CAD Access Controls 3

Question 1

In CyberArk's Master Policy, which setting controls whether users must provide a reason when checking out a privileged account?

Accepted Answer

Require users to specify reason for access

Answer

The 'Require users to specify reason for access' Master Policy rule forces users to document a justification that is logged with every credential retrieval.

Question 2

A Vault admin needs to grant a new security team member the ability to manage Safe memberships but NOT retrieve passwords. Which permission set is appropriate?

Accepted Answer

Manage Safe members only

Answer

Granting only 'Manage Safe members' allows the user to add/remove Safe members and adjust permissions without giving them access to the stored credentials.

Question 3

Which CyberArk feature allows a SOC analyst to gain temporary elevated privileges to a target system for a defined period without permanently owning the account?

Accepted Answer

Just-In-Time Access through the PVWA request workflow

Answer

CyberArk's Just-In-Time (JIT) access workflow in PVWA allows temporary, time-boxed privilege grants that expire automatically, reducing standing access.

Question 4

When a platform has 'One Time Password' (OTP) enabled, what occurs after the privileged session ends?

Accepted Answer

The CPM immediately rotates the password to a new random value

Answer

With One Time Password enabled, the CPM automatically changes the credential immediately after the session ends, ensuring each use produces a unique password.

Question 5

What is the role of the 'Authorizer' Safe member permission in a dual control workflow?

Accepted Answer

To approve or reject access requests submitted by other Safe members

Answer

The Authorizer permission designates a user as an approver who can confirm or deny credential access requests in the dual control workflow.

(CAD) CyberArk Defender Certification Practice Test

(CAD) CyberArk Defender Certification Practice Test

CAD Access Controls 3