PAM-DEF · Domain 1 of 7

PAM-DEF Domain 1: Onboard Accounts

How privileged accounts get into the CyberArk Vault: prioritising what to onboard first, running Windows and UNIX discovery, automatic onboarding rules, the pending accounts list, bulk upload and manual onboarding in the PVWA.

Exam weight estimate
Not published
Official objectives
7
Estimated questions estimate
~10
Suggested study time estimate
8–12 hrs

About 14 min read Reviewed October 2026

Overview

Domain 1 covers the content administrator's first job: getting privileged accounts under management. The official study guide lists seven tasks. You need to prioritise onboarding work by risk, bulk-upload accounts from a file, create automatic onboarding rules, onboard accounts that discovery has placed in the pending accounts list, set up UNIX and Windows discovery, and add a single account by hand in the Privileged Vault Web Access (PVWA).

Every onboarding path ends in the same place: an account object stored in a safe and assigned to a platform, so the Central Policy Manager (CPM) can verify and rotate it. The exam therefore tests the choices made along the way, such as which safe, which platform, and which method fits the number and type of accounts. CyberArk states that these tasks apply to both PAM Self-Hosted and Privilege Cloud. This page uses the 2023 study guide, the latest official outline available for review; CyberArk publishes no domain weights.

How it's tested

Domain 1 items usually present an onboarding situation and ask which method, screen or setting to use. Some ask what must exist before onboarding succeeds, such as a safe, an active platform or a discovery account. Read the scale and the account type in the stem before looking at the options.

  • Pick the onboarding method

    A number of accounts and a source are described, and you choose between manual add, bulk upload, an onboarding rule or the pending accounts list.

  • Discovery prerequisites

    A Windows or UNIX discovery returns nothing, and you identify the missing credential, network access or scope setting.

  • What to onboard first

    Several account groups are listed and you pick the highest-risk group to bring under management first.

Reasoning it through

A discovery has found 400 local administrator accounts on Windows servers, and new servers appear weekly. Manual onboarding is too slow, and a one-time bulk upload misses future servers. An automatic onboarding rule that matches local administrator accounts on Windows servers and assigns a safe and platform onboards current and future matches, so it is the best answer.

Objectives 7

Official objectives from the CyberArk outline, in outline order.

1.1 Prioritize onboarding projectsDecide which privileged accounts to bring under management first.
What it means
Onboarding is done in phases. Prioritising means ranking account groups by the damage their misuse could cause and starting with the most powerful ones, such as domain administrators, built-in local administrator accounts and root.
What to understand
The CyberArk Blueprint frames early work around blunt-force risk reduction: take control of the credentials attackers most want, then expand. Domain-level accounts outrank single-server accounts. Accounts used by many people or shared across systems rank high because rotation removes the most exposure. Service accounts matter, but onboarding them without mapping their usages can break applications, so they are usually planned carefully rather than rushed.
How it shows up
Expect a ranking question that lists account types and asks which group should be onboarded first.
Common confusion
Choosing the largest group of accounts first instead of the most privileged one.
1.2 Perform a bulk upload of accountsLoad many known accounts at once from a file.
What it means
Bulk upload adds a list of accounts from a prepared file in a single operation through the PVWA, instead of creating each one by hand.
What to understand
The file supplies the properties onboarding needs, such as address, username, safe, platform and, where known, the current password. Target safes and platforms must exist and be active before the upload, or those rows fail. Bulk upload suits a one-time import from an existing inventory. It does not watch for new accounts, which is what discovery and onboarding rules are for. Upload results should be reviewed for failed rows.
How it shows up
Questions ask which method fits a spreadsheet of known accounts, or why some rows were not onboarded.
Common confusion
Expecting bulk upload to pick up accounts created after the import.
1.3 Create an onboarding ruleAutomate onboarding of discovered accounts that match defined criteria.
What it means
An automatic onboarding rule tells the system to onboard newly discovered accounts that match filters, placing each one in a chosen safe with a chosen platform, without someone clicking through the pending list.
What to understand
Rules filter on attributes such as machine type, account type, username or group membership, so a rule can target, for example, local administrator accounts on Windows servers. Each rule names a target safe and platform, and the CPM can then rotate the password according to policy. Accounts that match no rule stay in the pending list for review. Narrow filters avoid onboarding accounts nobody should manage.
How it shows up
A recurring flow of similar accounts from discovery usually points to an onboarding rule.
Common confusion
Thinking a rule runs discovery; rules act on discovery results, they do not scan.
1.4 Onboard an account from the pending accounts listReview and onboard accounts that discovery found.
What it means
The pending accounts list holds privileged accounts that discovery or other sources found but that are not yet managed. An administrator reviews entries and onboards selected accounts to a safe and platform.
What to understand
Pending entries show details such as the machine, the account and whether it is privileged. Onboarding from the list fills in most account properties from what discovery found, and the administrator chooses safe and platform. Entries can also be deleted when they should never be managed. This is the manual review path for discovery output, sitting between full automation with rules and adding accounts from scratch.
How it shows up
Expect a scenario where discovery has run and an administrator must decide where the found accounts appear.
Common confusion
Assuming discovered accounts are managed immediately; without a matching rule they wait in pending.
1.5 Setup a UNIX discoveryConfigure discovery of accounts on Linux and UNIX machines.
What it means
A UNIX discovery connects to listed Linux or UNIX machines over SSH, reads local account information, and reports privileged accounts and, optionally, SSH keys back to the pending list.
What to understand
You provide the target machines, for example by address range or a file, and a discovery account that can log on over SSH with enough rights to read account data. Discovery identifies privileged users such as root and members of administrative groups. Network reachability on SSH and correct credentials are the usual failure points. Found SSH keys can then be onboarded so the CPM manages them as well.
How it shows up
Questions focus on what the UNIX discovery needs to connect and what it returns.
Common confusion
Using a Windows domain account for UNIX discovery; it needs credentials valid on the UNIX targets.
1.6 Setup a Windows discoveryConfigure discovery of accounts across a Windows domain.
What it means
A Windows discovery scans machines in an Active Directory domain to find privileged domain and local accounts and, optionally, the dependencies where accounts are used, such as Windows services and scheduled tasks.
What to understand
You give the domain and scope, such as the organisational units to scan, plus a discovery account with rights to query the directory and the scanned machines. Results go to the pending list or are picked up by onboarding rules. Dependency discovery matters because it shows where a service account's password is used, which informs safe usage configuration so rotation does not break services.
How it shows up
Expect questions on scope settings, required permissions, or why dependencies were found or missed.
Common confusion
Forgetting dependencies, then rotating a service account without updating the services that use it.
1.7 Manually onboard an accountAdd a single account through the PVWA.
What it means
Manual onboarding is adding one account through the Add Account flow in the PVWA, choosing the system type, platform and safe, and entering the address, username and password.
What to understand
This suits one-off accounts and testing a new platform before scaling. The user needs safe permissions that allow adding accounts to that safe. The platform's required properties must be filled in, or the CPM cannot manage the account. After saving, a verify or change can confirm the details. Manual onboarding is the slowest method, so questions about many accounts point elsewhere.
How it shows up
A single new account, often for a test or exception, is the manual onboarding scenario.
Common confusion
Picking manual onboarding for large numbers of accounts because it seems safest.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Account object

