberKey", @sk, "Frequency", "monthly")
DeleteDE("Preference_Center", "SubscriberKey", @sk)
SET @n = InsertData("Form_Submissions", "Id", GUID(), "Email", @email)
SET @m = DeleteData("Cart_Abandon", "SubscriberKey", @sk)

🔍 Line by line:

• InsertDE("Audit", "AuditId", GUID(), ...) — insert only, no numKeys argument at all — just alternating column/value pairs. GUID() generates a unique key so concurrent renders don't collide.
• UpdateDE("Preference_Center", 1, "SubscriberKey", @sk, "Frequency", "monthly") — update only, never inserts. Same numKeys grammar as UpsertDE; a no-op if nothing matches.
• DeleteDE("Preference_Center", "SubscriberKey", @sk) — deletes every row where the column matches. No numKeys; just match pairs. Destructive — always scope it tightly.
• SET @n = InsertData(...) / SET @m = DeleteData(...) — the synchronous CloudPage variants, each returning a row count.

⭐ numKeys is the most dangerous argument in AMPscript. It must equal the number of primary-key columns on the DE. Too few and you duplicate rows; misaligned and you overwrite the wrong rows. No error is raised either way — you just get bad data.

🔑 Guard write-backs by context. In a send, the render also runs on View As Web Page, Preview, and Forward-To-A-Friend, so an unguarded UpsertDE fires again every time someone opens the web version:

%%[
  IF _messagecontext == "SEND" THEN
     UpsertDE("Engagement", 1, "SubscriberKey", @sk, "LastSeen", Now())
  ENDIF
]%%

🔍 Line by line:

• IF _messagecontext == "SEND" THEN — _messagecontext is the system variable holding the render context. Values include SEND (a real send), VAWP (view as web page), PREVIEW, FTAF, SITE (CloudPage), LANDINGPAGE, SMS. Testing for SEND positively is safer than blacklisting the others.
• UpsertDE(...) — the write happens only on a genuine send, so web-page views don't pollute the DE or skew "last interaction" timestamps.

4. Content functions 🔑

%%[
  VAR @legal
  SET @legal = ContentBlockByKey("legal-en-gb", @null, "legal-region", false)
]%%
%%=IIF(Empty(@legal), ContentBlockByKey("legal-default"), @legal)=%%

🔍 Line by line:

• SET @legal = ContentBlockByKey("legal-en-gb", @null, "legal-region", false) — fetch the block into a variable rather than outputting it directly, so you can inspect it first. The optional arguments: @null is an unset placeholder, "legal-region" names an impression region for tracking, and the trailing false tells the function not to throw if the key isn't deployed to this BU — it returns empty instead. That final false is what makes "fail soft" possible.
• %%=IIF(Empty(@legal), ContentBlockByKey("legal-default"), @legal)=%% — output. If the block was missing, inject a default; otherwise render the real copy. Net effect: a missing key never breaks the send.

⭐ TreatAsContent is a security boundary. It executes arbitrary AMPscript. Never pass it a RequestParameter or any user-supplied value — an attacker could inject Lookup, UpsertDE or HTTPGet calls that run with your render's privileges. Only ever pass content you authored and stored yourself. Also: TreatAsContentArea caches by key, so reusing one key for different content in a single render silently returns the first value both times.

5. String, number and date functions 🔑

Strings

%%[
  SET @clean  = Trim(ProperCase(@name))
  SET @area   = Substring(@phone, 1, 3)
  SET @masked = Concat(Substring(@card, 1, 4), "********", Substring(@card, 13, 4))
  SET @isThere= IndexOf(@email, "@")
  SET @safe   = Replace(@copy, "{{brand}}", @brandName)
  SET @len    = Length(@sku)
  SET @upper  = Uppercase(@code)
]%%

🔍 Line by line:

• SET @clean = Trim(ProperCase(@name)) — functions nest inside-out: ProperCase capitalizes each word ("akash panda" → "Akash Panda"), then Trim strips leading/trailing whitespace.
• SET @area = Substring(@phone, 1, 3) — Substring(string, startPos, length). AMPscript strings are 1-indexed, so position 1 is the first character — not 0.
• SET @masked = Concat(Substring(@card, 1, 4), "********", Substring(@card, 13, 4)) — Concat takes any number of arguments. This masks a card number.
• SET @isThere = IndexOf(@email, "@") — returns the 1-based position of the substring, or 0 if not found (not -1 as in JavaScript). That difference is a real bug source.
• SET @safe = Replace(@copy, "{{brand}}", @brandName) — a literal find/replace. AMPscript has no regex replace; RegExMatch(input, pattern, group) can only extract. For regex substitution you drop to SSJS.
• SET @len = Length(@sku) — character count.
• SET @upper = Uppercase(@code) — also Lowercase, ProperCase.

Numbers

SET @subtotal = Multiply(@price, @qty)
SET @vat      = Divide(Multiply(@subtotal, 20), 100)
SET @total    = Add(@subtotal, @vat)
SET @bucket   = Mod(@id, 2)
SET @display  = FormatCurrency(@total, "en-GB", 2, "£")

🔍 Line by line:

• SET @subtotal = Multiply(@price, @qty) — there is no * operator. Multiply() is mandatory.
• SET @vat = Divide(Multiply(@subtotal, 20), 100) — 20% VAT, nested inside-out. Divide(a, b).
• SET @total = Add(@subtotal, @vat) — Add; Subtract for the inverse.
• SET @bucket = Mod(@id, 2) — remainder. With divisor 2 this is a clean A/B split: even ids give 0, odd give 1.
• SET @display = FormatCurrency(@total, "en-GB", 2, "£") — FormatCurrency(number, culture, decimals, symbol).

Dates — and the timezone trap ⭐

%%[
  SET @now      = Now()
  SET @deadline = DateAdd(@now, 3, "D")
  SET @daysLeft = DateDiff(@now, @endOfSale, "D")
  SET @pretty   = FormatDate(@deadline, "dddd d MMMM yyyy")
  SET @parsed   = DateParse("2026-08-31 23:59:59")
  SET @month    = DatePart(@now, "M")
]%%

🔍 Line by line:

• SET @now = Now() — the current SFMC system time. ⭐ Now() returns US Central Standard Time (UTC−6) with NO daylight saving observed, all year round. It is never CDT. So in summer, SFMC system time is one hour behind actual US Central wall-clock time. This is the classic AMPscript interview trap and a real source of off-by-one-hour bugs in "expires at midnight" logic.
• SET @deadline = DateAdd(@now, 3, "D") — DateAdd(date, amount, interval). Intervals: "D" days, "H" hours, "M" minutes or months depending on context (use "MI" where supported for minutes and be explicit), "Y" years. Negative amounts subtract.
• SET @daysLeft = DateDiff(@now, @endOfSale, "D") — DateDiff(startDate, endDate, interval) returns the whole-number difference. Argument order matters: start first, end second, or you get a negative.
• SET @pretty = FormatDate(@deadline, "dddd d MMMM yyyy") — renders e.g. "Friday 24 July 2026". FormatDate(date, pattern [, timePattern, culture]). Format() is the older general-purpose equivalent.
• SET @parsed = DateParse("2026-08-31 23:59:59") — converts a string into a real date value so you can do date maths on it. You cannot DateDiff a raw string reliably.
• SET @month = DatePart(@now, "M") — extracts one component ("Y", "M", "D", "H").

🔑 SystemDateToLocalDate(@d) converts system time to the account/business-unit timezone — not the subscriber's. For true per-subscriber local time, store the subscriber's UTC offset on the DE and DateAdd it yourself: DateAdd(DateAdd(Now(), 6, "H"), @offsetHours, "H") — the +6 converts CST to true UTC first.

6. RaiseError — the exact distinction they ask 🔑

RaiseError(message, boolSkipCurrentOnly, apiErrorCode, apiErrorNumber, boolPreserveDataExt)

🔍 Line by line:

• message — arg 1, the only required one: the human-readable error text that appears in tracking and error reporting.
• boolSkipCurrentOnly — arg 2, the one they ask about: true skips only the current subscriber and the send continues; false (the default when omitted) aborts the entire job.
• apiErrorCode — arg 3, an optional user-defined string code you invent, e.g. "ERR_TOKEN". It is not a field name.
• apiErrorNumber — arg 4, an optional user-defined numeric code.
• boolPreserveDataExt — arg 5: true keeps DE writes made before the error; false rolls them back. This is how you avoid leaving half-written audit rows behind.

%%[
  IF Empty(@requiredToken) THEN
     /* true => skip ONLY this subscriber, the rest of the send continues */
     RaiseError("Missing personalization token", true, "ERR_TOKEN", 1001)
  ENDIF

  IF Empty(@criticalFeed) THEN
     /* false/omitted => the WHOLE send job errors and stops */
     RaiseError("Product feed unavailable — aborting send", false)
  ENDIF
]%%

🔍 Line by line:

• IF Empty(@requiredToken) THEN — the guard: do we have what we need to render this subscriber safely?
• /* true => skip ONLY this subscriber ... */ — the comment states the rule you must recite.
• RaiseError("Missing personalization token", true, "ERR_TOKEN", 1001) — arg 2 is boolSkipCurrentOnly. true = skip only the current subscriber and continue the send for everyone else. Arg 3 "ERR_TOKEN" is a user-defined error code string you invent, surfaced in tracking. Arg 4 1001 is a user-defined numeric code. Arg 5 (boolPreserveDataExt, not shown) controls whether DE writes made before the error are retained (true) or rolled back (false).
• RaiseError("Product feed unavailable — aborting send", false) — false (also the default when omitted) aborts the entire send job. Use this only when rendering any subscriber without the data would be wrong.

🔑 The exact sentence to say: "The second parameter is boolSkipCurrentOnly. true skips just that subscriber and the send continues; false or omitting it fails the whole job. For a missing per-subscriber token I use true; for a missing global feed I use false."

⭐ AMPscript has no try/catch. RaiseError is a way to raise an error deliberately, not to catch one. If you need to recover from a failure, that logic belongs in SSJS (see A04 §4).

7. Context — sendable vs non-sendable, and the three ways to read a value 🔑

Sendable context (an email sent to a sendable DE or a list): %%FieldName%% and AttributeValue("FieldName") resolve from the send data source row plus subscriber attributes. System variables like _subscriberkey, _jobid, _listid, _messagecontext are populated.

Non-sendable context (a CloudPage, landing page, or VAWP): there is no send context. Nothing resolves automatically. You must supply identity yourself via RequestParameter("sk") / QueryParameter("sk") and then Lookup everything.

🔑 Senior line: "%%Field%% is fine for known, always-present columns. I use AttributeValue when the column name itself is data-driven, or when I want a graceful empty instead of a hard error. v() is purely for variables I set myself. In a CloudPage none of the send-context sources exist, so I pass an encrypted identifier on the URL and look everything up."

8. Defensive patterns checklist 🔑

• Always SET @count = RowCount(@rows) and always IF @count > 0 THEN before looping.
• Always start FOR at 1 — rowsets are 1-based.
• Use Field(@row, "Col", 0) to suppress a missing-column runtime error, which would otherwise blank the region.
• Default every value: IIF(Empty(@x), "fallback", @x) or IsNullDefault(@x, "fallback").
• Know the three "no data" signals apart: RowCount == 0 (no row), Field returning "" (row present, column blank), Lookup returning "" (no match or matched a blank).
• Empty(x) is true for null and "". IsNull(x) is true only for an actual null — a field explicitly set to "" is not null.
• Always provide empty-state copy so a data gap renders a sentence, not a hole.
• Guard write-backs with _messagecontext == "SEND".
• Never TreatAsContent user input.
• Prefer doing writes on a CloudPage or in an Automation, not in the email render, because the render is not transactional — a later error does not roll back an earlier InsertDE.

9. Interview angles — likely questions and model answers

Q1. Write AMPscript to look up a single value from a Data Extension.

SET @region = Lookup("Store_Master", "Region", "StoreID", @storeId) — "DE, return column, match column, match value. It gives back one scalar, or an empty string if there's no match. If several rows match it returns an unspecified one, so when I need the latest I use LookupOrderedRows instead."

Q2. Write AMPscript to loop through multiple rows from a Data Extension.

Reproduce Pattern 2 verbatim: LookupRows → RowCount → IF > 0 → FOR @i = 1 TO @count DO → Row(@rows, @i) → Field(@row, "Col") → NEXT @i → ELSE fallback → ENDIF. Call out the 1-based index and the row guard while you write.

Q3. What is the difference between Lookup and LookupRows?

"Lookup returns a single scalar and takes a return-column argument. LookupRows returns a whole rowset and has no return column — you get every column of every matching row and access them with Row() and Field(). LookupRows is capped at 2,000 rows and gives no ordering guarantee."

Q4. How do you get the most recent order for a customer?

"LookupOrderedRows("Orders", 1, "OrderDate DESC", "CustomerID", @custId), then Row(@rows, 1). Lookup and LookupRows have no ordering guarantee, so an explicit ORDER BY through LookupOrderedRows is the only reliable way."

Q5. What is the row limit on AMPscript lookups?

"2,000 rows for LookupRows and its CS variant, and for LookupOrderedRows when numRows is zero or negative. Passing an explicit numRows above 2,000 is how you retrieve more. Above that I pre-aggregate with a SQL Query Activity into a summary DE and Lookup a single row at render, or page it in SSJS with WSProxy."

Q6. How do you do a lookup on two columns?

"Add more match pairs: Lookup("Prices", "Price", "SKU", @sku, "Region", @region). They're ANDed. The same works on LookupRows and LookupOrderedRows."

Q7. How is LookupRows different from LookupRowsCS?

"CS is case-sensitive on the matched value. The default lookups are case-insensitive, which matters when you're matching tokens or codes where ABC must not equal abc. The 2,000-row cap applies to both."

Q8. What is the difference between UpsertData and UpsertDE?

"UpsertDE is the send-time function — it's queued by the send engine and returns nothing, so you can't confirm it in the same render. UpsertData is the CloudPage function — it's synchronous and returns the number of rows affected, so I can branch on the result and show a real confirmation message. On a form I always use UpsertData."

Q9. What does numKeys mean in UpsertDE?

"It says how many of the following name/value pairs are the matching keys; everything after them is data. It must match the DE's actual primary key count. Get it wrong and you either duplicate rows or overwrite the wrong ones — with no error raised."

Q10. What does the second parameter of RaiseError do?

"It's boolSkipCurrentOnly. true skips only the current subscriber and lets the send continue. false, or omitting it, fails the entire send job. There's also a fifth parameter, boolPreserveDataExt, that controls whether DE writes made before the error are kept or rolled back."

Q11. Does AMPscript have try/catch?

"No — that's its biggest structural limitation and the main reason to drop into SSJS for anything genuinely fallible. In AMPscript I code defensively instead: guard every rowset with RowCount, use Field(..., 0) so a missing column can't blank the send, default everything with IIF/Empty, and use RaiseError with boolSkipCurrentOnly=true to isolate one bad subscriber rather than failing the job."

Q12. What timezone does Now() return?

"US Central Standard Time, UTC−6, with no daylight saving all year — so in summer it's an hour behind actual Central wall-clock time. SystemDateToLocalDate converts to the account timezone, not the subscriber's. For a real subscriber-local time I store their UTC offset on the DE and DateAdd it, converting to true UTC first with +6."

Q13. How do you concatenate strings in AMPscript?

"Concat(). There is no + or & string operator — && and || exist as logical aliases, which misleads people into assuming & concatenates. It doesn't; it won't render."

Q14. Difference between %%Field%%, AttributeValue("Field") and v(@field)?

"%%Field%% reads the send data source and errors if the field is absent. AttributeValue reads the same source but returns empty instead of erroring, and it accepts a computed column name so you can do data-driven personalization. v() outputs a script variable — a completely separate namespace with no connection to data fields."

Q15. How do you stop write-backs firing when someone views the email as a web page?

"Guard on _messagecontext. I test for == "SEND" positively rather than blacklisting VAWP, PREVIEW and FTAF, so any new context defaults to not writing. Better still, keep the email render read-mostly and do state changes on a CloudPage or in an Automation, because the email render isn't transactional — there's no rollback."

10. ⭐ Gotchas

• ⭐ Rowsets are 1-indexed. Row(@rows, 0) is an error. Every FOR starts at 1.
• ⭐ LookupRows has no return-column argument — mixing up the Lookup and LookupRows signatures is the single most common mistake under pressure.
• ⭐ LookupRows returns rows in no guaranteed order. "The first row" is meaningless without LookupOrderedRows.
• ⭐ 2,000-row silent truncation — no error, no warning. DataExtensionRowCount("DE") gives the true total so you can detect it.
• ⭐ Field(@row, "Col") throws by default if the column doesn't exist. Pass 0 as the third argument to get "" instead.
• ⭐ No + or & for strings, no * / - for numbers. Concat, Add, Subtract, Multiply, Divide, Mod.
• ⭐ IndexOf returns 0 when not found, not -1.
• ⭐ A missing ENDIF or NEXT produces a confusing parse error far from the real line. Write the terminator immediately after the opener, then fill the body in.
• ⭐ Now() is Central Standard Time with no DST — one hour behind Central wall clock in summer.
• ⭐ numKeys mismatches corrupt data silently.
• ⭐ UpsertDE returns nothing — if you wrote IF UpsertDE(...) > 0 you want UpsertData instead.
• ⭐ Write-backs fire on VAWP, PREVIEW and FTAF unless guarded by _messagecontext.
• ⭐ TreatAsContent on user input is an AMPscript-injection vulnerability.
• ⭐ ContentBlockById breaks across BUs; ContentBlockByName breaks when folders move. Use ContentBlockByKey, and pass the trailing false so a missing key fails soft rather than killing the send.
• ⭐ Comments are /* */ only. // is not a comment and will break the block.
• ⭐ The render is not transactional — an InsertDE that succeeded is not undone when a later line errors.

