You want to add an additional maintenance user on the PSM for SSH. How can you accomplish this if InstallCyberarkSSHD is set to Integrated?
Answer(s): A
The correct answer is A: Create a local user and add it to the PSMP_MaintenanceUsers Group. Here's why:CyberArk's PSM for SSH utilizes the InstallCyberarkSSHD parameter to define how the PSM SSH daemon interacts with the underlying system's SSH daemon. When InstallCyberarkSSHD is set to Integrated , the PSMSSH daemon integrates more tightly with the system's native SSH configuration. This means that authentication and authorization are largely delegated to the system's SSH mechanisms.The PSMP_MaintenanceUsers group is a pre-defined local group in CyberArk's implementation, specifically designated to grant maintenance access to the PSM for SSH. Users belonging to this group are authorized to perform administrative tasks and troubleshoot PSM for SSH-related issues. This approach aligns with the principle of least privilege, granting only necessary access to authorized users.Option B is incorrect because hardcoding usernames like "proxymaster" and modifying PAM configuration directly, specifically the auth-password file, is not the recommended or supported method for managing PSMfor SSH maintenance users. Manual modifications can introduce security vulnerabilities and are difficult to maintain.Option C is incorrect because, although the AllowGroups parameter in /etc/sshd_config controls which groups are allowed to SSH into the system, it doesn't specifically define maintenance users for PSM for SSH. Using it might grant SSH access but not the specific maintenance privileges required by PSM.Option D is incorrect because while the name suggests management user, it’s not the designated method, The correct method relies on the PSMP_MaintenanceUsers group for the defined maintenance operations.Furthermore, modifying PAM configurations directly is generally discouraged for security reasons.By adding a local user to the PSMP_MaintenanceUsers group, you are leveraging CyberArk's built-in mechanisms for managing maintenance access, maintaining security and simplifying administration. This ensures that the user is properly authorized and can perform necessary tasks without compromising the system's integrity.For further research:CyberArk PSM for SSH documentation (official CyberArk documentation should be reviewed for specifics related to your environment). Look for sections on installation, configuration, and user management.
What is determined by the 'MaxConcurrentConnections' setting within a platform?
The 'MaxConcurrentConnections' setting within a CyberArk platform specifically governs the number of simultaneous connections established by the Central Policy Manager (CPM) when managing accounts associated with that platform. This is a crucial parameter for controlling the load and preventing performance bottlenecks when the CPM performs tasks such as password changes, verifications, and reconciliations on numerous target systems concurrently.Option A is correct because the CPM directly interacts with remote machines to execute these privileged access management tasks. It opens connections to the target systems defined in the platform to change passwords, verify account status, and reconcile discrepancies between the Vault and the target account.Option B is incorrect. While the PSM (Privileged Session Manager) facilitates user connections to target systems, 'MaxConcurrentConnections' doesn't directly limit PSM connections within a platform configuration. PSM connection management is handled through separate settings and resource limitations.Option C is incorrect because account-specific connection limitations are typically managed through access control policies and not via platform-level settings. Platform settings generally affect all accounts managed under that platform's configuration.Option D is not directly relevant. While audit activities are important, 'MaxConcurrentConnections' primarily addresses the concurrent connection management during CPM operations on target systems and not Vault connection limitations related to audit logging. The limitation of the number of vault connections is managed by other vault policies.Therefore, 'MaxConcurrentConnections' is a critical parameter for optimizing the CPM's operations and preventing performance degradation when managing privileged accounts across diverse platforms.For further research, consult the official CyberArk documentation:CyberArk Documentation: Search for "MaxConcurrentConnections" within the CyberArk documentation portal relevant to your CyberArk version.While a specific URL may vary depending on the documentation version, searching the CyberArk documentation for the term will provide definitive information.
You are configuring an integration to provision users based on LDAP directory services for Privileged Cloud Shared Services. Which component must first be installed and configured in the environment to support this?
The correct answer is CyberArk Identity Connector because it acts as the bridge between your on-premises LDAP directory and the CyberArk Privilege Cloud. User provisioning from LDAP to Privilege Cloud Shared Services requires a mechanism to synchronize user identities and attributes. The CyberArk Identity Connector serves precisely this purpose. It securely connects to your LDAP directory, authenticates, and retrieves user information. This information is then synchronized with Privilege Cloud, allowing you to provision users based on their existing LDAP accounts.Without the CyberArk Identity Connector, Privilege Cloud would lack the necessary connection to your LDAP directory to perform user provisioning. Secure Tunnel is used for securing communication channels, Privilege Cloud Connector is related to connecting to on-premises resources managed by Privilege Cloud, and Linux Connector Server manages SSH keys in privileged access management and do not primarily handle LDAP user provisioning. The CyberArk Identity Connector allows Privilege Cloud to understand user attributes, group memberships, and other relevant data from your LDAP directory, making it central to automated user provisioning. It's the initial component required to establish this integration before any user provisioning can take place from LDAP.The connector facilitates secure communication and data transfer between the on-premises environment and the cloud, adhering to security best practices. It usually supports features like attribute mapping, allowing you to define how LDAP attributes are translated into Privilege Cloud user properties. Therefore, it is the fundamental component for integrating with LDAP for user provisioning in Privilege Cloud Shared Services.https://docs.cyberark.com/Product-Doc/OnlineHelp/PrivCloud/Latest/en/Content/Integrations/Identity-Connector.htmhttps://docs.cyberark.com/Product-Doc/OnlineHelp/idaptive/Latest/en/Content/CoreServices/ConfiguringIdentityConnector.htm
You are implementing LDAPS Integration for a standard Privilege Cloud environment. Which information must be provided to the CyberArk Privilege Cloud support team through a Service Request? (Choose two.)
