Central Policy Manager (CPM) Flashcards
7 cards from real CAD practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Central Policy Manager (CPM) flashcards as text
Which CyberArk component performs the actual on-demand password change when a user returns a checked-out account (with 'Change password automatically after check-in' enabled)?
Answer: Central Policy Manager
The CPM performs the on-demand password change triggered by an account check-in event, connecting to the target system to rotate the password immediately after the user releases the account.
When 'Enforce check-in/check-out exclusive access' is enabled in the Master Policy, what is the typical CPM behavior for a currently checked-out account?
Answer: CPM respects the check-out state and waits until the account is checked in before changing the password
With exclusive access enforced, the CPM waits for the account to be checked in before rotating its password, preventing a mid-session password change that would lock out the active user.
What does the account status 'Disconnected' indicate for a CPM-managed account in the Vault?
Answer: CPM was unable to establish a connection to the target system to perform password management
'Disconnected' status indicates that the CPM attempted to reach the target system for password management but could not establish a connection, often due to network issues, firewall rules, or the system being offline.
What is the significance of the CPM 'HeadStartInterval' (Grace Period) parameter?
Answer: A buffer period that prevents CPM from immediately rotating a password after it has been accessed, giving users time to finish their work
The HeadStartInterval (Grace Period) prevents the CPM from immediately changing a password after it was retrieved, ensuring users are not locked out while actively using the credential.
A CPM password change fails with an 'Access Denied' error. What is the most likely root cause?
Answer: The account used to connect to the target system lacks sufficient permissions to change the password
An 'Access Denied' error during CPM password change most commonly indicates that the managed account or its configured logon account does not have the necessary privileges on the target system to change the password.
Which CyberArk feature allows the CPM to discover unmanaged privileged accounts across the network and queue them for onboarding into the Vault?
Answer: CPM Account Discovery (CPM Scanner)
CPM Account Discovery (CPM Scanner) scans network systems such as Windows machines and domain controllers to identify unmanaged privileged accounts and surfaces them for onboarding into the Vault.
In CyberArk, 'Platform Parameters' in a CPM platform configuration primarily allow administrators to do what?
Answer: Customize CPM behavior for a specific system type, including password complexity, rotation intervals, and connection settings
Platform Parameters allow administrators to tailor the CPM's operational behavior for a given system type, defining rules such as password composition requirements, rotation frequency, and technical connection attributes.