PAM-DEF study guide · 2026

The 7 PAM-DEF domains, explained

7 areas and 46 objectives. CyberArk does not publish weights for these areas, so each gets equal space here. Each guide explains what the area covers, how it is assessed and where candidates slip.

Start with Domain 1 See all domains
Questions
65 multiple-choice questions (third-party sources; unverified)
Time
90 minutes (third-party sources; unverified)
Passing score
Not published by CyberArk (~70% per third-party sources)
Outline
CyberArk Defender-PAM Certification Study Guide (2023 edition; latest official outline readable for this review)

Exam blueprint

CyberArk does not publish weights, so every area is drawn the same size.

  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  1. 1 Onboard Accounts
  2. 2 Manage the Application
  3. 3 Perform Ongoing Maintenance and Troubleshooting
  4. 4 Configure and Manage Passwords
  5. 5 Manage Security and Audit Functions
  6. 6 Configure Session Management
  7. 7 Configure User Management

All 7 domains

46 official objectives 52–75 hrs suggested study

  1. Domain 01

    Onboard Accounts

    How privileged accounts get into the CyberArk Vault: prioritising what to onboard first, running Windows and UNIX discovery, automatic onboarding rules, the pending accounts list, bulk upload and manual onboarding in the PVWA.

    Inside this domain

    • Prioritize onboarding projects
    • Perform a bulk upload of accounts
    • Create an onboarding rule
    • Onboard an account from the pending accounts list
    • and 3 more objectives

    Watch for Volume over risk

    Objectives
    7
    Questions est.
    ~10
    Study time est.
    8–12 hrs
  2. Domain 02

    Manage the Application

    The application support view of CyberArk PAM: the tools that show component health, how the Vault, PVWA, CPM and PSM talk to each other and to targets, and what the REST API is used for.

    Inside this domain

    • Identify and describe tools used to monitor CyberArk application health
    • Describe how each component communicates with other devices at a high level
    • Identify the purpose of RestAPI

    Watch for Port mix-up

    Objectives
    3
    Questions est.
    ~6
    Study time est.
    4–6 hrs
  3. Domain 03

    Perform Ongoing Maintenance and Troubleshooting

    Day-two support of CyberArk PAM: confirming that the Vault, PVWA, CPM and PSM are working, isolating which one is failing, and knowing when an issue is a support case and when it needs a services engagement.

    Inside this domain

    • Describe how to ensure each component is operational
    • Understand which types of activities are break/fix vs. services engagement

    Watch for Restart everything

    Objectives
    2
    Questions est.
    ~5
    Study time est.
    4–6 hrs
  4. Domain 04

    Configure and Manage Passwords

    The largest Defender-PAM domain by task count: safes and safe membership, platforms, Master Policy workflows such as dual control and one-time passwords, logon and reconcile accounts, service account usages and automatic CPM rotation.

    Inside this domain

    • Configure a request/approval process
    • Configure workflow processes to ensure non-repudiation
    • Configure logon and reconcile accounts
    • Configure and link a service account platform to a target account platform
    • and 12 more objectives

    Watch for Approval for accountability

    Objectives
    16
    Questions est.
    ~20
    Study time est.
    16–22 hrs
  5. Domain 05

    Manage Security and Audit Functions

    The audit side of CyberArk PAM: generating and scoping PVWA reports, the purpose of the Telemetry tool, searching for and reviewing session recordings, and how the CyberArk Blueprint guides a PAM program.

    Inside this domain

    • Generate reports
    • Identify and describe reports within the PVWA
    • Describe the use of safe permissions to limit the scope of reports for specific users
    • Describe the purpose of the CyberArk Telemetry Tool
    • and 4 more objectives

    Watch for Report shows too little

    Objectives
    8
    Questions est.
    ~9
    Study time est.
    6–9 hrs
  6. Domain 06

    Configure Session Management

    Configuring the Privileged Session Manager for isolated, recorded privileged sessions: Master Policy rules, the Connect button, the HTML5 Gateway, connection components, recording safes, live monitoring rights and split workflows.

