CyberArk Guardian study plan

Map the CyberArk PAM component stack (Vault, PVWA, CPM, PSM, PTA, PSMP, EPV) and draw a labeled architecture diagram showing traffic flows and trust boundaries.

Define the core PAM vocabulary precisely in your own words: safe, member, account, platform, policy, master policy, and privileged account lifecycle.

Trace the full password rotation path for a local Windows administrator account, naming each component that participates at every step and what happens when the CPM cannot reach the target.

Explain the difference between the Vault as a hardened appliance and the Vault as a logical trust anchor, and list the network ports and directions each component requires.

Configure a master policy and a platform policy in a lab or sandbox, then document how inheritance and exceptions resolve when two rules conflict.

Compare CPM reconciliation, verification, and rotation behaviors, and predict the outcome when a target account is disabled, locked, or has an expired password.

Design a safe hierarchy for a fictional organization with 3 business units, including naming conventions, owner assignments, and dual-control requirements.

Describe PSM connection flows for RDP and SSH, including how session isolation, recording, and keystroke logging are enforced.

List the audit evidence a PAM administrator can produce for an access review, and identify which Vault reports or logs supply each item.

Explain how CyberArk's identity security model separates authentication, authorization, and authorization scope for human users versus privileged accounts.

Compare the major authentication methods available for human access (password, RADIUS, SAML/SSO, certificate, FIDO2) and state the tradeoffs of each for a privileged user population.

Map how Adaptive MFA and behavioral analytics influence a login decision, and identify which signals an administrator can tune.

Describe the risk associated with standing privilege versus just-in-time elevation, and outline how a JIT access request would flow through approval to session launch.

Build a role-based access model for a fictional 200-person company, mapping job functions to safe permissions and least-privilege scopes.

Draft an access certification campaign: define who certifies, what evidence they see, remediation timelines, and what happens to un-reviewed access.

Explain session monitoring and the difference between live monitoring, recorded review, and automated anomaly detection, and when each is appropriate.

Describe how to onboard and offboard a privileged user end to end, including every artifact that must be revoked and verified.

Identify the top human-factor risks in privileged access (shared accounts, credential sharing, shadow admin accounts) and propose a control for each.

Distinguish secrets management from traditional vaulting, and enumerate the nonhuman identities in a typical cloud-native environment (service accounts, API keys, certificates, CI/CD tokens, database credentials).

Describe the secrets lifecycle: creation, storage, distribution, rotation, revocation, and audit, and name the failure mode at each stage.

Explain dynamic versus static secrets and how short-lived credentials reduce blast radius, including the tradeoff of issuance latency and dependency on the secret provider.

Map how applications authenticate to a secrets manager without a bootstrap secret, covering workload identity, platform attestation, and Kubernetes service account tokens.

Design a secrets rotation policy for a fictional deployment with 3 environments and state the rotation interval rationale for each secret class.

Explain how agentic and AI-driven identities differ from human and service identities in autonomy, delegation, and accountability, and where the authorization boundary sits.

Describe the risks of over-scoped machine identities and outline a least-privilege model for a workload that only needs read access to one database.

Trace how an autonomous agent obtains credentials, what scope it should receive, how its actions are attributed in logs, and how its access is revoked when the agent is retired.

Explain identity governance fundamentals: entitlement catalog, access request, approval workflow, certification, and role mining, and how each applies to nonhuman identities.

Identify the governance gap when a machine identity is created outside the approved process, and propose detection and remediation controls.

Build a cross-domain threat model for a fictional enterprise, listing at least 10 attack paths that cross PAM, human identity, secrets, and agentic identity boundaries.

For each attack path, name the specific control that breaks the chain and the evidence that proves the control is working.

Reconcile conflicting priorities between domains, such as rotation frequency versus application stability, and write the decision rationale.

Explain how a single compromised human credential could cascade into machine identity compromise, and describe the containment points.

Complete a timed 60-question mixed practice set weighted to the domain percentages, and record accuracy per domain.

Review every missed question and write a one-sentence root cause for each, distinguishing knowledge gaps from misread questions.

Re-drill the two weakest domains using targeted flashcards and a second short practice set.

Write a one-page exam-day strategy covering time allocation, question triage, and how to handle scenario questions with multiple plausible answers.