➡️ Next: A06_SQL_and_Data_Views.md

A06 — SQL and Data Views in SFMC

🎯 Why this matters for Accenture: Data Extensions, SQL and Data Views are ~12% of questions in Indian-IT SFMC panels, and SQL is where your second failed question lived. It is also the most testable skill in the round — they can hand you a scenario and watch you write. This chapter makes that safe.

🧠 One-screen mental model

              SFMC SQL — WHAT IT IS AND ISN'T

   T-SQL SUBSET, SELECT-ONLY
   ─────────────────────────────────────────────────
   ✅ SELECT, JOIN, WHERE, GROUP BY, HAVING,
      CASE, window functions (ROW_NUMBER/RANK),
      subqueries, UNION, DATEADD/DATEDIFF
   ❌ UPDATE  ❌ DELETE  ❌ MERGE  ❌ INSERT
   ❌ stored procs  ❌ temp tables  ❌ (usually) CTEs

   WHERE IT RUNS                WHERE IT WRITES
   ──────────────────────       ─────────────────────
   Automation Studio            a TARGET DE you made
     → SQL Query Activity         Overwrite | Append | Update
   Query Studio (ad hoc)          (Update + PK = upsert)

   WHAT YOU CAN QUERY
   ──────────────────────────────────────────────────
   Your Data Extensions   +   Data Views (_Sent, _Open …)
                              invisible system tables,
                              ~180 days rolling only

🔑 The rules that get you marked down if you miss them

⭐ The single most common interview trap: being asked to "update records" and answering with UPDATE. The correct answer is: "SFMC SQL is SELECT-only — I'd write a SELECT that produces the corrected rows and run the Query Activity in Update mode against a target DE that has a primary key. That's the upsert pattern."

🔑 Deduplication — the pattern you must write cold

Covered fully in A01, restated here because it is the single most-asked SQL task.

SELECT SubscriberKey, EmailAddress, ModifiedDate
FROM (
    SELECT
        SubscriberKey,
        EmailAddress,
        ModifiedDate,
        ROW_NUMBER() OVER (
            PARTITION BY SubscriberKey
            ORDER BY ModifiedDate DESC
        ) AS rn
    FROM Source_DE
) AS t
WHERE rn = 1;

🔍 Line by line: - FROM ( ... ) AS t — the derived table is mandatory: WHERE runs before window functions are assigned, so you cannot filter rn in the same scope. - ROW_NUMBER() OVER (...) — numbers rows within each group without collapsing them. - PARTITION BY SubscriberKey — restart numbering per identity; this is your dedup key. - ORDER BY ModifiedDate DESC — newest row becomes rn = 1. - WHERE rn = 1 — keep only the newest per key.

ROW_NUMBER vs RANK vs DENSE_RANK

⭐ Expect the follow-up "what if two rows have the same date?". Answer: add a tiebreaker column to ORDER BY for determinism, or switch to RANK() if keeping both is correct.

🔑 The Data Views you must be able to name

🔑 JobID is the universal bridge from any tracking event back to the email that produced it.

🧪 Engagement report — the classic join question

SELECT
    j.EmailName,
    COUNT(DISTINCT s.SubscriberKey)                        AS Delivered,
    COUNT(DISTINCT o.SubscriberKey)                        AS UniqueOpens,
    COUNT(DISTINCT c.SubscriberKey)                        AS UniqueClicks
FROM _Sent AS s
INNER JOIN _Job AS j
    ON s.JobID = j.JobID
LEFT JOIN _Open AS o
    ON s.SubscriberKey = o.SubscriberKey
   AND s.JobID = o.JobID
LEFT JOIN _Click AS c
    ON s.SubscriberKey = c.SubscriberKey
   AND s.JobID = c.JobID
WHERE s.EventDate > DATEADD(DAY, -30, GETDATE())
GROUP BY j.EmailName;

🔍 Line by line: - FROM _Sent — start from sends, because that is your denominator for open and click rates. - INNER JOIN _Job ON s.JobID = j.JobID — attach the human-readable email name. - LEFT JOIN _Open — left, not inner: most sends are never opened, and an inner join would silently drop them and inflate your rates. - ON ... SubscriberKey AND ... JobID — 🔑 you must join on both. Joining on subscriber alone mixes engagement across unrelated campaigns. - COUNT(DISTINCT ...) — a subscriber can open the same email many times; DISTINCT gives you unique opens. - DATEADD(DAY, -30, GETDATE()) — rolling 30-day window. - GROUP BY j.EmailName — one row per email.

⭐ The LEFT JOIN choice is the thing being tested. Say out loud: "Left join, because sends without opens still have to count in the denominator."

The metric formulas

• Open Rate = Unique Opens ÷ Delivered
• CTR = Unique Clicks ÷ Delivered
• CTOR = Unique Clicks ÷ Unique Opens ← engagement quality
• Bounce Rate = Bounces ÷ Sent
• Delivered = Sent − Bounces

⭐ Apple Mail Privacy Protection inflates opens and masks geo/device/time. Volunteer this: "Post-MPP I'd lead with click-based metrics and CTOR rather than open rate." It is a current-thinking signal.

🔑 Joins, and the SFMC-specific gotchas

SELECT
    c.SubscriberKey,
    c.EmailAddress,
    o.OrderID,
    o.OrderTotal
FROM Customer_Master AS c
INNER JOIN Orders_DE AS o
    ON c.SubscriberKey = o.SubscriberKey
WHERE o.OrderDate >= DATEADD(DAY, -7, GETDATE())
  AND c.EmailAddress IS NOT NULL
  AND c.Status = 'Active';

🔍 Line by line: - Alias every table (AS c, AS o) — required once you join, and it makes the query readable. - INNER JOIN — only customers with an order in scope. - DATEADD(DAY, -7, GETDATE()) — last 7 days. - c.EmailAddress IS NOT NULL — ⭐ defensive: a null email in a sendable audience causes send errors. - c.Status = 'Active' — filter suppressed/inactive records before they reach the audience.

⭐ Gotchas: - Case sensitivity on joins can bite when keys came from different systems. UPPER()/LOWER() both sides if unsure. - Trailing whitespace in imported keys silently breaks joins. LTRIM(RTRIM(col)). - Data types must match to join — a Text key won't cleanly join a Number key. - NULL never equals NULL. Use IS NULL, not = NULL.

🔑 Automation Studio — how the SQL actually runs

The SQL is half the answer. They will ask how you'd operationalise it.

The click-path — narrate this:

1. Automation Studio → Automations → New Automation.
2. Choose the starting source: Schedule (nightly/hourly) or File Drop (fires when a file lands on the SFTP).
3. Drag a SQL Query Activity into step 1 → Create New → paste SQL → choose the target DE → pick Overwrite / Append / Update.
4. Add a Verification Activity — stop the automation if row counts are zero or wildly off.
5. Add downstream steps (Import, Filter, Extract, Send Email, Script).
6. Save → Run Once to test → check Activity tab for run history and errors.
7. Schedule it once validated.

⭐ The Verification Activity is the senior touch. Almost no candidate mentions it. Saying "I'd add a verification step so an empty result fails the automation instead of silently overwriting the audience with zero rows" signals production experience.

Common Automation activities

🔑 Scenario answers they actually ask

"An automation failed last night. Walk me through it."

"Automation Studio → the automation → Activity tab for run history and the error message. If it's the query step, I'd open the Query Activity and run it in Query Studio to see the actual SQL error. Most common causes: a target DE column renamed or type-changed, a source DE empty so a downstream step failed, an SFTP file not arriving for a file-drop trigger, or a query timeout from a missing filter. Then I'd check whether it's the query or the data — and add a Verification Activity so it fails loudly next time."

"Your audience DE has 500k rows but the send went to 480k. Why?"

"The gap is suppression and hygiene. In order: All Subscribers status — unsubscribed, bounced or held records are excluded regardless of DE membership; then any suppression or exclusion lists on the send definition; then null or malformed email addresses; then duplicates collapsed on SubscriberKey. I'd prove it by querying _Sent for that JobID and comparing against the audience DE to find exactly which keys dropped."

"How do you keep more than 6 months of tracking data?"

"Data views only hold about 180 days. I'd build a rollup DE and schedule a nightly Query Activity that appends the previous day's _Sent, _Open and _Click rows into it, with a primary key so re-runs don't duplicate. That gives unlimited history under my control."

⭐ Gotchas checklist

• SFMC SQL is SELECT-only — no UPDATE/DELETE/MERGE.
• Window functions must be wrapped in a subquery to be filtered.
• LEFT JOIN for optional events (opens/clicks) — inner join silently inflates rates.
• Join _Sent/_Open/_Click on SubscriberKey and JobID.
• Data views: ~180 days, invisible, Query Activity or Query Studio only.
• Target DE columns must match your SELECT aliases.
• Update mode requires a Primary Key or it behaves like Append.
• NULL comparisons need IS NULL.
• Query Activities have a 30-minute runtime ceiling — filter early, avoid needless joins.
• Test in Query Studio before scheduling.

➡️ Next: A07_Journey_Builder.md

A07 — Journey Builder

🎯 Why this matters for Accenture: The JD names Journey Builder first. On Indian-IT panels (Accenture, TCS, Capgemini, Deloitte) Journey Builder + Automation Studio is the single biggest question cluster — roughly one question in six. And the questions are almost never "define a Decision Split." They are "a client says contacts aren't entering the journey — walk me through what you check" and "show me where you'd click to add a wait." This chapter is written to give you words you can say and clicks you can narrate.

🧠 One-screen mental model

                       JOURNEY BUILDER = a state machine PER CONTACT
                       (Automation Studio = a pipeline per TABLE)

  ENTRY SOURCE                 CANVAS (activities)                    SETTINGS
  ────────────                 ───────────────────                    ────────
  Data Extension  ─┐
  API Event        ├──► [Email] ─► [Wait 2d] ─► [Decision Split] ─┬─► [SMS] ─► Exit
  Salesforce Data  │                                             └─► [Email 2] ─► Exit
  CloudPage form   │
  Event / Audience ┘        ▲                    ▲
                            │                    │
                   Journey Data = FROZEN    Contact Data = LIVE
                   snapshot @ entry         read at THIS step

  GOAL  = a measurement (does NOT remove anyone unless "exit on goal met")
  EXIT  = removes the contact
  BOTH are evaluated ONLY at ENTRY and at the END OF EACH WAIT — never continuously.

  Draft ─► Scheduled ─► Running ─► (new version activated) ─► Finishing ─► Stopped
                           └─► Paused (max 14 days) ─► Resumed

🔍 Line by line:

• JOURNEY BUILDER = a state machine PER CONTACT — the single sentence that wins the "JB vs Automation Studio" question. Every contact has its own position on the canvas and its own entry snapshot.
• ENTRY SOURCE column — the five real ways contacts get in. Say all five; most candidates say two.
• [Email] ─► [Wait 2d] ─► [Decision Split] — the canonical shape of almost every journey you'll be asked to whiteboard: send, wait, branch.
• Journey Data = FROZEN snapshot @ entry vs Contact Data = LIVE read at THIS step — the highest-frequency single question in the whole module. Memorise the two words: frozen and live.
• GOAL = a measurement — a goal by itself never removes anybody. Only exit criteria, or a goal with "exit contacts when they meet the goal" ticked, removes a contact.
• evaluated ONLY at ENTRY and at the END OF EACH WAIT — the senior gotcha. If you remember one timing rule, remember this one.
• Draft ─► Scheduled ─► Running ─► Finishing ─► Stopped — the real lifecycle. Note there is no "Validated" status; validation is a pre-activation check.

1. Journey Builder vs Automation Studio 🔑

Panels open with this because it separates people who have built from people who have read.

Say this: "They're complements, not alternatives. Automation Studio is my back office — SQL queries, imports, file drops, data hygiene, building the audience DE overnight. Journey Builder is my front office — it takes that prepared audience and orchestrates one-to-one experiences over time. In practice about 80% of my journeys are fed by an automation: the automation builds and cleans the entry DE, the journey consumes it."

1.1 The decision question they actually ask

"Client wants an email to everyone with Status = Lapsed every Monday at 6am. Journey or Automation?" → Automation Studio. It's a batch, set-based, one-shot send with no per-contact timing and no branching. A journey adds cost and complexity for nothing. Use a Schedule → SQL Query → Send Email automation.

"Client wants: when someone abandons a cart, wait 1 hour, email; if no purchase after 24 hours, SMS." → Journey Builder. Per-contact timing, per-contact branching, multi-channel, and an exit on purchase. That's a state machine.

2. Entry sources — in full 🔑

Contacts get onto the canvas exactly five ways. Know the prerequisite for each — that's the follow-up question.

2.1 ⭐ The DE-entry delta trap

"Evaluate new records on a schedule" picks up rows inserted since the last evaluation. It is a delta on inserts, not on updates. If you UPDATE an existing row hoping to re-trigger entry, nothing happens.

The production-safe pattern:

• Add an EntryProcessed BIT column (default 0) to the entry DE.
• Entry filter: EntryProcessed = false.
• Immediately after entry, an Update Contact / Update DE activity (or a follow-up automation) sets EntryProcessed = 1.

Say this: "Schedule-based DE entry is a delta on inserts, not a re-scan. So I drive entry off a processed flag or an EntryDate watermark and stamp rows as they enter — that way I never double-enter a contact and never silently miss a batch that landed between evaluations."

2.2 Re-entry modes — and exactly when each is right 🔑

⭐ The trap: "No re-entry" blocks the contact forever, not just while they're in flight. Candidates constantly answer "no re-entry means they can't be in twice at the same time" — that's re-entry only after exiting. Get this right.

⭐ The Groundhog Day bug: re-entry-anytime + a badly filtered DE entry = the same contact re-entering on every schedule run and getting hammered. Fix = the processed-flag pattern in §2.1.

3. 🔑 Journey Data vs Contact Data — the question they ask most

• Journey Data = the frozen snapshot of the entry record, captured at the exact moment the contact entered. It never changes for that journey instance.
• Contact Data = the live value read from the Contact Builder data model at the moment the step executes.

Journey Data (frozen entry snapshot):
  {{Event."DEAudience-a33c4f76-f98c-1210-8205-df62800d6778"."FirstName"}}
  {{Event.APIEvent-1a2b3c."Cart Total"}}

Contact Data (live at this step):
  {{Contact.Attribute."Loyalty"."Tier"}}

Contact Key shortcut:
  {{Contact.Key}}

🔍 Line by line:

• {{ ... }} — Journey Builder uses GTL / Handlebars-style double-brace binding. This is not AMPscript (%%[ ]%%) — do not mix the two in an interview answer.
• Event. — the prefix meaning "read the frozen entry snapshot."
• "DEAudience-a33c4f76-…" — the event definition key, not the DE's external key. That mix-up is a classic follow-up. DE entry keys start DEAudience-, API entry keys start APIEvent-. You find the real one from the Journey Data dropdown in the content editor.
• ."Cart Total" — a field name containing a space, so the double quotes are mandatory. Field names are case-sensitive; wrong casing renders blank, not an error.
• Contact.Attribute."Loyalty"."Tier" — live read. Loyalty is the attribute set / related DE name, Tier the field. The relationship must exist in Contact Builder or it renders blank.
• {{Contact.Key}} — shortcut for the contact key; handy in link tracking and QA.

3.1 The worked example that proves you've built this

Scenario: A loyalty journey. Contact enters on Monday as Silver. Step 1 is an email, then a 7-day wait, then a second email that says "As a {tier} member…". On Wednesday the nightly automation upgrades them to Gold.

• If the second email binds {{Event."DEAudience-…"."Tier"}} → it prints Silver. Wrong. The customer just got upgraded and the email is telling them they're still Silver. Support ticket.
• If it binds {{Contact.Attribute."Loyalty"."Tier"}} → it prints Gold. Correct.

Now flip it. A cart-abandon journey where the email must show the cart that triggered it. If you bind Contact Data and the customer has since abandoned a different cart, the email shows the wrong basket. Here you want the frozen Journey Data value.

Say this: "The rule I use is: bind to Journey Data when the message must reflect the event that caused entry — the cart, the order, the form they filled. Bind to Contact Data when the message must reflect current state — tier, balance, preference, address. And I always set a default value and proof the binding, because a wrong binding renders blank, it doesn't throw an error."

⭐ Two gotchas to volunteer unprompted:

1. Journey Data only exposes fields that were in the entry event schema. You cannot reference an entry-DE column that wasn't part of the event definition. If you need it later, it must go into the entry schema — or come from Contact Data.
2. Every re-entry gets a brand-new snapshot. A contact who re-enters does not inherit the previous run's frozen values.

4. Activities — the palette, and what each is really for 🔑

4.1 Message activities

• Email — the workhorse. Needs content selected, a sender profile, and a send classification or the journey won't validate.
• SMS (MobileConnect) — needs a valid mobile number, an opt-in, and a provisioned keyword / short code. No opt-in, no send, silently.
• Push (MobilePush) — needs an MC-registered app (MobilePush SDK) and a registered device token. A contact with no device is silently undeliverable.
• In-App Message, WhatsApp / LINE (GroupConnect), Ad Audience (Advertising Studio), Inbox message — know they exist and their provisioning prerequisite.

