CAD Central Policy Manager (CPM) 2 — Questions and Answers
Question 1: Which Safe permission must the CPM user account have on a Safe in order to perform automatic password management for accounts stored in that Safe?
- Manage Safe
- Initiate CPM password management operations (Correct answer)
- Access Safe without confirmation
- Unlock accounts
Correct answer: Initiate CPM password management operations
The 'Initiate CPM password management operations' permission explicitly grants the CPM user account the ability to trigger password change, verify, and reconcile operations on accounts in the Safe.
Question 2: What is a 'Platform' in the context of CyberArk CPM configuration?
- The operating system on which CyberArk components are installed
- A configuration template defining how CPM manages a specific type of target system (Correct answer)
- The hardware infrastructure hosting the Digital Vault
- A group of Safes sharing common Master Policy settings
Correct answer: A configuration template defining how CPM manages a specific type of target system
A Platform is a configuration template that defines the CPM plugin, connection method, password policy parameters, and other settings used to manage a specific target system type such as Windows Local or Unix SSH.
Question 3: When troubleshooting CPM password change failures, which log file on the CPM server should be checked first?
- CyberArk Vault audit log
- pm.log (Password Manager log) (Correct answer)
- Windows Event Viewer System log
- PVWA IIS access log
Correct answer: pm.log (Password Manager log)
The pm.log file, located in the CPM installation directory, contains detailed records of all password management operations including failures, error codes, and retry attempts.
Question 4: What does the CPM 'Verify' operation confirm?
- That the Vault is reachable from the CPM server
- That the password stored in the Vault matches the actual current password on the target system (Correct answer)
- That the CPM plugin is correctly installed and configured
- That network connectivity between the CPM and target system is functioning
Correct answer: That the password stored in the Vault matches the actual current password on the target system
The Verify operation attempts to authenticate to the target system using the password currently stored in the Vault, confirming that the stored password is accurate and the account is accessible.
Question 5: How does CyberArk CPM handle managed accounts for which there are dependent services (e.g., Windows services running as that account)?
- CPM ignores service accounts that have dependencies
- CPM requires manual reconfiguration of all dependent services after each password change
- CPM can automatically update dependent services, scheduled tasks, and COM+ applications after changing the account password (Correct answer)
- CPM disables all dependent services before changing the password
Correct answer: CPM can automatically update dependent services, scheduled tasks, and COM+ applications after changing the account password
CyberArk CPM supports account dependencies and can automatically update Windows services, scheduled tasks, and COM+ applications to use the new password after rotating the parent account's credentials.
Question 6: In CyberArk, what is the primary use case for CPM Proxy (routing CPM through an intermediary)?
- To load balance CPM operations across multiple CPM servers
- To allow CPM to manage accounts on systems in network segments that are not directly accessible from the CPM server (Correct answer)
- To provide a REST API interface for third-party password management integration
- To cache frequently used credentials for faster retrieval
Correct answer: To allow CPM to manage accounts on systems in network segments that are not directly accessible from the CPM server
CPM Proxy allows the CPM to reach and manage accounts on target systems located in isolated or restricted network segments by routing password management traffic through an accessible intermediary host.
Question 7: What is the role of a 'Logon Account' in a CyberArk CPM platform configuration?
- The account that end users use to log into the PVWA
- A separate privileged account that CPM uses to authenticate to the target system before changing the managed account's password (Correct answer)
- The CPM Windows service account used to connect to the Vault
- The account used for generating compliance and audit reports
Correct answer: A separate privileged account that CPM uses to authenticate to the target system before changing the managed account's password
A Logon Account provides CPM with a separate set of credentials to first authenticate to the target system when the managed account itself lacks the privilege to change its own password.
CAD Central Policy Manager (CPM) 2
Which Safe permission must the CPM user account have on a Safe in order to perform automatic password management for accounts stored in that Safe?