CyberArk CDE (CAU302) study plan
CyberArk CDE (CAU302) · Give each week a clear focus.
8 weeks · About 6 hours per week
Account Onboarding and Management
Map the full account lifecycle from discovery through onboarding, verification, rotation, and offboarding, and write the sequence in your own words as a one-page diagram.
Enumerate the account properties that drive CPM behavior (address, username, platform, safe, secret type, automatic management flags) and explain how each one changes what the CPM does.
Practice onboarding at least three account types (local Windows, domain, database) into a lab vault and record which fields you had to reconcile manually.
List the most common causes of a failed first reconciliation and describe the log entry you would look for to confirm each one.
Your checkpoint
A one-page account lifecycle diagram plus a table of 10 onboarded lab accounts showing platform, safe, and reconciliation status.
Account Onboarding and Management & Safe and Safe Member Administration
Configure automatic onboarding rules and verify that newly discovered accounts land in the intended safe without manual intervention.
Create safes with deliberate naming and retention conventions, then assign members at each safe permission level and justify each grant.
Configure dual control and exclusive access on a test safe and demonstrate the approval flow end to end.
Document the difference between safe-level permissions and master policy settings, with two examples where each one wins.
Your checkpoint
A safe design document covering five safes, their member rosters with justification, and screenshots-free written evidence of one successful dual-control approval.
Platform Management and CPM Configuration
Trace how a platform inherits from its base platform and identify which settings you can safely override versus which must stay inherited.
Configure CPM rotation schedules, retry behavior, and password change policies on a custom platform copy and predict the effect of each change.
Set up verification and reconciliation intervals that differ from the rotation interval and explain the operational risk of each mismatch.
Break a platform on purpose (wrong change command, bad prompt) and recover it using logs and rollback of the platform copy.
Your checkpoint
A custom platform exported or documented with every deviation from its base platform annotated with the reason for the change.
Platform Management and CPM Configuration & Troubleshooting and Day-to-Day Operations
Read CPM logs to diagnose three seeded failures: an unreachable target, a wrong credential, and a platform mismatch.
Use the CPM diagnostic and manual run capabilities to reproduce and confirm a fix for each seeded failure.
Write a triage checklist that orders checks from least to most invasive when a rotation fails.
Identify which CPM issues are solved by policy change versus platform change versus target-side change.
Your checkpoint
A triage runbook with three worked failure cases, each showing symptom, log evidence, root cause, and the fix applied.
Session Management and PSM Configuration
Connect a target through PSM and record every component touched: connector, platform, connection component, and proxy settings.
Configure a privileged session with recording enabled and confirm the recording is retrievable and playable.
Set up at least two different connection methods (for example RDP and SSH) and note where their configuration diverges.
Explain how PSM behaves when the connector is unavailable and describe the user-visible failure.
Your checkpoint
A PSM connection matrix for two target types listing every configuration element required and the verified result of one recorded session each.
Access Control, Authentication and Authorization
Configure an identity provider integration or directory-based authentication path and test a successful and a failed login.
Design and test a least-privilege authorization model where a user reaches only the accounts their role requires, and prove the denial case.
Configure MFA for a privileged user group and verify the fallback behavior when the second factor fails.
Map each authentication method you configured to the risk it mitigates and the operational cost it adds.
Your checkpoint
An access control design with a role-to-safe permission matrix and written evidence of one allowed and one denied access attempt.
Monitoring, Reporting and Auditing & Troubleshooting and Day-to-Day Operations
Build a report or scheduled query that answers a real audit question, such as who accessed a given account in the last 30 days.
Configure alerting or forwarding for high-value events and verify that a test event reaches the destination.
Reconstruct a timeline of a simulated incident using only audit records and session recordings.
Identify the retention settings that would undermine an audit and adjust them.
Your checkpoint
An audit package: one report definition, one verified alert path, and a reconstructed incident timeline with timestamps from audit data.
Account Onboarding and Management & Safe and Safe Member Administration & Platform Management and CPM Configuration & Session Management and PSM Configuration & Access Control, Authentication and Authorization & Monitoring, Reporting and Auditing & Troubleshooting and Day-to-Day Operations
Re-run every deliverable from weeks 1 through 7 against the weighted domain percentages and score your own confidence per domain.
Rebuild the weakest two configurations from scratch without notes to confirm retention.
Complete a timed mixed-domain practice set and review every missed item back to the underlying configuration.
Write a one-page pre-exam reference of the settings and log locations you most often confuse.
Your checkpoint
A self-scored domain confidence sheet plus a one-page pre-exam reference card covering your weakest areas.
Milestones
Week 2: You can onboard a new account and grant safe access end to end without consulting notes, and you can explain why each permission level was chosen.
Week 4: Given a failing CPM rotation, you can locate the relevant log evidence and name the root cause category within ten minutes.
Week 6: You can demonstrate one permitted and one denied access path and explain which policy or permission produced each outcome.
Week 8: All seven deliverables exist, your two weakest domains have been rebuilt from scratch, and your timed practice score is at or above your target.