4.2 Flow control

• Wait — see §5, it has its own depth.
• Decision Split — branches on data attributes (Journey or Contact data). Evaluates instantly, no wait. Paths evaluate top-to-bottom, first match wins, up to 20 paths. Always wire the default/remainder path.
• Engagement Split — branches on email engagement (sent / opened / clicked / bounced / not opened) of a prior journey email. You configure an evaluation window — how long to wait for the engagement before deciding. So it is effectively Wait + Decision on behaviour.
• Random Split — static % buckets (50/50, 33/33/34). No winner is chosen — you analyse offline.
• Path Optimizer — A/B/n test on whole branches with a test window, then auto-promotes the winner so remaining contacts flow down the best path. Use this when you want the journey to learn and act.
• Einstein Engagement Frequency Split — buckets contacts by send saturation over ~28 days into Undersaturated / On Target / Almost Saturated / Saturated. Classic use: route Saturated down a suppress path.
• Einstein Scoring Split / Engagement Split — branch on predictions (likely to open, click, convert, unsubscribe).
• Einstein STO (Send Time Optimization) — sits immediately before an Email, holds each contact and releases them at their individually predicted best time.
• Join — merges branches back into one path so downstream steps run once.
• Wait Until Event — hold until a named event fires (with an optional max-wait fallback), rather than a fixed clock.

4.3 Action activities

• Update Contact / Update Data Extension — writes attributes back at execution time (e.g. JourneyStage = 'Customer'). The target DE must be related to the Contact model via Contact Key. ⭐ It does not retroactively change the Journey Data of contacts already in flight.
• Sales & Service Cloud activities (via MC Connect) — Create/Update Lead, Contact or any Object incl. custom; Convert Lead; Create Task; Add/Remove from Campaign; Invoke a Salesforce Flow.
• Journey exit / Stop — force an exit at a point in the flow.
• Custom activities — CloudPages-hosted REST activities built with the JB SDK. ⭐ If the endpoint times out, contacts stall at that step.

4.4 Random Split vs Path Optimizer vs Decision Split (they will contrast these)

5. Wait types in depth 🔑

5.1 ⭐ The birthday trap — the #1 wait-by-attribute question

"Set a Wait By Attribute on BirthDate and send a birthday email." This fails, and the panel knows it. A stored birthdate is always in the past, and a past date means no wait — every contact rockets through and gets the email immediately.

Fix: compute a future date in SQL first.

SELECT
    SubscriberKey,
    EmailAddress,
    BirthDate,
    CASE
        WHEN DATEFROMPARTS(YEAR(GETDATE()), MONTH(BirthDate), DAY(BirthDate)) >= CAST(GETDATE() AS DATE)
            THEN DATEFROMPARTS(YEAR(GETDATE()),     MONTH(BirthDate), DAY(BirthDate))
        ELSE     DATEFROMPARTS(YEAR(GETDATE()) + 1, MONTH(BirthDate), DAY(BirthDate))
    END AS NextBirthday
FROM   ent.Subscribers
WHERE  BirthDate IS NOT NULL;

🔍 Line by line:

• SELECT SubscriberKey, EmailAddress, BirthDate, — carry identity, address and the raw stored birthdate into the target DE.
• CASE — decides whether this year's birthday is still ahead of us or already gone.
• WHEN DATEFROMPARTS(YEAR(GETDATE()), MONTH(BirthDate), DAY(BirthDate)) >= CAST(GETDATE() AS DATE) — DATEFROMPARTS builds a date from year/month/day parts; here it builds this year's birthday. CAST(GETDATE() AS DATE) strips the time so the comparison is date-to-date. Asks: is this year's birthday today or later?
• THEN DATEFROMPARTS(YEAR(GETDATE()), ...) — yes → use this year's date.
• ELSE DATEFROMPARTS(YEAR(GETDATE()) + 1, ...) — already passed → roll to next year.
• END AS NextBirthday — the output column, guaranteed to be in the future, which is what Wait By Attribute needs.
• WHERE BirthDate IS NOT NULL; — exclude nulls, because a blank wait date also causes instant pass-through.

Then Wait By Attribute on NextBirthday (or compute NextBirthday - 7 for a pre-birthday teaser).

Other wait facts worth saying: a date-only value defaults to midnight (00:00), and waits resolve against the account/send timezone — date-driven sends land "a day off" if you ignore that.

6. Goals vs Exit criteria — and the timing rule 🔑

• Goal = a measurement. "How many contacts purchased during this journey?" A goal by itself does not remove anyone. It only exits people if you tick "exit contacts when they meet the goal."
• Exit Criteria = a condition that removes the contact from the journey. This is what stops you nagging someone who already converted.

6.1 ⭐ THE timing rule

Exit criteria and goal-exits are NOT evaluated continuously. They are evaluated when a contact enters and at the END of each Wait activity.

Consequences you must state plainly:

• A contact sitting in a 5-day wait who purchases on day 1 is not removed until day 5.
• To make exit responsive, insert shorter waits — especially a short Wait By Duration immediately before a sensitive send.
• This is exactly why the ≤3-minute wait-skip rule is suspended when a goal/exit exists: the tiny wait is preserved because it's an evaluation point.

Worked scenario to narrate:

Cart-abandon journey: Entry → Email 1 → 24-hour Wait → Reminder Email. Exit criteria = Purchased = true. The customer buys 2 hours in. They stay in the journey for the remaining 22 hours — but because exit re-evaluates at the end of the wait and the reminder sits after the wait, exit fires first and they correctly get nothing. However, if there were a send before any re-evaluation point, the converter would still receive it. That's why I place a short Wait By Duration directly before every sensitive send.

6.2 Two subtleties that mark you as senior

• Goals keep counting after exit. The goal measures "converted within the attribution window", not "converted while still active" — so goal conversions can exceed the number of contacts exit removed. That's correct, not a bug.
• Order of operations: when both a goal-exit and an exit criterion could fire at the same wait, the goal evaluates first so the statistic is recorded before the contact leaves.

7. Versioning — why you can't edit a running journey 🔑

• Journeys are versioned. Once a version is activated and contacts are flowing, you cannot edit its flow or activities. You create a new version, edit, validate, and activate.
• In-flight contacts always finish on their original version. When v2 activates, v1 stops accepting new entrants and shows Finishing while it drains, then goes Stopped. A "Finishing" version is normal, not an error.
• Reporting rolls up across versions under the parent journey.

7.1 The real statuses

⭐ "Validated" is not a status. Validation is a pre-activation check.

7.2 Pause vs Stop — know the difference cold

• Pause — holds in-flight contacts where they are; resumable; max 14 days, after which it auto-resumes or stops per configuration. You can choose to extend Wait By Duration steps by the pause length and to queue entrants at the entry source during the pause. This is your emergency brake for bad content or a data issue.
• Stop — halts all in-flight contacts immediately. They're done; they will not resume. This is the kill switch, and it's not reversible.

7.3 ⭐ The entry-schema constraint

You cannot change the entry source or entry event schema in a new version while the old version is still running — the entry source is locked while in use. Two migration patterns:

1. Flow-only change (schema unchanged): create v2 → edit → validate → activate. New entrants go to v2, v1 shows Finishing.
2. Entry-schema change: stop v1 → let it drain → activate v2. You cannot run both.

8. 🧪 Click-path walkthroughs — narrate these out loud

8.1 Build a welcome journey end to end

1. App switcher (waffle, top-left) → Journey Builder → Journeys. You land on the journey list with a Create New Journey button top-right.
2. Click Create New Journey → Multi-Step Journey (not Single Send, not Transactional Send). The blank canvas opens.
3. Rename it top-left — click the journey name and type ACN_Welcome_Series_v1. Naming convention matters; say so.
4. Click the Entry Source box (top-left of the flow). In the right-hand panel pick Data Extension, then Browse to the sendable DE, e.g. Welcome_Entry_DE.
5. In the same panel, set the entry filter (drag Status into the filter canvas → is equal to → New) and the entry schedule — Run Once, or Recurring every hour/day. Click Summary → Done.
6. Entry Settings (the gear / "Contact Entry" section) — choose No re-entry for a welcome. Also set contact evaluation if only qualifying contacts should proceed.
7. Drag an Email activity from the left palette onto the canvas, drop it after the entry source. Click it → Select an email (Content Builder picker) → pick Welcome_Email_1 → set Sender Profile, Send Classification, subject line → Done.
8. Drag a Wait, drop after the email, click it → Wait By Duration → 2 days → Done.
9. Drag a Decision Split, drop after the wait (see §8.2).
10. Drag Update Contact onto the last path → target DE Contact_Master, set WelcomeComplete = true → Done.
11. Top-right → Validate. Fix anything flagged.
12. Top-right → Activate. Confirm the version. Status flips to Running.

8.2 Add a Decision Split

1. Drag Decision Split from the palette onto the canvas.
2. Click it. The configuration panel opens on the right with Path 1 and a Remainder path.
3. In the left data pane you'll see two folders: Journey Data and Contact Data. Expand the one you need — this is the physical place where the frozen-vs-live choice is made.
4. Drag the attribute (e.g. Contact Data → Loyalty → Tier) into the Path 1 filter canvas.
5. Set the operator and value: Tier is equal to Gold. Rename the path label to Gold.
6. Click + Add Path for further branches (max 20). Leave the Remainder path wired to something — a dangling path fails validation.
7. Done. Then drag the downstream activities under each path.

Say this while doing it: "Paths evaluate top to bottom, first match wins, so I put the most specific condition at the top and I always leave the remainder path connected."

8.3 Configure a wait

1. Drag Wait onto the canvas → click it.
2. Choose the wait type from the dropdown: Duration, Specific Date, Date Attribute, or Specific Day/Time.
3. For Date Attribute, click the attribute picker and choose a date field — and say out loud: "I check that this field is populated and in the future, otherwise the contact skips the wait entirely."
4. Set the timezone if the panel offers it. Done.

8.4 Set a goal and exit criteria

1. On the canvas, click Goal (the flag icon on the entry source panel / the goal bar at the top of the canvas).
2. Drag the attribute that defines conversion — e.g. Contact Data → Purchases → HasPurchased is equal to true.
3. Tick "Exit contacts when they meet the goal" if you want the goal to remove people, not just measure them.
4. For separate exit criteria: Entry Source panel → Exit Criteria → Define Exit Criteria, build the filter, Done.

8.5 Publish and check status

1. Validate (top-right) → Activate → confirm.
2. Back on Journey Builder → Journeys, the journey now shows Running with a version number.
3. Open it → the canvas shows live counts under each activity (entered, in progress, exited).
4. Journey dashboard tabs — Journey Health / Goal / Engagement for aggregate numbers.
5. To trace one person: Contact Builder → Contacts → search Contact Key → Journey Membership shows which journeys they're in and which activity they're sitting on.
6. Journey History (from the Journeys list) shows entry/exit and error events over time — this is your first stop in any triage.

9. 🧪 Troubleshooting — ordered debug chains

Panels love "walk me through your debugging." Give them a numbered chain, not a guess.

9.1 "Contacts aren't entering the journey"

1. Is the journey Running? Draft and Scheduled journeys accept nobody.
2. Entry schedule — DE entry only injects when the schedule runs. Check the next-run time. If it's Run Once and already ran, nothing more will enter.
3. Delta rule — were the rows inserted since the last evaluation, or merely updated? Updates don't trigger entry.
4. Entry filter — does the data actually satisfy it? Check for nulls, trailing spaces, case.
5. Is the DE sendable and does every row have a populated Subscriber/Contact Key? Rows with a null key are skipped.
6. Re-entry mode — if it's No re-entry and these contacts were in before, they are permanently blocked.
7. Contact exists in the Contact model? For API entry, no contact = no entry.
8. API entry: is the EventDefinitionKey correct, and is the event definition active? Check the API response — a 201 means queued, anything else means rejected.
9. Suppression / exclusion at entry — a contact evaluation filter or a global exclusion can quietly drop them.
10. Journey History — it will often show the entry attempt and the reason it failed.

9.2 "Contacts are stuck at a wait"

1. What kind of wait is it? Wait By Attribute with a blank or past date should not stall — it passes through instantly. If they're stalled, it's not that.
2. Wait Until Event with no fallback — the event never fired, so they wait forever. This is the most common genuine stall.
3. The activity after the wait errored — a custom/REST activity that times out leaves contacts parked. Check Journey History for error events.
4. Is the journey Paused? Paused holds everyone in place. Check the status badge.
5. Timezone — the wait may simply not be over yet in the account timezone. Check the actual release time, not your local clock.
6. Check the contact directly via Contact Builder → Journey Membership to see the exact activity they're on.
7. If the flow itself is wrong, build a new version; existing contacts can't be moved onto it.

9.3 "The wrong email went out"

1. Which version did those contacts enter on? In-flight contacts run the old version — if you fixed v1 by publishing v2, people already inside still get v1's content.
2. Which email asset is selected on the activity? Content Builder assets can be re-used; someone may have edited the shared asset.
3. Journey Data vs Contact Data binding — stale personalization usually means {{Event…}} where {{Contact.Attribute…}} was needed (or vice versa).
4. Decision Split ordering — first match wins. An over-broad path at the top swallows contacts intended for a lower path.
5. Remainder path — contacts with unexpected/null data fall to remainder. Is remainder wired to the right thing?
6. Exit criteria timing — a converter mid-long-wait wasn't exited yet, so they got the follow-up. Fix by adding a short evaluation wait before the send.
7. Immediate action: Pause the journey (not Stop) to halt the damage while you diagnose.

9.4 "Journey shows entries but no sends"

1. Subscriber status — Unsubscribed / Held / Bounced contacts enter fine but are suppressed at the send step.
2. Exclusion script or suppression list on the send / sender profile.
3. Missing or invalid email address on the contact record.
4. Send classification / sender profile misconfigured on the Email activity.
5. Channel prerequisite missing for non-email: no opt-in (SMS), no device token (Push).
6. Contacts still in a wait — check the activity counts; "entered" ≠ "reached the email."
7. Confirm in Email Studio → Tracking → the send job and in the _Sent / _Journey data views — if there's no job at all, the send never fired; if there's a job with 0 delivered, it's a deliverability/suppression issue.

9.5 "How do I stop a journey safely"

1. Pause first, not Stop. Pause holds in-flight contacts where they stand and is reversible (14-day max).
2. Choose whether entrants queue at the entry source or are ignored during the pause.
3. Diagnose: Journey History, activity counts, the offending data or endpoint.
4. If the content or data was wrong → fix it, then Resume.
5. If the flow was wrong → build a new version, validate, activate; the old one goes to Finishing.
6. Reserve Stop for a genuine kill switch — it ejects everyone permanently and cannot be undone.
7. Communicate: note the paused window, because pausing does not un-send anything already delivered.

10. Journey Builder REST API basics

Firing an entry event is a very common "can you code?" whiteboard ask.

POST https://YOURSUBDOMAIN.rest.marketingcloudapis.com/interaction/v1/events
Authorization: Bearer <access_token>
Content-Type: application/json

{
  "ContactKey": "abc123",
  "EventDefinitionKey": "APIEvent-1a2b3c",
  "Data": {
    "FirstName": "Akash",
    "CartTotal": 129.99
  }
}

🔍 Line by line:

• POST .../interaction/v1/events — the synchronous, single-contact journey entry endpoint. YOURSUBDOMAIN is your tenant subdomain from the installed package, not a generic host.
• Authorization: Bearer <access_token> — an OAuth 2.0 token from POST /v2/token (client credentials from an installed package). Tokens expire in ~20 minutes, so production code refreshes them.
• Content-Type: application/json — declares the JSON body.
• (blank line) — the required header/body separator.
• "ContactKey": "abc123" — the stable contact key. The contact must exist in (or be creatable in) the Contact model or there is nobody to inject.
• "EventDefinitionKey": "APIEvent-1a2b3c" — routes the event to the right journey. This is the same key you bind to in personalization ({{Event.APIEvent-1a2b3c."FirstName"}}) and is not the data extension's external key.
• "Data": { ... } — the entry payload. These values become the contact's frozen Journey Data snapshot. Anything you omit can never be referenced later via Journey Data.
• "CartTotal": 129.99 — keys must match the event schema exactly, case-sensitively, or they silently fail to bind.
• Success = 201 Created with an eventInstanceId. That means queued for entry, not entered — entry is asynchronous.

For volume, use the batch route:

POST https://YOURSUBDOMAIN.rest.marketingcloudapis.com/interaction/v1/async/events
Authorization: Bearer <access_token>
Content-Type: application/json

{
  "eventDefinitionKey": "APIEvent-1a2b3c",
  "members": [
    { "contactKey": "abc123", "data": { "FirstName": "Akash", "CartTotal": 129.99 } },
    { "contactKey": "def456", "data": { "FirstName": "Priya", "CartTotal":  59.00 } }
  ]
}

🔍 Line by line:

• .../interaction/v1/async/events — the asynchronous batch endpoint. The /async/ segment is the whole difference.
• "eventDefinitionKey" — note the lowercase first letter here, versus EventDefinitionKey on the sync route. The casing genuinely differs between the two endpoints; copy-pasting a sync payload here is a real-world bug.
• "members": [ ... ] — the array of contacts. Maximum 100 per request — page beyond that.
• { "contactKey": ..., "data": { ... } } — per-member key plus that member's own entry snapshot. Lowercase keys on this endpoint.
• Response is a 202/201 accepted-for-processing — you do not get per-contact results inline, so log the batch and reconcile against journey entry counts.

Other endpoints worth naming: GET /interaction/v1/interactions (list journeys), POST /interaction/v1/interactions (create), /interaction/v1/interactions/publishAsync/{id} (publish a version), and POST /interaction/v1/interactions/contactexit (force contacts out of a journey).

