Privileged Access Management (Human Identity Security)
Domain 1 of the PAM-SEN exam covers the human privileged access lifecycle: how the Digital Vault stores and authorises credentials, how Safes and the Master Policy enforce control, how the Central Policy Manager (CPM) rotates secrets, how Privileged Session Manager (PSM) brokers and records sessions, and how Privileged Threat Analytics (PTA) scores behaviour. Items are scenario-shaped - you are told a control failed and must name the component that should have enforced it.
Objects and permissions
- The Digital Vault encrypts data at rest with AES-256 using a server key; a separate Recovery Private Key is printed and stored offline. Losing both makes the vault unrecoverable, so key custody is a favourite exam topic.
- A Safe is the unit of ownership and authorisation. Membership is role-based (Safe Manager, End User, Auditor and their combinations), and every permission - use, retrieve, list, add, update, delete, approve - is granted explicitly. A Safe Manager without the retrieve permission cannot read a credential.
- Vault Admins administer infrastructure and cannot read Safe contents; Auditors read logs only. The split is deliberate and frequently tested.
Master Policy
Global settings apply to every Safe: one-time passwords, exclusive access, dual control, reason requirement, session recording, maximum session duration and ticketing validation. One-time password and exclusive access are complementary but distinct - the first rotates the credential after retrieval, the second prevents concurrent use.
CPM, PSM, PTA
CPM performs verify, change and reconcile actions per platform; reconcile is what returns an unmanaged or drifted credential to the managed state. PSM proxies the connection and records it - it never stores the password. PTA correlates Vault, PSM and network data to raise detections such as golden ticket use or out-of-hours access.
Worked example
An auditor asks why a contractor with dual control on a Safe could not open a session even though two colleagues approved it. Reasoning: the requester is never a valid approver, and dual control requires two approvers other than the requester, each holding the approve permission. The block happens at the Master Policy layer, not in the platform configuration, so changing the target system would not help.
Traps
Confusing PSM (brokering and recording) with CPM (rotation). Assuming Vault Admin implies credential access. Treating verify as change. Forgetting that policy exceptions are configured per Safe, not per individual user.