CAD Central Policy Manager (CPM) 3

Question 1

Which CyberArk component performs the actual on-demand password change when a user returns a checked-out account (with 'Change password automatically after check-in' enabled)?

Accepted Answer

Central Policy Manager

Answer

Privileged Session Manager

Answer

Password Vault Web Access

Answer

Privileged Threat Analytics

Question 2

When 'Enforce check-in/check-out exclusive access' is enabled in the Master Policy, what is the typical CPM behavior for a currently checked-out account?

Accepted Answer

CPM respects the check-out state and waits until the account is checked in before changing the password

Answer

CPM rotates the password immediately regardless of check-out status

Answer

CPM is permanently disabled for accounts with exclusive access enabled

Answer

CPM sends a change request to the Vault administrator for approval

Question 3

What does the account status 'Disconnected' indicate for a CPM-managed account in the Vault?

Accepted Answer

CPM was unable to establish a connection to the target system to perform password management

Answer

The account owner has logged out of the PVWA

Answer

The account has been disabled in Active Directory

Answer

The CPM Windows service has stopped unexpectedly

Question 4

What is the significance of the CPM 'HeadStartInterval' (Grace Period) parameter?

Accepted Answer

A buffer period that prevents CPM from immediately rotating a password after it has been accessed, giving users time to finish their work

Answer

The delay before CPM starts after system boot

Answer

The allowed retry interval after a failed password change operation

Answer

The period during which a new platform configuration takes effect

Question 5

A CPM password change fails with an 'Access Denied' error. What is the most likely root cause?

Accepted Answer

The account used to connect to the target system lacks sufficient permissions to change the password

Answer

The Vault SSL certificate has expired

Answer

The PVWA web server is unreachable

Answer

The Safe has exceeded its maximum account storage limit

Question 6

Which CyberArk feature allows the CPM to discover unmanaged privileged accounts across the network and queue them for onboarding into the Vault?

Accepted Answer

CPM Account Discovery (CPM Scanner)

Answer

Privileged Threat Analytics scanning

Answer

PVWA Active Directory sync

Answer

Vault replication service

Question 7

In CyberArk, 'Platform Parameters' in a CPM platform configuration primarily allow administrators to do what?

Accepted Answer

Customize CPM behavior for a specific system type, including password complexity, rotation intervals, and connection settings

Answer

Define which Vault administrators can approve access requests

Answer

Restrict which network segments CPM is permitted to reach

Answer

Configure dual control workflows for password checkout