Overview
Domain 2 targets the application support role named in the study guide. It has three official tasks: identify and describe the tools used to monitor CyberArk application health, describe at a high level how each component communicates with other devices, and identify the purpose of the REST API.
The core architecture is consistent. The Digital Vault stores credentials and audit data. The PVWA is the web interface users and administrators work in. The CPM verifies and changes credentials on target systems. The Privileged Session Manager (PSM) brokers isolated, recorded sessions. Each component authenticates to the Vault with its own component user and connects over CyberArk's Vault protocol, by default TCP 1858. Health is visible in the PVWA System Health view, in Windows services and in component logs. The REST API exposes PVWA functions to scripts and other systems. In Privilege Cloud the Vault and PVWA are delivered as a service, while connector components such as the CPM and PSM run in the customer network.
How it's tested
Questions in this domain test architecture recall. Expect to match a function to a component, a symptom to a monitoring tool, or a connection to its direction and protocol. A few items ask why an organisation would use the REST API instead of the PVWA interface.
-
Who talks to whom
A connection is described and you identify the source, destination or protocol, such as a CPM reaching the Vault or a user reaching the PSM.
-
Where to see health
A component appears down and you choose where to confirm its status, such as System Health in the PVWA or the component's service and logs.
-
API or interface
An automation or integration need is described, and you decide whether the REST API is the right tool.
A firewall change is planned between the CPM server and the Vault. The question asks which flow must stay open. Users never connect to the CPM, and the CPM does not use the PVWA to reach credentials. It authenticates to the Vault directly over the Vault protocol on TCP 1858, so that port from the CPM to the Vault must remain allowed.
Objectives 3
Official objectives from the CyberArk outline, in outline order.
2.1 Identify and describe tools used to monitor CyberArk application healthKnow where component status and errors are visible.
- What it means
- This task is about the places an administrator looks to confirm CyberArk components are running and connected, from the System Health page in the PVWA down to Windows services and component log files.
- What to understand
- System Health in the PVWA lists connected components such as PVWA, CPM, PSM and PSM for SSH, with connection status and last connection time. On the servers, each component runs as a service that can be checked directly. Component logs record detail: the Vault has its own logs, the CPM writes activity and error logs, and PSM and PVWA keep their own. Remote administration tools exist for the Vault, which is hardened and not meant for interactive logon. Monitoring can also be fed to SIEM tools through syslog.
- How it shows up
- A symptom is given and you choose the quickest reliable place to confirm component status.
- Common confusion
- Logging on interactively to the Vault server to check health, which hardening is designed to avoid.
2.2 Describe how each component communicates with other devices at a high levelMap traffic between users, components, the Vault and targets.
- What it means
- Each CyberArk component plays a fixed role in the traffic flow. Users reach the PVWA over HTTPS and the PSM for sessions; components reach the Vault over the Vault protocol; the CPM and PSM reach target systems with the target's own protocols.
- What to understand
- The Vault listens on TCP 1858 by default and components open connections to it, each with its own credential file. The PVWA is a web application that users reach over HTTPS. The CPM connects outward to targets with protocols such as SMB or RPC for Windows and SSH for UNIX. The PSM accepts RDP or browser sessions, fetches credentials from the Vault and opens the connection to the target, so the user never holds the password. In Privilege Cloud, connector servers make outbound connections to the cloud-hosted Vault.
- How it shows up
- Expect firewall or architecture questions naming a source and destination.
- Common confusion
- Assuming the PVWA retrieves passwords for the CPM; each component talks to the Vault itself.
2.3 Identify the purpose of RestAPIUnderstand what the PVWA REST API is used for.
- What it means
- The REST API exposes PVWA functions, such as account, safe, user and platform management, to scripts and external systems over HTTPS, so tasks can be automated or integrated instead of done by hand.
- What to understand
- Typical uses include onboarding accounts from provisioning workflows, creating safes in bulk, pulling report data, and integrating ticketing or orchestration tools. Calls authenticate first and then use a session token, and they run under the permissions of the authenticated user, so safe permissions still apply. The API does not bypass the Vault's access model. Tooling built on it, such as PowerShell modules, is common in support work.
