CAD Privileged Access Management Concepts 2 — Questions and Answers
Question 1: What is the primary purpose of a Privileged Session Manager (PSM) in CyberArk?
- To store privileged credentials in an encrypted vault
- To proxy and record privileged sessions without exposing credentials to end users (Correct answer)
- To automatically rotate passwords on a scheduled basis
- To scan the network for undiscovered privileged accounts
Correct answer: To proxy and record privileged sessions without exposing credentials to end users
PSM acts as a proxy between users and target systems, recording sessions while keeping credentials hidden from the end user.
Question 2: Which PAM control ensures that a privileged account password is changed immediately after each use?
- Dual control
- One-time password (OTP) rotation (Correct answer)
- Just-in-time provisioning
- Session isolation
Correct answer: One-time password (OTP) rotation
One-time password rotation changes credentials after every checkout, preventing reuse and limiting the window of exposure.
Question 3: In CyberArk, what is a 'Safe' used for?
- A firewall rule set protecting the Vault server
- A logical container within the Vault that stores accounts and applies access policies (Correct answer)
- A backup copy of the entire Vault database
- A network segment isolated from production systems
Correct answer: A logical container within the Vault that stores accounts and applies access policies
A Safe is the primary organizational and access-control unit inside the CyberArk Vault, grouping accounts with shared policies.
Question 4: What does 'least privilege' mean in the context of PAM?
- Granting users the minimum level of access required to perform their job functions (Correct answer)
- Encrypting all privileged credentials with the weakest acceptable algorithm
- Allowing privilege only during off-peak hours
- Restricting access to the fewest number of servers
Correct answer: Granting users the minimum level of access required to perform their job functions
Least privilege limits each user or process to only the permissions needed for their specific tasks, reducing the attack surface.
Question 5: What is 'credential theft' in the context of privileged access risks?
- Unauthorized copying of SSL certificates from a web server
- An attacker obtaining and misusing valid privileged account credentials (Correct answer)
- Accidental deletion of service account passwords
- Brute-forcing a non-privileged user account
Correct answer: An attacker obtaining and misusing valid privileged account credentials
Credential theft occurs when an attacker acquires legitimate privileged credentials and uses them to move laterally or escalate privileges.
Question 6: Which component in CyberArk is responsible for automatically discovering privileged accounts across the network?
- Central Policy Manager (CPM)
- Privileged Threat Analytics (PTA)
- Account Discovery (DNA / PVWA scan) (Correct answer)
- Privileged Session Manager (PSM)
Correct answer: Account Discovery (DNA / PVWA scan)
CyberArk's Discovery and Audit (DNA) tool and PVWA account discovery scans identify unmanaged privileged accounts across the environment.
Question 7: Why is it important to manage service accounts under a PAM solution?
- Service accounts never change passwords, making them low-risk
- Service accounts often have broad privileges and static passwords, making them high-value targets (Correct answer)
- Service accounts are only used for batch jobs and cannot be exploited interactively
- PAM solutions only support human user accounts, not service accounts
Correct answer: Service accounts often have broad privileges and static passwords, making them high-value targets
Service accounts frequently have excessive privileges and rarely-rotated passwords, making them prime targets for attackers seeking persistent access.
CAD Privileged Access Management Concepts 2
What is the primary purpose of a Privileged Session Manager (PSM) in CyberArk?