Session Management and PSM Configuration
What this domain tests
PSM configuration: how a 'Connect' click becomes a proxied, recorded session, and which component is responsible when it does not. The exam favors 'session fails' and 'session not recorded' scenarios.
Core rules
- PSM is a proxy and jump host. Users connect to PSM, PSM retrieves the credential and connects to the target, and the session is recorded. CPM is separate: it rotates passwords; PSM brokers sessions.
- A connection component defines the client, connector, and connection method (RDP, SSH, web). It must be assigned to the platform's UI and workflow settings, and the matching connector must be installed and enabled on the PSM server.
- Recording is configured per platform/session: record the full session, keystrokes only, or none. Recording storage and retention are separate settings from the session policy.
- Live monitoring and session termination are performed from the active-sessions view; termination is an audited action.
- PSM Gateway is for segmented networks where the PSM server cannot reach the target directly; it adds a component and firewall path, not a new platform.
- 'Connect' and 'Retrieve' are different permissions and different risk: Connect goes through PSM and is recorded; Retrieve shows the password and is not a proxied session.
Worked example
Users can retrieve an SSH account's password, but Connect fails with 'connection component not found'. Reasoning: the platform has no SSH connection component assigned, or the SSH connector is disabled on the PSM server. Retrieval works because it never touches PSM. Fix: assign the SSH connection component in the platform's UI/workflow settings and confirm the connector is enabled on the PSM host.
Traps that cost marks
- Confusing PSM and CPM ownership of a symptom - rotation failures are CPM, connection failures are PSM.
- Disabling recording to troubleshoot and forgetting to re-enable it, creating a compliance gap.
- Assuming a platform with working RDP also supports SSH without an assigned SSH component.
- Testing only with an admin account, which can mask connector permission issues for normal users.