Application Access Manager Flashcards

A developer wants to integrate an application with CyberArk AAM without installing any agent on the app server. Which retrieval method should they use?

Answer: Central Credential Provider (CCP) REST API

CCP's REST API is the agentless method, allowing any application to retrieve credentials via HTTPS without a local agent.

In CyberArk Conjur, which entity represents the non-human identity of an application requesting a secret?

Answer: Host

In Conjur, a 'Host' represents a machine or application identity that can authenticate and retrieve secrets.

Which CyberArk AAM feature allows Kubernetes pods to retrieve secrets without storing credentials in the pod specification?

Answer: Conjur Secrets Provider for Kubernetes

The Conjur Secrets Provider runs as an init or sidecar container to inject secrets into pods at runtime.

What must be configured in the Vault for an AAM application to access accounts in a specific Safe?

Answer: The AAM provider user must be added to the Safe with Retrieve permission

The provider user representing the AAM application must be granted at minimum 'Retrieve Accounts' permission on the target Safe.

Which AAM authentication method is MOST resistant to credential theft from the application server itself?

Answer: Hash-based authentication

Hash-based authentication ties credential access to the exact, unmodified binary, so a stolen executable or spoofed process cannot authenticate.

A CI/CD pipeline needs to inject database credentials at build time using CyberArk. Which integration approach is BEST aligned with CyberArk best practices?

Answer: Use AAM CCP REST API to pull credentials dynamically at runtime

Calling the CCP REST API at runtime eliminates hardcoded secrets and keeps credentials current without pipeline changes.

What is the default port used by the Central Credential Provider (CCP) web service for HTTPS requests?

Answer: 443

CCP listens on the standard HTTPS port 443 by default when hosted in IIS.