PAM-DEF · Domain 4 of 7

PAM-DEF Domain 4: Configure and Manage Passwords

The largest Defender-PAM domain by task count: safes and safe membership, platforms, Master Policy workflows such as dual control and one-time passwords, logon and reconcile accounts, service account usages and automatic CPM rotation.

Exam weight estimate
Not published
Official objectives
16
Estimated questions estimate
~20
Suggested study time estimate
16–22 hrs

About 19 min read Reviewed October 2026

Overview

Domain 4 holds 16 of the 46 tasks in the study guide, more than any other domain. It covers the content administrator's core configuration work. Safes are containers that control who can see and use accounts, so you must know how to provision a safe, follow a naming convention, add users and groups according to access policy, and set data retention and CPM assignment. Platforms define how the CPM manages a type of system, so you must use out-of-the-box platforms, duplicate them, and import custom ones from the CyberArk Marketplace.

Workflows come from the Master Policy and its exceptions: request and approval (dual control), exclusive access and one-time passwords for non-repudiation, and controls that reduce credential theft. You also configure logon and reconcile accounts, link service account usages to their parent account, decide when loosely connected devices apply, and set automatic verification, change and reconciliation of passwords and SSH keys. Finally, you should be able to explain why managing credentials improves security.

How it's tested

Questions combine a business requirement with a configuration location. You may be told that every password retrieval needs a manager's approval, or that a Linux root account cannot log on over SSH, and asked which setting, account type or permission solves it. Locate the setting before judging the options.

  • Where is it configured

    A requirement such as approvals, one-time use or retention is described, and you choose Master Policy, platform, or safe as the place to set it.

  • Which supporting account

    A rotation fails because of logon restrictions or an out-of-sync password, and you choose a logon account or reconcile account as the fix.

  • Safe permission fit

    A group needs a specific level of access, and you choose the safe permissions that grant it without granting more.

Reasoning it through

Policy forbids direct root logon over SSH, so the CPM cannot change the root password with root's own credentials. A reconcile account is used when the stored password is out of sync, not for every logon. A logon account lets the CPM connect as an allowed user and then switch to root to perform the change, so linking a logon account is correct.

Objectives 16

Official objectives from the CyberArk outline, in outline order.

