CAD Privileged Session Manager Setup 3 — Questions and Answers
Question 1: What is a PSM Connection Component responsible for?
- Defining how PSM connects to a specific target system type (e.g., RDP, SSH, Web) (Correct answer)
- Encrypting session recordings before storing them in the Vault
- Rotating credentials on target machines after each session
- Monitoring network traffic between PSM and the target
Correct answer: Defining how PSM connects to a specific target system type (e.g., RDP, SSH, Web)
A Connection Component defines the protocol, application, and parameters PSM uses to launch a session to a particular target system type.
Question 2: Where are PSM session recordings stored by default after a privileged session ends?
- In a network file share defined in PVWA
- In the CyberArk Vault as secure files linked to the account (Correct answer)
- On the PSM server's local disk indefinitely
- Directly in the SIEM platform
Correct answer: In the CyberArk Vault as secure files linked to the account
By default, PSM uploads session recordings to the CyberArk Vault, where they are stored securely and linked to the relevant account.
Question 3: Which PSM configuration parameter controls the maximum duration of an idle privileged session before automatic disconnection?
- MaxConnectionTime
- IdleTimeout (Correct answer)
- SessionTimeoutMinutes
- DisconnectOnIdle
Correct answer: IdleTimeout
The IdleTimeout parameter (configured in PSM settings) specifies how many minutes of inactivity are allowed before PSM automatically disconnects the session.
Question 4: When configuring a PSM platform in PVWA, which setting maps a platform to a specific Connection Component?
- AllowedSafes
- PSMConnectDomain
- ConnectionComponent (Correct answer)
- SessionRecordingMode
Correct answer: ConnectionComponent
The ConnectionComponent property in a platform definition tells PSM which connector to use when launching sessions for accounts in that platform.
Question 5: What must be configured in the Vault to allow PSM to retrieve credentials for a target account on behalf of a user?
- The PSM service account must be an Owner of the Safe containing the account
- The PSMConnect account must be added to the Safe with Retrieve permission (Correct answer)
- The account password must be stored in plain text format
- The target account must be in the built-in PSM Safe
Correct answer: The PSMConnect account must be added to the Safe with Retrieve permission
PSMConnect must have Retrieve (and List) permission on the Safe that holds the target account so it can fetch the password at session time.
Question 6: Which CyberArk feature allows a user to request a PSM session that must be approved by a manager before it is established?
- Dual Control (Ticketing Integration) (Correct answer)
- Access Control Lists on the platform
- Session Termination Policy
- Break-Glass Emergency Access
Correct answer: Dual Control (Ticketing Integration)
Dual Control requires a second authorizer to approve an access request before PSM will initiate the privileged session.
Question 7: In a high-availability PSM deployment, what is typically placed in front of multiple PSM servers to distribute session load?
- CyberArk Vault cluster
- Network Load Balancer (NLB) or Application Delivery Controller (Correct answer)
- Central Policy Manager
- Privileged Threat Analytics node
Correct answer: Network Load Balancer (NLB) or Application Delivery Controller
A Network Load Balancer or ADC distributes incoming RDP/SSH connections across multiple PSM servers to provide redundancy and load distribution.
CAD Privileged Session Manager Setup 3
What is a PSM Connection Component responsible for?