This course develops the knowledge and practical skills needed to plan, install, configure, secure, and troubleshoot a basic CyberArk Privileged Access Management (PAM) Self-Hosted deployment. It covers the Digital Vault, Password Vault Web Access (PVWA), Central Policy Manager (CPM), and Privileged Session Manager (PSM), together with account onboarding, authentication, credential management, and recovery planning.
The proposed curriculum supports the deployment and configuration focus of CyberArk Sentry PAM (PAM-SEN).
Duration 4 Days – 28 hrs.
Objectives
- Explain the architecture and communication flows of CyberArk PAM Self-Hosted.
- Identify infrastructure, network, security, and installation requirements.
- Install and configure the Digital Vault and core PAM components.
- Configure Safes, permissions, platforms, and privileged account policies.
- Integrate directory services and supported authentication mechanisms.
- Configure password verification, rotation, and reconciliation.
- Enable privileged session connections, recording, and monitoring.
- Apply component hardening and secure communication settings.
- Explain backup, disaster recovery, and component availability requirements.
- Troubleshoot common installation, connectivity, and configuration issues.
- Document a functioning PAM deployment and its operational requirements.
Target Audience
- PAM implementation engineers and consultants.
- CyberArk administrators progressing into deployment responsibilities.
- Identity and access management engineers.
- Cybersecurity engineers and security infrastructure specialists.
- Windows and Linux administrators supporting privileged access systems.
- Technical personnel preparing for CyberArk Sentry PAM (PAM-SEN).
Prerequisites
- Completion of CyberArk PAM Administration training or equivalent practical experience.
- Familiarity with privileged accounts, Safes, platforms, and password management.
- Working knowledge of Windows Server administration and Active Directory.
- Basic Linux administration skills.
- Understanding of DNS, TCP/IP, firewalls, ports, and network connectivity.
- Familiarity with TLS certificates, authentication, and access control.
- Basic experience with virtual machines and enterprise infrastructure.
Course Outline
Day 1: Architecture, Planning, and Digital Vault Deployment
Module 1: CyberArk PAM Architecture
- Privileged access risks and PAM implementation goals.
- Core components and their responsibilities.
- Component communication and credential flows.
- Deployment topology and security boundaries.
Module 2: Deployment Planning and Preparation
- Business and technical requirements.
- Supported infrastructure and software prerequisites.
- Server sizing and component placement.
- Network connectivity, DNS, time synchronization, and firewall requirements.
- Installation accounts, permissions, licenses, and installation materials.
- Certificate and authentication planning.
Module 3: Digital Vault Installation and Configuration
- Preparing the Vault server.
- Installing and initializing the Digital Vault.
- Vault security and administrative access.
- Initial users, groups, Safes, and permissions.
- Protecting installation keys and recovery materials.
- Verifying Vault services and connectivity.
Day 2: PVWA, CPM, and Credential Management
Module 4: Password Vault Web Access Deployment
- PVWA prerequisites and installation.
- Connecting PVWA to the Digital Vault.
- Configuring HTTPS and certificates.
- Initial configuration and access verification.
- Directory integration and authentication configuration.
Module 5: Central Policy Manager Deployment
- CPM prerequisites and installation.
- Component registration and Vault connectivity.
- CPM permissions and configuration.
- Platform settings and password management policies.
- Password verification, change, and reconciliation.
Module 6: Account Onboarding and Access Configuration
- Safe structure and permission design.
- Onboarding Windows, domain, and Unix/Linux accounts.
- Assigning platforms and management settings.
- Configuring logon and reconciliation accounts.
- Handling dependent accounts and service credentials.
- Confirming end-to-end credential management.
Day 3: Session Management and Deployment Security
Module 7: Privileged Session Manager Deployment
- PSM prerequisites and installation.
- Vault integration and component configuration.
- PSM connection components.
- Target system access and connection requirements.
- Session recording storage and access permissions.
- Verifying privileged session connections.
Module 8: Session Access and Control
- Configuring RDP and SSH connections through supported connection components.
- Linking platforms to session connection settings.
- Session monitoring, recording, and playback.
- Access workflows and approval requirements.
- Troubleshooting connection and recording issues.
Module 9: Hardening and Enterprise Integration
- Applying component hardening requirements.
- Securing component communication.
- Managing certificates and component credentials.
- Applying least privilege and separation of duties.
- Integrating audit logs with enterprise monitoring systems.
- Verifying configuration consistency across components.
Day 4: Resilience, Troubleshooting, and Capstone
Module 10: Backup, Recovery, and Availability
- Vault backup requirements and configuration.
- Disaster Recovery Vault concepts and replication.
- Recovery procedures and failover considerations.
- Availability planning for PVWA, CPM, and PSM.
- Upgrade preparation, dependencies, and rollback planning.
Module 11: Troubleshooting and Operational Readiness
- Locating component logs and diagnostic information.
- Resolving installation and registration failures.
- Diagnosing authentication, certificate, and connectivity problems.
- Troubleshooting password management failures.
- Diagnosing session connection issues.
- Preparing deployment records and operational handover documentation.
Module 12: Capstone—Integrated PAM Deployment
- Implement a basic PAM environment for a sample organization.
- Configure the Vault, PVWA, CPM, and PSM.
- Create Safes and assign appropriate access permissions.
- Onboard representative Windows and Linux privileged accounts.
- Configure credential rotation and reconciliation.
- Enable recorded privileged sessions.
- Resolve introduced configuration faults.
- Produce an architecture diagram, configuration record, and recovery checklist.