4.1 Configure a request/approval processSet up dual control so access needs approval.
What it means
A request/approval process, called dual control, makes users submit a request that one or more authorised approvers must confirm before the account can be used or retrieved.
What to understand
Dual control is switched on through the Master Policy rule that requires password access approval, with exceptions per platform where needed. Approvers are safe members with the permission to authorise account requests. The safe also sets how many approvers are needed. Requests can carry a reason and a time frame. Members can be exempted through the safe permission that allows access without confirmation, which supports different paths for different groups.
How it shows up
Expect questions on which settings turn on approval, who can approve and how many approvals are needed.
Common confusion
Thinking approvers are defined in the Master Policy; they come from safe membership and permissions.
4.2 Configure workflow processes to ensure non-repudiationMake each use of a shared credential attributable to one person.
What it means
Non-repudiation means a user cannot credibly deny having used a credential, because only that user could have held it at that time.
What to understand
Exclusive access (check-in and check-out) locks an account to one user until it is released. One-time password access makes the CPM change the password after it has been used, so a retrieved password cannot be reused by someone else later. Together with mandatory reasons and audit records in the Vault, these settings tie each use to a named person. They are Master Policy rules with possible platform exceptions.
How it shows up
A requirement to prove who used a shared account points to exclusive access and one-time passwords.
Common confusion
Choosing dual control alone; approval proves authorisation, not exclusive use.
4.3 Configure logon and reconcile accountsSupporting accounts that help the CPM manage restricted or out-of-sync accounts.
What it means
A logon account is an account the CPM uses to connect to a target when the managed account cannot log on directly. A reconcile account is a privileged account the CPM uses to reset a managed password that is out of sync with the Vault.
What to understand
Logon accounts are common on UNIX, where root logon over SSH is often disabled: the CPM logs on as the logon account and then elevates to change root. Reconcile accounts, such as a domain account with reset rights, fix passwords changed outside CyberArk. Both are linked to the managed account, and the platform controls whether reconcile happens automatically when verification finds a mismatch. Both supporting accounts should themselves be managed.
How it shows up
Rotation or verification failure scenarios ask which supporting account solves the problem.
Common confusion
Swapping the two: logon helps the CPM connect; reconcile resets a password nobody knows.
4.4 Configure and link a service account platform to a target account platformManage the places a service account's password is used.
What it means
When a service account's password changes, every place it is stored, such as Windows services, scheduled tasks or IIS application pools, must be updated. These places are called usages and have their own platforms.
What to understand
Usages are linked to the parent target account, and when the CPM changes the parent password it updates each linked usage, often restarting the service. Usage platforms are configured and activated like other platforms, then associated with the parent account platform. Windows discovery can find usages automatically. Without linked usages, rotation leaves services with the old password and they fail at next start.
How it shows up
A service failing after rotation is the classic sign that usages were not linked.
Common confusion
Creating separate managed accounts for each service instead of linking usages to one parent.
4.5 Configure workflow processes to reduce the risk of credential theftControls that limit exposure of privileged passwords.
What it means
These are workflow settings that keep passwords out of users' hands or limit how long a stolen password stays valid.
What to understand
Options include requiring sessions through the PSM so users connect without seeing the password, one-time password access so retrieved passwords are changed after use, short change intervals, exclusive access, and requiring a reason for access. Removing the retrieve permission while granting use lets people connect but not view or copy credentials. The aim is that a captured credential is either never exposed or quickly useless.
How it shows up
Expect a requirement to stop users from copying or reusing passwords, with several plausible controls offered.
Common confusion
Picking longer passwords; complexity does not stop theft or reuse of an exposed credential.
4.6 Configure Safe Data Retention, Time of Use Restrictions, and CPM assignmentSafe-level settings for history, access timing and which CPM manages accounts.
What it means
Safe settings control how long previous password versions and activity are retained, whether access is limited to certain times, and which CPM manages the accounts in the safe.
What to understand
Retention is set per safe, either by number of versions or number of days, which affects how far back old passwords and records can be recovered. Time of use restrictions limit when members can access accounts. Each safe is assigned to one CPM, which manages all accounts in it; a safe with no CPM assigned gets no automatic rotation. Larger deployments spread safes across CPMs by location or load.
How it shows up
Questions ask why accounts in a new safe never rotate, or how long old passwords are kept.
Common confusion
Assuming CPM assignment is set on each account rather than on the safe.
4.7 Identify cases where Loosely Connected Devices would be appropriateManaging accounts on endpoints that are not always reachable.
What it means
Loosely connected devices are endpoints, typically laptops and remote workstations, that are not reliably reachable from the CPM over the network. CyberArk can manage their local privileged accounts through an endpoint agent instead.
What to understand
Normal CPM rotation needs the CPM to reach the target. For devices that roam off the corporate network or sleep for long periods, that fails repeatedly. The loosely connected device approach lets the agent on the device carry out credential management when it can contact the service, so local administrator passwords are still rotated. It suits mobile endpoints, not servers that should be reachable.
How it shows up
A scenario with laptops that are often offline is the cue for loosely connected devices.
Common confusion
Choosing it for data-centre servers that are always reachable by the CPM.
4.8 Manage the password of a supported usageRotate passwords stored in services, tasks, application pools and similar usages.
What it means
Supported usages are locations where a credential is embedded, such as Windows services, scheduled tasks, IIS application pools, COM+ applications, configuration files and registry values. CyberArk can update them when the parent password changes.
What to understand
