PAM-DEF Domain 5: Manage Security and Audit Functions (Not published)

Overview

Domain 5 covers how a PAM program proves it is working and how it plans its next steps. The study guide lists eight tasks: generate reports, identify and describe the reports in the PVWA, describe how safe permissions limit the scope of reports for specific users, describe the purpose of the CyberArk Telemetry tool, search for a recording, review a recording, describe the CyberArk Blueprint, and know how to find out more about the Blueprint.

Reports in the PVWA cover areas such as the privileged account inventory, compliance status of accounts, user entitlements and activity. Their content is limited to safes the requesting user is allowed to see, which is how auditors for one business unit see only their own data. Session recordings created by the PSM are stored in safes and can be searched by user, account, target or time, then played back. The Blueprint is CyberArk's prescriptive framework for building an identity security program in risk-ordered stages.

Why it matters on the exam

Auditors, risk teams and regulators judge a PAM program by its evidence. Defender administrators are the people who produce that evidence: inventory and compliance reports that show which accounts are managed and rotated, entitlement reports that show who can reach what, and session recordings that show exactly what happened during a privileged session. Getting report scoping wrong either hides data an auditor needs or exposes data they should not see. The Blueprint objective connects daily administration to program strategy, which helps when recommending what to onboard or enforce next. Exam questions in this domain are usually short and specific, so knowing the report names, the permissions behind them and the recording search options pays off directly.

How it's tested

Questions ask which report answers a stated audit need, why a user sees fewer results than expected, how to locate a specific session recording, or what the Blueprint recommends doing first. Match the audit question to the report or tool before reading the options in detail.

Which report

An audit request is described, such as listing unmanaged accounts or user access rights, and you select the PVWA report that provides it.
Scope by permission

A user's report or search shows limited results, and you explain or fix it through safe membership and permissions.
Find the session

An incident needs a recording, and you choose search criteria or permissions needed to locate and play it.

Reasoning it through

A regional auditor runs an inventory report and sees only accounts from two safes, although the company has fifty. The report is working correctly. PVWA reports include only safes where the requesting user has the necessary permissions. If the auditor's role covers the whole company, add the auditor group to the other safes with read-only audit permissions rather than granting a vault-wide administrator role.

Objectives 8

Official objectives from the CyberArk outline, in outline order.

5.1 Generate reportsRun reports from the PVWA.

What it means: Generating a report means choosing a report type in the PVWA, setting filters, running it and retrieving the output for audit or operational use.
What to understand: Reports are requested from the Reports area of the PVWA, and output is available to download when it completes. Filters narrow results, for example to specific safes or time ranges. Reports can be generated on demand or scheduled where supported. The person generating the report needs permission to run reports and to see the safes involved.
How it shows up: Expect questions on the steps to produce a report and why it returns limited data.
Common confusion: Expecting a report to include safes the requester cannot see.

5.2 Identify and describe reports within the PVWAKnow what each standard report shows.

What it means: The PVWA ships standard reports that cover account inventory, compliance with password policy, user entitlements, application inventory and activity history.
What to understand: The privileged accounts inventory lists managed accounts and their properties. The compliance status report shows whether accounts meet policy, such as being changed within the required period. The entitlements report shows which users and groups have which permissions on which safes. Activity reports show who did what and when. Application inventory covers application identities used with credential providers. Choose the report by the question being asked.
How it shows up: Expect a requirement phrased as an audit question and options naming different reports.
Common confusion: Using an activity report to answer a question about who has access, which is an entitlements question.

5.3 Describe the use of safe permissions to limit the scope of reports for specific usersReport content follows safe access.

What it means: Report output is filtered by the requesting user's safe membership and permissions, so each user sees data only for safes they are entitled to see.
What to understand: Auditors are typically added to safes with list and view audit permissions but no use or retrieve rights. Scoping auditors by business unit means adding them only to that unit's safes. Granting broad vault-level authorisations widens what they see, which should be deliberate. This is the same least-privilege model used for account access in Domain 4.
How it shows up: Expect a scoping scenario where a user sees too much or too little in reports.
Common confusion: Granting retrieve permission to auditors so reports show data; view audit and list are enough.

5.4 Describe the purpose of the CyberArk Telemetry ToolCollect usage data about the PAM deployment.

What it means: The Telemetry tool collects information about how the CyberArk deployment is used, such as counts of accounts, users and components, and shares it to support adoption and licence insight.
What to understand: Telemetry gives the organisation and CyberArk a view of deployment size and usage trends, which helps with licence tracking, adoption reviews and planning. It reports usage metrics, not credential values. Knowing its purpose is the requirement; detailed configuration is outside the Defender scope.
How it shows up: Expect a question asking what the Telemetry tool is for, with distractors about auditing sessions or rotating passwords.
Common confusion: Thinking telemetry sends passwords or recordings to CyberArk.

