Study guide
17.1 Platform Security: Data Privacy, Encryption & Access Control
Dynatrace Certified Associate Exam
Track your progress as you read
Finished sections get a check mark.
1 Chapter 1: Platform Overview, Deployment Models & Architecture
1.1 Dynatrace Platform Capabilities, Web UI Navigation & the Dynatrace Hub 1.2 SaaS vs. Dynatrace Managed Architecture & Security 1.3 Core Telemetry Components: OneAgent, ActiveGate & Grail Lakehouse 1.4 Licensing Models: Dynatrace Platform Subscription (DPS) & Davis Data Units (DDUs)
2 Chapter 2: ActiveGate Architecture & Network Topologies
2.1 ActiveGate Types: Environment vs. Cluster ActiveGates 2.2 ActiveGate Capabilities: Proxying, Private Synthetic, Cloud Integrations & Extensions 2.3 Network Zones, Multi-DC Routing & Firewall Traversal
3 Chapter 3: OneAgent Deployment, Configuration & Management
3.1 OneAgent Architecture, Components & Automatic Injection 3.2 Host Installation on Linux, Windows & Containerized Hosts 3.3 Cloud-Native Deployment: Dynatrace Operator on Kubernetes & OpenShift 3.4 Kubernetes Observability: Clusters, Nodes, Namespaces, Workloads & Events
4 Chapter 4: Monitoring Modes, Process Groups & Infrastructure Observability
4.1 Monitoring Modes: Full-Stack vs. Infrastructure-Only vs. Discovery 4.2 Process Groups, Process Instances & Custom Process Group Detection Rules 4.3 Host Groups, Host Naming Rules & Environmental Metadata Extraction 4.4 Infrastructure & Operations: Host Health, Disk, Network & Availability Analysis 4.5 Database Observability: The Databases App, Connection Pools & Storage Latency
5 Chapter 5: Smartscape Topology & Service Flow
5.1 The 5-Layer Smartscape Topology: Datacenter to Application 5.2 Service Detection: Web Services, Background Tasks & Custom Services 5.3 Service Flow, Backtrace Analysis & Horizontal/Vertical Dependency Mapping
6 Chapter 6: PurePath Distributed Tracing & Code-Level Diagnostics
6.1 PurePath Architecture, Distributed Tracing & Request Context Propagation 6.2 Method Hotspots, CPU Profiling & Memory Allocation Thread Analysis 6.3 Database Service Diagnostics, Slow Queries & Exception Analysis
7 Chapter 7: Davis AI Engine, Baselining & Causation
7.1 Davis Deterministic Causation Engine vs. Pure Correlation 7.2 Automated Dynamic Baselining, Percentiles & Traffic Seasonality 7.3 Event Ingestion, Event Types & Event Hierarchy in Problem Evolution
8 Chapter 8: Problem Lifecycle, Root Cause Analysis & Alerting
8.1 Problem Lifecycle, Severity Categories & Root Cause Cards 8.2 Alerting Profiles, Delay Filters & Management Zone Routing 8.3 Problem Notification Integrations: Webhooks, Slack, ServiceNow & ITSM
9 Chapter 9: Digital Experience Monitoring: Synthetic Monitoring
9.1 Synthetic Monitors: HTTP, Single-Step Browser & Multi-Step Clickpaths 9.2 Private Synthetic Locations, ActiveGate Engines & Credential Vault 9.3 Outage Detection, Performance Baselining & Maintenance Suppression
10 Chapter 10: Digital Experience Monitoring: Real User Monitoring (RUM)
10.1 RUM Architecture, OneAgent Script Injection & Mobile/OpenKit Telemetry 10.2 User Actions: Load vs. XHR/Fetch Actions, Visually Complete & Speed Index 10.3 Apdex Performance Ratings, User Sessions & Session Replay Masking
11 Chapter 11: Log Management and Analytics on Grail with DQL
11.1 Log Management on Grail: Storage, Ingestion Pipelines & Log Masking 11.2 Dynatrace Query Language (DQL): Fetch, Filter, Fields & String Operations 11.3 DQL Aggregations: Summarize, MakeTimeseries, Sorting & Visualizations
12 Chapter 12: Platform Governance, OpenTelemetry & Automation
12.1 Management Zones: Scoping Observability, Dashboards & Access Control 12.2 Tagging Strategies: Automated Rule-Based Tags, Manual Tags & AWS/K8s Metadata 12.3 OpenTelemetry Ingestion, OpenPipeline & Dynatrace Workflows Automation
13 Chapter 13: Cloud Integrations & Agentless Infrastructure Ingestion
13.1 AWS, Azure & Google Cloud Integrations 13.2 VMware vSphere, Extensions & Other Agentless Ingestion Paths
14 Chapter 14: Business Analytics & Business Events
14.1 Business Events: Capture, Ingestion & the bizevents Grail Table 14.2 Business Analytics: Connecting Performance to Revenue, Conversion & KPIs
15 Chapter 15: Notebooks, Dashboards & Data Visualization
15.1 Notebooks: Section-Based Investigation & Shareable Analysis 15.2 Dashboards: Tiles, Variables, Segments & Continuous Monitoring 15.3 Choosing Visualizations: Data Explorer, Chart Types & Metric Selection
16 Chapter 16: Reporting, Metrics & User Behavior Analysis
16.1 Metrics on Grail: Built-in Metrics, Granularity & Retention 16.2 Dashboard Reports, Subscriptions & Exporting Data via APIs 16.3 User Behavior Analysis: Bounce Rate, Landing & Exit Pages, Conversion Goals 16.4 Session Segmentation, User Journeys & Funnel Drop-Off Analysis
17 Chapter 17: Security, Vulnerability Analytics & Application Protection
17.1 Platform Security: Data Privacy, Encryption & Access Control 17.2 Third-Party Vulnerabilities, the Davis Security Score & Security Advisor 17.3 Code-Level Vulnerabilities, Attacks & Runtime Application Protection 17.4 Security Investigator, Notifications & the Remediation Workflow
17.1 Platform Security: Data Privacy, Encryption & Access Control
Key Takeaways Explain This Topic AI
Security is one of the twelve scored Associate exam topics and covers both the security of the Dynatrace platform itself and the security findings it produces.