Each usage type has a platform that tells the CPM how to update it. The usage is linked to its parent account and inherits change events. Administrators can check the status of each usage in the PVWA and see which ones failed. Configuration file usages need the file path and the setting to replace.
How it shows up
Expect questions on which usage type covers a described embedded credential.
Common confusion
Thinking the CPM updates usages that were never linked to the parent account.
4.9 Describe the process to provision a safeCreate a safe with the right owners, members and settings.
What it means
Provisioning a safe means creating it with a compliant name, description and settings, assigning a CPM and retention, and adding members with the permissions their roles require.
What to understand
Safe creation needs a user with the vault-level authorisation to add safes. Typical membership includes the administrators group, the CPM and PSM component users added automatically, the users or groups who will use accounts, approvers, and auditors with read-only audit permissions. Safes are usually designed around who needs access, not around single servers. Requests to create safes often come through a process or the REST API.
How it shows up
Questions test the order of provisioning and which members a new safe needs.
Common confusion
Adding end users with full permissions because it is quicker than defining roles.
4.10 Identify and describe safe naming conventionsConsistent, compliant safe names.
What it means
A safe naming convention encodes useful information, such as business unit, platform type, environment or region, into a consistent pattern, within the Vault's naming rules.
What to understand
Safe names have a length limit and cannot contain certain special characters, so conventions must be short and use permitted characters. Good conventions make it obvious who owns the safe and what it holds, support automation and reporting, and avoid personal names. Consistency matters more than the exact pattern chosen.
How it shows up
Expect a question picking the most appropriate name or the rule a name breaks.
Common confusion
Including server names or individual users in safe names, which does not scale.
4.11 Duplicate a platformCreate a modified copy of an existing platform.
What it means
Duplicating a platform copies its settings into a new platform that can be changed without affecting the original, for example to apply a different password policy or change interval to a subset of accounts.
What to understand
Platform Management in the PVWA offers duplication. After copying, you rename the platform, adjust settings such as password complexity, change frequency or session settings, and activate it. Accounts are then assigned to the new platform. Duplicating keeps the original platform stable for other accounts and is the normal way to create variations.
How it shows up
A need for different rules for some accounts of the same system type points to duplication.
Common confusion
Editing the shared platform, which changes behaviour for every account using it.
4.12 Add a User/Group to a safe in accordance with access control policiesGrant safe permissions that match each role.
What it means
Adding a member to a safe means choosing a user or group, usually from the directory, and assigning the specific safe permissions their role needs under the organisation's access control policy.
What to understand
Permissions are granular: listing accounts, using accounts (connect), retrieving accounts (show or copy), adding or updating accounts, managing safe members, authorising requests, viewing audit logs, and more. A connect-only user gets use and list but not retrieve. Auditors get list and view audit. Groups from the directory are preferred over individual users for easier maintenance. Member expiry dates can limit temporary access.
How it shows up
Questions ask which permissions give exactly the access described.
Common confusion
Granting retrieve when only connect is needed, which exposes the password.
4.13 Use an Out-of-the-Box platform to manage a deviceManage common systems with the platforms CyberArk ships.
What it means
Out-of-the-box platforms are the platforms provided with the product for common systems, such as Windows domain and local accounts, UNIX via SSH, databases and network devices.
What to understand
Many shipped platforms are inactive by default and must be activated before accounts can use them. Once active, the platform supplies the CPM plug-in, required properties and default policies. For most standard systems an out-of-the-box platform is the right first choice; duplicate it if you need different settings.
How it shows up
Expect questions on why a platform is not offered when adding an account, or which one fits a system.
Common confusion
Forgetting that inactive platforms do not appear for selection.
4.14 Import a custom platform from the MarketplaceAdd platforms for systems not covered out of the box.
What it means
The CyberArk Marketplace offers platform packages, contributed by CyberArk and partners, for additional systems and applications. They are imported into the PVWA as packages.
What to understand
An administrator downloads the platform package and imports it through Platform Management in the PVWA. The imported platform then appears alongside shipped ones and may need activation and settings review. Marketplace content lets you support new devices without writing a plug-in yourself; building a new plug-in is services-level work.
How it shows up
A device type with no shipped platform is the cue for the Marketplace.
Common confusion
Assuming every system needs custom plug-in development.
4.15 Setup automatic verification, change, and reconciliation of passwords or SSH keysConfigure the CPM to manage credentials on a schedule.
What it means
Automatic management means the CPM verifies stored credentials, changes them at set intervals and reconciles them when they drift, for both passwords and SSH keys.
What to understand
Master Policy rules set the required change and verification periods, with platform exceptions where needed. Platform settings define how changes run and whether automatic reconciliation happens when verification fails. A reconcile account must be linked for reconciliation to work. SSH keys can be rotated so new key pairs replace old ones on targets. The safe must be assigned to a CPM for any of this to happen.
How it shows up
Expect questions on which settings produce automatic rotation and why reconciliation did not happen.
Common confusion
Expecting reconciliation without a linked reconcile account.
4.16 Describe the security value of managing credentialsWhy vaulting and rotating credentials reduces risk.
What it means
Managing credentials means storing them securely, controlling access, rotating them and auditing their use. Each part removes a common route attackers use.
What to understand
Rotation shortens the life of stolen or leaked passwords and removes knowledge held by former staff. Unique passwords stop one compromise from spreading to many systems. Access control and approvals limit who can obtain credentials. Audit trails tie actions to people, supporting investigations and compliance. Removing hard-coded and shared passwords cuts lateral movement.
How it shows up
Expect a question asking which benefit a specific control provides.
Common confusion
Treating vaulting alone as enough; without rotation, a stolen password stays valid.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Master Policy

