PAM-DEF · Domain 3 of 7

PAM-DEF Domain 3: Perform Ongoing Maintenance and Troubleshooting

Day-two support of CyberArk PAM: confirming that the Vault, PVWA, CPM and PSM are working, isolating which one is failing, and knowing when an issue is a support case and when it needs a services engagement.

Exam weight estimate
Not published
Official objectives
2
Estimated questions estimate
~5
Suggested study time estimate
4–6 hrs

About 10 min read Reviewed October 2026

Overview

Domain 3 is the troubleshooting domain. The study guide gives it two tasks: describe how to ensure each component is operational, and understand which types of activities are break/fix versus a services engagement. The first task asks for a practical health routine. For each component you should know what working looks like: the Vault service running and reachable, the PVWA logon page loading and authenticating, the CPM connected and processing changes without errors, and the PSM accepting connections and producing recordings.

You should also know the common failure points, such as an expired or out-of-sync component credential file, a stopped service, a full disk, a blocked port or a target that rejects the CPM's logon. The second task is about scope. Break/fix work restores something that used to work, and usually goes through CyberArk Technical Support. New design, upgrades, architecture changes and custom development are services work, delivered by CyberArk or partner professional services.

How it's tested

Expect symptom-based questions: something stopped working, and you choose the check that isolates the cause or the next step. Others describe a request and ask whether it is a support case or a services engagement. Eliminate options that change configuration before the cause is confirmed.

  • Isolate the component

    A symptom affects one function, such as recordings or password changes, and you identify which component to check first.

  • Likely cause

    A component cannot reach the Vault after maintenance, and you choose the probable cause, such as a credential file or firewall change.

  • Support or services

    A request is described and you decide whether it is break/fix for Technical Support or work for a services engagement.

Reasoning it through

After a server rebuild, the PSM service starts but no sessions can launch and System Health shows it disconnected. Targets and the PVWA are fine. Because the PSM authenticates to the Vault with its own credential file, a rebuilt or changed host often leaves that file out of sync. Checking and regenerating the PSM credential file fits better than reconfiguring platforms or restarting the Vault.

Objectives 2

Official objectives from the CyberArk outline, in outline order.

3.1 Describe how to ensure each component is operationalA health routine for Vault, PVWA, CPM, PSM and PSM for SSH.
What it means
This task means knowing, for each component, how to confirm it is running, connected to the Vault and doing its job, and where to look first when it is not.
What to understand
For the Vault, confirm the service is up and that components can connect on the Vault port. For the PVWA, confirm the site loads and users can authenticate. For the CPM, confirm it is connected in System Health and that recent verify and change jobs succeeded, using its activity and error logs. For the PSM, confirm it is connected, sessions launch and recordings reach the recording safe. Common causes include stopped services, credential files that no longer match the component user, expired certificates, disk space, blocked ports and changed target credentials.
How it shows up
Scenarios give one failing function and ask which component check or log isolates the cause.
Common confusion
Restarting every component or the Vault before identifying which one is actually failing.
3.2 Understand which types of activities are break/fix vs. services engagementTell support cases apart from project work.
What it means
Break/fix covers restoring existing, previously working functionality. A services engagement covers new capability, design changes, upgrades and custom work that need planning and specialist effort.
What to understand
Examples of break/fix: a CPM that stopped changing passwords, a PSM that cannot connect, an error after a patch. These go to CyberArk Technical Support with logs and details. Examples of services work: designing a new safe model, deploying additional components, a major upgrade or migration such as moving to Privilege Cloud, or developing a custom platform plug-in. These go to CyberArk or partner professional services. Mixing the two delays outcomes.
How it shows up
A described request must be classified, usually with options naming Technical Support or professional services.
Common confusion
Treating a version upgrade or new component deployment as a support case.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Health baseline

    Knowing what normal looks like for each component before an incident.

    Remember
    You cannot spot abnormal status without a known good state.
    Tested as
    Operational check questions.
    Trap
    Checking only whether services are running.

  • Component credential file

    Encrypted file holding a component's Vault logon details.

    Remember
    If it no longer matches the component user, the component cannot connect.
    Tested as
    Common cause after rebuilds or password resets.
    Trap
    Blaming network first for a clean authentication failure.

  • CPM error logs

    Logs recording failed verify, change and reconcile actions with reasons.

    Remember
    They separate target-side failures from CPM-side ones.
    Tested as
    Password change troubleshooting.
    Trap
    Assuming a failed change is always a CPM fault.

  • PSM connectivity

    The PSM must reach the Vault, accept user connections and reach targets.

    Remember
    Three separate links can each fail.
    Tested as
    Session failure scenarios.
    Trap
    Assuming a working PVWA proves the PSM is healthy.

  • Disk space and recordings

    Session recordings and logs consume storage on component servers and the Vault.

    Remember
    Full disks stop services or recordings.
    Tested as
    Sudden failure after long stable periods.
    Trap
    Ignoring capacity as a cause.

  • Break/fix

    Restoring functionality that previously worked.

    Remember
    Handled through Technical Support with logs.
    Tested as
    Classification questions.
    Trap
    Including upgrades or redesigns.

  • Services engagement

    Planned work that adds or changes capability.

    Remember
    Delivered by CyberArk or partner professional services.
    Tested as
    Classification questions.
    Trap
    Opening a support case for a design change.