Answer(s): A,D
The correct answers are A. LDAPS certificate chain for all domain controllers to be integrated and D. Fully Qualified Domain Name and IP Address of the domain controllers to be integrated.Here's why:LDAPS Certificate Chain (A): LDAPS (LDAP over SSL/TLS) requires a valid certificate chain to establish a secure, encrypted connection between the Privilege Cloud environment and the domain controllers. This chain of trust verifies the identity of the domain controllers and prevents man-in-the-middle attacks. The certificate chain ensures that the Privilege Cloud can trust the authenticity of the domain controllers it's communicating with. Without the proper certificate, the secure connection cannot be established, and the integration will fail.Microsoft Documentation on LDAPS Certificate RequirementsFully Qualified Domain Name (FQDN) and IP Address of Domain Controllers (D): To integrate with the domain controllers, the Privilege Cloud environment needs to know the specific servers it should connect to. FQDN and IP Address provide that crucial connectivity information. The FQDN allows for DNS resolution, while the IP address enables direct communication. This allows the CyberArk solution to route traffic correctly to the intended servers. Without these, the Privilege Cloud system would not be able to find the domain controllers and establish a connection.Active Directory Domain Naming RequirementsWhy the other options are incorrect:B: LDAP bind username and password: While a bind account is needed for LDAP integration, this information is typically configured within the CyberArk Privilege Cloud environment itself (e.g., in the Directory Mapping configuration) after the connectivity is established. You generally wouldn't provide the bind password directly to CyberArk support via a service request, as this would raise security concerns. C. Domain Base Context: Similar to the bind account, the Domain Base Context (e.g., "DC=example,DC=com") is typically configured within the CyberArk Privilege Cloud environment during the directory integration setup, not directly provided via a service request for initial LDAPS setup. E. Remote port set during secure tunnel configuration: This information might be relevant if a secure tunnel or proxy is used for connection but is not a standard requirement for LDAPS integration. It is not necessarily provided for every integration of Privilege Cloud.In summary, successful LDAPS integration fundamentally relies on a secure connection established using verified certificates and the correct addressing of the domain controllers. These pieces of information would be crucial to ensure the initial setup of the LDAPS environment can be done by the CyberArk support team.
Which file must you edit to ensure the PSM for SSH server is not hardened automatically after installation?
Answer(s): C
The correct answer is C. psmpparms .The psmpparms file (short for PSM Parameters) is a critical configuration file used during the Privilege SessionManager (PSM) installation and hardening process. It dictates specific parameters and behaviors of the PSM server after it's installed. It directly influences how the PSM is configured and what hardening steps are applied. Specifically, this file contains parameters which control the post-installation scripts that perform the automated hardening.By modifying this file before running the PSM installation, you can customize or disable various hardening steps. For example, you could comment out or modify lines relating to SSH hardening, which would prevent the automatic application of these configurations. This is crucial in environments where custom configurations or specific security requirements necessitate manual adjustments to the hardening baseline.The other options are incorrect. vault.ini is the primary Vault configuration file. user.cred is related to user credentials. psmgw.config configures the PSM Gateway. While these files are all part of the CyberArk infrastructure, they are not the control point to prevent the automatic hardening of the PSM for SSH server during the initial installation process. The psmpparms file is the central configuration location that determines whether or not the post-installation hardening process runs and what parameters are used. Therefore, editing psmpparms is the only way to reliably control this behavior.For further information on PSM configuration and hardening best practices, refer to the official CyberArk documentation, which is usually accessible through the CyberArk support portal (requires login) or the CyberArk Marketplace.
When creating a new safe, if you select 'Save account versions for a period of days' within 'Version Retention' settings, what is the default number of days that password versions are saved?
The correct answer is indeed C. 30. When configuring a new safe within CyberArk's Privilege Cloud and enabling the "Save account versions for a period of days" option within the "Version Retention" settings, the default retention period for password versions is 30 days.This default setting provides a balance between maintaining a reasonable historical record for auditing, troubleshooting, and potential recovery scenarios, while simultaneously preventing excessive storage consumption due to accumulating numerous password versions. CyberArk, as a leading provider of privileged access management (PAM) solutions, emphasizes security best practices, including version control of privileged credentials. Password versioning ensures that if a compromised account is suspected, administrators can revert to a previously known-good password. Retaining password versions also aids in forensic analysis and understanding the evolution of account security over time.Choosing the appropriate retention period is crucial. While longer retention periods offer greater historical context, they also increase storage requirements and potentially impact performance. Shorter retention periods reduce storage costs but limit the ability to recover from long-term compromises or conduct thorough investigations. CyberArk allows customization of this setting to meet specific organizational needs and compliance requirements, making the 30-day default a sensible starting point. The default of 30 days aligns with common industry compliance guidelines requiring audit logs to be retained for a defined period to facilitate security investigations. Understanding this default and its implications is essential for implementing a robust and efficient privileged access management strategy within the CyberArk ecosystem.For further information regarding safe creation and version retention settings, consult the official CyberArk documentation:CyberArk Privilege Cloud Documentation: https://docs.cyberark.com/ (Navigate to the relevant section within Privilege Cloud documentation regarding safe management and version retention.) While there isn't one specific page, searching the documentation for "safe creation" and "version retention" will yield the relevant settings and details.