    Central rules for privileged access workflows, password management and session controls.

    Remember
    Exceptions are set per platform, not per account.
    Tested as
    Locating workflow settings.
    Trap
    Looking for dual control on the account object.

  • Dual control

    Access requires approval by authorised safe members.

    Remember
    Number of approvers is a safe setting.
    Tested as
    Approval workflow questions.
    Trap
    Thinking approvers are named in the Master Policy.

  • Exclusive access

    Only one user can hold an account at a time until it is released.

    Remember
    Supports non-repudiation.
    Tested as
    Shared account accountability.
    Trap
    Confusing it with dual control.

  • One-time password

    The password is changed after use, so a retrieved value cannot be reused.

    Remember
    Change happens after release and a minimum validity period.
    Tested as
    Credential theft and accountability questions.
    Trap
    Assuming it changes the password immediately at retrieval.

  • Logon account

    An account the CPM uses to connect when the managed account cannot log on directly.

    Remember
    Common for root with SSH logon disabled.
    Tested as
    Rotation failure scenarios.
    Trap
    Using a reconcile account for this.

  • Reconcile account

    A privileged account the CPM uses to reset an out-of-sync password.

    Remember
    Must be linked for automatic reconciliation.
    Tested as
    Verification failure scenarios.
    Trap
    Expecting reconcile without linking one.

  • Usages

    Places where a credential is embedded, updated when the parent account changes.

    Remember
    Must be linked to the parent account.
    Tested as
    Service account rotation.
    Trap
    Rotating service accounts without usages.

  • Platform

    Defines how a type of account is managed, including CPM plug-in and policies.

    Remember
    Duplicate rather than edit shared platforms.
    Tested as
    Platform management questions.
    Trap
    Editing a platform used by unrelated accounts.

  • CPM assignment

    Each safe is managed by one assigned CPM.

    Remember
    No assigned CPM means no automatic rotation.
    Tested as
    Why accounts never rotate.
    Trap
    Setting it per account.

  • Safe permissions

    Granular rights such as list, use, retrieve, authorise and view audit.

    Remember
    Use without retrieve allows connecting without seeing the password.
    Tested as
    Least-privilege membership questions.
    Trap
    Granting retrieve for connect-only users.

  • Loosely connected devices

    Endpoints managed through an agent because the CPM cannot reach them reliably.

    Remember
    Meant for laptops and roaming endpoints.
    Tested as
    Scenario cue: often offline devices.
    Trap
    Applying it to always-reachable servers.

  • CyberArk Marketplace

    Source of downloadable platform packages for extra systems.

    Remember
    Imported through Platform Management.
    Tested as
    Unsupported device scenarios.
    Trap
    Assuming custom development is needed.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Logon vs reconcile accounts

ConceptMeaningKey differenceCommon trap
Logon account Used by the CPM to connect to the target. Solves direct logon restrictions. Expecting it to fix unknown passwords.
Reconcile account Used by the CPM to reset an out-of-sync password. Solves drift after outside changes. Expecting it to solve SSH logon bans.

Workflow controls

ConceptMeaningKey differenceCommon trap
Dual control Approval before use. Proves authorisation. Thinking it proves who used the password.
Exclusive access One user at a time. Proves sole possession during use. Confusing it with approval.
One-time password Change after use. Makes a retrieved password useless later. Assuming it blocks retrieval.
PSM-only access Connect without seeing the password. Removes exposure entirely. Leaving retrieve permission granted.

Where settings live

ConceptMeaningKey differenceCommon trap
Master Policy Organisation-wide workflow and rotation rules. Exceptions per platform. Looking for it per safe.
Platform Technical management settings for an account type. Shared by all accounts of that platform. Editing it for one account's needs.
Safe Membership, approver count, retention and CPM. Controls who and which CPM. Expecting it to define change intervals.

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Approval for accountability

    What candidates pick
    Use dual control to prove who used a shared account.
    Why it looks right
    Approvals create records.
    Why it's wrong
    Approval shows someone was authorised; exclusive access and one-time passwords show who actually held the credential.

    Clue to watch for Words like 'non-repudiation' or 'prove who used'.

  2. Reconcile for logon bans

    What candidates pick
    Link a reconcile account because root cannot log on.
    Why it looks right
    Reconcile accounts are powerful.
    Why it's wrong
    The problem is connecting, so a logon account is needed; reconcile only resets passwords that are out of sync.