11. Multi-BU and shared data extensions

• Journeys are BU-scoped. A journey lives in one Business Unit and sends from that BU's sender profiles and reply-mail settings. There is no "one journey across all BUs" — you replicate per BU (or use a template/deployment package).
• Shared Data Extensions live in the Enterprise/Shared folder and are readable from child BUs (ENT. prefix in SQL). ⭐ A shared DE can be used as a journey entry source from a child BU, but contacts entering are stamped in that BU — reporting and subscriber status are per-BU.
• All Subscribers is at the parent BU. Unsubscribes can be at the BU level or All Subscribers level depending on your unsubscribe configuration — this is a classic multi-BU compliance question.
• Contact Delete is an enterprise-wide operation and will pull a contact out of in-flight journeys everywhere.
• Practical advice to say: "For multi-BU I keep the data shared at Enterprise level and the journeys local to each BU, so each brand controls its own sender profile, footer and unsubscribe experience while reading one governed audience."

12. Interview angles — 15 likely questions with model answers

Q1. "Journey Builder vs Automation Studio — when do you use which?" → "Journey Builder is a stateful state machine per contact that advances over time on data and behaviour; Automation Studio is stateless batch processing over a whole table. Weekly blast to a segment → Automation. Cart abandon with a 1-hour wait, an SMS fallback and an exit on purchase → Journey. In practice they pair: an automation builds and cleans the entry DE overnight, the journey consumes it."

Q2. "Name every entry source and one prerequisite for each." → DE (must be sendable, populated Contact Key), API Event (event definition key, contact must exist), Salesforce Data Event (MC Connect + integration user), CloudPage Smart Capture form, and Audience/behavioural events including Data Cloud data actions.

Q3. 🔑 "Journey Data vs Contact Data?" → "Journey Data is the frozen snapshot of the entry record taken at injection — {{Event."key"."Field"}} — and it's limited to fields in the entry event schema. Contact Data is the live value read from the Contact model at each step — {{Contact.Attribute."Set"."Field"}}. If a tier upgrades mid-journey, Journey Data still says the old tier. I bind to Journey Data for the event that caused entry, Contact Data for current state."

Q4. "A contact converts during a 5-day wait. Do they still get the next email?" ⭐ → "They are not exited until the wait ends — exit and goal-exit evaluate only at entry and at the end of each wait, never continuously. If the next send is after that wait, exit fires first and they're spared. If a send sat before any re-evaluation, they'd still get it. That's why I put a short Wait By Duration immediately before any sensitive send — it creates a fresh evaluation point."

Q5. "Can you edit a running journey?" → "Not the flow. I create a new version, edit, validate and activate — new entrants get v2 and in-flight contacts finish on v1, which shows Finishing. I can Pause/Resume (max 14 days), Stop, and change some settings live. And I can't change the entry schema at all while v1 runs — the entry source is locked, so I'd stop v1, let it drain, then activate v2."

Q6. "Explain the three re-entry modes and give me a use case for each." → No re-entry = once ever, even after exiting → welcome. Re-entry anytime = multiple concurrent instances → cart abandon. Re-entry only after exiting = repeats but never overlapping → renewal / replenishment.

Q7. "Birthday journey — how do you build it?" ⭐ → "Not with a Wait By Attribute on the raw birthdate — that date is always in the past and a past date means no wait, so everyone fires immediately. I compute a NextBirthday in a SQL query (roll the month/day to this year, and to next year if it's already passed), write it to the entry DE, then Wait By Attribute on NextBirthday minus the lead time."

Q8. "Decision Split vs Engagement Split vs Random Split vs Path Optimizer?" → Decision = data attributes, instant. Engagement = open/click/bounce of a prior journey email with a configurable evaluation window, so it waits. Random = static % buckets with no winner. Path Optimizer = branch A/B/n that auto-promotes the winner after a test window.

Q9. "Contacts aren't entering — walk me through your debugging." → Give the ordered chain from §9.1: journey status → entry schedule → insert-vs-update delta → entry filter → DE sendable + Contact Key → re-entry mode → contact exists → event definition key → suppression → Journey History.

Q10. "How would you stop an in-flight journey that's sending bad content?" → "Pause, not Stop. Pause holds contacts in place, is reversible, and I can queue or ignore entrants during the pause. I diagnose via Journey History, fix the content or data, and Resume. If the flow is wrong I build a new version. Stop is a kill switch — it ejects everyone permanently."

Q11. "How do you enter contacts from an external system in real time?" → "OAuth token from /v2/token, then POST /interaction/v1/events with ContactKey, EventDefinitionKey and a Data payload matching the event schema exactly. 201 with an eventInstanceId means queued. For volume I use /interaction/v1/async/events, max 100 members per request — and I watch the casing, because that endpoint uses lowercase eventDefinitionKey."

Q12. "What's a goal, and does it stop the journey?" → "A goal is a measurement of conversion within the attribution window. It removes nobody unless I tick 'exit contacts when they meet the goal.' And goals keep counting after contacts exit, so goal conversions can legitimately exceed the number exited."

Q13. "Why won't my journey validate?" 🔑 → Rattle these off: an Email activity with no content selected; missing send classification or sender profile; a Decision/Engagement Split with an unwired path; a dangling branch that leads nowhere; a disconnected activity floating on the canvas; an entry source that's misconfigured (DE not sendable, no Contact Key, broken event definition).

Q14. "Your Update Contact activity ran but the email still shows the old value. Why?" → "Because the email is bound to Journey Data, which was frozen at entry. Update Contact writes to the DE/contact record at execution time — it does not retroactively change an in-flight contact's snapshot. To see the updated value I have to bind that field to Contact Data, and confirm the target DE is related to the Contact model by Contact Key."

Q15. "How do you test a journey before go-live?" 🧪 → "Validate, then Test Mode with a small set of seed contacts. Test mode accelerates waits so I can see the whole flow quickly, but the sends are real and consume send volume, so I use seed addresses. I deliberately craft test data that exercises every branch including the remainder path, and I proof each message to confirm the Journey-vs-Contact data bindings render the right values with defaults in place."

13. ⭐ Gotchas — the rapid-fire list

• Exit and goal-exit evaluate at entry and at the end of each wait — never continuously. The #1 senior gotcha.
• You cannot edit a running version's flow. New version. In-flight contacts finish on the old one, which shows Finishing.
• "Validated" is not a status. Real states: Draft, Scheduled, Running, Finishing, Paused, Stopped.
• No re-entry blocks a contact forever, even after they've exited — it is not "not concurrently."
• DE entry is a delta on INSERTS, not updates. Updating a row does not re-trigger entry.
• Every re-entry gets a fresh Journey Data snapshot — re-entrants do not inherit the old frozen values.
• Journey Data only exposes fields in the entry event schema — you can't reference an entry-DE column that wasn't in the event definition.
• Contact Data needs a Contact-model relationship and an existing row at step time, or it renders blank — not an error, blank.
• Wait By Attribute on a blank or past date = no wait at all. The birthday trap.
• Date-only wait values default to midnight, and waits resolve in the account timezone.
• A mid-journey wait of ≤3 minutes is skipped unless the journey has a goal or exit criteria.
• Goal ≠ exit unless "exit on goal met" is ticked — and goals keep counting after exit.
• Decision Split paths evaluate top-to-bottom, first match wins, up to 20 paths; always wire the remainder.
• Update Contact does not rewrite Journey Data for contacts already in flight.
• Entry source is locked while a version runs — schema changes require stopping and draining first.
• Pause ≠ Stop. Pause holds (14-day max, reversible); Stop ejects everyone permanently.
• Deleting or altering the entry DE's schema breaks the journey.
• Channel prerequisites: SMS needs opt-in + short code; Push needs a registered app + device token. Missing either = silent non-delivery.
• Batch entry API caps at 100 contacts per request, and uses lowercase eventDefinitionKey unlike the sync endpoint.
• High-volume transactional traffic belongs on the Transactional Messaging API, not a marketing journey.

➡️ Next: A08_Email_Studio_and_Content_Builder.md

A08 — Email Studio and Content Builder

🎯 Why this matters for Accenture: The JD names Email Studio as a must-have, and email is still 80% of what an SFMC delivery team actually ships. Panels probe this in two ways: the send flow end to end (audience DE → send definition → sender profile → suppression → MTA → tracking), and "a send failed / the numbers look wrong — what do you check?" Both are practical. This chapter gives you the click-paths to narrate and the debug chains to recite.

🧠 One-screen mental model

  CONTENT BUILDER                 EMAIL STUDIO                    DATA
  (the assets)                    (the sending)                   (the audience)
  ──────────────                  ──────────────                  ─────────────
  Templates                       User-Initiated Send             Data Extension (sendable)
  Emails (template / HTML / text) Triggered Send                  Lists / All Subscribers
  Content Blocks (reusable)       A/B Test                        Exclusion + Suppression
  Images, Documents               Test Send / Preview             Publication / Send Log
        │                                │                              │
        └────────────► SEND DEFINITION ◄─┴──────────────────────────────┘
                              │
        Sender Profile + Delivery Profile + Send Classification
                              │
                   Exclusion script ─► Suppression lists ─► Dedup on Subscriber Key
                              │
                            MTA  (throttled, IP/domain reputation)
                              │
      Tracking ──► _Sent / _Open / _Click / _Bounce / _Unsubscribe  (Data Views)

  Open Rate = Unique Opens / Delivered      CTR  = Unique Clicks / Delivered
  CTOR      = Unique Clicks / Unique Opens  Bounce Rate = Bounces / Sent
  ⭐ Apple MPP inflates opens → trust CLICKS and CTOR, not open rate.

🔍 Line by line:

• Three columns — assets, sending, audience. Almost every Email Studio question is really "which column does this belong to?"
• Templates / Emails / Content Blocks — everything reusable lives in Content Builder, not Email Studio. Content Builder replaced the legacy Email Studio Content tab.
• SEND DEFINITION — the join point. It marries content + audience + configuration. If you can only say one sentence about the send flow, say "the send definition binds the email, the audience and the sending configuration."
• Sender Profile + Delivery Profile + Send Classification — the three configuration objects. Send Classification wraps the other two plus the CAN-SPAM behaviour.
• Exclusion script ─► Suppression lists ─► Dedup — the order matters and panels ask about it.
• MTA (throttled...) — the mail transfer agent actually delivers; throttling and IP reputation live here, which is why a big send trickles out rather than landing instantly.
• _Sent / _Open / _Click / _Bounce / _Unsubscribe — the Data Views, queryable with SQL in Automation Studio. This is how you build real reporting beyond the UI.
• The four formulas — memorise the denominators. Open Rate and CTR are over Delivered; CTOR is over Unique Opens; Bounce Rate is over Sent.
• Apple MPP inflates opens — the modern deliverability answer that immediately marks you as current.

1. Email Studio vs Content Builder — where things actually live 🔑

Email Studio is the sending application: subscribers, lists, send definitions, triggered sends, A/B tests, tracking. Content Builder is the asset application: templates, emails, content blocks, images, documents — a single shared repository accessible from Email Studio, Journey Builder, Mobile Studio and CloudPages.

Say this: "Content Builder is the shared asset library; Email Studio is the sending engine. Everything I build once in Content Builder gets consumed by Email Studio sends, Journey Builder email activities and CloudPages — that's the whole point of the consolidation away from the old Classic Content area."

2. Content Builder in depth 🔑

2.1 The three ways to create an email

⭐ Trap: a template-based email can only be edited within its content areas. If you later need to change the surrounding layout you must change the template (which affects every email built on it) or rebuild as HTML. Panels ask "how do you change the layout of 200 emails?" → change the shared template.

2.2 Content blocks

• Free-form — WYSIWYG rich text. What business users touch.
• HTML block — raw HTML, where you put AMPscript/GTL for dynamic content.
• Text block, Image block, Button block, Social Follow / Social Share, Layout / column blocks.
• A/B Test block — lets you vary a single block within one email.
• Einstein Content Selection block — Einstein picks the best asset per contact.
• Reference / reusable block — created once, dropped into many emails. ⭐ Editing a reusable block updates every email that references it — powerful for a global footer, dangerous if you forget.

2.3 Sharing and folders

• Content Builder uses a folder tree; permissions and search are folder-driven, so a naming convention matters more than it looks (/Brand/Campaign/Year/Asset).
• Sharing — from a parent/Enterprise BU you can share content to child BUs. Shared content appears read-only downstream unless configured otherwise.
• ⭐ You cannot move an asset that is in use by a running journey without care — the journey references the asset by ID, so renaming is safe but deleting is not.

2.4 Content Builder API basics

Assets are managed through the REST Asset API.

POST https://YOURSUBDOMAIN.rest.marketingcloudapis.com/asset/v1/content/assets
Authorization: Bearer <access_token>
Content-Type: application/json

{
  "name": "ACN_Welcome_Email_1",
  "assetType": { "name": "htmlemail", "id": 208 },
  "category": { "id": 12345 },
  "views": {
    "html":    { "content": "<html><body>Hello %%FirstName%%</body></html>" },
    "subjectline": { "content": "Welcome aboard, %%FirstName%%" }
  }
}

🔍 Line by line:

• POST .../asset/v1/content/assets — the Content Builder asset endpoint. The same route with GET lists assets, and PATCH /{id} updates one.
• Authorization: Bearer <access_token> — OAuth token from /v2/token; the installed package needs the Saved Content: Read/Write scope or you get a 401/403.
• "name": "ACN_Welcome_Email_1" — the asset name shown in the UI. Names must be unique within the folder.
• "assetType": { "name": "htmlemail", "id": 208 } — the asset type. 208 = htmlemail, 207 = templatebasedemail, 196 = htmlblock, 197 = textblock. Getting this ID wrong is the most common Asset API error.
• "category": { "id": 12345 } — the folder the asset lands in. Get valid folder IDs from GET /asset/v1/content/categories. Omit it and it goes to the default folder.
• "views": { ... } — an email asset is composed of views: html, text, subjectline, preheader.
• "html": { "content": "..." } — the body markup. AMPscript inline (%%FirstName%%) is stored as-is and resolved at send time, not at create time.
• "subjectline": { "content": "..." } — the subject as its own view, personalizable exactly like the body.
• Success = 201 Created with the asset id and customerKey, which you then reference from a send definition or journey Email activity.

3. Subscribers, lists and data extensions 🔑

3.1 All Subscribers, lists, DEs

• All Subscribers is the master list of every subscriber in the account (at the parent BU in an Enterprise 2.0 setup). Every subscriber exists here exactly once, keyed by Subscriber Key.
• Lists are the legacy audience construct: flat, limited to profile and preference attributes, slow at scale, and they carry a subscriber status.
• Data Extensions are relational tables with your own schema. They're the default for a reason.

Say this: "DEs are the default because they're relational and SQL-addressable — I can segment with a query activity, relate them in Contact Builder, and use them as journey entry sources. Lists are legacy: fixed schema, no SQL, and they don't scale. The only thing lists still give you natively is subscriber status management, and I handle that with the _Subscribers data view plus an unsubscribe DE."

⭐ Sendable DE requirement: to send to a DE it must be marked sendable with a send relationship — one field (usually SubscriberKey or EmailAddress) mapped to Subscriber Key on the Subscriber record. Not sendable = it won't appear in the audience picker. This is a very common "why can't I select my DE?" question.

3.2 Profile and preference attributes

• Profile attributes — data about the subscriber (First Name, City, Birthdate). Some are system attributes; you can add custom ones. Referenced as %%FirstName%%.
• Preference attributes — true/false flags describing what they want to receive (HTML Format, Wants Newsletter). Used for opt-down / preference centres.

3.3 Subscriber status values ⭐

⭐ The exam-style traps:

• Held is set by the system, not by you. You cannot manually set a subscriber to Held; you can remove it by reactivating them.
• Status lives on the subscriber (All Subscribers), not on the DE row. A DE row with Status = 'Active' in your own column means nothing to the send engine.
• A send to a DE still respects All Subscribers status — unsubscribed contacts are suppressed at send time even though they're in your audience DE. This is the single most common "why is Delivered lower than my DE row count?" answer.
• Unsubscribe scope depends on configuration: BU-level vs All Subscribers (global) unsubscribe. Know which your account uses — it's a multi-BU compliance question.

4. 🔑 The send flow end to end

 1. AUDIENCE          sendable DE (or list) selected on the send definition
        │
 2. SEND DEFINITION   binds: email asset + audience + config + tracking
        │
 3. CONFIGURATION     Send Classification ─► Sender Profile (From name/address)
        │                                 └► Delivery Profile (IP, header/footer)
        │
 4. EXCLUSIONS        exclusion script (AMPscript) evaluated per subscriber
        │             publication/suppression lists subtracted
        │             All Subscribers status: Unsub / Held / Bounced removed
        │
 5. DEDUP             one send per unique Subscriber Key per job
        │
 6. RENDER            AMPscript / GTL resolved per subscriber; links wrapped for tracking
        │
 7. MTA               queued, throttled, sent by IP; retries on soft bounce
        │
 8. TRACKING          _Sent, _Open, _Click, _Bounce, _Unsubscribe, _Complaint (Data Views)
                      + Send Log DE if configured

🔍 Line by line:

• 1. AUDIENCE — the DE must be sendable. This is where "Sent" count originates.
• 2. SEND DEFINITION — the object that marries content, audience and configuration. In the UI this is the Send flow wizard (Define Properties → Select Audience → Configure Delivery → Review & Send).
• 3. CONFIGURATION — Send Classification is the wrapper: it points at a Sender Profile and a Delivery Profile and declares Commercial vs Transactional.
• Sender Profile — the From name and From address, plus reply-mail management behaviour.
• Delivery Profile — the IP address / send pool and the header and footer (where the CAN-SPAM physical address and unsubscribe link come from).
• 4. EXCLUSIONS — order matters: exclusion script runs per subscriber, then suppression/publication lists are subtracted, then All Subscribers status removes Unsubscribed, Held and Bounced. This is why Sent < audience count, every time.
• 5. DEDUP — one email per unique Subscriber Key per job. A DE with the same key twice sends once. Duplicate email addresses under different keys will each get one.
• 6. RENDER — AMPscript and GTL resolve per subscriber at send time, and links are rewritten to the tracking domain. A broken lookup here produces a blank, not an error, unless you wrap it.
• 7. MTA — the mail transfer agent throttles by receiving domain and IP reputation. This is why a 2-million send takes hours and why "Sent" fills in progressively.
• 8. TRACKING — engagement flows back into the Data Views, queryable in a SQL Query activity. Send Log is an optional DE you configure to capture per-send-per-subscriber detail (JobID, SubscriberKey, and any AMPscript values you write) — invaluable for reconstructing what was sent.

