PAM-DEF · Domain 6 of 7

PAM-DEF Domain 6: Configure Session Management

Configuring the Privileged Session Manager for isolated, recorded privileged sessions: Master Policy rules, the Connect button, the HTML5 Gateway, connection components, recording safes, live monitoring rights and split workflows.

Exam weight estimate
Not published
Official objectives
9
Estimated questions estimate
~11
Suggested study time estimate
10–14 hrs

About 13 min read Reviewed October 2026

Overview

Domain 6 covers the Privileged Session Manager (PSM) from the administrator's side. The study guide lists nine tasks: configure a split workflow; use the Master Policy to enable the PSM, create PSM recordings and enable the Connect button; configure the PSM to use the HTML5 Gateway; identify connection components and their functions; configure a recording safe; describe how to grant access to view recordings or monitor sessions live; and describe the security value of session isolation and session audit.

With the PSM, users click Connect in the PVWA, and the PSM opens the session to the target with the stored credential. The user never sees the password, and the session can be recorded and watched. Master Policy rules decide whether sessions must go through the PSM and whether they are recorded, with platform exceptions. The platform chooses the PSM server and connection components, such as RDP or SSH clients. The HTML5 Gateway allows sessions in a browser without a local RDP client.

How it's tested

Most items describe a desired session behaviour and ask which Master Policy rule, platform setting or safe permission produces it. Others describe a user experience, such as a missing Connect button or a browser-only requirement, and ask for the cause or fix.

  • Policy switch

    A behaviour such as forcing PSM, recording sessions or showing the Connect button is required, and you choose the matching Master Policy rule.

  • Client and gateway

    Users need a particular client experience, such as browser-only access, and you choose the HTML5 Gateway or the right connection component.

  • Who can watch

    A team needs to view recordings or monitor live sessions, and you choose the safe membership and permissions required.

Reasoning it through

Contractors must connect to Windows servers from locked-down laptops that block RDP clients, using only a browser. Changing the connection component to SSH does not help with Windows targets, and showing the password defeats isolation. Configuring the PSM server to use the HTML5 Gateway lets the RDP session render in the browser, so that is the correct choice.

Objectives 9

Official objectives from the CyberArk outline, in outline order.

