Secrets Management (Machine Identity Security)
Domain 2 covers machine identity: how applications, scripts, containers and CI/CD pipelines obtain secrets without hardcoding them. The exam tests two delivery models - the Application Access Manager toolset inside the Digital Vault (Central Credential Provider, Credential Provider, Application Server Credential Provider) and CyberArk Secrets Manager (Conjur / Dynamic Access Provider), plus Secrets Hub for cloud-native consumers.
Policy as code
- Policies are YAML documents loaded declaratively and idempotently; reloading does not duplicate objects.
- Statements include !policy, !layer, !host, !variable, !group, !user, !webservice, !permit, !grant, !revoke and !delete.
- !permit grants a role a privilege on a resource; !grant adds a role to a group. Mixing the two is the classic scripting error.
- Hosts authenticate with their own identity (API key or JWT), so no standing secret is stored on the workload.
Authenticators
Supported types include authn-jwt, authn-oidc, authn-iam, authn-azure, authn-gcp and authn-k8s. A service ID is appended, giving identifiers such as authn-jwt/my-service.
Runtime and dynamic secrets
Secrets are fetched at runtime through the API or SDKs. Dynamic secrets are issued with a time to live and expire on their own, so there is nothing to rotate; rotators can still rotate static variables on a schedule.
Application Access Manager in the Vault
Application identity is a triple: ApplicationID, the Safe it may read, and the machines allowed to authenticate. CCP is a web service for non-Windows workloads, CP is a Windows credential provider, and ASCP serves Java applications.
Secrets Hub
Sync is one-way from PAM to a cloud secret store such as AWS Secrets Manager or Azure Key Vault. The Vault stays the source of truth and there is no write-back.
Worked example
A pipeline fails with an authorisation error fetching a variable. Reasoning: the host was created by policy, but no privilege was ever granted on the variable. The fix is a !permit giving read and execute on that variable to the host or its layer - recreating the host changes nothing because identity is not the problem, entitlement is.
Traps
Assuming Secrets Hub syncs both ways. Assuming dynamic secrets are stored somewhere. Confusing !grant with !permit. Forgetting the machine restriction in the ApplicationID triple.