• High Availability (HA) and Disaster Recovery (DR) for Vault: Configure the CyberArk Vault in HA pairs and set up DR Vault replication to ensure continuous operation even if a site goes down. Includes exercises on promoting a DR Vault and syncing data post-failover.
• Multi-Data Center Deployment Strategies: Learn how to deploy CyberArk across multiple data centers or cloud regions for resilience and low-latency access. We cover network architecture considerations, Vault clustering, and global safe access design.
• Vault Performance Tuning & Hardening: Optimize the Vault server for large-scale usage. Topics include adjusting platform parameters, increasing throughput for CPM rotations, OS-level hardening, and vault parameter tuning for performance.
• Log Management and Event Monitoring: Configure detailed logging and retention policies. You’ll practice analyzing Vault and Component logs (PVWA, CPM, PSM) to glean useful insights. We also set up SIEM integration via syslog to forward CyberArk logs to security monitoring systems.
• Secure Communications & Encryption Best Practices: Ensure all CyberArk components communicate securely. This includes implementing digital certificates for PVWA and CPM, TLS hardening for CyberArk endpoints, and configuring secure RPC encryption between Vault and clients.
• Master Policy Fine-Tuning: Adjust the Master Policy settings for an enterprise environment. You’ll explore advanced policy options (like exclusive accounts, dual control, segregation of duties) and learn how to align Master Policy with organizational security requirements.
• Advanced Vault Maintenance: Perform maintenance tasks such as vault data purge/archive, safe redesign, and user onboarding/offboarding at scale. We cover backup strategies and best practices for vault backup and restoration (both automated and manual) to prevent data loss.
• Enterprise Integration: Implement custom alerting using the CyberArk REST API for events. For example, trigger automatic notifications or workflows (via ServiceNow or email) for certain Vault events (password changes, suspicious access, etc.). This ties Vault operations into the broader IT ecosystem.

• PSM Architecture & Customization: Understand the PSM internals and how to tailor it for various use cases. We cover multi-PSM deployments, PSM in isolation networks, and customizing the PSM gateway and UI for different user groups.
• Secure Session Recording & Forensics: Enable and manage advanced session recording for RDP, SSH, and web sessions. You will practice retrieving and reviewing session recordings, and using them for forensic analysis. Also learn about storage considerations and encryption of recordings.
• Load Balancing & Scaling PSM: Configure PSM for high load environments. This involves setting up multiple PSM servers behind a load balancer, session distribution strategies, and tuning PSM services to handle concurrent sessions.
• Developing Custom PSM Connectors: Build your own PSM connectors for protocols or applications not supported out-of-the-box. In a lab exercise, you’ll use the PSM SDK to create a connector (or adapt an existing one) for a custom application, test it, and troubleshoot connectivity.
• Connector Debugging and Optimization: Learn how to debug PSM connector issues using logs and diagnostic tools. We simulate connector failures and guide you through diagnosing them (for example, adjusting connection scripts, plugin parameters, or server settings to fix issues).
• Session Management Automation: Use scripting to automate session tasks. For instance, you’ll write a script to automatically launch a recorded session playback for review, or to extract session metadata via APIs. This demonstrates how to integrate PSM with workflows like incident response (e.g., automatically flagging and reviewing sessions that match certain criteria).
• Integrating MFA and Custom Authentication: Configure multi-factor authentication (MFA) for PSM access and build custom auth flows. We explore integrating solutions like Duo or RSA for an extra layer of verification when users launch privileged sessions, and how to create pre-connection and post-connection flows (such as invoking approval workflows).
• PSM Troubleshooting & Tuning: Master troubleshooting of common PSM issues – e.g., session launch failures, keyboard/clipboard issues, recording not playing, etc. You’ll also learn to tune PSM parameters for performance (thread pools, timeouts) and optimize the PSM server OS for stability.
• Advanced RDP/SSH Configurations & Secure Tunneling: Implement secure tunneling scenarios, such as jumping through a jump host or using the HTML5 web client for RDP/SSH. We also discuss configuring PSM-WEB (PVWA Web Access) and PSM for SSH Proxy in-depth. By the end of this module, you’ll be able to confidently extend and manage CyberArk’s session management to cover any application or use case in your organization.