- How it shows up
- A repeated or integration-driven task usually signals the REST API as the answer.
- Common confusion
- Believing API calls run with elevated rights; they inherit the caller's Vault permissions.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Digital Vault
The hardened server that stores credentials, policies and audit data in encrypted form.
- Remember
- Components connect to it; it is not a place for interactive admin work.
- Tested as
- Architecture and security-of-the-Vault questions.
- Trap
- Treating the Vault as a general-purpose server.
-
Vault protocol on TCP 1858
The default port components use to connect to the Vault.
- Remember
- Traffic flows from components to the Vault.
- Tested as
- Firewall and connectivity questions.
- Trap
- Choosing 443 for component-to-Vault traffic.
-
PVWA
The web interface for users and administrators, reached over HTTPS.
- Remember
- It is the front end; it does not rotate passwords itself.
- Tested as
- Function-to-component matching.
- Trap
- Crediting the PVWA with CPM work.
-
CPM
The component that verifies, changes and reconciles credentials on targets.
- Remember
- It reaches targets with their native protocols.
- Tested as
- Rotation and connectivity questions.
- Trap
- Thinking targets connect in to the CPM.
-
PSM
The proxy that opens isolated, recorded sessions for users.
- Remember
- Users connect to the PSM, which connects to the target with the stored credential.
- Tested as
- Session flow questions.
- Trap
- Thinking users receive the password before connecting.
-
System Health
PVWA page showing connected components and their status.
- Remember
- First place to check when a component seems down.
- Tested as
- Monitoring tool identification.
- Trap
- Going straight to log files before checking status.
-
Component users and credential files
Each component authenticates to the Vault with its own user and an encrypted credential file.
- Remember
- A broken credential file stops that component connecting.
- Tested as
- Links to Domain 3 troubleshooting.
- Trap
- Assuming components share one service account.
-
REST API
HTTPS interface exposing PVWA functions for automation.
- Remember
- Calls are limited by the caller's permissions.
- Tested as
- Automation and integration scenarios.
- Trap
- Thinking the API bypasses safe permissions.
-
Privilege Cloud connectors
Customer-hosted servers running CPM and PSM that connect out to the CyberArk-hosted Vault.
- Remember
- Defender tasks apply to both deployment models.
- Tested as
- Deployment-model awareness.
- Trap
- Assuming Privilege Cloud has no customer-side components.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Core components
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Vault | Secure storage of credentials and audit. | Everything else connects to it. | Using it for interactive administration. |
| PVWA | Web portal for users and admins. | Front end over HTTPS. | Expecting it to change passwords on targets. |
| CPM | Credential verification and rotation. | Acts on targets on a schedule or on request. | Expecting it to host user sessions. |
| PSM | Session isolation and recording. | Brokers the user's connection. | Expecting it to rotate passwords. |
Ways to check health
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| System Health page | Status overview in the PVWA. | Fast, all components in one view. | Not reading the last connection time. |
| Services on the server | Windows service state for each component. | Confirms the process is running. | Assuming running means connected. |
| Component logs | Detailed activity and error records. | Shows why something failed. | Reading logs before confirming which component is affected. |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Port mix-up
- What candidates pick
- Choose 443 for CPM-to-Vault traffic.
- Why it looks right
- HTTPS is the familiar secure port.
- Why it's wrong
- Components use the Vault protocol, by default TCP 1858, to reach the Vault; HTTPS is how users reach the PVWA.
Clue to watch for Source is a component, destination is the Vault.
-
PVWA does everything
- What candidates pick
- Say the PVWA changed the password.
- Why it looks right
- Users trigger changes from the PVWA.
- Why it's wrong
- The PVWA flags the request; the CPM performs the change on the target.
Clue to watch for 'Which component changes the password'.
-
Interactive Vault checks
- What candidates pick
- Log on to the Vault server to inspect health.
- Why it looks right
- It feels like direct evidence.
