CAD Application Access Manager 3 — Questions and Answers
Question 1: Which CyberArk component serves as the authentication broker when using the Central Credential Provider?
- PVWA
- CCP IIS Web Service (Correct answer)
- PrivateArk Server
- PSM
Correct answer: CCP IIS Web Service
The CCP is deployed as an IIS-hosted web service that authenticates applications and proxies credential requests to the Vault.
Question 2: In CyberArk AAM, what does 'OS User' authentication rely on to verify an application's identity?
- The operating system account running the application process (Correct answer)
- A client SSL certificate
- The application's IP address only
- A pre-shared API key
Correct answer: The operating system account running the application process
OS User authentication validates the Windows or Unix account under which the requesting process is executing.
Question 3: An application is registered in CyberArk AAM with three authentication methods: IP, OS User, and Path. How many methods must match for the request to succeed?
- All three must match (Correct answer)
- At least two must match
- Only one needs to match
- The number depends on the Safe policy
Correct answer: All three must match
By default, when multiple authentication methods are configured, ALL must be satisfied for the application to receive credentials.
Question 4: What is the role of the 'AppProviderUser' in the CyberArk AAM architecture?
- A Vault user that owns the Credential Provider Safe
- The Vault account used by the CP/CCP service to authenticate to the Vault on behalf of applications (Correct answer)
- The PVWA service account
- An LDAP bind account for directory lookups
Correct answer: The Vault account used by the CP/CCP service to authenticate to the Vault on behalf of applications
AppProviderUser is the Vault identity that the AAM provider uses to authenticate and perform retrievals on behalf of registered applications.
Question 5: Which file on the Credential Provider server stores its configuration, including Vault address and authentication details?
- vault.ini
- AppProvider.conf
- ClaudeConfig.xml
- appProvider.ini (Correct answer)
Correct answer: appProvider.ini
The appProvider.ini file contains the CP's configuration including the Vault IP and authentication parameters.
Question 6: What type of credential does CyberArk AAM support retrieving for SSH-based applications?
- Only passwords
- Passwords and SSH private keys (Correct answer)
- Only certificates
- Only API tokens
Correct answer: Passwords and SSH private keys
AAM can retrieve both passwords and SSH private keys stored in the Vault for applications that need SSH authentication.
Question 7: When troubleshooting a failed AAM credential retrieval, which log file on the Credential Provider server should you check first?
- IISLogs\W3SVC
- ITALog.log
- AppProvider.log (Correct answer)
- pvwaConfig.log
Correct answer: AppProvider.log
AppProvider.log records all Credential Provider activity including authentication failures and retrieval errors.
CAD Application Access Manager 3
Which CyberArk component serves as the authentication broker when using the Central Credential Provider?