CAD CyberArk Cloud Entitlements 2 — Questions and Answers
Question 1: Which CyberArk component specifically addresses the challenge of ephemeral cloud credentials that are short-lived and automatically rotated?
- Privileged Access Manager (PAM)
- Cloud Entitlements Manager (CEM) (Correct answer)
- Conjur Secrets Manager
- Endpoint Privilege Manager
Correct answer: Cloud Entitlements Manager (CEM)
CEM is designed to discover, analyze, and remediate cloud entitlements including short-lived ephemeral credentials across cloud environments.
Question 2: In AWS, what is the primary risk associated with overly permissive IAM roles attached to Lambda functions?
- Increased Lambda execution time
- Excessive access if the function is compromised or misconfigured (Correct answer)
- Higher AWS billing costs
- Reduced Lambda concurrency limits
Correct answer: Excessive access if the function is compromised or misconfigured
Overly permissive IAM roles on Lambda functions can allow an attacker to pivot across AWS services if the function is exploited.
Question 3: CyberArk Cloud Entitlements Manager uses what methodology to determine the minimum permissions a cloud identity actually requires?
- Manual policy review
- Usage analytics and activity monitoring (Correct answer)
- Random sampling of API calls
- Vendor-supplied default templates
Correct answer: Usage analytics and activity monitoring
CEM analyzes actual usage patterns and activity logs to calculate the effective minimum permissions needed, enabling least-privilege enforcement.
Question 4: What is a 'shadow permission' in the context of CyberArk Cloud Entitlements Manager?
- A permission granted via a secondary MFA method
- An effective permission derived indirectly through role chaining or group membership (Correct answer)
- A permission visible only in audit logs
- A read-only copy of an IAM policy
Correct answer: An effective permission derived indirectly through role chaining or group membership
Shadow permissions are effective access rights that arise indirectly through role chaining, group memberships, or policy inheritance rather than direct assignment.
Question 5: When CyberArk CEM generates a 'right-sized' policy recommendation, what should an administrator do before applying it in production?
- Apply it immediately to all accounts
- Review the recommendation and test it in a non-production environment first (Correct answer)
- Wait 90 days before applying any changes
- Delete the existing policy before applying the new one
Correct answer: Review the recommendation and test it in a non-production environment first
Right-sized policy recommendations should always be reviewed and tested in a staging environment before production deployment to avoid unintended access disruptions.
Question 6: Which cloud provider's concept of 'service accounts' does CyberArk CEM specifically analyze for excessive permissions in GCP environments?
- IAM Users
- GCP Service Accounts (Correct answer)
- Managed Identities
- Federated Identities
Correct answer: GCP Service Accounts
In GCP, Service Accounts are the primary non-human identity type, and CEM analyzes their permissions to identify and remediate excess access.
Question 7: What does CyberArk CEM's 'Entitlement Risk Score' primarily measure?
- The cost of cloud resources consumed by an identity
- The combination of excessive permissions and the likelihood of exploitation (Correct answer)
- The number of API calls made per day
- The age of the IAM policy in days
Correct answer: The combination of excessive permissions and the likelihood of exploitation
The Entitlement Risk Score combines the breadth of excessive permissions with contextual factors like identity exposure to quantify overall risk.
CAD CyberArk Cloud Entitlements 2
Which CyberArk component specifically addresses the challenge of ephemeral cloud credentials that are short-lived and automatically rotated?