BeyondTrust Password Safe study plan

Diagram the Password Safe component architecture from memory, labeling the vault, management console, access broker, and policy engine roles

Explain how credential checkout differs from session brokering in terms of where secrets are exposed

List the deployment topology options (single-site, distributed, clustered) and state one tradeoff of each

Define the core object model: safes, managed systems, managed accounts, functional accounts, and users

Trace the lifecycle of a managed account from onboarding through first rotation to retirement

Describe how password change mechanisms (agent-based, agentless, service-account) are selected and why the choice matters

Identify which prerequisites (permissions, connectivity, firewall rules) must exist before a rotation can succeed

Compare propagation to dependent systems versus standalone rotation and explain the failure modes of each

Configure a password policy with complexity, length, and rotation interval settings and justify each value

Explain how SSH key management and rotation differ operationally from password rotation

Describe how secrets are encrypted at rest and in transit and which components hold key material

Outline a rotation verification loop that detects silent failures before an outage occurs

Map the access request lifecycle from user request through approval to credential release and automatic check-in

Compare access policies based on user, group, time window, and source IP and state when each is appropriate

Explain approval workflow design including approver delegation, escalation, and emergency access paths

Describe how session recording, monitoring, and keystroke logging are configured and what each captures

Differentiate credential checkout, remote session brokering, and application-to-application password injection

Explain how session proxies isolate credentials so the end user never sees the secret

Describe how MFA integrates with access requests and what happens when the MFA provider is unreachable

Outline how break-glass access is granted, logged, and reviewed afterward

Configure role-based permissions distinguishing auditors, approvers, safe owners, and administrators

Explain least-privilege design for the Password Safe administrators themselves and why separation of duties matters

Describe the audit trail for a single checkout event, listing every record produced and where it lives

Identify which events should trigger alerts versus routine logging

Build a report inventory covering access reviews, rotation compliance, and failed-change exceptions

Explain how to reconcile managed accounts against discovery data to find unmanaged credentials

Describe backup, restore, and disaster recovery considerations for the vault itself

Outline a quarterly access recertification process including evidence retention

Rehearse explaining each domain's core concepts aloud within a two-minute limit per topic

Resolve every flagged weak area from prior weeks by rewriting the associated notes

Work through scenario questions that combine rotation failure with access and audit implications

Verify recall of configuration prerequisites without reference material