CAD Application Access Manager 2 — Questions and Answers
Question 1: Which AAM component must be installed on the application server to retrieve credentials using the file-based method?
- Central Credential Provider
- Credential Provider (CP) (Correct answer)
- PVWA Agent
- EPM Agent
Correct answer: Credential Provider (CP)
The Credential Provider (CP) is installed locally on the application server and enables file-based credential retrieval.
Question 2: What is the primary purpose of the CyberArk Application Identity Manager (AIM)?
- Rotate passwords for privileged accounts
- Eliminate hardcoded credentials in applications (Correct answer)
- Monitor application user behavior
- Enforce MFA for application logins
Correct answer: Eliminate hardcoded credentials in applications
AIM eliminates hardcoded credentials by allowing applications to retrieve secrets dynamically from the Vault.
Question 3: Which authentication method verifies an application's identity based on the executable file path and hash?
- IP-based authentication
- OS user authentication
- Path and hash authentication (Correct answer)
- Certificate-based authentication
Correct answer: Path and hash authentication
Path and hash authentication ensures that only the specific, unmodified executable can request credentials.
Question 4: In AAM, what does 'AllowedMachines' define in an application definition?
- Machines that can host the Vault
- IP addresses or hostnames permitted to request credentials for that application (Correct answer)
- Servers allowed to run PVWA
- Machines excluded from AAM policy
Correct answer: IP addresses or hostnames permitted to request credentials for that application
AllowedMachines restricts credential retrieval to specific IPs or hostnames associated with the registered application.
Question 5: When an application uses the Central Credential Provider (CCP), how does it retrieve secrets?
- Via a local file written by the Vault
- Through a REST API call over HTTPS (Correct answer)
- By querying Active Directory
- By reading a shared database table
Correct answer: Through a REST API call over HTTPS
CCP exposes a REST web service that applications call over HTTPS to retrieve credentials without a local agent.
Question 6: Which Safe permission must an AAM application's Vault user have to retrieve an account's credentials?
- Manage Safe
- Add Accounts
- Retrieve Accounts (Correct answer)
- Authorize Account Requests
Correct answer: Retrieve Accounts
The 'Retrieve Accounts' permission allows the AAM provider user to fetch the credential value from the Safe.
Question 7: What happens when an AAM application definition has 'Business Owner Approval' enabled?
- The application can retrieve credentials without any authentication
- A human approver must authorize each credential request before it is fulfilled (Correct answer)
- Credentials are rotated immediately after each retrieval
- The application is automatically added to the Master Policy exceptions
Correct answer: A human approver must authorize each credential request before it is fulfilled
Business Owner Approval introduces a workflow gate requiring manual authorization before the application receives its credential.
CAD Application Access Manager 2
Which AAM component must be installed on the application server to retrieve credentials using the file-based method?