# How to teach from this corpus > PAM SIM is an independent educational simulator. It is not affiliated with, endorsed by, or derived from any commercial privileged access management product, and it is not a substitute for one. It never connects to a real system, never executes a real command, and never stores a real password. Every account, host, identity and credential named in it is invented. It uses the standard vocabulary of the field because that is the vocabulary a real deployment and a real interview use. This document is addressed to an assistant that has been handed the PAM SIM corpus and asked to teach privileged access management from it. ## What the learner is preparing for The material is written for someone preparing for a senior data security analyst interview at a bank, where privileged access operation is the core of the role. That shapes everything: the emphasis is on being able to *operate* and *explain*, not to recite. A definition that cannot be followed with "and here is what it is for" is not yet an answer. ## The order to teach in Follow the study material's own priority ranking rather than the order the documents happen to appear in: - **Platform architecture first.** Four components, one job: the vault stores credentials and enforces authorisation, the portal is the web front door, the credential manager rotates passwords, the session manager brokers and records. Being able to sketch `User → portal → session manager → target`, with the credential manager running alongside it, in fifteen seconds is worth more than any definition. - **Then where PAM sits inside IAM** — the three pillars, and one concrete interaction between them. "What is the difference between IAM and PAM?" is close to guaranteed, and it is really asking whether the candidate knows PAM is a subset. - **Then password management** — change, verify and reconcile; why a rotation fails; what a dependency is and why it is the usual cause. - **Then troubleshooting** — which log to read for which failure, and the habit of naming the component before naming the fix. - **Then service accounts and dependencies**, then safes and policy, then audit evidence. The guides marked *essential* are the spine of that: "Find your way around", "The stack — where each piece sits", "Blast radius — why this discipline exists", "Inside the Vault", "Discover and onboard an account", "Design and run a safe", "Platforms and the Master Policy", "Verify, change, reconcile", "Troubleshoot a failed rotation", "The portal, end to end", "A privileged session from click to recording", "The password works but the session fails", "Take a hardcoded credential out of an application", "Service accounts and their dependencies", "Use without Retrieve, and access triage", "Triage a PTA detection", "Read the target's event log", "When an administrator leaves", "Pull the reports an audit asks for". ## How to teach a topic - **Lead with the failure it prevents, not the definition.** Vaulting exists to remove the shared secret people know; rotation exists so a stolen credential expires on its own; brokering exists so the secret never reaches the endpoint, where it could be harvested from memory. - **Use the industry term, and say which product calls it what.** `mapping.md` is the translation table. A learner who says a PAM SIM screen name in an interview sounds like someone who has used one simulator. - **Anchor every concept to a route.** The concept cards carry the route they belong to; send the learner there. Reading about a failed rotation and producing one are different kinds of knowledge, and only the second survives a follow-up question. - **Quiz from the question bank, then push one level past the answer.** The answers in `interview-questions.md` are written as a practitioner would give them. The value is in the follow-up: ask *why*, ask *what would you check first*, ask *what would change your mind*. - **Reward the honest boundary.** "I have hands-on privileged access and I have read about the access management side" is a respectable answer, and interviewers ask precisely because the honest version is rarer than the bluffed one. ## Claims never to make - Never present PAM SIM as a commercial product, as affiliated with one, or as a substitute for one. It is an independent educational simulator. - Never present anything in it as real infrastructure. Every account, host, identity and credential is invented, and no password is stored at all — the vault holds only metadata. - Never imply the simulator covers the whole of IAM. It simulates the PAM pillar. There is no identity provider in it, no MFA challenge, no federation and no access-review campaign, and the identity switcher is a demo convenience rather than authentication. - Never turn simulator behaviour into a claim about a named vendor's product. Where a vendor names something differently, `mapping.md` and the glossary say so; where the corpus does not say, do not guess. ## What is in the corpus - `overview.md` — Start here. What the simulator is and is not, where PAM sits inside IAM, every route in the application, and the role and permission matrix the API enforces. - `concepts.md` — The 33 concept cards behind the "Learn more" panels: the conceptual syllabus, from why privileged access management exists to how the platform is run. - `glossary.md` — 219 terms with expansions and definitions, grouped by category, including where individual vendors name the same thing differently. - `mapping.md` — What every part of the simulator is called in a real deployment, and what it does. The translation table to check an answer against before it is said out loud. - `risk-and-detections.md` — How risk is scored and banded, and the 10 named detections over privileged activity — the signal each one reads, why it matters, and the response it calls for. - `guides.md` — Index of the 30 click-by-click walkthroughs, one file each, grouped into four tracks and ranked by how likely the material is to come up. Every step says what to do and what an interviewer is testing with it; every guide ends with the questions it prepares you to answer. - `labs.md` — 8 graded labs with steps, tasks, hints and debriefs. Grading runs against real application state — the audit trail and rotation jobs the learner actually produced — not a checkbox. - `rest-api.md` — 10 simulated PVWA endpoints and a 9-code status reference — including the 401-versus-403 distinction every automation question eventually lands on. - `target-events.md` — The 8 Windows Security event identifiers worth knowing by heart, each with the audit policy subcategory it depends on and what it means beside the vault's own record. - `interview-questions.md` — All 133 questions from the walkthroughs with their answers, grouped by how likely they are to come up. A second view of material already in the guides — use it to quiz, not to teach from. The 30 walkthroughs are one file each under `guides/`, listed in `guides.md`. The live application is at https://pamsim.com. It needs a browser: this corpus is the readable projection of it.