I85PREP
⌘ K
CyberArk Guardian study materials
CyberArk Guardian study resources

CyberArk Guardian: Privileged Access Management (PAM)

CyberArk Guardian · Work through your exam, one topic at a time.

All guide sections

Privileged Access Management (PAM)

The PAM domain tests the control plane around privileged accounts in CyberArk: the Digital Vault, Safes, Master Policy, Central Policy Manager (CPM), and Privileged Session Manager (PSM/PSM for SSH). Expect scenario questions about onboarding an account, granting use without exposing the password, enforcing dual control, and proving that sessions were recorded.

Core rules

  • The Digital Vault stores and encrypts privileged objects; only Vault components decrypt them. PVWA, CPM, and PSM connect through the Vault and need appropriate Vault and Safe permissions.
  • A Safe is both an object container and a permission boundary. Safe members receive authorization levels such as Use, Retrieve, List, Add, Delete, Admin, and Audit. Use connects a user through PSM without revealing the password; Retrieve displays it.
  • Master Policy is the global privileged-access policy. It can be platform- or account-specific and controls dual control, exclusive access, session recording, one-time passwords, and just-in-time access.
  • CPM rotates and reconciles credentials according to the account platform. Platform settings define change, verify, and reconcile behavior; CPM must be able to access the account and its Safe.
  • PSM proxies and records sessions. A direct RDP connection that bypasses PSM is not recorded by PSM.
  • Typical onboarding sequence: discover the account, add it to a Safe, associate the correct platform, reconcile, verify, rotate, then grant least-privilege access.

Worked example

A DBA must administer a production Oracle account. Security requires two approvers, no password visibility, and recorded sessions. Reasoning: place the account in a Safe and give the DBA Use, not Retrieve; assign an Oracle platform so CPM can rotate the password; configure Master Policy for dual control and session recording; require PSM for connections. If standing access is prohibited, enable just-in-time access with a time-bound request and approval. The DBA never receives the credential.

Traps

  • Granting Retrieve when the requirement is Use without exposure.
  • Forgetting that CPM needs permissions on the Safe and account.
  • Assuming a Safe-level setting overrides Master Policy for privileged access.
  • Expecting recording without routing the session through PSM.
  • Letting the requester approve their own dual-control request.
  • Treating one-time password use as a substitute for credential rotation.