6.1 Configure a split workflowGive different groups different access paths to the same accounts.
What it means
A split workflow means configuring access so one group follows one workflow and another group follows a different one for the same accounts, such as connect-only through the PSM for most users and password retrieval or approval-free access for a small group.
What to understand
It is built from safe permissions and Master Policy settings. Members with use but not retrieve can connect through the PSM but cannot show or copy the password. Members granted access without confirmation bypass dual control. Exceptions on the platform can also change workflow for specific account types. The result lets operations staff work through isolated sessions while break-glass or senior staff keep a different path.
How it shows up
Expect a requirement where two groups need different access to the same account.
Common confusion
Duplicating the accounts into a second safe when safe permissions can split the workflow.
6.2 Configure the Master Policy to enable the PSMRequire privileged sessions through the PSM.
What it means
The Master Policy rule for privileged session monitoring and isolation makes connections to accounts go through the PSM rather than directly.
What to understand
When this rule is on for a platform, users connect through the PSM, and the credential stays in the PSM session. Exceptions can enable or disable it for specific platforms. The platform must also point to an available PSM server. Combined with removing retrieve permission, this ensures users never see the password.
How it shows up
Questions ask which rule forces PSM use and where exceptions are set.
Common confusion
Thinking PSM use is enabled per user rather than through policy and platform.
6.3 Configure the Master Policy to create PSM recordingsTurn on session recording.
What it means
A separate Master Policy rule controls whether PSM sessions are recorded and saved, so recordings exist only where policy requires them.
What to understand
Recording depends on PSM being used for the session. When the rule applies, the PSM records the session and stores the recording and its metadata in a recording safe. Exceptions can switch recording on or off for specific platforms. Retention of recordings follows the recording safe settings.
How it shows up
Expect a question on why sessions are isolated but no recordings appear.
Common confusion
Assuming enabling PSM automatically records sessions; recording is its own rule.
6.4 Configure the Master Policy to enable the connect buttonAllow transparent connections from the PVWA.
What it means
The Connect button lets a user open a session to a target from the PVWA without seeing the password. It is controlled by the Master Policy rule that allows transparent connections.
What to understand
If the rule is off for a platform, users do not get the Connect option for those accounts. The user also needs the use permission on the safe. Connection components defined on the platform determine which connection options appear. The Connect button is how most users start PSM sessions.
How it shows up
A user who cannot see Connect for an account is a common scenario.
Common confusion
Blaming the PSM server when the Master Policy rule or use permission is missing.
6.5 Configure the PSM to use the HTML5 GatewayBrowser-based sessions without a local client.
What it means
The HTML5 Gateway lets users open PSM sessions inside a web browser tab instead of launching a local RDP client.
What to understand
The gateway is installed as a separate component, and the PSM server configuration in the PVWA is set to use it. Users connect to the gateway over HTTPS, and it relays the session to the PSM. This helps with locked-down devices, contractors and environments where RDP clients or ports are blocked. The PSM still does isolation and recording.
How it shows up
Requirements for browser-only or clientless access point to the HTML5 Gateway.
Common confusion
Thinking the HTML5 Gateway replaces the PSM; it is a front end to it.
6.6 Identify and describe connection components and their functionsThe client definitions the PSM launches.
What it means
Connection components define how the PSM connects to a target: which client or protocol it runs, such as RDP, SSH, a database client or a web browser, and which parameters it uses.
What to understand
Examples include components for RDP, SSH, SQL clients and web applications. They are configured in the PVWA and assigned to platforms, which controls the options users see when connecting. Some components support extra features such as recording keystrokes or restricting what the user can do. Choosing the right component matches the target type.
How it shows up
Expect questions on which component suits a target, or why a connection option is missing.
Common confusion
Confusing connection components with CPM plug-ins; one connects users, the other changes passwords.
6.7 Configure a recording safeDefine where session recordings are stored and kept.
What it means
A recording safe stores PSM session recordings and their metadata. Administrators configure which recording safe sessions use, its retention period and who can access it.
What to understand
Organisations may use separate recording safes for different business units or sensitivity levels, so access to recordings can be scoped. Retention settings decide how long recordings remain. Recordings consume Vault storage, so retention should match policy rather than defaulting to forever. Membership controls who can view them.
How it shows up
Questions cover where recordings go, how long they stay, and how to separate them by audience.
Common confusion
Assuming recordings are stored in the same safe as the account used.
6.8 Describe how to grant access to view recordings or monitor sessions livePermissions for reviewers and monitors.
What it means
Viewing recordings and monitoring live sessions require membership in the relevant safes with suitable permissions. Live monitoring and termination use the live sessions safe, PSMLiveSessions by default.
What to understand
Reviewers need list and view audit style permissions on the recording safe to search and play recordings. Security teams that watch sessions live, and can terminate or suspend them, need membership in the live sessions safe with the related permissions. Keeping these rights limited protects sensitive session content. This ties directly to recording review in Domain 5.
How it shows up
Expect a scenario where a security analyst cannot see live sessions or recordings.
Common confusion
Granting vault administrator rights instead of specific safe membership.
6.9 Describe the security value of session isolation and session auditWhy PSM improves security.
What it means
Session isolation keeps credentials and malware away from end-user machines by brokering the connection through the PSM. Session audit records what happened, supporting accountability and investigation.
What to understand
With isolation, the password never reaches the user's device, so keyloggers and credential theft on that device do not capture it, and the target is not exposed directly to the user's network. Recording and live monitoring deter misuse, provide evidence and allow real-time response. Together they meet many compliance requirements for privileged activity.
How it shows up
Expect a question asking which benefit isolation or audit provides.
Common confusion
Treating recording as preventive; it deters and provides evidence, while isolation prevents exposure.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Privileged Session Manager

    Proxy that opens and controls sessions to targets using vaulted credentials.

    Remember
    The user never receives the password.
    Tested as
    Core of every session question.
    Trap
    Thinking the PSM changes passwords.

  • Monitoring and isolation rule

    Master Policy rule requiring sessions to go through the PSM.

    Remember
    Exceptions are per platform.
    Tested as
    Forcing PSM use.
    Trap
    Looking for it per user.

  • Recording rule

    Master Policy rule to record and save session activity.

    Remember
    Separate from the isolation rule.
    Tested as
    Missing recordings scenarios.
    Trap
    Assuming PSM always records.

  • Transparent connections rule

    Master Policy rule that shows the Connect button.

    Remember
    Also needs use permission on the safe.
    Tested as
    Missing Connect scenarios.
    Trap
    Blaming the PSM server.

  • HTML5 Gateway

    Component that renders PSM sessions in a browser.

    Remember
    Configured on the PSM server settings.
    Tested as
    Clientless access requirements.
    Trap
    Thinking it replaces the PSM.

  • Connection component

    Definition of the client and parameters the PSM launches.

    Remember
    Assigned on the platform.
    Tested as
    Connection option questions.
    Trap
    Confusing with CPM plug-ins.

  • Recording safe

    Safe holding recordings and metadata.

    Remember
    Has its own retention and membership.
    Tested as
    Recording storage and access.
    Trap
    Expecting recordings in the account safe.

  • PSMLiveSessions

    Default safe used for monitoring active sessions.

    Remember
    Membership enables live monitoring and termination.
    Tested as
    Live monitoring access.
    Trap
    Granting vault-wide admin instead.

  • Split workflow

    Different access paths to the same accounts for different groups.

    Remember
    Built from safe permissions and policy exceptions.
    Tested as
    Two-group requirement questions.
    Trap
    Duplicating accounts.

  • Use vs retrieve

    Use allows connecting; retrieve allows showing or copying the password.

    Remember
    Isolation needs use without retrieve.
    Tested as
    Least-privilege session access.
    Trap
    Granting both by default.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Master Policy session rules

ConceptMeaningKey differenceCommon trap
Monitoring and isolation Force sessions through the PSM. Controls the path. Assuming it records.
Record and save session activity Store recordings. Controls evidence. Assuming it forces PSM.
Transparent connections Show the Connect button. Controls the user option. Assuming it isolates sessions.

