PAM-SEN Practice Test

PAM-SEN practice test: what's covered

• Self-Hosted PAM
• Vault
• PVWA
• CPM
• PSM
• PSM for SSH
• HA/DR

Free PAM-SEN sample questions

1. In the CyberArk Self-Hosted PAM architecture, the component that securely STORES the privileged credentials/secrets is the:

   • A. PVWA
   • B. Digital Vault (the Vault server) — the hardened, encrypted store and "single source of truth"; all other components are clients of the Vault
   • C. CPM
   • D. PSM
   Show answer

   Correct: B. The Digital Vault is the secure, encrypted store of all secrets — the heart of CyberArk. PVWA (web UI), CPM (rotation), and PSM (sessions) are all CLIENTS that talk to the Vault. Protecting/hardening the Vault is paramount.

2. The PVWA (Password Vault Web Access) component provides:

   • A. Credential rotation
   • B. The web interface/portal — where users and admins access/request secrets, launch sessions, and admins configure the solution; it brokers user requests to the Vault
   • C. The encrypted store
   • D. SSH proxying
   Show answer

   Correct: B. PVWA is the web front-end: users retrieve/request secrets and launch sessions, admins configure platforms/policies. It's stateless (no secrets stored on it) — it relays to the Vault. Multiple PVWAs are deployed for HA/scale.

3. The CPM (Central Policy Manager) is responsible for:

   • A. Storing secrets
   • B. Automatic password management — CHANGING (rotating), verifying, and reconciling passwords on target systems per policy, and updating the Vault
   • C. The web UI
   • D. Recording sessions
   Show answer

   Correct: B. CPM is the rotation engine: it changes, verifies, and reconciles privileged passwords on targets (servers, DBs, devices) per platform policy, then updates the Vault. It does the heavy lifting of credential rotation. Placement near targets matters.

4. The PSM (Privileged Session Manager) provides:

   • A. Password rotation
   • B. Privileged session isolation, monitoring, and RECORDING — users connect THROUGH the PSM (a jump/proxy) to targets, with credentials injected (not exposed) and full session recording
   • C. The encrypted store
   • D. The web portal only
   Show answer

   Correct: B. PSM isolates and records privileged sessions: the user connects via PSM to the target (RDP/web/etc.), PSM injects the credential (user never sees it) and records everything. It's the session-control/recording component. PSM for SSH (PSMP) does the same for SSH.

5. Which TWO statements correctly pair a component with its role? (Choose 2)

   • A. CPM = automatic password rotation/verification on targets
   • B. PSM = isolated, recorded privileged sessions with credential injection
   • C. Vault = the web user interface
   • D. PVWA = the encrypted secret store
   Show answer

   Correct: A and B. Correct pairings: CPM=rotation, PSM=sessions/recording, Vault=secure store, PVWA=web UI. The two wrong options swap Vault/PVWA roles. Knowing each component's job (and how they're clients of the Vault) is foundational to deployment.

Last updated: 2026-10-19

PAM-SEN practice test FAQ