CAD CyberArk Cloud Entitlements 3

Question 1

In Azure, which identity type does CyberArk CEM primarily target when addressing non-human cloud entitlement risks?

Accepted Answer

Managed Identities and Service Principals

Answer

CEM focuses on Azure Managed Identities and Service Principals as the primary non-human identities that carry cloud workload permissions.

Question 2

What is the significance of 'cross-account access' risk in AWS as identified by CyberArk CEM?

Accepted Answer

A compromised identity in one account can leverage permissions to access resources in other accounts

Answer

Cross-account roles allow an identity compromised in one AWS account to pivot and access resources in other accounts, expanding the blast radius of a breach.

Question 3

How does CyberArk CEM handle multi-cloud environments when an organization uses AWS, Azure, and GCP simultaneously?

Accepted Answer

It provides a unified dashboard with normalized risk views across all three clouds

Answer

CEM offers a single unified interface that aggregates and normalizes entitlement data across AWS, Azure, and GCP for centralized visibility.

Question 4

Which AWS feature, when misconfigured, allows an attacker to escalate privileges by assuming roles beyond their intended scope?

Accepted Answer

IAM role trust policies with overly broad Principal definitions

Answer

An IAM role trust policy that allows any account or a wildcard principal to assume it can lead to privilege escalation across accounts or services.

Question 5

What remediation action does CyberArk CEM recommend when it detects an IAM user with long-standing unused access keys?

Accepted Answer

Deactivate or delete the unused access keys to eliminate stale credential risk

Answer

Stale, unused access keys represent persistent attack surfaces; CEM recommends deactivating or deleting them to reduce risk.

(CAD) CyberArk Defender Certification Practice Test

(CAD) CyberArk Defender Certification Practice Test

CAD CyberArk Cloud Entitlements 3