PAM-DEF · Domain 7 of 7

PAM-DEF Domain 7: Configure User Management

Managing external users in CyberArk PAM: administering and operating CyberArk Vendor PAM (Remote Access) so third-party vendors get time-limited, isolated access without VPNs, shared passwords or Vault accounts created by hand.

Exam weight estimate
Not published
Official objectives
1
Estimated questions estimate
~4
Suggested study time estimate
4–6 hrs

About 9 min read Reviewed October 2026

Overview

Domain 7 is the shortest domain in the 2023 study guide. It lists a single task: administer and operate CyberArk Vendor PAM (Remote Access). Vendor PAM is CyberArk's SaaS service for giving external vendors and contractors access to internal systems through the PAM environment, earlier known as CyberArk Remote Access and before that as Alero.

The model replaces VPN accounts and shared passwords. Administrators invite vendors, who enrol and authenticate with strong, usually mobile-based, authentication. A connector in the customer network makes outbound connections to the service, and vendor sessions are brokered through the PSM, so they are isolated and recorded like internal sessions. Access is granted for a defined period and to defined targets or safes, and it can be revoked centrally. The guide recommends the Vendor PAM (Remote Access) Administration course. Earlier versions of the Defender guide covered directory integration and internal users here; those ideas still help, but they are not listed tasks in the 2023 edition.

How it's tested

Expect scenario questions about giving an external party access: how they are invited, how they authenticate, how long access lasts and how their sessions are controlled. Options often include traditional methods such as VPN accounts or shared Vault users, which Vendor PAM is designed to replace.

  • Replace legacy vendor access

    A company uses VPN accounts or shared passwords for vendors, and you choose the Vendor PAM capability that removes them.

  • Scope and expiry

    A vendor needs access to specific systems for a fixed period, and you choose how to set targets and the access window.

  • Session control for vendors

    Vendor activity must be monitored, and you identify how Vendor PAM sessions are isolated and recorded.

Reasoning it through

A maintenance vendor needs three days of access to two database servers. Creating a VPN account and a shared Vault user would leave standing access and weak accountability. In Vendor PAM, the administrator invites the vendor's engineer, limits access to the needed targets, and sets the access period to three days. Sessions run through the PSM, so they are isolated and recorded, which meets the requirement.

Objectives 1

Official objectives from the CyberArk outline, in outline order.

7.1 Administer and Operate CyberArk Vendor PAM (Remote Access)Day-to-day administration of external vendor access through CyberArk Vendor PAM.
What it means
This task covers running Vendor PAM: setting up the connection to the PAM environment, inviting and managing vendor users, defining what each vendor can reach and for how long, and overseeing their sessions.
What to understand
Vendor PAM is a SaaS service. A connector installed in the customer network connects outbound to the service and to PSM servers, so no inbound firewall openings or VPN are needed for vendors. Administrators invite vendors, who enrol with strong authentication, often through a mobile app with biometrics. Access is assigned to specific targets or safes and given a start and end time, after which it lapses. Vendor users are provisioned for access without manual Vault user creation. Sessions go through the PSM, so isolation, recording and live monitoring apply. Administrators can review activity, extend or revoke access, and remove vendors when engagements end. Some deployments let a vendor-side manager invite their own staff within limits the customer sets.
How it shows up
Expect scenarios on onboarding a vendor, limiting duration and targets, revoking access, or how vendor sessions are recorded.
Common confusion
Thinking Vendor PAM requires a VPN or shared Vault accounts; it is designed to remove both.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Vendor PAM

    CyberArk SaaS service for secure third-party access to internal systems through PAM.

    Remember
    Formerly called Remote Access and, earlier, Alero.
    Tested as
    The only listed task in this domain.
    Trap
    Treating it as an on-premises Vault component.

  • Vendor invitation

    Administrators invite individual vendor users rather than creating shared accounts.

    Remember
    Each vendor gets an individual identity.
    Tested as
    Onboarding scenarios.
    Trap
    Creating one shared account per vendor company.

  • Strong vendor authentication

    Vendors enrol and authenticate with strong factors, typically a mobile app with biometrics.

    Remember
    No vendor passwords to share or steal.
    Tested as
    Authentication questions.
    Trap
    Assuming vendors log on with Vault passwords.

  • Access window

    Vendor access is granted for a defined period and expires automatically.

    Remember
    Removes standing access.
    Tested as
    Time-limited access scenarios.
    Trap
    Leaving vendor access open-ended.

  • Connector

    Customer-side component that connects outbound to the service and to PSM.

    Remember
    No inbound ports or VPN for vendors.
    Tested as
    Architecture questions.
    Trap
    Opening inbound firewall rules for vendors.

  • PSM for vendor sessions

    Vendor sessions are brokered through the PSM.

    Remember
    Isolation, recording and monitoring apply to vendors.
    Tested as
    Session control for third parties.
    Trap
    Thinking vendor sessions bypass recording.

  • Revocation

    Administrators can remove a vendor's access centrally at any time.

    Remember
    Ends access immediately when an engagement stops.
    Tested as
    Offboarding scenarios.
    Trap
    Waiting for passwords to rotate instead.

  • Directory-based users (background)

    Internal PAM users usually come from a directory such as Active Directory, mapped into Vault roles.

