I85PREP
⌘ K
CyberArk Defender - Identity study materials
CyberArk Defender - Identity study resources

CyberArk Defender - Identity: Human Identity Security (Privileged Access Management)

CyberArk Defender - Identity · Work through your exam, one topic at a time.

All guide sections

Human Identity Security (Privileged Access Management)

Human Identity Security (PAM)

This domain tests how you protect, control, and audit human privileged access in CyberArk PAM: safe design, account onboarding, CPM lifecycle, PSM brokering, and policy controls. The exam favors operational judgment over memorized screens.

Core rules

  • The Vault is the trust anchor. Accounts are stored in safes; safe membership and permissions decide who can list, retrieve, use, or manage each account.
  • A platform defines how an account is managed: connection components, password rotation, verification, reconciliation, and session behavior. Choose the platform before onboarding.
  • CPM performs rotation (change the password), verification (test that the stored password works), and reconciliation (reset a drifted password back to the Vault value). These are different outcomes and different troubleshooting paths.
  • PSM and PSM for SSH broker sessions so the user never sees the credential. Recording, keystroke logging, and session isolation provide evidence and control.
  • Master policy sets organization-wide defaults; safe-level settings tune controls within those boundaries. High-risk safes commonly require dual control, exclusive access, or one-time passwords.
  • Least privilege applies to safes too: do not grant retrieve when connect is sufficient, and review membership on a schedule.

Worked example

A database team needs a domain service account, svc-sql01, used only through PSM. Onboard it with the Windows domain account platform into safe SQL-Admins. Enable CPM rotation every 30 days, require PSM connections, and set dual control for password retrieval. Reasoning: rotation shrinks the exposure window; PSM removes the need for humans to know the password; dual control protects the rare retrieve case. Verification should be tested after the first rotation so a broken dependency is caught before an outage.

Traps

  • Confusing verification with reconciliation: verification does not reset a password.
  • Granting retrieve access to everyone who only needs to connect.
  • Treating safe owner and safe member as the same role.
  • Forgetting that a platform change can affect rotation and connection behavior for every account using it.
  • Assuming session recording exists without confirming the connection actually goes through PSM.