Monitoring, Reporting and Auditing
What this domain tests
Where evidence lives and who can read it. The exam asks you to distinguish audit records from reports, and to choose the correct source when asked to prove who retrieved a password or whether a session was recorded.
Core rules
- Audit is the record of actions (retrieval, change, connect, Safe membership change, logon). Reports are formatted, often scheduled, views derived from that data.
- Access to audit data is itself permissioned: Safe-level audit visibility requires the relevant authorization, and Vault-level audit is separate. An auditor who sees no events usually lacks the permission rather than the events being absent.
- Common built-in reports cover account inventory, Safe membership, account activity, privileged account usage, and session activity. They can typically be filtered, scheduled, and exported.
- Retrieval and connection are distinct events. A password retrieved outside PSM appears as a retrieval but produces no session recording.
- Session recordings are stored separately from audit records; 'session was recorded' is not the same as 'the session audit entry exists'.
- SIEM integration forwards audit events to an external collector; notifications alert on defined conditions but are not a substitute for the audit trail. Retention and archiving determine how far back evidence reaches.
Worked example
An auditor must prove a contractor both retrieved a password and had a recorded session. Reasoning: pull account activity for the contractor's username to show the retrieval event, then session activity/recordings to show the PSM session with start/end and target. If the retrieval appears but no session exists, the password was likely retrieved directly rather than used through PSM - an important finding, not a reporting gap.
Traps that cost marks
- Treating the reports tab as a complete audit trail; some events require Vault-level audit access.
- Assuming a session recording exists because a connection audit entry does.
- Overlooking retention/archiving, then declaring evidence 'missing' when it has aged out.
- Confusing SIEM forwarding with native audit retention - forwarding does not delete or replace the source record.