SecProve
ProfessionalVendor-specificCyberArk· issued from US

CyberArk Sentry

CyberArk Sentry — PAM

Designs and deploys CyberArk PAM at enterprise scale — vault architecture, HA/DR, and complex onboarding.

Official page at CyberArk↔ Compare with another cert
Exam fee
$200
Ongoing
$0/yr AMF
Study time
60–120 hrs
Delivery
Online proctored
Validity
2 yrs (renewal cycle)

› Quality score

22.0 / 40

Four-axis SecProve rubric, each 0–10. SecProve editorial assessment — each axis carries a written justification so you can push back on any single call without dismissing the whole score.

Blueprint rigor
How well-defined and rigorous the exam blueprint is.
Mid-tier exam guide covers architecture, deployment, and integration in measurable depth.
7.0/10
Practical evidence
Hands-on labs / written reports vs pure MCQ.
MCQ-only formal exam; vendor training includes labs but they aren't graded toward the credential.
1.5/10
Currency & upkeep
How aggressively content is kept current with the field.
Refreshed in step with CyberArk PAM Self-Hosted and Privilege Cloud releases.
7.0/10
Market recognition
How often this signal actually moves a hiring decision.
Common requirement on senior PAM-engineer / architect roles in CyberArk shops. [Holders: vendor doesn't publish]
6.5/10

› Market signals

public, citable inputs to the recognition score
Holders worldwide
8,000
as of 2024-12 · source

Estimate; CyberArk does not publish per-tier certified-holder counts.

› Built for these roles

Senior PAM EngineerPAM ArchitectIAM Architect (CyberArk-track)

› Exam format

Multiple-choice exam, ~65 questions, 90 minutes, English. Online proctored. Covers Vault deployment, CPM/PSM/PVWA architecture, integrations, and complex policy design.

› Recertification

Credential is valid for two years. Renewal requires passing the current Sentry exam or the Guardian assessment.

› NICE Framework work roles

The NIST NICE work-role IDs this cert maps to. NICCS lookup.

DD-WRL-004IO-WRL-005
Recognition
GlobalUSEUUK
Exam languages
en

› Core domains covered

The 2 domains this cert is centrally about. Passing the exam demonstrates working knowledge of each.

A6Identity & Access Management

AuthN/AuthZ, SSO, MFA, PAM, RBAC/ABAC, identity governance, FIDO2/passkeys, plus non-human identity: service accounts, workload identity, agent / plugin identities.

A3Zero Trust Architecture

Zero trust principles, micro-segmentation, NIST SP 800-207, ZTNA, continuous verification, BeyondCorp.

› Also touched

Present in the blueprint but not the primary focus — you’ll be introduced but shouldn’t expect depth.

A1Governance, Risk & Compliance

Risk frameworks (NIST RMF, ISO 31000, FAIR), policy development, audit, regulatory compliance, third-party risk.

A5Cloud Security

AWS/Azure/GCP security controls, IAM policies, CSPM, container security, shared responsibility model.

A10Security Operations

SOC operations, SIEM tuning, SOAR playbooks, alert triage, log analysis, runbook development.

› Prerequisites

Experience

1–2 years of hands-on CyberArk administration. Defender-level fluency expected.

Knowledge assumed
  • CyberArk Vault, CPM, PSM, PVWA components
  • PAM HA / DR design
  • AD, LDAP, and PKI integration

› Progression

requiredrecommended

Where this cert fits in the typical learning path. Required edges are vendor-gated; recommended edges reflect de facto industry progression.

Required prereqs (0)

No vendor-gated prereqs.

Recommended priors (1)
CyberArk DefenderCyberArk
CyberArk Sentry
CyberArk
Required by (0)

No certs require this one.

Recommended next (1)
CyberArk GuardianCyberArk

See this cert’s domains highlighted on the interactive map, or compare it against the rest of the catalog.

Highlight on the domain mapBrowse all certifications