Which group has only View Audit and View Safe permissions?
Answer(s): B
The correct answer is B. Auditors .Auditors, by definition, require access to audit logs and privileged access management data to perform their duties of reviewing and verifying security practices and compliance. The core function of an auditor is to examine existing records without making changes. Therefore, they primarily need "View" permissions."View Audit" permission allows the group to access and review audit logs, providing a history of actions performed within the Privilege Cloud environment. "View Safe" permission grants access to see the existence and metadata of Safes (secure repositories for credentials and other secrets), but not the contents within unless explicitly granted.Operators, Privileged Cloud Admins, and Backup Users, while they might require some auditing capabilities, also need permissions beyond just viewing. Operators typically manage day-to-day operations and require the ability to perform actions beyond merely viewing audit data and Safe information. Privileged Cloud Admins require extensive permissions to manage the entire Privilege Cloud environment. Backup Users need permissions to create and restore backups, which requires more than just viewing capabilities.Auditors, by design, are usually granted the least privileged access necessary to perform their jobs. Their primary concern is reviewing existing information, making "View Audit" and "View Safe" permissions the most fitting combination. Providing them with the ability to make changes or access highly sensitive information could create a conflict of interest. This aligns with the principle of least privilege, a fundamental security best practice in cloud computing.Therefore, the Auditors group is the only group listed where the combined "View Audit" and "View Safe" permissions are both necessary and sufficient for their defined role, making it the correct answer. They need to see audit logs and the existence of Safes to perform their compliance duties, but they shouldn't be managing or administering the system.Further reading:CyberArk Documentation (Least Privilege): Search the CyberArk official documentation for "least privilege" concepts within Privilege Cloud for a deeper understanding of permission design. NIST SP 800-53 (Access Control): National Institute of Standards and Technology (NIST) Special Publication 800-53 provides access control guidance that supports the role of auditors with view-only permissions. (Search on nist.gov)
What is recommended when applying GPO (Group Policy Object) hardening for in-domain PSM servers?
Answer(s): D
D is correct because placing in-domain PSM servers into a dedicated OU allows precise, minimal-scope GPO targeting, controlled inheritance, and delegated administration required for consistent, auditable hardening of privileged bastion hosts.Reasoning: A dedicated OU provides a singular scope for applying security baselines and PSM-specific GPOs so policies do not conflict with broader domain or workstation policies; this minimizes configuration drift and unintended behavior that can compromise session capture, credential isolation, or monitoring. It enables use of blocking inheritance, enforced GPOs, and link order determinism within a confined container, which simplifies validation, change control, and rollbacks — critical for high-assurance components. Segregation also supports least-privilege delegation (separating PSM management from general server administration), and eases auditing and compliance evidence collection by narrowing the object set. Finally, OU placement is aligned with Microsoft Group Policy processing and enterprise security architecture guidance for applying server hardening consistently and predictably.Why the other options are incorrect:A: Apply the GPO provided by CyberArk onto the servers after other GPOs. — Ordering a single GPO “after” others does not prevent conflicting settings from domain or higher-level GPOs and can create fragile dependencies; dedicated OU scoping and explicit link/enforcement is the robust solution. B. Apply the GPO hardening to all hosts that end-users will connect to through the PSM. — Broad application expands attack surface and risks breaking user workflows and endpoint functionality; hardening should be targeted to the PSM servers and any specific gateway hosts, not all remote hosts users may access.C: After installation, remove the PSM servers from the domain to maximize security. — Removing from the domain prevents AD integration required for authentication, policy management, centralized auditing, and easy certificate/patch management; isolation should be achieved via OU design, network segmentation, and hardened configuration rather than losing domain services.References: https://docs.cyberark.com/Product-Doc/OnlineHelp/Latest/en/Content/Resources/Privileged-Session-Manager/PSM-Hardening.htmhttps://learn.microsoft.com/en-us/troubleshoot/windows-server/group-policy/group-policy-processing-overviewhttps://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/organizational-units
References: https://docs.cyberark.com/Product-Doc/OnlineHelp/Latest/en/Content/Resources/Privileged-Session-Manager/PSM-Hardening.htmhttps://learn.microsoft.com/en-us/troubleshoot/windows-server/group-policy/group-policy-processing-overviewhttps://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/organizational-units
Post your Comments and Discuss CyberArk CPC-SEN exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CPC-SEN content, but please register or login to continue.