CyberArk Defender - Identity study plan
CyberArk Defender - Identity · Give each week a clear focus.
8 weeks · About 6 hours per week
Human Identity Security (Privileged Access Management)
Map the CyberArk Identity Security Platform components (Identity Administration, Privilege Cloud, PAM Self-Hosted, Conjur, EPM, Secure Cloud Access) to the four exam domains so you can place any question instantly.
Explain the difference between human privileged accounts, machine identities, and agentic identities, and list two exam-style scenarios for each category.
Define core PAM vocabulary in your own words: vault, safe, member, safe owner, master policy, platform, account onboarding, CPM, PSM, and session isolation.
Walk through the lifecycle of a privileged account from discovery to rotation, decommission, and reconciliation, noting which component performs each step.
Your checkpoint
A one-page component-to-domain map plus a 25-term glossary written from memory, both reviewed against official CyberArk documentation with corrections noted.
Human Identity Security (Privileged Access Management)
Configure a safe hierarchy with owners, members, and permission levels, and justify each permission using least privilege.
Describe how master policies and platform settings combine to control dual control, exclusive access, session recording, and password rotation rules.
Trace a privileged session through PSM or Privilege Cloud: connection brokering, credential injection, recording, and audit trail.
Compare CPM-driven automatic rotation with on-demand and manual reconciliation, including what happens when rotation fails.
Your checkpoint
A written configuration walkthrough of one safe and one platform, including a table of every policy setting you changed and why.
Human Identity Security (Privileged Access Management) & Endpoint Privilege Manager and Identity Governance
Explain how CyberArk Identity roles, role memberships, and directory mappings drive authorization for administrative consoles.
Describe the main privileged threat vectors (credential theft, lateral movement, shadow admin, unmanaged local accounts) and the control that mitigates each.
Identify the audit and reporting artifacts used to prove compliance: session recordings, activity logs, access certification results, and SIEM exports.
Set up a personal spaced-repetition deck covering Domain 1 facts and run the first review pass.
Your checkpoint
A threat-to-control matrix with at least eight rows and a 30-card review deck for Domain 1.
Machine and Nonhuman Identity Security (Secrets Management)
Distinguish secrets management from password vaulting: dynamic vs static credentials, secret zero, and workload authentication.
Explain how Conjur or Secrets Manager authenticates a workload using authenticators (for example API key, JWT, cloud IAM) and how host factory and enrollment work.
Describe secret retrieval flows for applications, CI/CD pipelines, and Kubernetes workloads, including how secrets reach the process without hardcoding.
Summarize secret rotation and versioning for database, cloud, and API-key secrets, and what breaks when rotation is misconfigured.
Your checkpoint
A diagrammed end-to-end secret flow for one workload type, from authentication through retrieval and rotation, with the failure points labeled.
Machine and Nonhuman Identity Security (Secrets Management) & Endpoint Privilege Manager and Identity Governance
Compare how EPM handles application control, least privilege elevation, and credential theft protection on Windows and macOS endpoints.
Explain policy precedence and exception handling in EPM, including how to respond when a legitimate business app is blocked.
List the categories of nonhuman identities in an enterprise (service accounts, API keys, certificates, tokens, RPA bots) and the control that governs each.
Describe how identity governance capabilities such as access certifications and segregation-of-duties checks apply to service accounts and secrets owners.
Your checkpoint
A nonhuman identity inventory template with at least six identity types, the owning system, the rotation method, and the governance control for each.
Agentic Identity Security (Secure AI Agents)
Define what makes an AI agent an identity: its credential, its delegated authority, its scope, and its audit trail.
Explain how agents obtain short-lived credentials at runtime and why static long-lived API keys for agents are a design smell.
Describe the risks unique to agentic workloads: over-broad delegation, prompt-driven privilege escalation, tool misuse, runaway loops, and confused-deputy problems.
Map controls to those risks: scoped tokens, just-in-time access, human approval gates, rate limits, and full action logging.
Your checkpoint
A risk-and-control table for agentic identity with at least six risks and a concrete control and detection signal for each.
Agentic Identity Security (Secure AI Agents) & Endpoint Privilege Manager and Identity Governance
Explain how identity governance reviews, certifications, and role mining reduce standing privilege for both humans and agents.
Describe how to audit an agent's actions end to end and what evidence proves the agent acted within its delegated scope.
Work through four cross-domain scenarios (an agent using a vaulted secret, a bot with an over-privileged service account, an endpoint elevation request, a failed certification) and pick the best control.
Run a second full review pass on Domains 2 and 3 using your decks and note weak areas.
Your checkpoint
Written answers to four cross-domain scenarios, each with a chosen control and a one-sentence justification, plus a list of your three weakest topics.
Human Identity Security (Privileged Access Management) & Machine and Nonhuman Identity Security (Secrets Management) & Agentic Identity Security (Secure AI Agents) & Endpoint Privilege Manager and Identity Governance
Complete a timed 60-question mixed practice set you write or assemble yourself, weighted 25% per domain, and score it.
Re-teach your three weakest topics aloud or in writing without notes until you can do so cleanly.
Recheck every fact you flagged as uncertain against current official product documentation and correct your notes.
Build a one-page pre-exam sheet covering the distinctions most likely to be tested, such as vault vs secrets manager and human vs agent identity.
Your checkpoint
A scored 60-question practice run with a written error log, plus the final one-page pre-exam sheet.
Milestones
Week 2: You can explain safe permissions, master policy effects, and the PSM session path from memory without notes.
Week 4: You can draw the full privileged-account lifecycle and a workload secret-retrieval flow side by side and state where each control lives.
Week 6: You can define an agent's identity, credential source, delegated scope, and audit trail in under two minutes, and name the control for each major agentic risk.
Week 8: You score at least 80% on the mixed 60-question set with no domain below 70%, and your error log has no unresolved items.