4.1 Send Classification, Sender Profile, Delivery Profile

4.2 ⭐ Commercial vs Transactional — the CAN-SPAM answer

• Commercial — marketing content. Must include an unsubscribe link and a valid physical postal address, and honours unsubscribes and the exclusion/suppression chain. Journey Builder marketing emails are commercial.
• Transactional — operational content the recipient asked for by transacting: order confirmation, shipping notice, password reset. Not required to carry a commercial unsubscribe link, and it bypasses the commercial unsubscribe suppression.

⭐ The trap: "Transactional means it ignores all suppression." False. Transactional relaxes commercial opt-out; it still respects hard bounces and global/hard suppressions. And you cannot smuggle a promotion into a transactional classification — the content itself must be genuinely operational or you're breaking CAN-SPAM (and CASL/GDPR are stricter still).

5. Send types: User-Initiated, Triggered, Transactional API

5.1 ⭐ The Triggered Send trap they love

A Triggered Send Definition has a lifecycle: New → Active (Started) → Paused → Stopped/Inactive. If the definition is not Started, incoming fire requests are accepted but not delivered — they are silently queued or rejected rather than throwing an obvious error. So the classic symptom is "the API returns success but no email arrives."

Debug order for that symptom:

1. Is the Triggered Send Definition Started? (Email Studio → Interactions → Triggered Sends → check the status badge → Start it.)
2. Was it paused by an error threshold? A definition can auto-pause on repeated failures.
3. Is the subscriber Unsubscribed / Held / Bounced?
4. Does the triggered send DE row exist with the required Subscriber Key and email address?
5. Check Tracking → the triggered send job for a job at all — no job means it never fired.

⭐ Also: you cannot edit a running triggered send definition's email — you pause it, change, and restart, and there's a propagation delay of up to ~15 minutes before the new content is used.

Say this: "Triggered Sends are the classic real-time construct, but for anything high-volume and operational I'd recommend the Transactional Messaging API instead — it's the modern replacement, it's not throttled like commercial marketing traffic, it gives per-message status via callbacks, and it doesn't require a started TSD sitting there as a single point of failure."

6. A/B testing in Email Studio ⭐

Where: Email Studio → Interactions → A/B Testing → Create.

What you can test — exactly these: Subject Line, Email (whole content), From Name (sender profile), Send Date/Time, and Preheader. You pick one variable per test.

How it runs: you choose a test audience percentage (split between Condition A and Condition B), a test duration, and a winner criterion. After the test window, the winner is sent to the remaining audience.

6.1 ⭐ The winner-criteria trap

Native A/B testing offers only two winner criteria:

• Highest Unique Open Rate
• Highest Unique Click Rate

That's it. Not CTOR. Not conversion. Not revenue. If a panel asks "can you pick the winner on conversion rate?" the answer is no, not natively — you'd use a Random Split or Path Optimizer inside a journey, or measure offline against your own conversion DE.

⭐ And the tie-breaker: if the two conditions tie, the winner defaults to Condition A.

⭐ Third trap: if you test Send Date/Time, the winner-criteria selection is not applicable in the usual way — you're testing timing, so the remaining-audience logic differs. And the whole A/B test is a User-Initiated Send construct — you cannot run native Email Studio A/B testing inside a journey; inside a journey you use Random Split (no winner) or Path Optimizer (auto-promotes a winner).

7. Testing, preview and validation 🧪

• Preview and Test (in the Content Builder email editor, top-right) — renders the email for a specific subscriber from a chosen DE or list. This is where you catch personalization errors: pick a real row and confirm %%FirstName%% resolves.
• Validate — inside Preview and Test, the Validation tab checks for broken AMPscript, missing personalization defaults, missing links, and missing physical address/unsubscribe.
• Test Send — sends to specific addresses or a test/seed list. Options: use a test subscriber's data, prefix the subject line (e.g. [TEST]), and suppress from tracking. ⭐ Test sends do consume send volume and appear in tracking unless suppressed.
• Litmus / Email on Acid — rendering previews across clients (Outlook, Gmail, iOS Mail, dark mode). Available in-product on some editions. Say you check Outlook desktop (the worst renderer — no flexbox, needs tables and VML buttons) and dark mode.
• Seed lists — a set of internal/monitoring addresses appended to real sends to verify inboxing.

Say this: "My QA gate before any send is: Validate → Preview against three real subscriber rows that exercise every dynamic branch → rendering check in Litmus with Outlook and dark mode → test send to a seed list → then check the links actually resolve, because tracking rewrites them."

8. Tracking and metrics 🔑

8.1 The formulas — know the denominators

⭐ Unique vs total: "Unique" counts one per subscriber; "total" counts every event. Panels ask which the standard rates use — unique.

8.2 ⭐ Apple Mail Privacy Protection

Since iOS 15, Apple MPP pre-fetches the tracking pixel for Mail app users regardless of whether the human opened the message. Consequences you should volunteer:

• Open rates are inflated — often dramatically, and unevenly across audiences.
• Open-based A/B winner criteria are compromised — prefer click-rate as the criterion.
• Open-based Engagement Splits and re-engagement/sunset logic mis-fire — someone counted as "opened" may never have seen it.
• Fix: shift primary KPIs to clicks, CTOR and conversion, and rebuild engagement segmentation on click and purchase behaviour rather than opens.

Say this: "I still report open rate because clients expect it, but I don't make decisions on it. Since Apple MPP the pixel fires without a human, so I anchor optimisation on unique clicks and CTOR, and I rebuild sunset/re-engagement policies on clicks and site behaviour rather than opens."

8.3 Data Views — real reporting

The system Data Views are queryable in a SQL Query activity (not in the UI query tool):

• _Sent, _Open, _Click, _Bounce, _Unsubscribe, _Complaint
• _Job (send job metadata), _Subscribers (status), _ListSubscribers, _BusinessUnitUnsubscribes, _Journey / _JourneyActivity

⭐ Retention is limited — roughly 6 months for engagement views (_Open, _Click, _Sent, _Bounce), 30 days for _Journey*. If a client wants year-over-year reporting you must snapshot the data views into your own DE on a schedule. Saying this unprompted reads as production experience.

SELECT
    j.EmailName,
    COUNT(DISTINCT s.SubscriberKey)                                   AS Delivered,
    COUNT(DISTINCT o.SubscriberKey)                                   AS UniqueOpens,
    COUNT(DISTINCT c.SubscriberKey)                                   AS UniqueClicks,
    CAST(COUNT(DISTINCT c.SubscriberKey) AS FLOAT)
        / NULLIF(COUNT(DISTINCT o.SubscriberKey), 0)                  AS CTOR
FROM        _Sent  s
JOIN        _Job   j ON j.JobID = s.JobID
LEFT JOIN   _Open  o ON o.JobID = s.JobID AND o.SubscriberKey = s.SubscriberKey AND o.IsUnique = 1
LEFT JOIN   _Click c ON c.JobID = s.JobID AND c.SubscriberKey = s.SubscriberKey AND c.IsUnique = 1
WHERE       s.EventDate >= DATEADD(DAY, -30, GETDATE())
GROUP BY    j.EmailName;

🔍 Line by line:

• SELECT j.EmailName, — group the report by the email name from the _Job view, so one row per email rather than per job.
• COUNT(DISTINCT s.SubscriberKey) AS Delivered — _Sent holds successfully-handed-off sends, so distinct subscriber keys here is your delivered base.
• COUNT(DISTINCT o.SubscriberKey) AS UniqueOpens / COUNT(DISTINCT c.SubscriberKey) AS UniqueClicks — DISTINCT plus the IsUnique = 1 filter in the join gives unique, not total, engagement.
• CAST(... AS FLOAT) / NULLIF(..., 0) AS CTOR — CAST ... AS FLOAT forces decimal division instead of integer truncation; NULLIF(x, 0) turns a zero denominator into NULL so the query returns NULL instead of throwing a divide-by-zero. Both idioms are worth showing.
• FROM _Sent s JOIN _Job j ON j.JobID = s.JobID — _Job supplies the email name and send metadata; JobID is the join key across every engagement view.
• LEFT JOIN _Open o ON o.JobID = ... AND o.SubscriberKey = ... AND o.IsUnique = 1 — LEFT join so emails with zero opens still appear. Joining on both JobID and SubscriberKey is essential; joining on JobID alone fans the row count out catastrophically.
• WHERE s.EventDate >= DATEADD(DAY, -30, GETDATE()) — a 30-day window. Data views are large; always bound them by date or the query times out.
• GROUP BY j.EmailName; — one summary row per email.

9. 🧪 Click-path walkthroughs — narrate these out loud

9.1 Build and send an email to a data extension

1. App switcher → Email Studio → Content Builder. Navigate to your campaign folder.
2. Create → Email → Template (or HTML, or Existing Template). Pick the layout.
3. Define Properties — name, description, and select the folder. Give it a convention-compliant name like ACN_Welcome_2026Q1_v1.
4. Drag content blocks from the left palette into the content areas. Drop an HTML block where you need AMPscript.
5. Set the Subject line and Preheader at the top of the editor. Personalize with %%FirstName%% and always give it a default.
6. Preview and Test (top-right) → choose a subscriber source (a DE) → step through a few rows → check the Validation tab → Send Test to your seed addresses.
7. Save. Then Send (top-right of the email, or Email Studio → Interactions → Email → the send flow).
8. Define Properties — the send name and, importantly, whether it's tracked as a new send.
9. Select Audience — click Data Extensions, pick your sendable DE. Add Exclusions and Suppression lists here.
10. Configure Delivery — pick the Send Classification (which brings the sender + delivery profile), confirm the From name/address, choose Send immediately or Schedule, and set the Send Log / tracking options.
11. Review & Send — the summary screen shows the audience count. Send.
12. Email Studio → Tracking → Sends to watch the job move through Queued → Sending → Complete.

9.2 Set up a triggered send

1. Email Studio → Interactions → Triggered Sends → Create.
2. Properties — name, External Key (this is what the API calls, so pick it deliberately), description.
3. Select the email from Content Builder.
4. Delivery options — sender profile, delivery profile, send classification (usually a Transactional classification for receipts).
5. Suppression/exclusion and the triggered send data extension if you're passing attributes.
6. Save → then ⭐ Start the definition. It is not live until you press Start.
7. Fire it — from AMPscript on a CloudPage, or via REST:

POST https://YOURSUBDOMAIN.rest.marketingcloudapis.com/messaging/v1/messageDefinitionSends/key:WELCOME_TSD/send
Authorization: Bearer <access_token>
Content-Type: application/json

{
  "To": {
    "Address": "akash@example.com",
    "SubscriberKey": "abc123",
    "ContactAttributes": {
      "SubscriberAttributes": { "FirstName": "Akash", "OrderId": "SO-9912" }
    }
  }
}

🔍 Line by line:

• POST .../messaging/v1/messageDefinitionSends/key:WELCOME_TSD/send — the triggered send fire endpoint. key:WELCOME_TSD addresses the definition by its External Key — that's why the key you chose in step 2 matters.
• Authorization: Bearer <access_token> — OAuth token; the package needs Email: Write / triggered send scope.
• "To": { ... } — the recipient envelope.
• "Address": "akash@example.com" — the destination address. It must be a valid, non-suppressed address or the send is dropped after acceptance.
• "SubscriberKey": "abc123" — the identity key. If this key is Unsubscribed/Held/Bounced in All Subscribers, the message is suppressed even though the API returned success.
• "ContactAttributes": { "SubscriberAttributes": { ... } } — the personalization payload. These keys become available in the email as %%FirstName%%, %%OrderId%%. Names must match what the email references, exactly.
• Response: 202 Accepted with a requestId. ⭐ 202 means accepted for processing, not delivered — if no email arrives, check the TSD status first (§5.1).

9.3 Run a test send

1. Open the email in Content Builder → Preview and Test → Send Test tab.
2. Choose a subscriber source so personalization resolves against real data — otherwise %%FirstName%% renders blank and you'll wrongly think the email is broken.
3. Enter recipients, or pick a test/seed list.
4. Tick Add a prefix to the subject line ([TEST]) and, if you don't want it polluting reports, suppress from tracking.
5. Send. Check inbox rendering, the footer (physical address + unsubscribe present), and that every link resolves through the tracking domain.

9.4 Find out why a send failed

1. Email Studio → Tracking → Sends — find the job. What's the status: Cancelled, Error, Complete?
2. Open the job → compare Sent vs Delivered vs Bounced. The gap tells you which stage failed.
3. Bounces tab → read the bounce category and SMTP reason. Hard bounce (bad address) vs soft (mailbox full, greylisted) vs block (reputation/content — the serious one).
4. If Sent is far below your audience count → exclusions, suppression, subscriber status, or dedup. Query _Sent against your audience DE to identify exactly who was dropped.
5. If the job never appeared → the send definition or automation never ran. Check Automation Studio → the automation's activity history for the Send Email activity error.
6. If content failed → a runtime AMPscript error halts rendering for that subscriber. Check the error in the job details; wrap risky lookups in AttributeValue/Lookup guards with defaults.
7. Deliverability escalation: a spike in blocks at one domain = reputation or content issue → check complaint rate, authentication (SPF/DKIM/DMARC on the sending domain), and whether an IP warm-up is being violated by a volume spike.

10. 🧪 Troubleshooting — ordered debug chains

10.1 "Delivered is much lower than my DE row count"

1. Duplicates — dedup is per unique Subscriber Key per job. Count distinct keys in your DE.
2. Subscriber status — Unsubscribed / Held / Bounced are removed at send time regardless of the DE.
3. Exclusion script on the send definition.
4. Suppression / publication lists attached to the send.
5. Null or invalid email addresses in the audience.
6. Bounces — Sent minus Bounced is Delivered.
7. Reconcile precisely with SQL: your audience DE LEFT JOIN _Sent on SubscriberKey and JobID, and look at who's missing.

10.2 "Personalization is rendering blank"

1. Is the field actually in the audience DE? %%FirstName%% resolves from the send context, not from thin air.
2. Exact name and casing — SFMC personalization strings are matched by name; a typo renders blank, not an error.
3. Attribute vs DE column collision — a profile attribute and a DE column with the same name can shadow each other.
4. Null data — set a default value on the attribute or wrap it: %%[ IF EMPTY(@fn) THEN SET @fn = "there" ENDIF ]%%.
5. Preview against a real subscriber row, not the blank preview — the blank preview always shows empty.
6. In a journey, confirm you used the right binding — Journey Data vs Contact Data (see A07 §3).

10.3 "The email looks broken in Outlook"

1. Outlook desktop uses the Word rendering engine — no flexbox, no CSS grid, patchy float, no background-image without VML.
2. Rebuild layout with nested tables and inline styles.
3. Buttons: use VML bulletproof buttons, not CSS-styled anchors.
4. Check image blocking — always set alt text and never put critical content in an image alone.
5. Re-check in Litmus / Email on Acid across Outlook 2016/365, Gmail webmail and iOS Mail, plus dark mode.

10.4 "API returns success but no email arrives"

1. Triggered Send Definition not Started — the number one cause (§5.1).
2. 202 ≠ delivered. Accepted for processing only.
3. Subscriber suppressed — Unsubscribed / Held / Bounced.
4. Send classification points at a delivery profile with a bad footer or a paused IP.
5. Check Tracking → the triggered send job — no job means it never entered the send engine.
6. Check the bounce log — it may have been sent and hard-bounced.

10.5 "Unsubscribe rate suddenly spiked"

1. Which send? Isolate the job in Tracking.
2. Audience — did someone widen the segment, or send to a stale/never-mailed list?
3. Frequency — check send saturation; over-mailing is the usual culprit.
4. Content relevance — wrong offer to the wrong segment, or a subject line that over-promises.
5. Complaint rate alongside it — if complaints rose too, this is a reputation event, not just a preference event.
6. Remediation: suppress the affected cohort, reduce cadence, and add an Einstein Engagement Frequency Split in the journey to route saturated contacts away from sends.

11. Interview angles — 15 likely questions with model answers

Q1. "What's the difference between Email Studio and Content Builder?" → "Content Builder is the shared asset repository — templates, emails, blocks, images — consumed by Email Studio, Journey Builder, Mobile Studio and CloudPages. Email Studio is the sending application: subscribers, lists, send definitions, triggered sends, A/B tests and tracking."

Q2. 🔑 "Walk me through a send from audience to tracking." → Recite §4: sendable audience DE → send definition binds content + audience + config → send classification carrying sender and delivery profile → exclusion script, suppression lists, subscriber status → dedup on Subscriber Key → AMPscript renders per subscriber and links are wrapped → MTA throttles and delivers → engagement lands in the _Sent/_Open/_Click/_Bounce data views plus the send log.

Q3. "Lists vs data extensions — why are DEs the default?" → "DEs are relational with a schema I define, SQL-addressable in Automation Studio, relatable in Contact Builder, scale to millions, and can be journey entry sources. Lists are fixed-schema, don't scale past a few hundred thousand, and can't be segmented with SQL."

Q4. "What makes a DE sendable?" → "A send relationship: one field mapped to Subscriber Key on the subscriber record, usually SubscriberKey or EmailAddress. Without it the DE never appears in the audience picker."

