CyberArk SECRET-SEN study plan
CyberArk SECRET-SEN · Give each week a clear focus.
8 weeks · About 6 hours per week
Secrets Management Fundamentals and Nonhuman Identity Security
Define secrets management and distinguish it from password vaulting, PAM session brokering, and key management services
Classify nonhuman identities (service accounts, application credentials, API keys, certificates, CI/CD tokens, machine identities) and map each to a typical attack path
Explain the shared responsibility split between a secrets management platform, the consuming application, and the cloud provider
Diagram the lifecycle of a secret from creation through rotation, consumption, and revocation
Your checkpoint
A one-page nonhuman identity taxonomy with at least 8 identity types, each paired with one realistic compromise scenario and the control that mitigates it
Secrets Management Fundamentals and Nonhuman Identity Security & Vault, Safe, and Policy Administration
Describe how safes, accounts, and permissions compose into an authorization model, and predict the outcome of member and permission combinations
Explain the role of the Vault as the root of trust and how its own administrative access is protected
Compare human, application, and delegated access paths to a stored credential
Identify why dual control, approval workflows, and break-glass procedures exist in a secrets program
Your checkpoint
A written authorization walkthrough for three scenarios (human interactive access, application retrieval, emergency break-glass) showing which safe, account, and permission decisions apply in each
Secrets Manager Architecture and Deployment
Sketch a Secrets Manager deployment topology including Vault, component servers, connectors, and the network zones they cross
Explain what each architectural component does and what breaks if it is unavailable or misconfigured
Describe high availability and disaster recovery options and the trade-offs between them
Identify the firewall, DNS, and time-synchronization dependencies that cause most deployment failures
Your checkpoint
An annotated architecture diagram of a two-site deployment with every component labeled, plus a table of the ports and trust relationships between them
Secrets Manager Architecture and Deployment & Vault, Safe, and Policy Administration
Configure a safe hierarchy with master safes and sub-safes and justify the structure for a multi-team organization
Apply least privilege by defining roles, safe members, and permission sets rather than per-user grants
Explain how platform settings and account policies drive rotation and verification behavior
Distinguish account-level, platform-level, and master-policy settings and resolve conflicts between them
Your checkpoint
A safe design document for a fictional three-team organization: safe tree, role definitions, permission matrix, and rotation policy per account class
Vault, Safe, and Policy Administration & Secrets Retrieval, Application Credentials Delivery, and CI/CD Integration
Compare application authentication methods for secrets retrieval and select the appropriate one for a given environment
Trace the sequence of API calls an application makes to authenticate and retrieve a credential, including error and retry behavior
Explain how application identities are onboarded, scoped to safes, and revoked
Describe how credential providers and SDKs abstract retrieval and where caching introduces risk
Your checkpoint
A sequence diagram plus working pseudocode for an application that authenticates, retrieves a secret, caches it with a defined TTL, and handles rotation without downtime
Secrets Retrieval, Application Credentials Delivery, and CI/CD Integration
Integrate secrets retrieval into a CI/CD pipeline so that no credential is stored in source, pipeline variables, or build logs
Explain how short-lived tokens and dynamic credentials reduce standing privilege compared with static secrets
Identify the failure modes of secrets injection in containerized and serverless workloads
Design a rotation strategy that keeps consumers working while credentials change
Your checkpoint
A pipeline reference design with the secret-injection step, the identity used at each stage, and a list of at least six places credentials commonly leak in CI/CD
Governance, Auditing, and Secrets Remediation
Interpret audit events to reconstruct who or what accessed a credential, when, and from where
Design detection rules for anomalous retrieval patterns such as off-hours access, volume spikes, and new source hosts
Explain how discovery and remediation of unmanaged credentials works and how to prioritize findings
Describe reporting obligations and how to evidence control effectiveness to an auditor
Your checkpoint
An incident reconstruction write-up from a hypothetical audit trail, ending with three detection rules and a prioritized remediation backlog
Secrets Management Fundamentals and Nonhuman Identity Security & Secrets Manager Architecture and Deployment & Vault, Safe, and Policy Administration & Secrets Retrieval, Application Credentials Delivery, and CI/CD Integration & Governance, Auditing, and Secrets Remediation
Consolidate weak areas by re-testing every domain and logging each missed concept with its root cause
Practice explaining architecture, authorization, and retrieval trade-offs aloud within time limits
Verify recall of component names, permission semantics, and retrieval flow steps without notes
Build a personal one-page reference of facts you repeatedly miss
Your checkpoint
A full-length timed practice run with a scored breakdown by domain and a one-page personal fact sheet covering every concept still marked uncertain
Milestones
Week 2: Can explain, without notes, how safes, accounts, and permissions combine to authorize a request, and why the Vault is the root of trust
Week 4: Can draw the full Secrets Manager topology from memory and defend a safe and role design against a least-privilege review
Week 6: Can trace an application's authentication and retrieval sequence end to end and describe how the pipeline avoids storing any static credential
Week 8: Scores at least 80 percent overall on a timed practice run with no domain below 70 percent, and holds a completed personal fact sheet