Setup
Account hierarchy and scope
Marketing Cloud Setup is about building the account skeleton before anyone sends. The Enterprise account sits at the top; Business Units are containers for users, data, and channels. A common exam trap is assuming that data or settings automatically flow between Business Units. They do not: subscribers, data extensions, and most assets are BU-scoped, and a user must be assigned to a BU to work in it. Settings such as sender authentication profiles are configured in a specific BU unless your account design says otherwise.
Identity and access
Users are not given permissions one at a time in most designs; you assign roles, which are bundles of permissions. A user can hold different roles in different Business Units. Least privilege is the guiding rule. API integrations use installed packages with server-to-server or web app credentials; the package's scopes determine what the integration can do.
Sending infrastructure
Sender Authentication Package (SAP) is the big one: it covers domain authentication, dedicated IP, link branding, and reply mail management. Sender ID is a separate email authentication method, not a synonym for SAP. Traps include confusing SAP with a sender profile, or assuming a From address alone authenticates a domain. DNS changes are required for SAP.
Worked example: a new brand wants branded tracking links, a dedicated IP, and replies routed to a service desk. That is an SAP use case, not a sender profile change. Rule of thumb: if the question is about domain-level trust and deliverability, think SAP and DNS; if it is about the visible From name, think sender profile.