    Remember
    Listed in earlier Defender guides, not as a 2023 task.
    Tested as
    Background for user questions.
    Trap
    Creating local Vault users for every internal person.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Vendor access approaches

ConceptMeaningKey differenceCommon trap
VPN plus shared account Traditional vendor access. Standing access, weak accountability. Assuming MFA on VPN solves sharing.
Vendor PAM SaaS-brokered vendor access through PSM. Individual identity, time-limited, recorded. Thinking it needs a VPN.
Internal Vault user for vendor Manually created PAM user. Manual lifecycle and cleanup. Forgetting to remove it after the contract.

Internal vs vendor users

ConceptMeaningKey differenceCommon trap
Internal users Employees, usually from the corporate directory. Lifecycle follows HR and directory groups. Managing them in Vendor PAM.
Vendor users External third parties invited through Vendor PAM. Lifecycle follows invitations and access windows. Adding them to the corporate directory.

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. VPN still needed

    What candidates pick
    Provide a VPN account alongside Vendor PAM.
    Why it looks right
    VPN is the familiar way in.
    Why it's wrong
    Vendor PAM connects through an outbound connector and the PSM, so vendors do not need VPN access.

    Clue to watch for Option bundles VPN with Vendor PAM.

  2. Shared vendor account

    What candidates pick
    Create one account per vendor company.
    Why it looks right
    It is simpler to manage.
    Why it's wrong
    Shared accounts remove accountability; Vendor PAM invites individual users with their own authentication.

    Clue to watch for 'Prove which engineer performed the change'.

  3. Permanent access

    What candidates pick
    Grant vendor access without expiry for convenience.
    Why it looks right
    Vendors return often.
    Why it's wrong
    Standing access is the risk Vendor PAM removes; access windows limit exposure between visits.

    Clue to watch for 'Only during the maintenance window'.

  4. Inbound firewall rules

    What candidates pick
    Open inbound ports from the vendor network.
    Why it looks right
    Vendors are external, so traffic seems inbound.
    Why it's wrong
    The connector initiates outbound connections, so no inbound openings are required.

    Clue to watch for Architecture question with firewall options.

  5. Unrecorded vendor sessions

    What candidates pick
    Assume vendor sessions need separate recording tools.
    Why it looks right
    The service is SaaS and external.
    Why it's wrong
    Vendor sessions run through the PSM, which records them like internal sessions.

    Clue to watch for 'Audit vendor activity'.

Answer framework

Use these steps for any question about external or vendor access.

  1. Identify whether the user is internal staff or an external vendor, since vendors belong in Vendor PAM. Internal administrators are normally provisioned from the corporate directory instead.
  2. Reject options that rely on VPN accounts, shared credentials or manually created vendor Vault users.
  3. Define the minimum targets or safes the vendor needs and set an access window with a clear end date. Narrow scope limits damage if the vendor's device is compromised.
  4. Confirm the vendor authenticates with their own strong factor and that sessions route through the PSM for recording.
  5. Plan offboarding: revoke access in Vendor PAM when the engagement ends, without waiting for expiry. Review the vendor's session recordings during the engagement, not only afterwards.

Practice question

A company currently gives an outsourced support provider a VPN account and a shared Vault user. Auditors want individual accountability, no VPN, and access limited to agreed support windows. What should the PAM administrator use?

Want more like this? The PAM-DEF practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Because the 2023 study guide lists only one task here, study it deeply rather than broadly. Begin with the CyberArk Vendor PAM documentation overview and the Vendor PAM (Remote Access) Administration course, which the study guide recommends. Note the earlier product names, Remote Access and Alero, because older study material uses them.

Draw the Vendor PAM flow on one page: vendor device, the SaaS service, the outbound connector in the customer network, the PSM and the target. Mark which side starts each connection. This picture answers most architecture questions.

Next, walk through the vendor lifecycle as a list: invitation, enrolment and strong authentication, assignment of targets, access window, sessions through the PSM, review of recordings, and revocation. For each step, write which role performs it and what can go wrong.

Finally, refresh general user management ideas from earlier Defender guides, such as directory integration for internal users, since scenario wording may still mention them. Then practise vendor scenarios that contrast Vendor PAM with VPN and shared account approaches until the right choice is automatic.

FAQ

How much of the PAM-DEF exam is Configure User Management?

CyberArk does not publish weights. Configure User Management lists one official task in the 2023 guide, so we estimate about 4 questions.

What is CyberArk Vendor PAM?

A SaaS service for secure third-party access to internal systems through the PAM environment, earlier called Remote Access and Alero.

Do vendors need a VPN with Vendor PAM?

No. A connector in the customer network connects outbound, and sessions are brokered through the PSM.

Are vendor sessions recorded?

Yes. Vendor sessions go through the PSM, so isolation, recording and monitoring apply as they do for internal users.

Does this domain still cover LDAP integration?

The 2023 guide lists only Vendor PAM here. Earlier guides listed directory integration, which is still useful background knowledge.

How is vendor access ended?

Through the access window expiring or by an administrator revoking the vendor's access in Vendor PAM.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 7 knowledge

Practise Vendor PAM onboarding, access window and revocation questions in short timed sets before a full PAM-DEF mock exam.

Take the PAM-DEF practice test Check your PAM-DEF readiness

Keep going