Dynatrace incorporates encryption, access controls, and compliance with industry standards to protect sensitive data and ensure the integrity of monitoring processes.
All monitoring traffic is outbound-only over TLS; no inbound firewall openings into monitored networks are required.
Access to the Application Security overview is restricted to users in the Security admin group for the whole environment, not for a subset of management zones.
Masking must be applied at capture or on ingest, because data that reaches storage unmasked cannot be retroactively un-collected.
Last updated: September 2026
Security is a separately scored line on the Dynatrace Associate exam score report, and the official learning path devotes an entire lesson to it. The topic has two halves, and candidates who prepare only one lose points on the other:
The security of the monitoring platform — how Dynatrace protects the data it collects. This section.
The security findings the platform produces — vulnerabilities and attacks. Sections 17.2 to 17.4.
Dynatrace's own framing covers both: "Dynatrace incorporates robust security measures, including encryption, access controls, and compliance with industry standards, to protect sensitive data and ensure the integrity of monitoring processes. The platform continuously monitors for vulnerabilities and potential threats, to proactively address security risks and maintain resilience against attacks."
Communication Security
The architecture established in Chapters 1 and 2 is itself a security control:
All communication is outbound-only over HTTPS/TLS. OneAgent connects out to an ActiveGate or to the Dynatrace platform; the platform never initiates a connection into the monitored network. No inbound firewall openings are required.
ActiveGate consolidates egress. Rather than granting thousands of hosts internet access, only the ActiveGate needs an outbound path — the smallest possible attack surface.
Data is encrypted in transit and at rest.
Dynatrace Managed keeps all monitoring data inside the customer's own datacenter, with only health, licensing, and update metadata flowing to Mission Control . Mission Control does not receive customer application payload data.
Any exam answer requiring inbound access into the monitored environment for monitoring purposes is wrong.
Access Control
Dynatrace access control operates on several axes, and scenarios test whether you pick the narrowest control that satisfies the requirement.
- Control What it scopes
- Groups and roles What a user may do — view, configure, manage settings, administer
- Management zones (Chapter 12) Which entities a user may see
- Policies and permissions Which Grail data a principal may query, by data type and scope
- OAuth clients (Section 16.2) What a machine integration may do, with scoped, short-lived tokens
A specific, testable rule from the security area: access to the Application Security overview is restricted to users who are part of the Security admin group for the whole environment, not just for a selected set of management zones. Vulnerability data is deliberately not delegable by management zone in the same way ordinary observability data is — a partial view of an organization's vulnerability posture is misleading, so the platform requires environment-wide security authority.
The general principle behind exam answers here is least privilege : a developer who needs to read their own service's logs should get a policy scoped to that data, not an administrator role.
Data Privacy and Masking
Monitoring systems see everything an application sees, which makes privacy configuration a first-class responsibility rather than an afterthought. Dynatrace provides controls at each layer:
- Layer Control
- RUM IP anonymization, user-tag suppression, Session Replay masking (Chapter 10)
- Session Replay Masking modes ranging from masking all user input up to masking all text and images
- Requests / traces Control over which request attributes and parameters are captured at all
- Logs Masking and redaction rules applied on ingest via OpenPipeline (Chapter 11)
- Business events Field selection at capture time (Chapter 14)
The rule that decides exam questions: mask at capture or on ingest, never afterwards. Once a payment card number or national identifier has been written to Grail, deleting it is an incident-response exercise, not a configuration change. When a scenario describes sensitive data appearing in logs, the correct answer is an ingest-time masking rule — not a dashboard filter, and not restricting who can view the log, both of which leave the data stored.
On the RUM side, opt-in mode and cookie lifetime controls ( rxVisitor defaults to two years and can be shortened) exist specifically to satisfy stricter data-protection regimes.
Compliance Posture
Dynatrace maintains compliance with recognized industry standards and offers deployment options that align with data-residency requirements — SaaS in a chosen region, or Dynatrace Managed entirely on customer infrastructure. The Associate exam does not require you to recite certification names; it requires you to know that data residency is chosen through the deployment model , which is why the SaaS-versus-Managed decision in Section 1.2 is framed as a compliance decision rather than merely an operational one.
Segregation of Duties
A final theme that recurs across scenarios: the person who operates an application is often not the person permitted to see its security findings or its raw customer data. Dynatrace supports that separation through the combination of groups, management zones, and Grail policies — and the Security admin requirement above is the platform enforcing it by design rather than leaving it to convention.