I85PREP
⌘ K
BeyondTrust Password Safe study materials
BeyondTrust Password Safe study resources

BeyondTrust Password Safe practice questions

One question at a time. Build your BeyondTrust Password Safe understanding.

First 50 of 199 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Password Safe Fundamentals and Architecture

In BeyondTrust Password Safe, what is the primary purpose of the Password Safe appliance?

  1. To serve as the primary DNS resolver for the domain
  2. To broker, store, and control privileged account credentials Correct answer.
  3. To provide network address translation for internal subnets
  4. To replace the endpoint antivirus agent on managed servers

Explanation

Password Safe is a privileged access management appliance whose core job is to vault privileged credentials, rotate them, and broker sessions so administrators never see plaintext passwords. It is not a general-purpose network or endpoint security product.

Question 2Password Safe Fundamentals and Architecture

Which component initiates the request when an administrator checks out a password from Password Safe?

  1. The managed system's local agent
  2. The domain controller's LDAP service
  3. The target server's SSH daemon
  4. The Password Safe client or web interface Correct answer.

Explanation

Users interact with Password Safe through the web interface or installed client, which submits the checkout request to the appliance. The appliance then evaluates policy and releases or launches the credential.

Question 3Password Safe Fundamentals and Architecture

What does the term 'managed system' refer to in a Password Safe deployment?

  1. The endpoint from which administrators launch sessions
  2. The syslog server that receives audit records
  3. A target device whose privileged accounts are vaulted and rotated Correct answer.
  4. The appliance that stores the encrypted credential database

Explanation

A managed system is any target asset, such as a server, network device, or database, whose privileged accounts Password Safe controls. The appliance manages those accounts on the remote device.

Question 4Password Safe Fundamentals and Architecture

Which statement best describes how Password Safe stores vaulted credentials?

  1. Encrypted at rest using keys protected by the appliance Correct answer.
  2. Stored only in the memory of the client workstation
  3. Hashed with a one-way function and never recoverable
  4. In plaintext within a hardened database table

Explanation

Credentials must be recoverable for checkout and rotation, so they are encrypted at rest rather than hashed. The encryption keys are protected by the appliance so that database access alone does not expose secrets.

Question 5Password Safe Fundamentals and Architecture

What is the function of a Functional Account in Password Safe?

  1. A read-only reporting account for auditors
  2. A user account that approves access requests
  3. A privileged account the appliance uses to perform rotation on managed systems Correct answer.
  4. A temporary account created for each session

Explanation

Functional accounts are the privileged credentials Password Safe itself uses to connect to a managed system and change passwords or SSH keys. They are distinct from the accounts being managed.

Question 6Password Safe Fundamentals and Architecture

Which access method lets a user connect to a target system without ever viewing the credential?

  1. Password checkout with copy to clipboard
  2. Manual password reveal with approval
  3. Export of the credential to a CSV file
  4. Remote session brokering through the appliance Correct answer.

Explanation

Session brokering proxies the connection through Password Safe so the credential is injected on the user's behalf. This keeps the secret hidden while still recording the session for audit.

Question 7Password Safe Fundamentals and Architecture

What is the role of an Access Policy in Password Safe?

  1. It determines the retention period for session recordings
  2. It defines which users may access which accounts under what conditions Correct answer.
  3. It configures the appliance's network interface addresses
  4. It sets the TCP port used for RDP connections

Explanation

Access policies bind users or groups to managed accounts and specify conditions such as approval requirements and time windows. They are the central authorization mechanism for credential release.

Question 8Password Safe Fundamentals and Architecture

An administrator needs a credential only for the next two hours. Which Password Safe feature best enforces that limit automatically?

  1. A managed system group with inheritance
  2. A checkout duration or release policy on the access policy Correct answer.
  3. A functional account with a long password
  4. A password rule that forces complexity

Explanation

Checkout duration settings on the access policy automatically expire a released credential after a defined period. This limits the window in which a user holds the plaintext password.

Question 9Password Safe Fundamentals and Architecture

What is the purpose of password rotation in Password Safe?