- Why it's wrong
- The Vault is hardened for minimal access; System Health and remote tools are the expected route.
Clue to watch for Option mentions RDP to the Vault.
-
API privilege escalation
- What candidates pick
- Use the REST API to reach accounts the user cannot see.
- Why it looks right
- Automation tools seem powerful.
- Why it's wrong
- The API enforces the same Vault and safe permissions as the PVWA.
Clue to watch for Scenario with a restricted user and a script.
-
Direction of connections
- What candidates pick
- Open a rule from the Vault to the CPM.
- Why it looks right
- The Vault holds the data, so it seems to push it.
- Why it's wrong
- Components initiate connections to the Vault, so the flow is component to Vault.
Clue to watch for Firewall rule questions.
Answer framework
Apply this sequence to architecture and monitoring questions in this domain.
- Name the component the scenario is really about: Vault, PVWA, CPM, PSM or PSM for SSH.
- Recall that component's job, and reject options that give it another component's job.
- Trace the connection direction and protocol, remembering that components connect to the Vault on TCP 1858. PVWA, CPM and PSM all act as Vault clients, so a blocked port stops every one of them at once.
- For status questions, start with System Health in the PVWA, then the service, then the component log. The log usually names the step that failed.
- For automation or integration needs, choose the REST API and remember it runs with the caller's permissions. A script that calls the API cannot do more than the user or application identity it authenticates as.
Practice question
Want more like this? The PAM-DEF practice test has questions for every domain.
Checklist
0 of 10
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Draw the architecture yourself. On one page, place users, the PVWA, the Vault, the CPM, the PSM, PSM for SSH and two target systems, then draw every connection with its direction and protocol. Redraw it from memory until it is quick, because most questions in this domain reduce to that picture.
In a lab, open System Health and learn what a connected and a disconnected component look like. Stop the CPM service briefly and watch the status change, then start it again. Locate the main log files for the CPM and PSM and read a few entries, so log names in an answer option look familiar.
For the REST API, read the CyberArk documentation overview of the API, then make a logon call and a simple list-accounts call with a tool such as Postman or PowerShell. Try the same call with a user who lacks safe access and note the result. That one exercise answers most API questions.
If you support Privilege Cloud, repeat the drawing with the Vault and PVWA in the cloud and the connector servers on site.
FAQ
How much of the PAM-DEF exam is Manage the Application?
CyberArk does not publish weights. Manage the Application has three official tasks, and we estimate around 6 questions, but treat that as a planning figure.
Which port should I remember for the Vault?
TCP 1858 is the default port for component connections to the Vault. Users reach the PVWA over HTTPS.
Does the PVWA store passwords?
No. Credentials live in the Vault. The PVWA is the web interface that reads from and writes to the Vault on the user's behalf.
Do I need to write REST API code for the exam?
No. Know what the API is for, how it authenticates and that it respects user permissions.
Is architecture different in Privilege Cloud?
The Vault and PVWA are hosted by CyberArk, while connector components run in your network. The study guide says Defender tasks apply to both models.
What is the first check when a component seems down?
System Health in the PVWA, which shows each connected component and its last connection time.
Other Cybersecurity certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
- CompTIA Cybersecurity Analyst+ Study guide
- Microsoft Security Operations Analyst Associate Study guide
- Certified Ethical Hacker Study guide
- Penetration Tester Study guide
- Systems Security Certified Practitioner Study guide
- Certified in Risk and Information Systems Control Study guide
- CompTIA PenTest+ Study guide
- CompTIA SecurityX (CASP+) Study guide
- Azure Security Engineer Associate Study guide
- CISM (Certified Information Security Manager) Study guide
- CISSP Study guide
- CompTIA Security+ Study guide
- Certified Information Systems Auditor Study guide
- Certified Cloud Security Professional Study guide
Test your Domain 2 knowledge
Practise component, port and health-tool questions in short timed sets before attempting a full PAM-DEF mock exam.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the PAM-DEF AI tutor Get any concept explained your way