CyberArk CDE (CAU302) study guide
CyberArk CDE (CAU302) · Work through your exam, one topic at a time.
The CyberArk Certified Defender (CDE) credential, aligned with exam CAU302, validates the day-to-day skills of administrators who operate CyberArk Privileged Access Management in production. It suits PAM administrators, security operations staff, and implementation engineers who already work with the platform and want independent confirmation of their operational competence. The CyberArk CDE (CAU302) study guide has 7 sections and about 2,805 words.
01Account Onboarding and Management
The exam checks whether you can take a privileged account from 'known but unmanaged' to 'managed, rotating and auditable' - and whether you can tell which onboarding decision caused a later failure. Most questions here are diagnostic: a password never changes, a change fails with an authentication error, or the wrong plugin is in play.
449 words, about 2 min02Safe and Safe Member Administration
Safe administration is the authorization core of CyberArk. The exam asks who can see, retrieve, change, connect to, or approve an account, and how group membership and restrictions alter that answer.
384 words, about 2 min03Platform Management and CPM Configuration
Platforms are policy templates; this domain tests how CPM policy, password policy, and platform association combine to produce a change or a failure. Questions typically give a CPM error and ask which layer to change.
392 words, about 2 min04Session Management and PSM Configuration
PSM configuration: how a 'Connect' click becomes a proxied, recorded session, and which component is responsible when it does not. The exam favors 'session fails' and 'session not recorded' scenarios.
397 words, about 2 min05Access Control, Authentication and Authorization
The split between authentication (proving identity) and authorization (what the identity may do). Questions often describe a user who can log in but sees nothing, or who sees accounts but cannot connect - and expect you to name the missing layer.
389 words, about 2 min06Monitoring, Reporting and Auditing
Where evidence lives and who can read it. The exam asks you to distinguish audit records from reports, and to choose the correct source when asked to prove who retrieved a password or whether a session was recorded.
388 words, about 2 min07Troubleshooting and Day-to-Day Operations
Day-to-day operational diagnosis: reading CPM and PSM symptoms, choosing the least invasive fix, and knowing when to reconcile rather than retry. Questions are usually short incident scenarios with one correct next step.
406 words, about 2 min