5.5 Search for a recordingLocate PSM session recordings.

What it means: Searching for a recording means finding a specific privileged session in the PVWA monitoring area using criteria such as user, target, account, time or keywords.
What to understand: PSM stores recordings and their metadata in recording safes. The PVWA lets authorised users filter recordings by session attributes, and indexed activity such as commands or window titles can help narrow results. Users see only recordings in safes they have rights on. Recordings exist only when the Master Policy requires recording for that platform.
How it shows up: Incident scenarios ask how to find the session where a change happened.
Common confusion: Searching CPM logs for session activity, which the CPM never records.

5.6 Review a recordingPlay back and analyse a session.

What it means: Reviewing a recording means playing the session back in the PVWA, using the recorded activity list to jump to relevant moments and determine what happened.
What to understand: Playback shows the visual session for RDP-style connections and command activity for SSH sessions. Activity lists let a reviewer skip to specific commands or windows instead of watching the full session. Reviewers need appropriate permissions on the recording safe. Findings support incident response and compliance evidence.
How it shows up: Expect questions on how to locate a moment in a long recording or who may review it.
Common confusion: Assuming any PVWA user can play any recording.

5.7 Describe the CyberArk BlueprintCyberArk's staged framework for an identity security program.

What it means: The CyberArk Blueprint for Identity Security Success is a prescriptive framework that sequences security controls by risk, helping organisations decide what to protect first and what to do next.
What to understand: It is built around stopping the attack chain: preventing credential theft, stopping lateral and vertical movement, and limiting privilege escalation and abuse. It organises work into stages, starting with high-value, high-risk credentials such as domain administrators, and progresses toward broader coverage and least privilege. It is vendor guidance for planning, not a product feature.
How it shows up: Questions ask what the Blueprint recommends prioritising or what it is used for.
Common confusion: Thinking the Blueprint is a configuration wizard inside the PVWA.

5.8 Understand how to find out more about the CyberArk BlueprintWhere Blueprint material is published.

What it means: This task is about knowing that Blueprint guidance, toolkits and assessments are published by CyberArk online and through its community and training resources.
What to understand: CyberArk publishes Blueprint material on its website and in the Blueprint toolkit, including guidance documents and planning tools, and covers it in training and the Technical Community. Customers can also work with CyberArk teams to map their program to Blueprint stages. Knowing where to look is enough for the exam.
How it shows up: Expect an item asking where a team should go to learn more about Blueprint stages.
Common confusion: Expecting Blueprint documentation inside the product help for a component.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

Privileged accounts inventory

Report listing managed accounts and their properties.

Remember
Answers 'what do we manage'.

Tested as
Report selection questions.

Trap
Using it to show who has access.
Compliance status report

Shows whether accounts meet policy, such as change and verification periods.

Remember
Answers 'are we following policy'.

Tested as
Audit readiness questions.

Trap
Confusing it with the inventory.
Entitlements report

Shows which users and groups hold which safe permissions.

Remember
Answers 'who can reach what'.

Tested as
Access review questions.

Trap
Using activity logs for access reviews.
Activity reports

Show actions performed, by whom and when.

Remember
Answers 'what happened'.

Tested as
Investigation questions.

Trap
Using them for access reviews.
Report scoping

Report content is limited to safes the requester can see.

Remember
Fix scope through safe membership.

Tested as
Too little or too much data scenarios.

Trap
Granting broad admin rights to auditors.
View audit permission

Safe permission allowing a member to see activity on the safe.

Remember
Core auditor permission with list.

Tested as
Least-privilege auditor setup.

Trap
Adding retrieve for auditors.
Recording safes

Safes that store PSM recordings and metadata.

Remember
Access to recordings follows recording safe permissions.

Tested as
Recording access questions.

Trap
Assuming recordings are in the account's safe.
Recording search

PVWA filter by user, account, target, time and recorded activity.

Remember
Recordings exist only if policy requires them.

Tested as
Incident investigation.

Trap
Searching CPM logs instead.
Telemetry tool

Collects deployment usage metrics for adoption and licence insight.

Remember
Does not collect credentials.

Tested as
Purpose identification.

Trap
Confusing it with SIEM integration.
CyberArk Blueprint

Risk-prioritised framework for identity security programs.

Remember
Starts with the highest-risk credentials.

Tested as
Prioritisation and program planning.

Trap
Treating it as a product module.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Choosing a report

Concept	Meaning	Key difference	Common trap
Inventory	What accounts are managed.	Lists accounts and properties.	Using it for policy compliance.
Compliance status	Whether accounts meet policy.	Shows overdue changes or failures.	Using it to list access rights.
Entitlements	Who has which permissions.	Access review evidence.	Using activity logs instead.
Activity	What actions occurred.	Timeline of events.	Using it for current access state.

Audit evidence sources

Concept	Meaning	Key difference	Common trap
PVWA reports	Structured lists from Vault data.	Good for periodic audits.	Expecting session content.
Session recordings	Visual or command record of a session.	Shows exactly what was done.	Expecting them without a recording policy.
Telemetry	Usage metrics for the deployment.	Supports adoption and licence views.	Treating it as audit evidence of actions.