    Clue to watch for 'Direct logon is not permitted'.

  3. Edit the shipped platform

    What candidates pick
    Change the Windows platform's interval for a few accounts.
    Why it looks right
    It is quick and visible.
    Why it's wrong
    Every account on that platform changes; duplicating keeps other accounts unaffected.

    Clue to watch for Requirement applies to a subset of accounts.

  4. Account-level CPM

    What candidates pick
    Look for the CPM setting on the account.
    Why it looks right
    Accounts are what get rotated.
    Why it's wrong
    CPM assignment is a safe setting, so all accounts in the safe share it.

    Clue to watch for 'Accounts in the new safe never rotate'.

  5. Complexity as theft control

    What candidates pick
    Increase password length to stop theft.
    Why it looks right
    Stronger passwords sound safer.
    Why it's wrong
    Theft and reuse are reduced by isolation, one-time passwords and rotation, not by complexity.

    Clue to watch for 'Prevent users from reusing a copied password'.

  6. Usages forgotten

    What candidates pick
    Rotate the service account and restart services by hand.
    Why it looks right
    It seems simplest.
    Why it's wrong
    Linked usages let the CPM update and restart dependents automatically, avoiding outages.

    Clue to watch for 'Service failed after the password changed'.

Answer framework

Use these steps to place a password requirement in the right configuration location.

  1. Classify the requirement as who can access (safe), how access works (Master Policy) or how the system is managed (platform).
  2. For workflow needs, choose the Master Policy rule and decide whether any platform needs an exception. Dual control, one-time password access and exclusive access are typical Master Policy settings.
  3. For access needs, pick the minimum safe permissions, and use groups from the directory rather than individual users.
  4. For management needs, start with an out-of-the-box or Marketplace platform and duplicate it for variations. Password complexity rules, plug-in settings and connection components are all defined at platform level.
  5. Check supporting pieces: CPM assigned to the safe, logon or reconcile accounts linked, and usages attached to service accounts.

Practice question

Several administrators share a privileged Windows account. Auditors require proof of which administrator used it each time and want any retrieved password to be useless after the session. Which Master Policy settings meet both requirements?

Want more like this? The PAM-DEF practice test has questions for every domain.

Checklist

0 of 14

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Give this domain the most time, because it holds 16 of the 46 official tasks and its settings appear in other domains too. Organise study around three configuration locations: the Master Policy, platforms and safes. For each task in the study guide, write down which location it lives in.

In a lab, create a safe using a naming convention, assign a CPM and set retention. Add a directory group with connect-only permissions and an auditors group with list and view audit. Turn on dual control and set one approver, then request access as a user and approve it as another.

Next, enforce exclusive access and one-time passwords through the Master Policy and watch the CPM change the password after release. Configure a Linux account with SSH logon for root disabled and fix it with a logon account. Change a Windows password outside CyberArk, then fix it with a reconcile account and automatic reconciliation.

Duplicate a Windows platform, change its interval and move one account to it. Import one Marketplace package. Finally, link a Windows service usage to a domain account and rotate it, confirming the service restarts cleanly.

FAQ

How much of the PAM-DEF exam is Configure and Manage Passwords?

CyberArk does not publish weights, but Configure and Manage Passwords has 16 of 46 official tasks, the most of any domain. We estimate around 20 of about 65 questions.

Where is dual control turned on?

In the Master Policy, with platform exceptions possible. The safe defines approvers through permissions and sets how many approvals are needed.

What is the difference between a logon account and a reconcile account?

A logon account helps the CPM connect when the managed account cannot log on directly. A reconcile account resets a password that is out of sync.

Why duplicate a platform instead of editing it?

Editing changes behaviour for every account on that platform. A duplicate lets you apply different settings to a subset of accounts.

Are platforms active by default?

Many shipped platforms are inactive and must be activated before accounts can be assigned to them.

Can the CPM manage SSH keys?

Yes. The study guide includes automatic verification, change and reconciliation of passwords or SSH keys.

What are loosely connected devices for?

Endpoints such as laptops that are not reliably reachable by the CPM, managed through an agent on the device.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 4 knowledge

Practise Master Policy, safe permission and platform questions in short timed sets before a full PAM-DEF mock exam.

Take the PAM-DEF practice test Check your PAM-DEF readiness

Keep going