# Guided walkthroughs

> PAM SIM is an independent educational simulator. It is not affiliated with, endorsed by, or derived from any commercial privileged access management product, and it is not a substitute for one. It never connects to a real system, never executes a real command, and never stores a real password. Every account, host, identity and credential named in it is invented. It uses the standard vocabulary of the field because that is the vocabulary a real deployment and a real interview use.

30 walkthroughs of the running application, one document each. Within a track they are ordered by the study material's own priority ranking: work through the *essential* ones first.

## Foundations

Architecture, where PAM sits inside IAM, the vault, safes and platforms.

| Guide | Priority | Minutes | Goal | Read it |
| --- | --- | --- | --- | --- |
| Find your way around | essential | 9 | Learn the shape of a privileged access platform: which component does what, where PAM sits inside IAM, and what breaks when each piece is down. | https://pamsim.com/llms/guides/orientation.md |
| The stack — where each piece sits | essential | 9 | Answer the opening question: how network access, multi-factor, the authenticator and privileged access fit together, and why they are not competing tools. | https://pamsim.com/llms/guides/the-stack.md |
| Blast radius — why this discipline exists | essential | 11 | Walk an attack chain and say which control breaks which link, name every class of privileged account, and describe the complete control set. | https://pamsim.com/llms/guides/why-pam-exists.md |
| Inside the Vault | essential | 10 | Understand the component everything else depends on: how it protects secrets, why it is Tier 0, what the server key means, and what you do on the day it is unavailable. | https://pamsim.com/llms/guides/vault-operations.md |
| Tiering the administrative plane | high | 9 | Understand why a Tier 0 credential must never be typed on an ordinary workstation, and what the model that follows from that actually looks like. | https://pamsim.com/llms/guides/admin-tiering.md |
| Authenticators and hard tokens | high | 10 | Rank the factors by what actually resists attack rather than by form factor, and handle the lifecycle question that produces audit findings. | https://pamsim.com/llms/guides/authenticators.md |
| Zero trust network access, precisely | high | 10 | Separate the two products people both call "the VPN", explain why connectors mean no inbound rules, and say how this layers with privileged access. | https://pamsim.com/llms/guides/zero-trust-access.md |

## Operations

Day-to-day running: rotation, requests, sessions, service accounts, and the troubleshooting that goes with them.

