Privileged Access Management (PAM) Fundamentals
The Vault as the Center of Gravity
CyberArk PAM is built around the Digital Vault, which stores accounts, their passwords, and the safes that organize them. A safe is a container with its own membership and authorization rules; a member is a user or group granted a role inside that safe. The most tested distinction is between safe membership (who can see and act on objects in the safe) and master policy (platform-level rules that apply across all safes). Master policy governs things like dual control, exclusive access, and one-time passwords, so a question describing a behavior that applies to every safe is almost always pointing at master policy, not safe permissions.
Accounts, Platforms, and Rotation
An account is a privileged credential; a platform defines how that credential is managed (connection components, password change method, rotation rules). CPM (Central Policy Manager) performs automatic password changes according to the platform and master policy. Traps here: candidates confuse CPM (rotates credentials) with PSM (Privileged Session Management, which proxies and records sessions). A question about keystroke logging or session isolation is PSM, not CPM. Another trap is assuming a password change happens on demand only; scheduled rotation is driven by platform policy.
Worked Example and Rule of Thumb
Suppose a request asks how to ensure two approvers are required before a user can retrieve a password for a production database. The answer is dual control configured in master policy and applied to the relevant safe, not a safe-level permission toggle. Rule of thumb: who can access is safe membership; how access behaves is master policy; how the password is changed is the platform.
Authorization Flow
Understand that authorization checks combine the user's safe membership role, master policy, and any safe-level restrictions. Least privilege means granting the minimum role (e.g., retrieve versus use versus manage) needed for the task.