Session access front ends

ConceptMeaningKey differenceCommon trap
Local RDP client PSM session opened in the user's RDP client. Needs client and port access. Choosing it for locked-down devices.
HTML5 Gateway PSM session in a browser tab. No local client required. Thinking it bypasses recording.
PSM for SSH SSH sessions brokered through a proxy for UNIX targets. Command-line access with audit. Using it for Windows targets.

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. PSM implies recording

    What candidates pick
    Assume sessions are recorded once PSM is required.
    Why it looks right
    Recording is a PSM feature.
    Why it's wrong
    Recording is controlled by its own Master Policy rule and can be off while isolation is on.

    Clue to watch for Isolated sessions but no recordings.

  2. Gateway replaces PSM

    What candidates pick
    Deploy the HTML5 Gateway instead of a PSM.
    Why it looks right
    It also handles sessions.
    Why it's wrong
    The gateway only relays browser sessions to the PSM, which still opens and records them.

    Clue to watch for 'Browser access' plus 'recording required'.

  3. Component confusion

    What candidates pick
    Fix a session issue by changing the CPM plug-in.
    Why it looks right
    Both are platform settings.
    Why it's wrong
    CPM plug-ins change passwords; connection components define how the PSM connects users.

    Clue to watch for Problem is with connecting, not rotating.

  4. Admin for monitoring

    What candidates pick
    Make the SOC team vault administrators.
    Why it looks right
    Admins can see everything.
    Why it's wrong
    Live monitoring needs membership in the live sessions safe, not broad administrative rights.

    Clue to watch for 'Least privilege' or 'monitor only'.

  5. Second safe for split access

    What candidates pick
    Copy the accounts into another safe for a second group.
    Why it looks right
    Separate safes feel cleaner.
    Why it's wrong
    Duplicated accounts drift out of sync; safe permissions and exceptions split workflow on one account.

    Clue to watch for 'Same accounts, different access'.

  6. Recording as prevention

    What candidates pick
    Choose recording to stop credential theft.
    Why it looks right
    Recording sounds protective.
    Why it's wrong
    Recording deters and documents; isolation keeps the credential off the user's device and prevents theft.

    Clue to watch for 'Prevent exposure of the password'.

Answer framework

Use this sequence to resolve session configuration questions quickly.

  1. Name the behaviour wanted: forced isolation, recording, Connect button, browser access, client type or viewer access. Each of these is configured in a different place.
  2. Map policy behaviours to the matching Master Policy rule and check whether a platform exception changes it.
  3. Map client and server behaviours to the platform's PSM server and connection components, or to the HTML5 Gateway. The HTML5 Gateway lets users connect from a browser without a local RDP client.
  4. Map viewer and monitor access to recording safe or live sessions safe membership with minimum permissions.
  5. Confirm users have use but not retrieve where isolation is the goal, and adjust safe permissions for split workflows. Test with a real end-user account before rolling the change out.

Practice question

Security wants all sessions to Linux production servers recorded. The PSM is already required for that platform and users connect successfully, but no recordings appear. What should the administrator configure?

Want more like this? The PAM-DEF practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Learn the three Master Policy session rules as a set and test each one in a lab by turning it on and off for a single platform. Watch what changes: whether sessions go through the PSM, whether recordings appear and whether the Connect button shows. Write a one-line note for each result.

Then look at a platform's session settings. Find where the PSM server is chosen and which connection components are assigned. Remove one component and see the connection option disappear for users. Configure the HTML5 Gateway if your lab has it, or at least read the PSM server settings page that refers to it.

Create a recording safe for one business unit and point a platform's recordings to it. Add a reviewer group with read-only permissions and confirm they can find and play recordings but cannot connect. Add a monitoring group to the live sessions safe and watch a session from another browser.

Finish by building a split workflow: one group with use only, one with use and retrieve, and compare their experience. Explain the security value of each choice in your own words.

FAQ

How much of the PAM-DEF exam is Configure Session Management?

CyberArk publishes no weights. Configure Session Management has nine official tasks, so we estimate about 11 questions.

Does enabling PSM also turn on recording?

No. Recording is a separate Master Policy rule. Sessions can be isolated without being recorded.

Why can a user not see the Connect button?

Usually because the transparent connections rule is off for that platform or the user lacks use permission on the safe.

What does the HTML5 Gateway do?

It lets users run PSM sessions in a browser without a local RDP client. The PSM still isolates and records the session.

Who can monitor live sessions?

Members of the live sessions safe, PSMLiveSessions by default, with suitable permissions. Recording review uses the recording safe.

What is a connection component?

A definition of the client and parameters the PSM launches for a target, such as RDP, SSH or a database client.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 6 knowledge

Practise Master Policy session rules, HTML5 Gateway and recording access questions in short timed sets before a full PAM-DEF mock exam.

Take the PAM-DEF practice test Check your PAM-DEF readiness

Keep going