    An account in the Vault is a stored credential plus properties, held in a safe and linked to a platform.

    Remember
    Safe decides who can access it; platform decides how it is managed.
    Tested as
    Underpins every onboarding question.
    Trap
    Treating the platform as the access control layer.

  • Pending accounts list

    A holding area in the PVWA for discovered privileged accounts awaiting a decision.

    Remember
    Entries are not rotated or protected until onboarded.
    Tested as
    Appears whenever discovery output is described.
    Trap
    Assuming pending means managed.

  • Automatic onboarding rule

    A filter-based rule that onboards matching discovered accounts into a set safe and platform.

    Remember
    Rules act on discovery results; they do not perform scans.
    Tested as
    Best answer for recurring, similar accounts.
    Trap
    Choosing bulk upload for a stream of new accounts.

  • Accounts discovery

    Scans of Windows domains or UNIX hosts that report privileged accounts back to the PVWA.

    Remember
    Each scan needs a discovery account with access to the targets.
    Tested as
    Prerequisite and troubleshooting questions.
    Trap
    Ignoring network access to targets when discovery finds nothing.

  • Dependency discovery

    Windows discovery can find where accounts are used, such as services, scheduled tasks and IIS application pools.

    Remember
    Usages must be linked before rotation so dependent services keep working.
    Tested as
    Ties onboarding to service account management in Domain 4.
    Trap
    Rotating a service account without its usages.

  • Bulk upload

    Importing many accounts from a prepared file in one operation.

    Remember
    Safes and platforms named in the file must already exist and be active.
    Tested as
    Large known inventories.
    Trap
    Expecting it to catch accounts created later.

  • Onboarding priority

    Start with the most privileged and widely shared credentials, such as domain admins, local admin and root.

    Remember
    Risk, not volume, sets the order.
    Tested as
    Ranking questions.
    Trap
    Starting with the largest account group.

  • Required platform properties

    Each platform defines mandatory account properties, such as address and username.

    Remember
    Missing properties stop the CPM from managing the account.
    Tested as
    Why an onboarded account fails verification.
    Trap
    Blaming the safe when the platform data is incomplete.

  • SSH key onboarding

    UNIX discovery can find SSH keys, which can then be stored and managed like passwords.

    Remember
    Unmanaged keys are standing access that rotation can remove.
    Tested as
    UNIX discovery scope questions.
    Trap
    Thinking discovery only finds passwords.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Onboarding methods

ConceptMeaningKey differenceCommon trap
Manual add One account entered in the PVWA. Slowest, most controlled. Using it for hundreds of accounts.
Bulk upload Many known accounts from a file. One-time import of an existing list. Expecting it to repeat automatically.
Pending accounts list Review and onboard discovered accounts. Human decision per discovered entry. Thinking entries are already protected.
Onboarding rule Automatic onboarding of discovered matches. Ongoing, no per-account clicks. Writing filters so broad they catch unwanted accounts.

