# PAM SIM

> A hands-on Privileged Access Management training simulator, live at https://pamsim.com. PAM SIM is an independent educational simulator. It is not affiliated with, endorsed by, or derived from any commercial privileged access management product, and it is not a substitute for one. It never connects to a real system, never executes a real command, and never stores a real password. Every account, host, identity and credential named in it is invented. It uses the standard vocabulary of the field because that is the vocabulary a real deployment and a real interview use.

The site itself is a single-page application and renders nothing useful without JavaScript. What follows is the same teaching content, generated from the same source at build time, as plain Markdown. All of it is fetchable without authenticating.

Contents: 33 concept cards, 219 glossary terms, 30 guided walkthroughs, 8 graded labs, 10 named detections, 10 REST endpoints, 8 target event identifiers.

## Docs

- [Overview — what PAM SIM is and how it is laid out](https://pamsim.com/llms/overview.md): Start here. What the simulator is and is not, where PAM sits inside IAM, every route in the application, and the role and permission matrix the API enforces.
- [Concepts — the reference the application links out to](https://pamsim.com/llms/concepts.md): The 33 concept cards behind the "Learn more" panels: the conceptual syllabus, from why privileged access management exists to how the platform is run.
- [Glossary](https://pamsim.com/llms/glossary.md): 219 terms with expansions and definitions, grouped by category, including where individual vendors name the same thing differently.
- [PAM SIM ↔ industry terminology](https://pamsim.com/llms/mapping.md): What every part of the simulator is called in a real deployment, and what it does. The translation table to check an answer against before it is said out loud.
- [Risk scoring and the detection catalogue](https://pamsim.com/llms/risk-and-detections.md): How risk is scored and banded, and the 10 named detections over privileged activity — the signal each one reads, why it matters, and the response it calls for.
- [Guided walkthroughs — index](https://pamsim.com/llms/guides.md): Index of the 30 click-by-click walkthroughs, one file each, grouped into four tracks and ranked by how likely the material is to come up. Every step says what to do and what an interviewer is testing with it; every guide ends with the questions it prepares you to answer.
- [Hands-on labs](https://pamsim.com/llms/labs.md): 8 graded labs with steps, tasks, hints and debriefs. Grading runs against real application state — the audit trail and rotation jobs the learner actually produced — not a checkbox.
- [The REST API surface and the status-code reference](https://pamsim.com/llms/rest-api.md): 10 simulated PVWA endpoints and a 9-code status reference — including the 401-versus-403 distinction every automation question eventually lands on.
- [The target system's own event log](https://pamsim.com/llms/target-events.md): The 8 Windows Security event identifiers worth knowing by heart, each with the audit policy subcategory it depends on and what it means beside the vault's own record.
- [How to teach from this corpus](https://pamsim.com/llms/teaching-guide.md): Addressed to an assistant that has been given this corpus and asked to teach from it: the order to teach in, how to quiz, and the claims never to make.

## Optional

- [The interview question bank](https://pamsim.com/llms/interview-questions.md): All 133 questions from the walkthroughs with their answers, grouped by how likely they are to come up. A second view of material already in the guides — use it to quiz, not to teach from.
- [Everything in one file](https://pamsim.com/llms-full.txt): the whole corpus concatenated, for a reader that would rather have it in one request than follow links.