CAD CyberArk Cloud Entitlements 2

Question 1

Which CyberArk component specifically addresses the challenge of ephemeral cloud credentials that are short-lived and automatically rotated?

Accepted Answer

Cloud Entitlements Manager (CEM)

Answer

CEM is designed to discover, analyze, and remediate cloud entitlements including short-lived ephemeral credentials across cloud environments.

Question 2

In AWS, what is the primary risk associated with overly permissive IAM roles attached to Lambda functions?

Accepted Answer

Excessive access if the function is compromised or misconfigured

Answer

Overly permissive IAM roles on Lambda functions can allow an attacker to pivot across AWS services if the function is exploited.

Question 3

CyberArk Cloud Entitlements Manager uses what methodology to determine the minimum permissions a cloud identity actually requires?

Accepted Answer

Usage analytics and activity monitoring

Answer

CEM analyzes actual usage patterns and activity logs to calculate the effective minimum permissions needed, enabling least-privilege enforcement.

Question 4

What is a 'shadow permission' in the context of CyberArk Cloud Entitlements Manager?

Accepted Answer

An effective permission derived indirectly through role chaining or group membership

Answer

Shadow permissions are effective access rights that arise indirectly through role chaining, group memberships, or policy inheritance rather than direct assignment.

Question 5

When CyberArk CEM generates a 'right-sized' policy recommendation, what should an administrator do before applying it in production?

Accepted Answer

Review the recommendation and test it in a non-production environment first

Answer

Right-sized policy recommendations should always be reviewed and tested in a staging environment before production deployment to avoid unintended access disruptions.

(CAD) CyberArk Defender Certification Practice Test

(CAD) CyberArk Defender Certification Practice Test

CAD CyberArk Cloud Entitlements 2