Windows vs UNIX discovery

ConceptMeaningKey differenceCommon trap
Windows discovery Scans an Active Directory domain and its machines. Can also find service and task dependencies. Running it without directory query rights.
UNIX discovery Connects to hosts over SSH. Can also find SSH keys. Using credentials that are not valid on the hosts.

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Volume over risk

    What candidates pick
    Onboard the largest group of accounts first.
    Why it looks right
    It looks like the fastest coverage gain.
    Why it's wrong
    Priority follows privilege and blast radius, so domain admins and root come before thousands of low-risk accounts.

    Clue to watch for Words like 'first' or 'highest priority'.

  2. Discovery equals protection

    What candidates pick
    Assume discovered accounts are being rotated.
    Why it looks right
    The PVWA shows them, so they seem to be managed.
    Why it's wrong
    Pending entries are not stored in a safe or tied to a platform, so no rotation, recording or auditing applies yet.

    Clue to watch for Accounts 'appear in the PVWA' after a scan.

  3. Rule as scanner

    What candidates pick
    Create an onboarding rule to find accounts on new servers.
    Why it looks right
    Rules sound like automation that does everything.
    Why it's wrong
    Rules only act on accounts that discovery has already found; a scan must still run.

    Clue to watch for No mention of discovery being configured.

  4. Bulk upload for continuous feeds

    What candidates pick
    Schedule repeated bulk uploads for new servers.
    Why it looks right
    Bulk upload already handles many accounts.
    Why it's wrong
    A discovery plus onboarding rule handles newly created accounts without preparing new files each time.

    Clue to watch for 'New servers are added every week'.

  5. Wrong discovery credential

    What candidates pick
    Reuse a domain account for UNIX discovery.
    Why it looks right
    It already works for Windows discovery.
    Why it's wrong
    UNIX discovery logs on to hosts over SSH, so it needs credentials those hosts accept.

    Clue to watch for A UNIX scan returns no results or logon errors.

Answer framework

Use these steps to pick the right onboarding approach for any account scenario.

  1. Identify how many accounts are involved and whether new ones will keep appearing over time. A handful of known accounts calls for a different approach than a fleet of servers that grows every month.
  2. Rank the account types by privilege and exposure, and start with domain-level, built-in administrator and root accounts.
  3. Confirm the target safe exists with the right members and that an active platform matches the system type.
  4. Pick the method: manual for one account, bulk upload for a known list, discovery with rules or pending review for ongoing finds.
  5. After onboarding, check that the CPM can verify each account and map service account usages before any rotation. Rotate only after dependencies are confirmed.

Practice question

A team has just finished a Windows discovery. Two hundred local administrator accounts on member servers now appear in the PVWA, and more servers are built every month. What should the administrator do so current and future matching accounts are managed with least effort?

Want more like this? The PAM-DEF practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Work in a lab where possible, because Domain 1 questions describe screens and outcomes you will recognise after doing the tasks once. CyberArk's PAM Administration and Privilege Cloud Administration courses both include onboarding labs, and the study guide recommends them.

Start by adding two accounts manually: a Windows local administrator and a Linux root account. Note each required field and confirm the CPM can verify them. Then prepare a small bulk upload file with five accounts, deliberately naming one safe that does not exist, and review how the failure is reported.

Next configure a Windows discovery against a test domain, including dependency discovery, and a UNIX discovery against one Linux host. Look at the pending accounts list, onboard a few entries by hand and delete one. Finally create an onboarding rule that captures local administrator accounts and rerun discovery to watch it work.

Finish by writing a short priority list for a fictional company, ordering domain admins, local admins, root, service accounts and application accounts, with one line of reasoning for each. That exercise covers the prioritisation objective.

FAQ

How much of the PAM-DEF exam is Onboard Accounts?

CyberArk does not publish weights for the Onboard Accounts domain. It has seven of the 46 official tasks, so we estimate roughly 10 of about 65 questions; treat that as a planning figure only.

Do onboarding tasks differ between PAM Self-Hosted and Privilege Cloud?

The study guide states that all Defender tasks are universal to both deployment models. Screens may differ slightly, but the concepts of discovery, pending accounts and rules are the same.

Is there an Installation domain on the Defender-PAM exam?

Not in the 2023 study guide. Installing components belongs to the Sentry-level exam. Defender focuses on day-to-day administration and support.

Do I need to know the bulk upload file format?

Know what information the file must carry and what must exist beforehand. Memorising every column name is less useful than knowing why rows fail.

Can discovery find SSH keys?

Yes. UNIX discovery can report SSH keys, which can then be onboarded so the CPM manages them.

Why are service accounts handled carefully during onboarding?

Their passwords are stored in services, tasks or application pools. If the CPM rotates the password without updating those usages, the dependent service fails to start.

Can I take the Defender-PAM exam online?

Pearson VUE states that from 1 November 2025 all CyberArk certification exams are delivered in person only, so plan for a test centre.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 1 knowledge

Practise choosing onboarding methods, discovery settings and priorities in short timed sets before a full PAM-DEF mock exam.

Take the PAM-DEF practice test Check your PAM-DEF readiness

Keep going