Q5. ⭐ "What are the subscriber statuses and what sets each?" → Active (default), Held (system-set after repeated soft bounces — you cannot set it manually), Unsubscribed (unsub link, complaint, API/import), Bounced (hard bounce), Deleted. "And the key point: status lives on the subscriber in All Subscribers, not on my DE row — so a send to a DE still respects it."

Q6. "Sender profile vs delivery profile vs send classification?" → Sender profile = From name/address and reply-mail behaviour. Delivery profile = sending IP plus header and footer (physical address, unsubscribe link). Send classification wraps both and declares Commercial vs Transactional.

Q7. ⭐ "Commercial vs transactional — and does transactional bypass suppression?" → "Commercial must carry an unsubscribe link and physical address and honours the full suppression chain. Transactional is genuinely operational content and doesn't require a commercial unsubscribe. But it does not bypass everything — hard bounces and global suppressions still apply. Transactional relaxes commercial opt-out, not deliverability hygiene."

Q8. ⭐ "What can native A/B testing pick a winner on?" → "Only Highest Unique Open Rate or Highest Unique Click Rate. Not CTOR, not conversion, not revenue. And a tie defaults to Condition A. If a client wants conversion-based winner selection I'd use a Path Optimizer in a journey or measure offline against a conversion DE."

Q9. "Give me the four core metric formulas." → Open Rate = Unique Opens / Delivered. CTR = Unique Clicks / Delivered. CTOR = Unique Clicks / Unique Opens. Bounce Rate = Bounces / Sent. "Note Bounce Rate's denominator is Sent, not Delivered — that one catches people."

Q10. ⭐ "Open rates jumped 40% with no change to the programme. What happened?" → "Almost certainly Apple Mail Privacy Protection — since iOS 15 Apple pre-fetches the tracking pixel, so opens register without a human. I'd validate by segmenting opens by mail client, then shift KPIs and any engagement-based segmentation onto clicks, CTOR and conversion."

Q11. "The API returns 202 but no email arrives. Debug it." → §10.4: TSD not Started → 202 means accepted not delivered → subscriber suppressed → send classification/delivery profile → check for a job in Tracking → check the bounce log.

Q12. "How do you build year-over-year email reporting?" → "Data views only retain roughly six months of engagement (and 30 days for journey views), so I run a scheduled SQL Query activity that snapshots _Sent, _Open, _Click and _Bounce into my own history DEs, then report off those. Building reporting straight off the data views silently loses your history."

Q13. "How do you change a footer across 200 emails?" → "Two levers. If the footer is the delivery profile footer, I change it once in Admin → Send Management and every send using that profile picks it up. If it's in the content, I use a reusable content block referenced by all 200 emails — editing the block updates them all."

Q14. "What's your QA process before a production send?" 🧪 → "Validate in Preview & Test → preview against real subscriber rows covering every dynamic branch → Litmus/Email on Acid rendering check with Outlook desktop and dark mode → test send to a seed list with a [TEST] subject prefix → verify footer compliance and that links resolve through the tracking domain → confirm audience count on the Review & Send screen matches what I expect before I press send."

Q15. "Triggered Send or Transactional Messaging API — which and why?" → "For high-volume operational messages, the Transactional Messaging API: it's built for real-time throughput, has an SLA, gives per-message status via event callbacks, and doesn't depend on a started TSD as a single point of failure. Classic Triggered Sends still make sense for lower-volume, business-configurable real-time sends where the team wants to manage the definition in the UI."

12. ⭐ Gotchas — the rapid-fire list

• A stopped/never-started Triggered Send Definition silently fails. The API returns success; nothing is delivered. Always check the TSD status first.
• HTTP 202 means accepted, not delivered.
• A DE must be sendable (send relationship to Subscriber Key) or it won't appear in the audience picker.
• All Subscribers status wins over your DE. Unsubscribed/Held/Bounced are suppressed at send time even if they're in the audience.
• Held is system-set, after repeated soft bounces — you cannot set it manually.
• Dedup is per unique Subscriber Key per job — duplicate keys send once; duplicate addresses under different keys each send.
• Native A/B winner criteria are Unique Open Rate or Unique Click Rate ONLY, and a tie defaults to Condition A.
• Email Studio A/B testing is a User-Initiated Send construct — you cannot run it inside a journey. Use Random Split or Path Optimizer there.
• Bounce Rate's denominator is Sent, while Open Rate and CTR use Delivered.
• Apple MPP inflates opens — never make decisions on open rate alone, and never build sunset logic on opens.
• Personalization renders blank on error, not an exception. Always set defaults and preview against real rows.
• Editing a reusable content block updates every email that references it — great for footers, dangerous when unnoticed.
• Template-based emails can only be edited inside their content areas — layout changes mean changing the template, which affects every child email.
• Transactional classification does not bypass hard bounces or global suppressions.
• You can't edit a running triggered send's email without pausing it, and content changes take up to ~15 minutes to propagate.
• Data view retention is ~6 months (_Sent/_Open/_Click/_Bounce) and ~30 days for _Journey* — snapshot to your own DEs for history.
• Always join engagement data views on BOTH JobID and SubscriberKey — JobID alone fans out the row count.
• Test sends consume send volume and appear in tracking unless you suppress them.
• Outlook desktop uses the Word rendering engine — tables and inline styles, VML buttons, no flexbox.
• Asset API assetType IDs matter — 208 htmlemail, 207 templatebasedemail, 196 htmlblock. Wrong ID is the most common 400.

➡️ Next: A09_Mobile_Studio.md

A09 — Mobile Studio (MobileConnect, MobilePush, GroupConnect)

🎯 Why this matters for Accenture: The JD names Mobile Studio as a must-have alongside Journey Builder and Email Studio. Accenture staffs consultants onto multi-country, multi-brand programmes where the SMS/push layer is where the compliance and data-model risk lives — TCPA in the US, DLT registration in India, GDPR consent in the EU. Round-1 interviewers rarely ask "what is MobilePush." They ask "a push isn't arriving — debug it," "why did this SMS bill three times," and "an email unsub — are they out of SMS too?" This chapter gives you the runnable answers, not the brochure.

🧠 One-screen mental model

                        ONE CONTACT  (Contact Key = SubscriberKey)
                                     |
   +---------------------------+-----+--------------------+--------------------------+
   |                           |                          |                          |
EMAIL STUDIO            MOBILECONNECT              MOBILEPUSH                 GROUPCONNECT
(email address)         (mobile number)            (device token)             (LINE / WhatsApp id)
   |                           |                          |                          |
consent:                consent:                   consent:                   consent:
All Subscribers /       _MobileSubscription        OS push permission         channel opt-in +
publication list        (per keyword/program)      + registered device        WhatsApp 24-hr window
   |                           |                          |                          |
   +---------------------------+--------------------------+--------------------------+
                                     |
                          CONTACT BUILDER attribute groups
                     _MobileAddress / _MobileSubscription /
                     _MobilePushDemographics  (system DEs)
                                     |
                          JOURNEY BUILDER canvas
                 Email  ->  SMS  ->  Push / In-App  ->  WhatsApp
                 (each activity silently SKIPS a contact
                  that lacks the address or the consent)
                                     |
                          APIs:  /sms/v1/...   /push/v1/...
                                 /messaging/v1/...  (Transactional)

🔍 Line by line:

• ONE CONTACT (Contact Key = SubscriberKey) — the single most important fact in this chapter. Mobile Studio is not a separate audience; every mobile record resolves to the same Contact Key your email sends use. That is what lets one journey email, then text, then push the same human.
• EMAIL STUDIO … MOBILECONNECT … MOBILEPUSH … GROUPCONNECT — the four channel apps. Each owns a different channel address for the same contact: email address, mobile number, device token, OTT app id.
• consent: … row — each channel keeps its own consent record. An All-Subscribers unsubscribe touches email only. This is the #1 cross-channel trap (§7).
• _MobileAddress / _MobileSubscription / _MobilePushDemographics — the underscore-prefixed system data extensions that Contact Builder exposes. _MobileAddress holds the number, _MobileSubscription holds the SMS opt-in state, _MobilePushDemographics holds device + push attributes.
• each activity silently SKIPS a contact — the failure mode nobody warns you about: a contact with no mobile opt-in doesn't error at the SMS activity, they just fall through. Debugging starts here.
• /sms/v1/... /push/v1/... /messaging/v1/... — the three REST families that matter: MobileConnect API, MobilePush API, and the modern Transactional Messaging API which covers email, SMS and push under one shape.

1. The three components 🔑

🔑 Say this in one breath: "Mobile Studio is three apps over one Contact — MobileConnect for SMS/MMS through an aggregator, MobilePush for app notifications through APNs/FCM via the Unified Mobile SDK, and GroupConnect for WhatsApp and LINE. They share the Contact Key with Email Studio but each holds its own consent record."

2. MobileConnect — SMS / MMS

2.1 The mobile subscriber model 🔑

A MobileConnect subscriber is a mobile number tied to a Contact Key, opted in to one or more keywords/programs on a specific code. Three nested ideas:

• Contact — the person, identified by Contact Key.
• Mobile address — the phone number in E.164 format (+919876543210), stored in _MobileAddress. One contact can hold more than one number; one is flagged primary.
• Subscription — the opt-in row in _MobileSubscription / the mobile subscription list, scoped to a keyword and code. Opting in to SALE on short code 54321 does not opt you in to SUPPORT on the same code.

⭐ Trap: people say "the subscriber opted in." Always ask opted in to what — consent in MobileConnect is per keyword/program, not global to the account.

2.2 Codes — short vs long vs alphanumeric 🔑

🔑 The alphanumeric sender ID answer that separates seniors from juniors: "Alphanumeric sender IDs are not supported in the US or Canada and are one-way only — the customer physically cannot reply, so you cannot run keyword opt-in, STOP handling, or a conversation over them. Where they are allowed (India, much of EMEA/APAC) you must pair them with an out-of-band opt-out mechanism, because there's no MO path."

2.3 MO vs MT 🔑

• MO — Mobile Originated: customer's phone → you. Keyword texts, STOP, conversation replies. Requires a two-way-capable code.
• MT — Mobile Terminated: you → customer's phone. Campaign sends, order alerts, OTPs.

⭐ Billing gotcha: MO messages consume message credits too. Two-way programs are not "free inbound." Budget both directions.

2.4 Keywords 🔑

Three flavours:

• Subscribe keyword — texting it opts the number in (JOIN, SALE).
• Response/standard keyword — returns canned content or drops the contact into an automation/journey.
• Conversation next-keyword — inside a live conversation, the next reply is interpreted without re-typing a keyword.

Carrier-reserved keywords, handled by the platform:

STOP / END / CANCEL / UNSUBSCRIBE / QUIT   -> opt-out, platform-enforced, automatic
HELP / INFO                                -> returns the help text YOU configure
START / UNSTOP / YES                       -> re-subscribe or confirm double opt-in

🔍 Line by line:

• STOP / END / CANCEL / UNSUBSCRIBE / QUIT -> opt-out — universal opt-out words. SFMC honours these automatically on every code; you never hand-code STOP. Once received, messaging that number again is a TCPA violation, not merely a config bug.
• HELP / INFO -> returns the help text YOU configure — carriers require a help response. The platform routes the word, but the content (brand name, support contact, how to opt out) is your responsibility and must be truthful.
• START / UNSTOP / YES -> re-subscribe or confirm — the opt-in side. YES is typically wired as the confirmation keyword that completes a double opt-in, which is how you get a clean, auditable consent record.

2.5 Character limits, GSM-7 vs UCS-2 ⭐

• GSM-7 (the standard SMS alphabet): 160 characters in a single message. Over that, the message is concatenated and each segment carries only 153 characters — 7 characters per segment are consumed by the user-data header that reassembles the parts.
• UCS-2 / Unicode (any character outside GSM-7 — most emoji, curly quotes, em-dashes, Devanagari, Chinese): the whole message flips to Unicode: 70 characters single, 67 per concatenated segment.
• Every segment is a separately billed message and consumes throughput.

⭐ The classic interview question — "why did my short SMS cost 3×?" Answer: "Encoding. Someone pasted a curly apostrophe or an emoji, which flips the entire body from GSM-7 to UCS-2. The limit collapses from 160 to 70, so a one-segment message became three billable segments. My fix is to normalise copy to GSM-7 at build time — straight quotes, hyphens not em-dashes — and treat any emoji as a deliberate, costed decision. AMPscript personalisation makes this worse because the rendered length varies per contact: I budget for the longest first name, not the average."

2.6 🧪 Hands-on — personalised SMS body

%%[
  /* Same AMPscript engine as email — attributes resolve from the sendable DE / Contact */
  SET @first = AttributeValue("FirstName")
  SET @first = IIF(Empty(@first), "there", @first)
  SET @order = AttributeValue("OrderId")
]%%
Hi %%=v(@first)=%%, order %%=v(@order)=%% has shipped. Track: %%=RedirectTo(Concat('https://trk.brand.com/', _subscriberkey))=%% Reply STOP to opt out.

🔍 Line by line:

• %%[ — opens an AMPscript logic block. Everything to ]%% executes server-side at send time and prints nothing.
• SET @first = AttributeValue("FirstName") — reads the FirstName attribute from the current send context (the sendable DE or the Contact record) into the variable @first. Identical to how you'd do it in an email.
• SET @first = IIF(Empty(@first), "there", @first) — a defensive default. IIF(condition, trueValue, falseValue) returns "there" when the name is blank, so you never send "Hi , order…". Missing-data defaults matter far more in SMS than email because there's no layout to hide behind.
• SET @order = AttributeValue("OrderId") — pulls the order number for the body.
• ]%% — closes the logic block; everything below is literal SMS text plus inline output.
• Hi %%=v(@first)=%%, order %%=v(@order)=%% has shipped. — the visible message. %%=v(@var)=%% is AMPscript's inline print: v() writes the variable's value into the body.
• Track: %%=RedirectTo(Concat('https://trk.brand.com/', _subscriberkey))=%% — Concat() glues the base URL to the contact's key; RedirectTo() wraps it so the click is tracked through SFMC's link-wrapping layer. _subscriberkey is the built-in personalisation string for the contact identity.
• Reply STOP to opt out. — literal compliance text. Note every one of these characters counts against your 160-char GSM-7 budget (§2.5), which is exactly why SMS copy is a costing exercise, not a writing exercise.

2.7 🧪 Triggered SMS via the MobileConnect REST API

curl -X POST "https://YOURSUBDOMAIN.rest.marketingcloudapis.com/sms/v1/messageContact/ORDERSHIP/send" \
  -H "Authorization: Bearer ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
        "mobileNumbers": ["+919876543210"],
        "Subscribe": true,
        "Resubscribe": false,
        "keyword": "ORDERSHIP",
        "Override": true,
        "messageText": "Hi Priya, order A1029 has shipped. Track: brand.com/t/abc Reply STOP to opt out."
      }'

🔍 Line by line:

• curl -X POST ".../sms/v1/messageContact/ORDERSHIP/send" — the MobileConnect send route. ORDERSHIP in the path is the message API key / keyword whose program supplies the code and consent context. The trailing \ continues the shell command.
• -H "Authorization: Bearer ACCESS_TOKEN" — the OAuth 2.0 bearer token from /v2/token (covered fully in A11). No token, or an expired one, returns 401.
• -H "Content-Type: application/json" — declares the body format.
• "mobileNumbers": ["+919876543210"] — an array of E.164 numbers. Array form lets you batch several recipients per call, which matters for rate limits.
• "Subscribe": true — if the number isn't yet subscribed to this keyword, subscribe it as part of the send. Only set this when you genuinely hold consent from another channel — it is not a licence to message strangers.
• "Resubscribe": false — do not revive a number that previously sent STOP. Leaving this false is your safety catch against re-messaging an opted-out contact.
• "keyword": "ORDERSHIP" — repeats the keyword in the body so the message binds to the right program and consent record.
• "Override": true — tells MobileConnect to use the messageText below instead of the keyword's pre-configured response text.
• "messageText": "…" — the actual body sent. Same GSM-7 budget applies; the visible "Reply STOP" is compliance copy.
• The API returns a tokenId you can use on a follow-up status call; an invalid request returns 400 with error detail rather than silently failing.

2.8 Send methods

• Outbound message — one-off or scheduled blast to a filtered audience or mobile list.
• Automation Studio SMS Send Activity — inside a scheduled or file-triggered automation (nightly back-in-stock).
• Journey Builder SMS activity — orchestrated, per-contact (§6).
• API / triggered — /sms/v1/messageContact/{key}/send or the Transactional Messaging API /messaging/v1/sms/messages/{key} for real-time, high-throughput transactional.

3. Compliance — the section that wins interviews 🔑

3.1 United States — TCPA and CTIA

• TCPA requires prior express written consent for marketing texts. The consent must be unambiguous and the customer must know the brand, roughly how often you'll message, and that rates apply.
• CTIA messaging principles (carrier-enforced) mandate universal STOP/HELP, truthful sender identity, and no bait-and-switch opt-in.
• Required disclosures at opt-in: brand/program name, message frequency ("~4 msgs/month"), "Msg & data rates may apply", links to Terms and Privacy, and STOP/HELP instructions.
• Quiet hours: marketing texts restricted to roughly 8am–9pm in the recipient's local time zone. For a national programme this means time-zone-aware scheduling, not one blast at 9am Eastern.
• Revocation by any reasonable means — text, email, web form, phone call — must be honoured, and current FCC guidance expects it within about 10 business days.

