Troubleshooting and Day-to-Day Operations
What this domain tests
Day-to-day operational diagnosis: reading CPM and PSM symptoms, choosing the least invasive fix, and knowing when to reconcile rather than retry. Questions are usually short incident scenarios with one correct next step.
Core rules
- Isolate the layer first: Vault (service, authentication), PVWA (UI/authentication method), CPM (rotation), PSM (connection/recording), or target (account state, network). A CPM error is rarely a PSM problem.
- CPM failures split into connectivity (firewall, port, DNS), credential (CPM user rights, stale password, lockout), and policy (complexity mismatch). Each has a different fix; adding retries fixes none of them.
- Reconcile is for a vault/target password mismatch where CPM has no trusted credential. Manual change sets a known password. Verify only checks that the stored password works. Using the wrong one wastes change cycles.
- PSM failures usually trace to a missing or disabled connection component/connector, an unreachable target from the PSM host, or a platform workflow setting.
- Repeated retries against a locked target extend the lockout. Pause the change policy before investigating.
- Logs are the evidence: CPM and PSM logs on their servers, plus Vault audit for authentication and authorization events.
Worked example
A single account fails every change with 'connection error', while other accounts on the same platform succeed. Reasoning: platform-wide policy and the CPM service are healthy because peers succeed, so the fault is account-specific - wrong address or port, a target firewall rule, or a target service that is down. Check reachability from the CPM server to that host first; do not edit the platform, which would affect every peer account.
Traps that cost marks
- Editing a shared platform to fix one account and changing behavior for all accounts on it.
- Retrying a failing change until the account or the CPM user locks out.
- Using manual change when the real problem is a stale vault password that requires reconcile.
- Assuming a PSM failure is a credential problem when the connector is simply disabled.
- Ignoring the audit trail during troubleshooting; it often names the exact failing actor.