CAD Vault Management 2 — Questions and Answers
Question 1: Which CyberArk Vault component is responsible for enforcing access control policies and logging all activity?
- Digital Vault (Correct answer)
- Password Vault Web Access
- PrivateArk Client
- Central Policy Manager
Correct answer: Digital Vault
The Digital Vault is the core component that enforces access control, encrypts stored credentials, and maintains an immutable audit log of all activity.
Question 2: In CyberArk, what is the purpose of the Safe's 'Expiration Date' property?
- It deletes all passwords in the Safe when reached
- It disables access to the Safe on the specified date (Correct answer)
- It triggers an alert to rotate all credentials in the Safe
- It archives the Safe contents to cold storage
Correct answer: It disables access to the Safe on the specified date
Setting an Expiration Date on a Safe disables all access to that Safe once the date is reached, preventing further use of stored credentials.
Question 3: What is the minimum number of Master CD keys required to reconstruct the Vault Encryption Key during disaster recovery?
- All provided Master CD keys (Correct answer)
- Any 2 of the provided keys
- Exactly 3 keys regardless of total
- Only the first Master CD key issued
Correct answer: All provided Master CD keys
All Master CD keys issued during Vault initialization must be used together to reconstruct the Vault Encryption Key for disaster recovery.
Question 4: Which Safe is used by CyberArk to store the Vault's own internal configuration and system accounts?
- System Safe
- VaultInternal Safe (Correct answer)
- PasswordManager Safe
- Notification Engine Safe
Correct answer: VaultInternal Safe
The VaultInternal Safe stores CyberArk's own system credentials and configuration data used internally by Vault services.
Question 5: A CyberArk administrator needs to prevent a specific user from accessing a Safe even though that user is a member of a group that has Safe access. What is the correct approach?
- Remove the user from the Active Directory group
- Add the user to the Safe with no permissions (Correct answer)
- Use a Safe Owner exclusion rule for that user
- Create a separate Safe with restricted membership
Correct answer: Add the user to the Safe with no permissions
Adding a user directly to a Safe with zero permissions overrides inherited group-level permissions, effectively blocking that individual's access.
Question 6: What does the CyberArk Vault 'dual control' workflow require before a password can be retrieved?
- Two separate LDAP authentications by the requester
- Approval from at least one authorized Safe Owner or approver (Correct answer)
- Confirmation from both the CPM and the PVWA
- Digital signature from two Vault administrators
Correct answer: Approval from at least one authorized Safe Owner or approver
Dual control requires that one or more designated approvers authorize a password request before the requester can view or use the credential.
Question 7: Which CyberArk Vault log file records all administrative operations performed on the Vault server itself?
- italog.log
- vault.log (Correct answer)
- dbparam.ini
- PVConfiguration.xml
Correct answer: vault.log
vault.log is the primary Vault server log that records operational events, errors, and administrative actions performed on the Vault service.
CAD Vault Management 2
Which CyberArk Vault component is responsible for enforcing access control policies and logging all activity?