CyberArk PAM-SEN study plan

Map every component of the human-identity PAM architecture (Vault, Digital Vault, Password Vault Web Access, Central Policy Manager, Privileged Session Manager, Session Recording) and state in one sentence what each does and how they talk to each other

Trace a full password-checkout flow end to end: user authenticates, PVWA requests credentials, CPM rotates and reconciles the password, audit record is written - write the sequence from memory

Differentiate the master policy, safe-level policy, and platform-level policy layers, and identify which settings can only be set at each layer

Explain dual control, exclusive access, and one-time password as approval workflows and describe the exact scenario where each is required

Configure (in a lab or sandbox) a safe, a member, a platform, and a basic master policy exception, then verify the effect on a checkout

Describe how CPM reconciles accounts, what happens on a failed verification or change, and how to read CPM error codes to diagnose a stuck account

Compare the main authentication methods (CyberArk password, LDAP, RADIUS, SAML, PKI, MFA) and select the right one for three given organizational constraints

Explain session isolation modes (basic, transparent, universal connector) and when each is appropriate

Outline the audit and reporting data path: where events are stored, what the Vault audit vs. PSM recording captures, and how to retrieve evidence for an auditor

List the top five causes of PSM connection failures and the first diagnostic step for each

Distinguish human-identity PAM from machine-identity secrets management and articulate three concrete risks unique to unmanaged machine secrets

Describe the Secrets Manager architecture: Conjur, the Vault, and how applications authenticate and retrieve secrets at runtime

Explain the difference between secrets management and workload identity, and describe how a workload proves who it is before receiving a secret

Compare at least three secret-retrieval patterns (agent-based, sidecar, API call) and state the tradeoff of each

Describe how secret rotation differs for a database credential vs. an API key vs. a certificate, and identify what breaks if rotation is not coordinated with the consumer

Explain how the Secrets Manager integrates with CI/CD pipelines, Kubernetes, and cloud providers to eliminate hardcoded credentials

Describe dynamic secrets and short-lived credentials: how they are issued, what TTL means, and why revocation matters

Outline how secrets are stored and protected at rest and in transit, including the role of the root of trust

Identify the audit trail for machine-identity secret access and explain how to prove a secret was never exposed in plaintext

Draft a migration plan for moving one application from hardcoded credentials to runtime secret retrieval

Describe the Endpoint Privilege Manager architecture (agent, policy engine, console) and how policy is delivered and enforced on endpoints

Explain application control and least-privilege elevation: what a policy rule looks like and how a rule is evaluated at execution time

Differentiate privilege elevation, application control, and credential theft protection as three separate controls

Describe how EPM handles Windows and macOS differently and identify the platform-specific limitations

Explain how EPM reports on endpoint events and how that data supports compliance evidence

Troubleshoot common EPM deployment problems: agent not reporting, policy not applying, and elevation failing after a policy change

Describe the end-to-end workflow of an access request: request, approval, provisioning, certification, and revocation, and identify where each step can fail

Explain the difference between identity governance and PAM in terms of what each controls and where they overlap

Describe how role mining and access certification reduce standing privilege, and what evidence a certification campaign produces

Map the connection between EPM endpoint data and the governance layer: which endpoint events should feed into a certification or review

Describe the identity lifecycle: joiner, mover, leaver, and the specific risk of a mover retaining old entitlements

Explain how segregation-of-duties policies are defined and enforced, and give three examples of conflicting access pairs

Outline how certification campaigns are scoped, scheduled, and remediated, and what happens to unreviewed entitlements

Describe how governance reporting evidences least privilege to an auditor, including the difference between a policy and its actual enforcement

Explain how privileged accounts are brought under governance without duplicating the PAM control layer

Re-derive the core mental model of each domain in one paragraph each, from memory, without notes

Identify the three weakest topics from prior weeks and close each gap with a focused review session

Practice scenario questions that combine domains (e.g., a machine secret accessed by a human via a privileged session) and trace the controls involved

Review all deliverables from weeks 1–7 and correct any factual errors found

Build a final one-page cross-domain reference sheet linking each domain to its primary control, primary risk, and primary evidence artifact