CAD Privileged Access Management Concepts 3 — Questions and Answers
Question 1: What is 'lateral movement' in the context of a privileged access attack?
- Moving data between on-premises and cloud environments
- An attacker using compromised credentials to access additional systems within the network (Correct answer)
- Rotating privileged accounts across multiple Safes
- Transferring session recordings between PSM nodes
Correct answer: An attacker using compromised credentials to access additional systems within the network
Lateral movement is the technique attackers use to progressively move through a network after gaining initial access, often leveraging stolen privileged credentials.
Question 2: Which CyberArk component enforces password policies and performs automatic password changes on target systems?
- PVWA (Password Vault Web Access)
- PSM (Privileged Session Manager)
- CPM (Central Policy Manager) (Correct answer)
- PTA (Privileged Threat Analytics)
Correct answer: CPM (Central Policy Manager)
The CPM is responsible for enforcing platform-specific password policies and executing automated credential rotation on managed accounts.
Question 3: What is 'dual control' in CyberArk PAM?
- Requiring two separate encryption keys to access the Vault
- A workflow where a second authorized user must approve a password request before it is granted (Correct answer)
- Using two CPM nodes to ensure high availability
- Splitting a password into two halves stored in separate Safes
Correct answer: A workflow where a second authorized user must approve a password request before it is granted
Dual control requires an approver to authorize a requestor's access before the Vault releases the credential, enforcing four-eyes verification.
Question 4: What is the difference between authentication and authorization in PAM?
- Authentication checks what a user can do; authorization verifies who they are
- Authentication verifies identity; authorization determines what resources the verified identity may access (Correct answer)
- Both terms describe the same process in PAM contexts
- Authentication applies only to humans; authorization applies only to service accounts
Correct answer: Authentication verifies identity; authorization determines what resources the verified identity may access
Authentication confirms identity (who you are), while authorization enforces permissions (what you are allowed to do) after identity is confirmed.
Question 5: In CyberArk, what is a 'platform' in the context of account management?
- The operating system running the CyberArk Vault server
- A template that defines how CyberArk manages and interacts with a specific type of account or system (Correct answer)
- The hardware appliance on which PSM is installed
- A cloud provider integration (AWS, Azure, GCP)
Correct answer: A template that defines how CyberArk manages and interacts with a specific type of account or system
A CyberArk platform is a policy template that specifies connection methods, password rules, and management settings for a particular account type or target system.
Question 6: Which of the following best describes 'privileged access workstations (PAWs)'?
- Servers dedicated to storing privileged credentials
- Hardened endpoints reserved exclusively for performing privileged administrative tasks (Correct answer)
- Workstations that are given elevated network permissions automatically
- Jump servers that record all incoming RDP sessions
Correct answer: Hardened endpoints reserved exclusively for performing privileged administrative tasks
PAWs are dedicated, hardened devices from which admins perform privileged tasks, reducing the risk of credential theft from general-purpose endpoints.
Question 7: What risk does an unmanaged 'local administrator' account on endpoints pose?
- It automatically syncs with Active Directory and can cause directory corruption
- It provides attackers with a persistent, often shared credential to move laterally across endpoints (Correct answer)
- It increases storage requirements in the CyberArk Vault
- It prevents CyberArk CPM from rotating domain passwords
Correct answer: It provides attackers with a persistent, often shared credential to move laterally across endpoints
Shared local admin accounts (e.g., same password across many machines) enable lateral movement once an attacker compromises any single endpoint.
CAD Privileged Access Management Concepts 3
What is 'lateral movement' in the context of a privileged access attack?