CAD Privileged Session Manager Setup 2 — Questions and Answers
Question 1: Which Windows feature must be enabled on the PSM server to support Remote Desktop Protocol connections from end users?
- Remote Desktop Services (Terminal Services) (Correct answer)
- Windows Remote Management (WinRM)
- Internet Information Services (IIS)
- DirectAccess and VPN
Correct answer: Remote Desktop Services (Terminal Services)
PSM relies on Remote Desktop Services (Terminal Services) to host user sessions on the PSM server and redirect them to target systems.
Question 2: What is the purpose of the PSMConnect domain user account created during PSM installation?
- It is the service account that runs the PSM Windows service
- It is used to log users into RDP sessions on the PSM server (Correct answer)
- It manages password rotation for target accounts
- It authenticates PSM to the Vault for API calls
Correct answer: It is used to log users into RDP sessions on the PSM server
PSMConnect is a dedicated domain account used to establish RDP sessions on the PSM server on behalf of connecting users.
Question 3: During PSM hardening, which of the following is restricted to prevent data leakage from a privileged session?
- Clipboard redirection and drive mapping (Correct answer)
- DNS resolution on the PSM server
- TLS certificate validation for Vault connections
- LDAP queries for Active Directory lookups
Correct answer: Clipboard redirection and drive mapping
PSM hardening disables clipboard redirection and drive mapping to prevent users from copying data out of privileged sessions.
Question 4: Which CyberArk component must PSM communicate with to retrieve target account credentials during session initiation?
- Password Vault Web Access (PVWA)
- Central Policy Manager (CPM)
- CyberArk Vault (Digital Vault) (Correct answer)
- Privileged Threat Analytics (PTA)
Correct answer: CyberArk Vault (Digital Vault)
PSM connects directly to the CyberArk Vault to retrieve the target account's password at session initiation time.
Question 5: What is the role of the PSMAdminConnect account in a PSM deployment?
- It is used by CyberArk support to shadow active sessions for troubleshooting (Correct answer)
- It rotates passwords for all PSM-managed target accounts
- It installs application connectors on remote target servers
- It synchronizes session recordings to an external SIEM
Correct answer: It is used by CyberArk support to shadow active sessions for troubleshooting
PSMAdminConnect is a privileged domain account that allows authorized admins or CyberArk support to shadow (monitor) live sessions.
Question 6: In PSM for SSH (PSMP), what protocol does the end user use to connect to the PSMP server?
- RDP over TCP 3389
- SSH over TCP 22 (Correct answer)
- HTTPS over TCP 443
- Telnet over TCP 23
Correct answer: SSH over TCP 22
PSMP proxies SSH connections, so users connect to the PSMP server using standard SSH on port 22.
Question 7: Which file on the PSM server defines the connection components and their associated application connectors?
- PVConfiguration.xml
- basic_psm.ini (Correct answer)
- PSMConfigSample.xml
- Web.config
Correct answer: basic_psm.ini
basic_psm.ini (and its variants) on the PSM server holds configuration for connection components, dispatcher settings, and recorder options.
CAD Privileged Session Manager Setup 2
Which Windows feature must be enabled on the PSM server to support Remote Desktop Protocol connections from end users?