CyberArk SECRET-SEN study guide
CyberArk SECRET-SEN · Work through your exam, one topic at a time.
The CyberArk SECRET-SEN exam - commonly referred to as the CyberArk Secrets Manager Sentry credential - is a multiple-choice certification aimed at practitioners who administer, deploy, or integrate CyberArk secrets management. Candidates who typically pursue it include security engineers, PAM administrators, DevOps and platform engineers, and cloud or CI/CD specialists who need to move application credentials out of code and configuration files and into governed vault storage. The CyberArk SECRET-SEN study guide has 5 sections and about 2,492 words.
01Secrets Management Fundamentals and Nonhuman Identity Security
This domain tests whether you can explain why machine credentials need a lifecycle distinct from human passwords, and how CyberArk Secrets Manager treats applications, containers, scripts, and CI/CD jobs as nonhuman identities (NHIs). Expect questions on secret types, risk, secret zero, and the control objectives behind centralization.
473 words, about 2 min02Secrets Manager Architecture and Deployment
This domain tests the components and deployment choices of CyberArk Secrets Manager (Conjur), including self-hosted and SaaS options, leader and follower roles, database, load balancing, and client connectivity. Self-hosted Secrets Manager, often called the Dynamic Access Provider (DAP), runs on Kubernetes via Helm.
432 words, about 2 min03Vault, Safe, and Policy Administration
This domain tests administration of the CyberArk Digital Vault and Safes in PAM, and policy authoring in Secrets Manager. Keep the control planes distinct: the Vault stores privileged accounts; Safes organize those accounts and permissions; Secrets Manager uses YAML policy to authorize NHIs to variables.
437 words, about 2 min04Secrets Retrieval
This domain tests how workloads authenticate and fetch secrets from Secrets Manager, including API flows, authenticators, host factory, versioning, and failure handling. Authenticators include authn-jwt for OIDC or JWT, authn-k8s, authn-aws, authn-azure, authn-oidc, authn-ldap, and API key authentication.
379 words, about 2 min05Application Credentials Delivery and CI/CD Integration
This domain tests how secrets reach applications and pipelines without being baked into images, repositories, or build logs. Know Summon, Secrets Provider for Kubernetes, SDKs, and CI/CD identity federation.
771 words, about 4 min