    Inside this domain

    • Configure a split workflow
    • Configure the Master Policy to enable the PSM
    • Configure the Master Policy to create PSM recordings
    • Configure the Master Policy to enable the connect button
    • and 5 more objectives

    Watch for PSM implies recording

    Objectives
    9
    Questions est.
    ~11
    Study time est.
    10–14 hrs
  7. Domain 07

    Configure User Management

    Managing external users in CyberArk PAM: administering and operating CyberArk Vendor PAM (Remote Access) so third-party vendors get time-limited, isolated access without VPNs, shared passwords or Vault accounts created by hand.

    Inside this domain

    • Administer and Operate CyberArk Vendor PAM (Remote Access)

    Watch for VPN still needed

    Objectives
    1
    Questions est.
    ~4
    Study time est.
    4–6 hrs

Suggested study order

No official weights are published, so follow the outline order, across about 52–75 hrs of study.

  1. 1 Onboard Accounts 8–12 hrs
  2. 2 Manage the Application 4–6 hrs
  3. 3 Perform Ongoing Maintenance and Troubleshooting 4–6 hrs
  4. 4 Configure and Manage Passwords 16–22 hrs
  5. 5 Manage Security and Audit Functions 6–9 hrs
  6. 6 Configure Session Management 10–14 hrs
  7. 7 Configure User Management 4–6 hrs

Try one

Practice questionDomain 1: Onboard Accounts

A team has just finished a Windows discovery. Two hundred local administrator accounts on member servers now appear in the PVWA, and more servers are built every month. What should the administrator do so current and future matching accounts are managed with least effort?

One trap from every domain

The answer that looks right, and the clue that gives it away.

  • Domain 1

    Volume over risk

    Clue Words like 'first' or 'highest priority'.

  • Domain 2

    Port mix-up

    Clue Source is a component, destination is the Vault.

  • Domain 3

    Restart everything

    Clue Only one function is failing.

  • Domain 4

    Approval for accountability

    Clue Words like 'non-repudiation' or 'prove who used'.

  • Domain 5

    Report shows too little

    Clue A user sees only some safes.

  • Domain 6

    PSM implies recording

    Clue Isolated sessions but no recordings.

  • Domain 7

    VPN still needed

    Clue Option bundles VPN with Vendor PAM.

Other Cybersecurity certifications

Study guides for exams that overlap with PAM-DEF.

Practise what you read

PAM-DEF domains: common questions

How many domains are in the PAM-DEF exam?

PAM-DEF has 7 domains with 46 official objectives between them: Onboard Accounts, Manage the Application, Perform Ongoing Maintenance and Troubleshooting, Configure and Manage Passwords, Manage Security and Audit Functions, Configure Session Management and Configure User Management.

What is the PAM-DEF exam format?

Questions: 65 multiple-choice questions (third-party sources; unverified). Time allowed: 90 minutes (third-party sources; unverified). Passing score: Not published by CyberArk (~70% per third-party sources).

How long should I study for PAM-DEF?

Our planning estimate is 52–75 hrs across all domains, split by weight. It is an editorial estimate, not an official figure, so adjust it to your experience and to how you score on practice questions.

Where should I start?

Work through the areas in order, since each builds on the one before. Use the checklist on each page to confirm you can do what it asks before moving on.

Which outline is this guide based on?

This guide follows CyberArk Defender-PAM Certification Study Guide (2023 edition; latest official outline readable for this review), published by CyberArk. It was last reviewed in October 2026.

Domain names, weights and objectives come from CyberArk's official outline (CyberArk Defender-PAM Certification Study Guide (2023 edition; latest official outline readable for this review)). Question counts and study hours are editorial planning estimates, not official figures. Last reviewed October 2026.