  • Change correlation

    Linking a failure to the most recent change, such as patches, rebuilds or firewall edits.

    Remember
    Recent change is the strongest clue in most scenarios.
    Tested as
    Likely-cause questions.
    Trap
    Ignoring the timing details in the stem.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Break/fix vs services engagement

ConceptMeaningKey differenceCommon trap
Component stops connecting Existing function broken. Break/fix through Technical Support. Calling it a project.
New safe model design Changing how the program is structured. Services engagement. Expecting Support to design it.
Major upgrade or migration Planned change of version or platform. Services engagement. Treating it as routine support.
Custom platform plug-in New integration development. Services engagement. Assuming Support writes custom code.

Where each failure shows

ConceptMeaningKey differenceCommon trap
CPM failure Passwords stop changing or verifying. CPM logs and System Health. Looking at PSM recordings.
PSM failure Sessions do not launch or record. PSM logs and recording safe. Checking CPM logs instead.
PVWA failure Users cannot log on to the portal. Web server and PVWA logs. Assuming the Vault is down.

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Restart everything

    What candidates pick
    Restart the Vault to fix a CPM problem.
    Why it looks right
    Restarts often fix things.
    Why it's wrong
    The Vault serves every component; restarting it causes a wider outage without fixing a CPM-specific cause.

    Clue to watch for Only one function is failing.

  2. Network first

    What candidates pick
    Blame the firewall for an authentication failure.
    Why it looks right
    Connectivity is a common cause.
    Why it's wrong
    An explicit authentication error with a reachable Vault points to the component credential, not the network.

    Clue to watch for Error mentions authentication or credentials.

  3. Upgrade as support

    What candidates pick
    Open a Technical Support case to perform a version upgrade.
    Why it looks right
    Support knows the product.
    Why it's wrong
    Upgrades are planned changes, which fall under a services engagement rather than restoring broken functionality.

    Clue to watch for Words like 'plan', 'design', 'upgrade', 'deploy'.

  4. Target vs CPM

    What candidates pick
    Assume the CPM is broken when one platform's changes fail.
    Why it looks right
    The CPM performs the change.
    Why it's wrong
    If other platforms rotate fine, the cause is likely target-side, such as a changed password or blocked protocol.

    Clue to watch for Failures limited to one platform or system.

  5. Service running equals healthy

    What candidates pick
    Mark a component healthy because its service is running.
    Why it looks right
    Running status looks green.
    Why it's wrong
    A running service can still fail to authenticate to the Vault or reach targets.

    Clue to watch for System Health shows disconnected.

Answer framework

Use this order to work through troubleshooting and scope questions.

  1. Name the failing function and map it to its component: rotation to CPM, sessions to PSM, portal to PVWA. Session failures limited to one platform usually point to its connection component settings.
  2. Check status in System Health and on the component server before changing any configuration. A stopped service or a disconnected component explains many symptoms without deeper digging.
  3. Look for the most recent change, such as a rebuild, patch, password reset or firewall edit.
  4. Read the component log for the specific error, separating target-side causes from component-side causes. A wrong target password or a locked account is a target-side cause, while a broken credential file on the CPM is component-side.
  5. Decide scope: restoring previous behaviour is break/fix for Support; new capability or upgrades need a services engagement.

Practice question

An organisation wants to add a second data centre with new PSM servers and redesign its safe structure for a merger. Which approach fits this request?

Want more like this? The PAM-DEF practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

This domain rewards hands-on breakage. In a lab, cause and fix a few controlled failures: stop the CPM service, block the Vault port from the PSM with a local firewall rule, and change a target account's password outside CyberArk so verification fails. Each time, note what System Health shows, which log records the error, and what fixed it.

Build a one-page table with a row per component and columns for what it does, how to check it is running, where its logs are, and its most common failure causes. Review this table alongside the Domain 2 architecture drawing, since troubleshooting is the architecture applied under pressure.

For the break/fix objective, write ten short requests on cards, such as 'CPM stopped after Windows patching', 'migrate to Privilege Cloud' or 'build a plug-in for a network device', and sort them into support and services piles. Check your sorting against the definitions in the study guide.

Read CyberArk's knowledge base articles on common CPM and PSM errors to recognise the wording that appears in exam options.

FAQ

How much of the PAM-DEF exam is Perform Ongoing Maintenance and Troubleshooting?

CyberArk does not publish domain weights. Perform Ongoing Maintenance and Troubleshooting has two official tasks, so we estimate about 5 questions, though scenario depth can make them feel heavier.

Do I need to know log file names?

Know which logs belong to which component and what they record. Recognising common log names helps eliminate wrong options.

What counts as break/fix?

Restoring functionality that previously worked, such as a component that stopped connecting or a feature that failed after patching.

Is an upgrade a support case?

No. Upgrades and migrations are planned changes and are treated as services engagements.

Does Defender cover disaster recovery operations?

The 2023 study guide lists only the two tasks above for this domain. Disaster recovery design and installation sit at the Sentry level, though knowing what a DR Vault is helps context.

What is the most common cause of a component not connecting after a rebuild?

A credential file that no longer matches the component's Vault user, together with blocked ports or certificate issues.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 3 knowledge

Practise symptom-to-component and break/fix classification questions in short timed sets before you sit a full PAM-DEF mock exam.

Take the PAM-DEF practice test Check your PAM-DEF readiness

Keep going