• Custom CPM Plugin Development: Learn how to create and modify CPM plugins to manage credentials for custom or non-standard platforms. In a lab, you’ll develop a plugin (using AutoIT or PowerShell) to rotate passwords for a sample custom application. This includes writing the plugin code, defining conditions, and testing it with CyberArk’s Plugin Management console.
• Advanced Password Rotation Policies: Implement complex rotation policies for specialized needs. For example, you’ll configure rules for service accounts that require coordination of password changes across multiple systems, or policies that enforce one-time passwords. We also look at managing SSH keys and how to rotate keys using CyberArk.
• Plugin Troubleshooting Best Practices: Handle failures in password change processes gracefully. You’ll examine CPM logs to troubleshoot plugin errors (like timeouts, misconfigurations, script errors) and learn techniques to debug and fix plugins. We cover how to ensure high reliability in automated password management – including fallback options and notifications on error.
• Credential Provider (CP) & Central Credential Provider (CCP): Understand the architecture and deployment of CyberArk’s Credential Providers for application authentication. We cover installing CP agents on application servers (for retrieving secrets securely) and setting up the Central Credential Provider web service for distributed environments.
• Application Integration and Performance Tuning: Integrate applications (databases, middleware, DevOps tools) with CyberArk using CP/CCP. You’ll learn how applications fetch credentials at runtime via CCP APIs, and how to optimize this for performance (caching, concurrency, and high-load scenarios). We simulate high-volume password retrieval to show how to tune the CCP for scalability.
• CCP Web Service API Deep Dive: Explore the Central Credential Provider Web Service in depth. In a lab, you will perform operations with the CCP API (querying for credentials, checking out secrets via REST calls) to understand how applications interact with CyberArk programmatically. Security aspects like authorizing applications (using certificates or tokens) are also covered.
• Remote Access via HTML5 Gateway: Deploy and configure CyberArk’s HTML5 Gateway for browser-based privileged sessions. This component allows end-users to connect to target systems through a web browser without any client – we set it up and secure it (SSL certificates, integration with PVWA). You’ll practice launching RDP/SSH sessions through the HTML5 interface and learn how to troubleshoot common issues.
• Enhancing Web Access Security: Implement additional controls for the HTML5 Gateway, such as MFA integration and session recording for web-accessed sessions. We discuss limitations and monitoring of HTML5 sessions, ensuring they meet the same security standards as standard PSM sessions.
• CPM & Provider Troubleshooting: Diagnose and resolve issues related to password management and credential providers. This includes handling scenarios like password change failures that could lock accounts, connectivity issues between CPM and target systems, and CP agent errors on application servers. By the end of Module 3, you’ll have the expertise to extend CyberArk’s automated password management to any application and maintain a seamless, secure supply of credentials to both users and applications.

• Privileged Threat Analytics (PTA) Deep Dive: Understand CyberArk’s behavioral analytics for privileged accounts. We explore how PTA’s engine detects anomalies (e.g., unusual login times, abnormal command usage) by analyzing Vault and session data. You’ll install/configure PTA (if not already in environment) and go through examples of suspicious behavior and how PTA flags them. Learn to customize threat detection policies and response actions to fit your organization’s risk profile.
• Integrating PTA with SIEM and Incident Response: Configure PTA to send alerts to SIEM solutions (like Splunk, QRadar) and trigger incident response workflows. We walk through setting up syslog forwarding for PTA alerts and creating a sample alert-to-ticket pipeline (so a high-severity PTA alert creates an incident ticket or sends a pager notification). This ensures that insights from PTA are actionable and integrated with your security operations.
• CyberArk REST API & Automation: Gain hands-on experience with the CyberArk REST API to automate tasks. In practical exercises, you’ll write API calls to onboard accounts in bulk, rotate passwords on demand, generate compliance reports (e.g., list of accounts not rotated in X days), and more. We also cover using PowerShell scripts with the CyberArk API and CLI for automation, and how to securely store API credentials.
• Scripting for Password Management: Build custom automation scripts that interact with CyberArk to solve real-world problems. For instance, a script to detect and automatically onboard new servers and their local admin accounts into CyberArk (“auto-onboarding”), or a script that resets certain passwords every Friday as part of an operations process. These labs illustrate how CyberArk can be integrated into DevOps pipelines and regular IT operations.
• Third-Party Integrations (ITSM, CI/CD, Cloud): Learn how to integrate CyberArk with various tools and platforms. We discuss use cases like ServiceNow (e.g., auto-creating safes when a new project is opened), SIEM/SOAR integrations (responding to threats by locking down accounts), and cloud platforms (managing AWS/Azure privileged accounts and keys with CyberArk). This gives you a broad vision of CyberArk as part of a larger ecosystem of enterprise security tools.
• Advanced Integration Capstone Workshop: In the final part of the module, we conduct an end-to-end integration workshop. You will design and implement a scenario that brings together multiple CyberArk components and automation: for example, onboarding a new application that requires setting up safes, adding accounts, deploying a CP agent on the app server, and configuring a PSM connector – all orchestrated through scripts and APIs. You’ll troubleshoot any issues in the flow and apply best practices learned throughout the course.
• Best Practices for Large-Scale Deployments: Conclude with a discussion on enterprise deployment best practices and a Q&A. We cover topics like governance (establishing PAM policies and oversight committees), scaling considerations (distributed Vaults, network latency optimizations), and auditing/compliance checkpoints (ensuring your CyberArk deployment meets standards like ISO 27001, SOX, etc.). This capstone ensures you leave with not just technical know-how, but also an understanding of how to successfully run a privileged access program using CyberArk in the real world.