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

Report shows too little

What candidates pick
Conclude the report is broken.

Why it looks right
Results look incomplete.

Why it's wrong
Reports include only safes the requester can see, so the result is expected until membership changes.

Clue to watch for A user sees only some safes.
Auditor over-permissioned

What candidates pick
Grant auditors retrieve to complete reports.

Why it looks right
More permission seems to fix missing data.

Why it's wrong
Auditors need list and view audit; retrieve lets them see passwords, breaking least privilege.

Clue to watch for 'Read-only audit access'.
Wrong report type

What candidates pick
Use activity reports for an access review.

Why it looks right
Activity mentions users and safes.

Why it's wrong
Access reviews need current permissions, which the entitlements report provides.

Clue to watch for 'Who has access to'.
Telemetry as SIEM

What candidates pick
Use the Telemetry tool to send audit events to a SIEM.

Why it looks right
Both sound like data export.

Why it's wrong
Telemetry reports usage metrics; audit events go to SIEM through syslog integration.

Clue to watch for Option mixes telemetry with security monitoring.
Blueprint as feature

What candidates pick
Enable the Blueprint in the PVWA.

Why it looks right
It has a product-like name.

Why it's wrong
The Blueprint is published guidance for planning a program, not a switch in the product.

Clue to watch for Option says 'enable' or 'configure' Blueprint.

Answer framework

Use these steps when an audit or evidence question appears.

Restate the audit question as what accounts exist, whether policy is met, who has access or what happened.
Map it to inventory, compliance status, entitlements or activity reports, or to a session recording. The Privileged Accounts Inventory and Activities Log reports answer most stems that ask for evidence.
Check the requester's safe membership, since reports and recordings follow safe permissions. A requester who lacks access to a safe will not see its accounts in the output.
For recordings, confirm the Master Policy required recording, then search by user, target, account or time. Without that rule, no recording exists to find.
For program planning or prioritisation questions, apply the Blueprint's risk order starting with the most powerful credentials.

Practice question

An internal audit team needs to confirm, for a quarterly review, which users and groups hold permissions on the finance safes. They must not be able to see any passwords. What should the administrator do?

Add the audit group to the finance safes with retrieve permission and run the inventory report Give the audit group vault administrator rights and run an activity report Add the audit group to the finance safes with list and view audit permissions and run the entitlements report Export the Telemetry tool output for the finance safes

Show the answer

Answer C. The entitlements report shows which users and groups hold which permissions, which is the access review the auditors need. List and view audit membership scopes the report to the finance safes without exposing passwords. Retrieve would let auditors see credentials, vault administrator rights are far too broad, activity reports show events rather than current access, and telemetry reports usage metrics.

Want more like this? The PAM-DEF practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Start by running each standard report in a lab as two different users: an administrator and an auditor who belongs to only one safe. Compare the outputs side by side. This single exercise teaches both the report catalogue and the scoping objective, which together cover most of this domain.

Write a short table that maps typical audit questions to reports: 'which accounts are overdue for rotation', 'who can access production databases', 'what did this user do last night'. Practise until the mapping is instant.

Next, make sure the Master Policy requires recording for one platform, open a few PSM sessions and run commands. Search for those recordings using different criteria and play them back, using the activity list to jump to specific commands. Then try as a user without recording safe access.

For the Telemetry tool, read the CyberArk documentation page that describes its purpose; one clear sentence is enough. For the Blueprint, read CyberArk's Blueprint overview, note the attack-chain goals and the idea of staged rollout, and remember where the toolkit is published.

FAQ

How much of the PAM-DEF exam is Manage Security and Audit Functions?

CyberArk does not publish weights. Manage Security and Audit Functions has eight official tasks, so we estimate about 9 questions.

Why does a user see only part of a report?

Reports include only safes where the requesting user has the necessary permissions. Adjust safe membership if the scope is wrong.

What permissions should auditors have?

Typically list accounts and view audit on the safes they review, without use or retrieve rights.

Where are session recordings stored?

In recording safes in the Vault, written by the PSM. Access follows the recording safe's permissions.

What is the CyberArk Blueprint?

A framework from CyberArk that sequences identity security controls by risk, starting with the most powerful credentials.

Is the Telemetry tool a security monitoring feature?

No. It collects deployment usage metrics, such as counts of accounts and components, for adoption and licence insight.

Related domains

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

PAM-DEF Domain 5: Manage Security and Audit Functions

Overview

How it's tested

Which report

Scope by permission

Find the session

Objectives 8

High-yield concepts

Privileged accounts inventory

Compliance status report

Entitlements report

Activity reports

Report scoping

View audit permission

Recording safes

Recording search

Telemetry tool

CyberArk Blueprint

Side by side

Choosing a report

Audit evidence sources

Exam traps

Report shows too little

Auditor over-permissioned

Wrong report type

Telemetry as SIEM

Blueprint as feature

Answer framework

Practice question

Checklist

Study strategy

FAQ

Other Cybersecurity certifications

Test your Domain 5 knowledge

Keep going