CyberArk PAM-DEF
CyberArk Certified Defender (PAM-DEF)
More study resources
Cheat sheet
Keep the key ideas within reach.
ExploreKey terms
Get comfortable with the vocabulary.
ExploreStudy plan
Give each week a clear focus.
ExploreCommon mistakes
Understand the traps and how to avoid them.
ExploreCase studies
Put your knowledge to work in context.
ExploreExam-day guide
Prepare for the day ahead.
ExploreAbout this exam
The CyberArk Certified Defender (PAM-DEF) is a vendor credential aimed at security engineers, administrators, and analysts who deploy and operate privileged access management controls day to day. Candidates typically come from identity, infrastructure, or security operations teams that already work with vaulting, session control, and endpoint least-privilege tooling. Exam content is organized into four domains: Privileged Access Management, Identity and Access Management, Endpoint Privilege Manager, and Secrets Management. That spread means preparation should be broad rather than deep in a single product area - expect questions on policy design, safe and account structures, access workflows, endpoint application control, and secret lifecycle handling. Practical lab time matters more than memorizing menus, so build a test environment, break it, and fix it. Work through vendor documentation and training paths for each domain, then self-test with scenario-based questions that force you to reason about consequences rather than recall button names. Note that the vendor's public material now describes the platform under a newer brand identity following its acquisition; existing customers are told they can continue using the platform as before, with a new logo and design. Verify current exam logistics - item count, duration, passing score, fee, and retake rules - directly with the vendor, because published certification pages can change without notice.
What you'll study
About CyberArk PAM-DEF preparation
What does the PAM-DEF exam actually test?
Four domains weighted equally at 25% each: Privileged Access Management, Identity and Access Management, Endpoint Privilege Manager, and Secrets Management. Expect design and troubleshooting scenarios across all four rather than deep specialization in one. Weakness in any single domain costs you roughly a quarter of the available marks.
How many questions are on the exam and how long do I get?
The public certification pages reviewed do not publish question counts, time limits, or passing scores. Treat any specific number you hear secondhand as unverified and confirm directly with the vendor before you book. Plan your pacing assuming scenario-style items that reward reading carefully rather than rushing.
How hard is it compared with other security certifications?
Difficulty is moderate for practitioners with hands-on platform experience and steep for candidates who only read documentation. The frequent failure mode is knowing what a setting is called but not what happens downstream when it is misconfigured. Lab work closes that gap faster than additional reading.
What is the most common reason candidates fail?
Uneven preparation. People over-study the PAM domain they use daily and skim Endpoint Privilege Manager or Secrets Management. Because each domain carries equal weight, a weak domain drags the total down hard. Audit your weakest area first and give it disproportionate time.
In what order should I study the domains?
Start with Privileged Access Management and Identity and Access Management together, since access policy and identity concepts reinforce each other. Then move to Secrets Management, which builds on vaulting fundamentals. Finish with Endpoint Privilege Manager, which is largely self-contained and easiest to study last without losing momentum.
Do I need lab access to pass?
Strongly recommended. Reading about least privilege, application execution control, and secret rotation does not build the intuition scenario questions demand. A small test environment where you configure policies, trigger them, and inspect the resulting logs teaches more per hour than passive review.
Is the certification still called CyberArk, or has it been renamed?
The vendor's public site now presents the platform under a newer brand, describing it as built on CyberArk's legacy and powered by Palo Alto Networks, and states existing CyberArk customers can continue using the platform as they always have with a new logo and design. Confirm the current exam name with the vendor before registering.
How long is the certification valid, and can I retake it?
Validity periods and retake policies are not published on the pages reviewed here, so no figure can be given reliably. Policies also vary by region and program changes. Check the vendor's certification terms at the time you schedule, and note the expiry date so you can plan renewal ahead.
Does the exam cover AI agents and nonhuman identities?
The vendor's platform material emphasizes securing human, machine, and agentic identities, including discovery and time-bound access for AI agents. Whether those topics appear on this specific exam is not stated in the source, so treat them as useful context rather than guaranteed content.