3.2 India — DLT registration 🔑 (name-drop this)

India's TRAI framework requires DLT (Distributed Ledger Technology) registration before any A2P SMS can be delivered:

1. Entity registration      -> the brand registers on a DLT portal (Jio / Airtel / Vi / BSNL)
2. Header (sender ID)       -> each 6-char alphanumeric header approved and mapped to the entity
3. Content template         -> every message template pre-registered and approved, with
                               variable placeholders marked  {#var#}
4. Consent / scrubbing      -> DND scrubbing against the national registry; explicit consent
                               templates for promotional traffic
5. Category                 -> Promotional / Transactional / Service-Explicit / Service-Implicit
                               (promotional traffic is blocked into DND numbers and time-windowed)

🔍 Line by line:

• Entity registration — the brand, not the ESP, registers itself on a telecom operator's DLT portal and receives an entity ID. Nothing sends until this exists.
• Header (sender ID) — the 6-character alphanumeric sender ID must be registered and approved per entity, and it is one-way (§2.2), so no keyword opt-in flows.
• Content template … {#var#} — this is the part that breaks SFMC projects: the message text itself is pre-approved. Your AMPscript personalisation must fit the registered {#var#} placeholders. If marketing edits the copy, the template is no longer approved and delivery fails at the operator.
• Consent / scrubbing — promotional messages are scrubbed against the national DND registry; only explicit-consent templates reach DND-registered numbers.
• Category — promotional traffic is restricted to roughly 9am–9pm and blocked to DND numbers, while transactional/service traffic is not. Choosing the wrong category is a common cause of "the OTP didn't arrive."

⭐ Interview line for Accenture specifically: "For an India rollout the blocker is never SFMC — it's DLT. Entity, header and content templates are pre-registered with the operators, so message copy is effectively frozen and my AMPscript has to map onto the approved {#var#} placeholders. I plan template approval as a lead-time item in the project plan, the same way I'd plan short-code provisioning in the US."

3.3 Other regimes worth a sentence

• GDPR / ePrivacy (EU): opt-in must be freely given, specific, informed, unambiguous, and revocable as easily as it was given; you must be able to evidence it.
• CASL (Canada): express consent with prescribed identification and unsubscribe.
• Country-level rules on sender IDs, quiet hours and pre-registration vary widely — never assume a US pattern ports.

4. MobilePush

4.1 SDK integration and device registration 🔑

MobilePush only reaches your own branded app, via the Salesforce Marketing Cloud Unified Mobile SDK (iOS/Android; the older "MarketingCloudSDK" branding is legacy). No app, no push.

The chain that must all succeed:

1. App embeds the Unified Mobile SDK, configured with:
      App ID  +  Access Token  +  App Endpoint  +  MID
2. User grants OS notification permission        <-- if denied, push is impossible
3. OS issues a push token (APNs on iOS, FCM on Android)
4. SDK registers the device with SFMC, sending the token
5. App calls setContactKey("<the CRM/loyalty id>")  <-- ties device to the known customer
6. Device row lands in _MobilePushDemographics, keyed on Contact Key

🔍 Line by line:

• App embeds the Unified Mobile SDK, configured with App ID + Access Token + App Endpoint + MID — these four values come from the MobilePush app configuration in Setup. A wrong MID here is a classic cause of "devices register but into the wrong Business Unit."
• User grants OS notification permission — an OS-level gate you do not control. A user who taps "Don't Allow" is permanently unreachable by push notification until they change it in settings. Roughly half of users decline, which is why §4.2's in-app fallback matters.
• OS issues a push token (APNs / FCM) — the token is issued only after permission is granted. Tokens also rotate (app reinstall, OS restore), so a stale token is normal and must be refreshed by the SDK.
• SDK registers the device with SFMC — the registration call is what creates the device record. Until it lands, the contact is not push-addressable even if the app is installed.
• App calls setContactKey(...) — the single most important line of app code. It binds the device to the same Contact Key as email and SMS. Miss it, and the SDK registers under a device-generated key.
• Device row lands in _MobilePushDemographics — the system DE holding device + contact attributes, which is what you target and personalise on.

⚠️ The #1 MobilePush bug: the app registers the device before login, so it lands under an anonymous device key; the user then logs in and their push profile is split across two keys. The customer appears push-registered in the app and unreachable in SFMC. Fix: call setContactKey immediately on login, or use the SDK's "delay registration until Contact Key is set" option.

4.2 Message types 🔑

⭐ High-value nuance: "In-app and Inbox messages do not require push permission, because they render inside the app on open or on a trigger rather than through the OS notification system. So the ~50% of users who declined notifications are still reachable in-app and via Inbox. I design push campaigns with an in-app/Inbox companion rather than treating declined-push users as lost."

4.3 Location messaging — geofence and beacon

• Geofence: the SDK monitors a circular region (latitude, longitude, radius) using GPS/Wi-Fi/cell, firing on entry or exit. "You're near our flagship — 20% off today."
• Beacon: Bluetooth Low Energy proximity, far tighter than GPS — a specific display or fitting room. Requires physical hardware in-store and Bluetooth enabled.

⚠️ Hard constraints to cite: location permission must be granted (often "Always", not "While Using"), and the OS caps how many regions an app may monitor at once — iOS monitors a maximum of 20 regions per app — so you cannot watch 500 stores simultaneously; the SDK prioritises the nearest. Treat location messaging as an opportunistic delight layer, never a guaranteed-delivery channel.

4.4 🧪 Triggered push via REST

curl -X POST "https://YOURSUBDOMAIN.rest.marketingcloudapis.com/push/v1/messageContact/{messageId}/send" \
  -H "Authorization: Bearer ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
        "inclusiveContactKeys": ["cust_88213"],
        "Override": true,
        "messageText": "Your order is out for delivery.",
        "keys": { "OrderId": "A1029" }
      }'

🔍 Line by line:

• POST .../push/v1/messageContact/{messageId}/send — the MobilePush contact-send route. {messageId} is the id of a push message defined in MobilePush — you cannot invent a message shape at call time, only override its content.
• -H "Authorization: Bearer ACCESS_TOKEN" — the same OAuth token used for every SFMC REST call.
• "inclusiveContactKeys": ["cust_88213"] — targets by Contact Key, not by device. SFMC fans the message out to every registered device under that contact — which is why §4.1's setContactKey binding is what makes this call work at all.
• "Override": true — replaces the message's configured text with messageText below.
• "messageText": "Your order is out for delivery." — the notification body the user sees.
• "keys": { "OrderId": "A1029" } — custom key/value payload delivered with the push; the app reads it to deep-link into the right order screen. Keep it small — push payloads are size-capped (roughly 4KB on APNs), so rich content belongs on a CloudPage the push deep-links to.

5. GroupConnect — WhatsApp and LINE

5.1 WhatsApp 🔑

• The 24-hour customer service window is the defining rule: once the customer messages you, you may reply with free-form content for 24 hours. To initiate a conversation, or after the window closes, you must use a pre-approved message template (historically "HSM").
• Templates require Meta approval and are categorised marketing / utility / authentication. You cannot free-text a cold marketing message.
• Opt-in must be collected, usually via another channel (web form, email, SMS), before you initiate.
• Meta's policy on marketing templates by country has changed repeatedly — check current policy before promising a client a WhatsApp marketing blast in any given market. Utility and authentication templates are the safe, stable use case.

5.2 LINE

• Dominant in Japan, Taiwan, Thailand. Managed as its own subscriber base with LINE-specific content types, surfaced in Content Builder and available as a Journey Builder activity.
• Same principle: channel-specific opt-in, channel-specific message formats, same Contact Key.

Interview line: "GroupConnect covers WhatsApp and LINE. WhatsApp's defining constraint is the 24-hour window — free-form inside it, Meta-approved templates to initiate or after it, with templates categorised marketing/utility/authentication. LINE is the APAC equivalent with its own subscriber model. Both are Journey Builder activities on the same Contact."

6. Integration with Journey Builder and Contact Builder 🔑

6.1 Journey Builder

Mobile channels appear as message activities on the same canvas as email: SMS, Push, In-App, Inbox, LINE, WhatsApp — interleaved with Waits, Decision Splits, Engagement Splits and Update Contact activities.

⭐ The pattern to present as your worked example — a consent-aware escalation:

1. Entry: cart-abandon event fired via /interaction/v1/events.
2. Wait 1 hour → Email (cheapest, richest).
3. Engagement Split — opened or clicked? → goal met, exit.
4. Not engaged → Decision Split on SMS consent. Opted in → SMS with a deep link. Not opted in → Push if a device exists → otherwise stay email-only.
5. Goal = purchase; frequency guard via a shared suppression DE or Einstein Engagement Frequency.

This demonstrates you reason about cost, consent, and immediacy — the three axes a senior is expected to name.

6.2 Contact Builder

• Mobile channels surface as attribute groups on the Contact: the MobileConnect demographic set and the MobilePush demographics.
• The system DEs — _MobileAddress, _MobileSubscription, _MobilePushDemographics — are queryable from Automation Studio SQL and readable via SSJS/WSProxy, so you can build reporting and suppression logic on them exactly as you would on any DE.
• One contact → many devices. A device count is not a people count, and an uninstalled app keeps a stale token until it hard-bounces.

7. ⭐ The cross-channel consent trap (senior differentiator)

Consent is per channel, on the same Contact.

• A contact who unsubscribed from email can still legally receive SMS and push — the email unsubscribe wrote to All Subscribers / a publication list, not to _MobileSubscription.
• A contact who texted STOP is out of SMS but still emailable.
• Therefore a single IsUnsubscribed flag driving a cross-channel journey is a bug, not a shortcut. Suppression must check the channel-specific consent record before every paid send.

Model answer: "No — consent lives per channel on the same Contact. Email opt-out writes to All Subscribers; SMS opt-out writes to the mobile subscription record; push opt-out is an OS permission. I split on the right consent immediately before each channel activity and never rely on a global unsubscribe flag. Where the business wants a global 'stop contacting me', I build that explicitly as a suppression attribute honoured by every channel — but I never assume it exists for free."

8. Mobile-related APIs 🔑

POST /sms/v1/messageContact/{key}/send        -> SMS to specific contacts (MobileConnect)
POST /sms/v1/messageList/{key}/send           -> SMS to a mobile list
GET  /sms/v1/deliveryStatus/{tokenId}         -> status of a prior SMS send request
POST /push/v1/messageContact/{id}/send        -> push to contacts (MobilePush)
POST /push/v1/messageApp/{id}/send            -> push to an entire app audience
GET  /push/v1/message                         -> list push message definitions
POST /messaging/v1/sms/messages/{key}         -> Transactional Messaging API, SMS
POST /messaging/v1/push/messages/{key}        -> Transactional Messaging API, push
POST /interaction/v1/events                   -> journey entry (channel-agnostic)

🔍 Line by line:

• POST /sms/v1/messageContact/{key}/send — the workhorse triggered-SMS call (§2.7). {key} identifies the MobileConnect message/keyword, which carries the code and consent context.
• POST /sms/v1/messageList/{key}/send — the same idea aimed at a mobile list rather than enumerated numbers; use it for pre-built audiences.
• GET /sms/v1/deliveryStatus/{tokenId} — the send call returns a tokenId; this is how you poll whether the request was accepted and dispatched. Worth naming: "accepted by the API" is not "delivered to the handset."
• POST /push/v1/messageContact/{id}/send — targets specific Contact Keys, fanning out to their devices (§4.4).
• POST /push/v1/messageApp/{id}/send — broadcasts to everyone registered on the app; use with care, there's no per-contact consent split inside the call.
• GET /push/v1/message — enumerates push message definitions, useful for discovering the {id} values your integration needs.
• POST /messaging/v1/sms/messages/{key} and .../push/messages/{key} — the Transactional Messaging API. This is the modern, higher-throughput, SLA-backed path for one-to-one transactional messages, and it exposes per-message status plus delivery callbacks. Prefer it over the legacy routes for volume transactional traffic.
• POST /interaction/v1/events — not a mobile endpoint as such, but the correct entry point when the right answer is "drop them into a journey that decides the channel" rather than "fire an SMS."

9. 🧪 Click-path walkthroughs

9.1 Stand up an SMS keyword opt-in program

Mobile Studio > MobileConnect
  > Administration > Codes            -> confirm the provisioned short/long code
  > Administration > Keywords > New   -> keyword "SALE", type = Subscription,
                                          code = 54321, response message = the
                                          double-opt-in confirmation text
  > Content > Messages > Create Message
        Message Type = Text
        Send Method  = Triggered Send / Outbound
        Body         = AMPscript body from section 2.6
  > Test  -> send to a seeded test number, verify segment count and rendering
  > Overview > Subscribers            -> confirm the opt-in row was written

🔍 Line by line:

• Administration > Codes — start here, always. If no code is provisioned for the Business Unit, nothing else is possible; provisioning is a Salesforce-side request with weeks of lead time.
• Administration > Keywords > New — a keyword is bound to one code. Setting type = Subscription is what makes the inbound text create an opt-in rather than just a canned reply.
• response message = the double-opt-in confirmation text — this reply must carry the mandated disclosures: brand, frequency, "Msg & data rates may apply", HELP and STOP instructions.
• Content > Messages > Create Message — where the outbound body lives, including AMPscript.
• Send Method = Triggered Send / Outbound — triggered for API/journey use, outbound for a scheduled blast to an audience.
• Test -> send to a seeded test number — the only reliable way to catch a Unicode flip; the message builder shows the segment count, and a real handset shows the actual rendering.
• Overview > Subscribers — verifies the consent row actually landed, which is your evidence trail if the programme is ever audited.

9.2 Diagnose "the push never arrived"

1. Was the send even attempted?      MobilePush > message > Overview / send history
2. Is the contact push-addressable?  Contact Builder > contact > _MobilePushDemographics
                                     - is there a device row?
                                     - is it under the RIGHT Contact Key or an anonymous one?
3. Is the token valid?               device row shows opt-in status / last registration
4. Did the OS allow it?              app settings on the device - notifications enabled?
5. Right BU?                         SDK config MID must match the BU that owns the message
6. Journey path?                     Journey Builder > journey > per-activity counts:
                                     did the contact even reach the push activity?
7. Silent skip?                      no device = no error, just a skipped contact

🔍 Line by line:

• Was the send even attempted? — always establish this first. Half of "it didn't send" tickets are journeys where the contact never reached the activity.
• Is the contact push-addressable? — _MobilePushDemographics is the ground truth. No device row means no push, full stop.
• under the RIGHT Contact Key or an anonymous one? — this is where you'll find the §4.1 bug. An anonymous device key with the right push token is the signature of register-before-login.
• Is the token valid? — tokens rotate on reinstall/restore; a device that hasn't re-registered holds a dead token.
• Did the OS allow it? — the one layer entirely outside SFMC. Ask the user to check notification settings.
• Right BU? — a mismatched MID in the SDK config registers devices into a Business Unit that isn't the one sending. Symptom: devices exist, just not where you're looking.
• Journey path? — per-activity counts on the journey canvas tell you whether the contact was routed elsewhere by a split.
• Silent skip? — the closing insight, and the sentence to say out loud in the interview: mobile activities do not error on missing address or consent, they skip. That is why you debug addressability before you debug delivery.

9.3 Diagnose "SMS delivered in the US, silently dropped in India"

- Check DLT: is the sender header registered and approved?
- Check the content template: does the sent body match an APPROVED template
  (including the {#var#} placeholder positions)?
- Check the category: promotional traffic into a DND number is blocked outright
- Check the time window: promotional traffic is restricted to daytime hours
- Check encoding: Devanagari forces UCS-2 -> 70 chars -> unexpected segmentation
- Check the number format: E.164 with country code (+91...), not a local 10-digit

🔍 Line by line:

• is the sender header registered and approved? — an unregistered header is rejected at the operator, not at SFMC, so SFMC reports the send as successful. This asymmetry is the whole reason the ticket is confusing.
• does the sent body match an APPROVED template — the highest-frequency real cause. A marketer tweaked one word, the body no longer matches the registered template, and the operator drops it.
• promotional traffic into a DND number is blocked outright — miscategorising a service message as promotional silently kills delivery to a large slice of the audience.
• promotional traffic is restricted to daytime hours — a night-scheduled promo simply doesn't arrive.
• Devanagari forces UCS-2 — regional-language copy collapses the limit to 70 characters and multiplies cost and segments.
• E.164 with country code — a 10-digit local number with no +91 is a routing failure, and one of the most common data-quality defects in a migration.

10. Interview angles — model answers ⭐

Q1: "Walk me through Mobile Studio." A: "Three apps over one Contact. MobileConnect is SMS/MMS through an aggregator to short, long, toll-free or alphanumeric codes. MobilePush is notifications, in-app, inbox and location messaging into your own app via the Unified Mobile SDK over APNs and FCM. GroupConnect is WhatsApp and LINE. All three resolve to the same Contact Key as Email Studio, but each carries its own consent record and its own channel address — that's the design point that makes cross-channel journeys work and also the source of most of the bugs."

Q2: "Short code vs long code vs alphanumeric sender ID?" A: "Short code: 5–6 digits, roughly 100 messages a second, weeks of carrier vetting, highest cost — for high-volume promotional blasts. Long code in the US is 10DLC, about one message a second, needs brand and campaign registration with The Campaign Registry — for conversational and low-volume traffic. Alphanumeric sender IDs give you brand identity but are one-way only and not permitted in the US or Canada; where they are allowed, typically India and EMEA, you lose keyword opt-in and STOP handling entirely, so you need an out-of-band opt-out."

Q3: "A customer unsubscribed from email. Can I still text them?" A: "Legally, yes, if you hold a valid separate SMS consent — consent is per channel and the email opt-out wrote to All Subscribers, not to the mobile subscription record. Commercially I'd flag it, because it reads as evasion to the customer. The engineering point is that a single global unsubscribe flag driving a cross-channel journey is a bug: I split on the channel-specific consent immediately before each paid send."

