CAD PAM Basics 3 — Questions and Answers
Question 1: What is the purpose of the 'exclusive check-out' policy in CyberArk?
- Ensuring only one user at a time can retrieve and use a shared password (Correct answer)
- Preventing the CPM from rotating a password while it is in use
- Restricting access to the PVWA to a single administrator
- Locking a Safe so no new accounts can be added
Correct answer: Ensuring only one user at a time can retrieve and use a shared password
Exclusive check-out ensures that when one user has checked out a password, no other user can retrieve it until it is checked back in.
Question 2: Which principle does PAM primarily enforce when granting privileged access?
- Least privilege (Correct answer)
- Defense in depth
- Zero trust network access
- Separation of duties
Correct answer: Least privilege
PAM enforces least privilege by ensuring users have only the minimum level of access required to complete their tasks.
Question 3: What happens to a privileged account password by default after it is checked back into CyberArk?
- The CPM automatically rotates it to a new value (Correct answer)
- It remains unchanged until the next scheduled rotation
- It is deleted and re-created
- It is archived in an audit log
Correct answer: The CPM automatically rotates it to a new value
Upon check-in, the CPM rotates the password immediately (if configured for immediate change) so the checked-out value is no longer valid.
Question 4: Which CyberArk component provides a web-based interface for end users to request and manage privileged accounts?
- Password Vault Web Access (PVWA) (Correct answer)
- Central Policy Manager (CPM)
- Privileged Session Manager (PSM)
- Vault server
Correct answer: Password Vault Web Access (PVWA)
PVWA is the web portal through which users access, request, and manage privileged accounts stored in the Vault.
Question 5: What does 'account discovery' refer to in a PAM deployment?
- Automatically scanning the environment to find unmanaged privileged accounts (Correct answer)
- Creating new service accounts in Active Directory
- Assigning discovered accounts to CyberArk Safes
- Generating reports on privileged access usage
Correct answer: Automatically scanning the environment to find unmanaged privileged accounts
Account discovery scans networks, directories, and endpoints to identify privileged accounts that are not yet managed by the PAM solution.
Question 6: In CyberArk, what is a 'platform' in the context of account management?
- A template that defines how the CPM manages and rotates credentials for a specific system type (Correct answer)
- A physical server hosting the Vault
- A network zone containing privileged workstations
- A license tier for the CyberArk product
Correct answer: A template that defines how the CPM manages and rotates credentials for a specific system type
A platform is a policy template that specifies connection, rotation, and verification rules for a particular target system type (e.g., Windows, Unix, Oracle).
Question 7: Which attack does PAM most directly mitigate by isolating privileged sessions through a proxy?
- Lateral movement via compromised privileged credentials (Correct answer)
- Phishing attacks targeting end users
- SQL injection on web applications
- Distributed denial-of-service attacks
Correct answer: Lateral movement via compromised privileged credentials
PSM proxies privileged sessions so attackers who compromise an endpoint cannot use stolen credentials to move laterally to other systems.
CAD PAM Basics 3
What is the purpose of the 'exclusive check-out' policy in CyberArk?