| Guide | Priority | Minutes | Goal | Read it |
| --- | --- | --- | --- | --- |
| Discover and onboard an account | essential | 14 | Run the whole sequence a real onboarding follows — find privilege nobody is managing, decide what should happen to it, and take the ones that matter under management. | https://pamsim.com/llms/guides/onboard-account.md |
| Design and run a safe | essential | 10 | Work the authorisation boundary end to end: why safes exist, how to structure them, how membership actually grants access, and what a safe looks like at review time. | https://pamsim.com/llms/guides/safe-design.md |
| Platforms and the Master Policy | essential | 10 | Work the policy layer end to end: what a platform controls, how to tune one safely, and where organisation-wide rules and their exceptions actually live. | https://pamsim.com/llms/guides/platform-policy.md |
| Verify, change, reconcile | essential | 9 | Run all three CPM job types and be able to say precisely what each one asks and when you would use it. | https://pamsim.com/llms/guides/verify-change-reconcile.md |
| Troubleshoot a failed rotation | essential | 11 | Work the most common ticket in a PAM team using a systematic ladder rather than guesswork. | https://pamsim.com/llms/guides/failed-rotation.md |
| The portal, end to end | essential | 10 | Follow one privileged access from search to expiry through the web front door, and understand why the portal being the only path is what makes every other control real. | https://pamsim.com/llms/guides/pvwa-portal.md |
| A privileged session from click to recording | essential | 10 | Follow the session path end to end — what the gateway does, the three separate controls it provides, and what happens after the session closes. | https://pamsim.com/llms/guides/psm-session.md |
| The password works but the session fails | essential | 8 | Diagnose the session path without touching the credential — and know why rotating would be the wrong move. | https://pamsim.com/llms/guides/session-troubleshooting.md |
| Take a hardcoded credential out of an application | essential | 11 | Use the credential provider: register an application, understand how it is authenticated, diagnose a refusal, and know when a remediation is only half done. | https://pamsim.com/llms/guides/application-credentials.md |
| Secrets for workloads, not people | high | 12 | Understand the cloud-native model: identity borrowed from the platform, secrets minted on demand with an expiry, and access defined as policy in version control. | https://pamsim.com/llms/guides/workload-secrets.md |
| Service accounts and their dependencies | essential | 9 | Understand why a successful rotation can still cause an outage, and how to onboard a service account without one. | https://pamsim.com/llms/guides/service-accounts.md |
| Use without Retrieve, and access triage | essential | 8 | Grant the right level of access, and diagnose the two complaints you will hear constantly: cannot see it, or can see it but cannot connect. | https://pamsim.com/llms/guides/permissions-triage.md |
| Automate it, and read the status code | high | 12 | Work the REST interface end to end — authenticate, call, and produce every status code that matters — so 401 against 403 is something you have done rather than something you memorised. | https://pamsim.com/llms/guides/rest-api.md |
| Reduce standing privilege without breaking the business | high | 10 | Run the programme play rather than the technical one: measure first, cut the safe tranche, make the replacement fast enough that nobody routes around it. | https://pamsim.com/llms/guides/reduce-standing-privilege.md |
| Run the platform — upgrades, resilience and cost | high | 11 | Handle the half of the job that is not access engineering: keeping the platform available, upgrading it safely, and arguing for the budget to expand it. | https://pamsim.com/llms/guides/platform-operations.md |

## Investigation

Reading the evidence: audit trails, session recordings, the target's own event log, and the detections raised over them.

| Guide | Priority | Minutes | Goal | Read it |
| --- | --- | --- | --- | --- |
| Triage a PTA detection | essential | 10 | Work the Privileged Threat Analytics queue: know the named detections, tell an analytics finding from a workflow event, and take the right first action on each. | https://pamsim.com/llms/guides/pta-triage.md |
| Review a suspicious session | high | 10 | Investigate recorded privileged activity and know the order of operations when a credential may be compromised. | https://pamsim.com/llms/guides/session-review.md |
| Read the target's event log | essential | 11 | Work the other half of the record: the Windows Security events privileged activity produces, what each one means, and why the finding usually lives in the gap between the two logs. | https://pamsim.com/llms/guides/windows-events.md |

## Compliance

Policy, access reviews, reporting, and the evidence an auditor actually asks for.

| Guide | Priority | Minutes | Goal | Read it |
| --- | --- | --- | --- | --- |
| When an administrator leaves | essential | 10 | Walk the termination chain control by control, across all three identity pillars, and know the step almost everyone forgets. | https://pamsim.com/llms/guides/leaver-controls.md |
| Maturity, metrics and the standards behind them | high | 10 | Frame a roadmap answer, quantify a programme with numbers an auditor and an executive both accept, and name which document each requirement comes from. | https://pamsim.com/llms/guides/maturity-and-metrics.md |
| Pull the reports an audit asks for | essential | 10 | Run the reporting surface end to end: which report answers which question, how to generate and export one, and what has to travel with it for it to count as evidence. | https://pamsim.com/llms/guides/pull-reports.md |
| Produce evidence for an audit | high | 9 | Answer what an auditor actually asks for, in the three layers they ask for it, and know why a screenshot is not evidence. | https://pamsim.com/llms/guides/sox-evidence.md |
| Dual control and access approval | high | 8 | Work both halves of the approval workflow and understand where time-bound access fits the Zero Standing Privileges argument. | https://pamsim.com/llms/guides/dual-control.md |