Q4: "Why did one SMS cost three times another?" A: "Encoding. GSM-7 gives 160 characters, or 153 per segment once it concatenates. A single emoji or curly apostrophe flips the whole message to UCS-2, which is 70 characters, 67 per segment — so a one-segment message becomes three billable segments. I normalise copy to GSM-7 and budget for the longest personalised value, not the average."

Q5: "What's MO and MT, and do they both cost?" A: "MO is mobile-originated, inbound from the customer — keyword texts, STOP, conversation replies, and it requires a two-way code. MT is mobile-terminated, outbound from the brand. Both consume message credits, so a two-way conversational programme is not 'free inbound' — that surprises people at budget time."

Q6: "Do you have to hand-code STOP handling?" A: "No — STOP, END, CANCEL, UNSUBSCRIBE and QUIT are enforced automatically by the platform on every code, and I must never build a path that re-messages someone who sent them. What I do have to configure is the HELP response content and the opt-in confirmation text with its mandated disclosures. And I'd include visible 'Reply STOP to opt out' copy, which costs me characters against the 160 budget."

Q7: "A user declined push notifications. Are they unreachable?" A: "Unreachable by push notification, yes — no OS permission means no token. But in-app messages and Inbox messages don't require push permission, because they render inside the app on open or on a trigger. So my push campaigns always ship with an in-app or Inbox companion; that's how you keep the roughly half of users who decline notifications addressable."

Q8: "Push isn't arriving for one customer. Debug it." A: "In order: did the send actually attempt, or did the journey never route them there? Is there a device row in _MobilePushDemographics? Is it under the correct Contact Key or an anonymous device key — that's the register-before-login bug where setContactKey was called too late? Is the token current, given tokens rotate on reinstall? Did the OS grant notification permission? And is the SDK configured with the right MID for the sending BU? The key insight is that mobile activities silently skip unaddressable contacts rather than erroring, so I always confirm addressability before I look at delivery."

Q9: "How does Mobile Studio tie into Contact Builder?" A: "Each mobile channel adds attribute groups and system data extensions on the Contact — _MobileAddress for the number, _MobileSubscription for SMS opt-in state, _MobilePushDemographics for device and push attributes. Because they're keyed on Contact Key, I can join them in Automation Studio SQL exactly like any DE — which is how I build cross-channel suppression and reporting. One caution: one contact maps to many devices, so device counts are not people counts."

Q10: "You're rolling SMS out in India. What's the first thing you raise?" A: "DLT registration, before anything in SFMC. The entity registers with the operators, each 6-character sender header is approved, and — the part that catches teams out — every content template is pre-registered, so the copy is effectively frozen and my personalisation must map onto the approved {#var#} placeholders. Plus DND scrubbing, promotional-vs-transactional categorisation, and the daytime-only window for promotional traffic. I schedule template approval as a lead-time dependency the same way I'd schedule short-code provisioning in the US."

Q11: "What's WhatsApp's 24-hour window?" A: "Once a customer messages you, you can reply free-form for 24 hours. To initiate a conversation, or after that window closes, you must use a Meta-approved message template categorised as marketing, utility or authentication. That's why WhatsApp is architecturally a service and utility channel first — you can't improvise a cold marketing message."

Q12: "How do you stop a journey emailing, texting and pushing the same person within an hour?" A: "There's no single native cross-channel frequency toggle — native caps are largely email-centric. I engineer it: a shared send-log or suppression DE keyed on Contact Key that every channel activity checks, plus Einstein Engagement Frequency where it's licensed, and I design journeys to escalate channels sequentially behind waits rather than firing them in parallel."

11. ⭐ Gotchas checklist

• ⚠️ Consent is per channel. Email unsub ≠ SMS opt-out ≠ push permission. A single global flag is a bug.
• ⚠️ Opt-in is per keyword/program, not per account. "They opted in" is an incomplete sentence.
• ⚠️ Encoding flips cost. One emoji or curly quote → UCS-2 → 160 becomes 70 → extra billable segments. Personalisation makes rendered length variable.
• ⚠️ MO messages cost credits too. Two-way is not free inbound.
• ⚠️ Alphanumeric sender IDs are one-way and not allowed in the US/Canada — no keyword opt-in, no STOP path.
• ⚠️ Mobile journey activities silently skip contacts lacking an address or consent — no error, no entry in the failure log you were looking at.
• ⚠️ setContactKey timing — register-before-login splits the push profile under an anonymous device key. Delay registration or set the key on login.
• ⚠️ Wrong MID in the SDK config registers devices into the wrong Business Unit; they exist, just not where you're sending from.
• ⚠️ In-app and Inbox don't need push permission — the fallback most people forget.
• ⚠️ Geofence/beacon are permission-fragile; iOS monitors at most 20 regions per app, so you cannot watch every store simultaneously.
• ⚠️ Push payloads are size-capped (~4KB APNs) — rich content lives on a deep-linked CloudPage, not in the payload.
• ⚠️ One contact, many devices — device counts overstate reachable people, and uninstalled apps hold stale tokens.
• ⚠️ India: DLT content templates freeze your copy. SFMC will report success while the operator drops the message.
• ⚠️ Quiet hours are local-time, not send-time — a national blast needs time-zone-aware scheduling.
• ⚠️ WhatsApp needs an approved template to initiate or after the 24-hour window; Meta's per-country marketing policy has moved more than once, so verify before promising it.
• ⚠️ "Accepted by the API" ≠ "delivered to the handset." Poll deliveryStatus; carrier acceptance is still not a render.

➡️ Next: A10_Social_Studio_and_Advertising.md

A10 — Social Studio and Advertising

🎯 Why this matters for Accenture: The JD lists "Social Studio" as a must-have skill. Social Studio no longer exists — Salesforce retired it on 18 November 2024. The JD is boilerplate copied from an older req. This is not a problem for you; it is an opportunity. A candidate who says "yes, I've used Social Studio extensively" is either lying or has been asleep since 2023. A candidate who says "Social Studio reached end of life in November 2024 — Salesforce partnered with Sprout Social for the transition; here's what it did, and here's what teams actually use now" instantly reads as someone who tracks the platform roadmap. That is exactly the signal Accenture wants from a Custom Software Engineer. The same story is now playing out with Advertising Studio, which stops being renewable on 15 August 2026 in favour of Data Cloud Ad Audiences — knowing that is even fresher currency.

🧠 One-screen mental model

   THE PAID + SOCIAL LAYER OF SFMC — AND WHERE IT WENT

   2016-2024                          2024-2026                      2026 onward
   ---------                          ---------                      -----------
   SOCIAL STUDIO                      RETIRED 18 Nov 2024             (gone; data deleted
     Publish / Engage / Analyze  --->  Salesforce -> Sprout Social  -->  90 days post-EOL)
     Topic Profiles, Approvals         partnership; customers also
     Social Customer Service           moved to Sprinklr, Hootsuite,
     Command Center                    Emplifi, Brandwatch

   ADVERTISING STUDIO                 Still functional, but          DATA CLOUD
     Advertising Audiences      --->   NOT RENEWABLE after      --->  AD AUDIENCES
     Journey Builder Ad activity       15 Aug 2026                    (identity resolution,
     Lead Capture                                                      real-time activation,
     Journey Builder Advertising                                       broader destinations)

   WHAT NEVER CHANGED — the mechanic you must be able to explain:
   ------------------------------------------------------------------
     Data Extension (or segment)
            | contact identifiers: email / phone / mobile ad id
            v
     HASHED + matched against the ad platform's user graph
            |
            v
     Facebook / Google / LinkedIn / X / Pinterest / Snapchat CUSTOM AUDIENCE
            |
            +--> suppression (exclude existing customers from acquisition spend)
            +--> retargeting (re-reach non-openers with paid)
            +--> lookalike / similar audiences (prospecting off your best customers)

🔍 Line by line:

• SOCIAL STUDIO … RETIRED 18 Nov 2024 — the hard fact. Access ended at contract end or 18 November 2024, whichever came first, and customer data was deleted approximately 90 days later per Salesforce's SPARC policy.
• Salesforce -> Sprout Social partnership — Salesforce did not build a replacement; it partnered with Sprout Social as the recommended migration path. Naming this partner is the detail that proves you didn't just read a headline.
• Sprinklr, Hootsuite, Emplifi, Brandwatch — where the rest of the market actually went. Enterprise clients rarely moved as one; large accounts often had Sprinklr or Brandwatch already.
• ADVERTISING STUDIO … NOT RENEWABLE after 15 Aug 2026 — the live, current retirement. Existing subscriptions run to term; renewals stop. This affects everything sold as Marketing Cloud Advertising, Ad Studio, and Active Audiences.
• DATA CLOUD AD AUDIENCES — Salesforce's stated strategic direction: richer identity resolution, broader destination coverage, real-time activation off Data Cloud segments rather than SFMC data extensions.
• WHAT NEVER CHANGED — the mechanic — the part you must be able to explain regardless of product branding. You push hashed identifiers from a data extension or segment into an ad platform's custom audience. Every product in this space, past and future, is a wrapper around that one idea.
• suppression / retargeting / lookalike — the three canonical use cases. If you can name these three and say why each has business value, you have covered 80% of what an interviewer wants on paid media.

1. What Social Studio was 🔑

Social Studio was SFMC's social media management application. It was licensed and administered separately from Email Studio, with its own user model (Social Studio users, not standard SFMC users) and its own workspaces.

1.1 The three workspaces

1.2 The concepts an interviewer might still name-drop

• Social accounts — the connected Facebook Pages, X/Twitter handles, Instagram, LinkedIn Company Pages, YouTube channels a workspace could publish to and monitor.
• Topic profiles — the heart of listening. A topic profile was a saved query: keywords to include, keywords to exclude, languages, sources and regions. It defined what the listening engine pulled from the public firehose. Poorly scoped topic profiles were the classic problem — a brand called "Gap" listening for the word gap drowns in noise, so you write exclusion terms and require co-occurring brand terms.
• Approval workflows — multi-step review before a post went live: a content creator drafts, a brand or legal approver signs off, a publisher schedules. Essential for regulated clients and the reason large enterprises used Social Studio at all rather than posting natively.
• Social Customer Service — the bridge that turned an inbound social post into a Service Cloud case, so social was handled by the same agents and SLAs as email and phone.
• Command Center — the big-screen "social war room" visualisation product, sold alongside it.
• Social Studio Automate — rules-based automation over inbound social.

🔑 Say this compactly: "Social Studio had three workspaces — Publish for scheduling to connected accounts with approval workflows, Engage as a unified inbox for mentions, comments and DMs with routing into Service Cloud cases, and Analyze for dashboards. Listening was driven by topic profiles, which were saved include/exclude keyword queries. Its real enterprise value was the governance layer — approvals and role-scoped workspaces — more than the publishing itself."

2. The retirement — stated accurately ⭐

The facts, in the order you should say them:

• Salesforce announced the retirement of the Social Studio family — Social Studio, Command Center, the Social Studio mobile app, Social Studio Automate, and Social Customer Service including the free Starter Pack.
• End of life: 18 November 2024, or the end of the customer's contract, whichever came first. After that date, no access.
• Customer data was deleted roughly 90 days later under Salesforce's Security, Privacy and Architecture (SPARC) documentation. Customers were told to export their historical data before the cutoff. Teams that didn't export lost years of listening history — a genuinely painful migration lesson worth mentioning.
• Salesforce partnered with Sprout Social as the recommended transition path, rather than building a successor product.
• Salesforce's own positioning was that social management is a specialist category better served by partners, while Salesforce focuses on data, journeys and activation.

2.1 ⭐ The diplomatic answer to "do you have Social Studio experience?"

Model answer — memorise the shape, not the words:

"I should be straight with you on that one, because I think it matters. Social Studio reached end of life on 18 November 2024 — Salesforce retired the whole family, including Command Center and Social Customer Service, and pointed customers at Sprout Social as the migration partner. So no current SFMC implementation is running it, and any recent hands-on I claimed would be fiction.

What I can do is speak to it properly: it had three workspaces — Publish, Engage and Analyze — listening driven by topic profiles, and approval workflows that were really its enterprise value. I understand the concepts and I understand why it went away.

For social today, the direction is: social management moves to a specialist tool — Sprout Social, Sprinklr, Hootsuite, Emplifi — and SFMC stays the system of record for the customer and the journey, integrating with those tools over API. And on the paid side there's an equivalent shift happening right now: Advertising Studio stops being renewable after 15 August 2026, with Salesforce steering customers to Data Cloud Ad Audiences. If this role touches paid or social, that's the conversation I'd want to be having on day one — which is a very different conversation from 'can you use the Publish workspace'."

Why this answer works:

• It is honest — no invented experience, which is the fastest way to fail a technical panel.
• It demonstrates the knowledge anyway — you describe the product accurately, so you lose nothing.
• It volunteers fresher information than the interviewer has, which reverses the power dynamic in a good way.
• It redirects to the architecture question, which is what the role is actually about.

⚠️ Do not say "Social Studio is dead, why is it even in the JD?" — that reads as criticising the recruiter. Say "the JD may predate the retirement" only if they raise it. Be helpful, not smug.

3. Advertising Studio / Marketing Cloud Advertising

3.1 What it is and its current status 🔑

Marketing Cloud Advertising (formerly Advertising Studio, and before that Active Audiences) lets you use your SFMC first-party data to target, suppress and prospect on paid platforms. Supported destinations historically included Facebook and Instagram, Google Ads, LinkedIn, X (Twitter), Pinterest, Snapchat, plus Google Customer Match and Display & Video 360 via Google integrations.

Current status (verify at interview time): Salesforce is retiring Marketing Cloud Advertising Studio. Subscriptions to products sold as Marketing Cloud Advertising, Ad Studio, and Active Audiences are no longer renewable from 15 August 2026. Existing subscriptions run through their current term. Salesforce's stated investment is in Data Cloud Ad Audiences, which expands the same capability with stronger identity resolution, broader integrations, and real-time activation.

3.2 Advertising Audiences — the core mechanic 🔑

STEP 1  Build the audience in SFMC
        Data Extension  ->  contact identifiers (email, phone, mobile advertising id)
        e.g. "Lapsed_Customers_90d" produced by an Automation Studio query

STEP 2  Advertising Audiences hashes the identifiers
        SHA-256 hashing happens BEFORE the data leaves Salesforce
        raw email addresses are never handed to the ad platform

STEP 3  The ad platform matches hashes against its own user graph
        match rate is typically 40-70% and is NEVER 100%
        - people use a different email on Facebook than with your brand
        - the platform has no record of that person at all

STEP 4  A Custom Audience appears in Ads Manager / Google Ads
        and refreshes on the sync schedule (near-real-time-ish, not instant)

STEP 5  The marketer uses it for:
        TARGET     - show ads to this exact audience
        SUPPRESS   - exclude existing customers from acquisition campaigns
        LOOKALIKE  - let the platform find similar users (prospecting)

🔍 Line by line:

• Data Extension -> contact identifiers — the audience source is an ordinary DE, usually produced by a query activity. This is the point to make in interview: paid audiences are just another consumer of your segmentation layer, not a separate data universe.
• SHA-256 hashing happens BEFORE the data leaves Salesforce — the privacy control, and the thing interviewers probe. You are not shipping plaintext email addresses to Meta; you ship one-way hashes and the platform hashes its own side to compare. Say this unprompted; it signals you think about data protection.
• match rate is typically 40-70% and is NEVER 100% — the single most common client misunderstanding. "I uploaded 100,000 customers and Facebook shows 62,000" is not a bug. Knowing the expected range stops you from chasing a phantom defect.
• A Custom Audience appears in Ads Manager — SFMC pushes the audience; the campaign, budget and creative still live in the ad platform. SFMC is not an ad-buying tool. Getting this boundary right is a senior distinction.
• refreshes on the sync schedule — audiences are synced, not live. A contact who unsubscribes now is not out of the Facebook audience this second.
• TARGET / SUPPRESS / LOOKALIKE — the three use cases. Suppression is the one that pays for itself: excluding existing customers from acquisition campaigns stops you paying to re-acquire people you already own.

3.3 Journey Builder advertising activities 🔑

Inside a journey you could drop an Advertising Audience activity that adds or removes the contact from a platform custom audience as they flow through:

Entry: cart abandon
   |
   v
[ Wait 1 hr ] --> [ Email: "still thinking about it?" ]
   |
   v
[ Engagement Split: opened? ]
   |                       \
  yes                       no
   |                          \
   v                           v
[ Ad Audience: REMOVE   ]   [ Ad Audience: ADD to
  from "Cart Retarget"  ]     "Cart Retarget" (Facebook) ]
                                   |
                                   v
                            [ Wait 3 days ]
                                   |
                                   v
                            [ Ad Audience: REMOVE ]  <- stop paying for stale retargeting

🔍 Line by line:

• Entry: cart abandon — a standard API or data-extension entry source; nothing paid-specific about it.
• [ Wait 1 hr ] --> [ Email ] — email first because it is by far the cheapest channel. Paid is the escalation, not the opener.
• [ Engagement Split: opened? ] — the journey decides whether paid is even needed, using owned-channel engagement. This is the whole argument for orchestrating paid inside the journey rather than as a separate campaign.
• [ Ad Audience: REMOVE from "Cart Retarget" ] on the yes branch — the contact engaged, so stop spending on them. Removal is the activity people forget, and it is where the money is saved.
• [ Ad Audience: ADD to "Cart Retarget" (Facebook) ] on the no branch — non-engagers get escalated to paid retargeting.
• [ Wait 3 days ] --> [ Ad Audience: REMOVE ] — a time-boxed retargeting window. Without it, contacts accumulate in the audience forever and you burn budget chasing people who have long since moved on.