  1. To synchronize user passwords with the directory
  2. To refresh the appliance's TLS certificate
  3. To periodically change managed credentials so exposure windows stay short Correct answer.
  4. To re-encrypt the appliance database on a schedule

Explanation

Rotation changes managed account passwords on a schedule or on demand, reducing the value of any leaked credential. Password Safe uses functional accounts to perform the change on the target.

Question 10Password Safe Fundamentals and Architecture

Which statement accurately distinguishes Password Safe from a typical password manager for end users?

  1. Password Safe cannot integrate with directories
  2. Password Safe is designed only for personal web logins
  3. Password Safe stores credentials unencrypted for speed
  4. Password Safe targets shared privileged accounts with brokering and audit Correct answer.

Explanation

Password Safe is built for privileged, often shared, accounts and adds session brokering, approval workflows, and detailed auditing. Consumer password managers focus on individual secrets without those controls.

Question 11Password Safe Fundamentals and Architecture

How does Password Safe typically obtain user identities for authentication?

  1. By issuing local accounts that replace directory accounts
  2. By integrating with directory services such as Active Directory Correct answer.
  3. By relying on self-registration by each user
  4. By importing a static list of usernames from a spreadsheet

Explanation

Password Safe integrates with directory services so users authenticate with existing enterprise identities and group membership. This avoids duplicate account management and supports centralized deprovisioning.

Question 12Password Safe Fundamentals and Architecture

What does the Password Safe audit trail primarily record?

  1. Only failed login attempts to the appliance
  2. The performance counters of managed systems
  3. The firmware version history of network switches
  4. Credential checkouts, approvals, rotations, and session activity Correct answer.

Explanation

The audit trail captures privileged activity such as who checked out which account, approvals, rotation results, and session recordings. This supports compliance reporting and forensic review.

Question 13Password Safe Fundamentals and Architecture

A security team wants keystroke-level visibility into what administrators do on target servers. Which Password Safe capability addresses this?

  1. Managed system discovery scans
  2. Session recording and playback Correct answer.
  3. Password complexity rules
  4. Certificate-based appliance login

Explanation

Session recording captures the proxied session so reviewers can replay exactly what occurred on the target. This provides accountability beyond simple checkout logs.

Question 14Password Safe Fundamentals and Architecture

Which deployment consideration is specific to placing a Password Safe appliance in a segmented network?

  1. It must hold the forest-wide schema master role
  2. It must be the DHCP server for the segment
  3. It must terminate all outbound internet traffic
  4. It must reach managed systems on required protocols for rotation and brokering Correct answer.

Explanation

The appliance needs network paths to managed systems for password changes and proxied sessions, so firewall rules must permit those protocols. Without reachability, rotation and brokering fail.

Question 15Password Safe Fundamentals and Architecture

What is the difference between a managed account and a functional account?

  1. Managed accounts are stored outside the vault; functional accounts are stored inside
  2. Managed accounts are rotated by the appliance; functional accounts perform that rotation Correct answer.
  3. Managed accounts are temporary; functional accounts are permanent user identities
  4. Managed accounts belong to auditors; functional accounts belong to vendors

Explanation

Managed accounts are the privileged credentials the vault protects and rotates. Functional accounts are the credentials the appliance itself uses to log in and carry out that rotation.

Question 16Password Safe Fundamentals and Architecture

Why does Password Safe support approval workflows before credential release?

  1. To eliminate the need for access policies
  2. To add a human authorization gate for sensitive accounts Correct answer.
  3. To improve the speed of password rotation
  4. To reduce the storage footprint of the database

Explanation

Approval workflows require a designated approver to authorize a checkout, adding separation of duties for highly sensitive accounts. They complement, rather than replace, access policies.

Question 17Password Safe Fundamentals and Architecture

Which scenario best demonstrates least privilege in Password Safe?

  1. Users receive access only to the accounts their role requires Correct answer.
  2. Every administrator can check out every account in the vault
  3. Approvals are disabled so access is faster
  4. All accounts share one common password for simplicity

Explanation

Least privilege means granting each user access only to the accounts needed for their duties, enforced through scoped access policies. Broad vault-wide access violates this principle.

Question 18Password Safe Fundamentals and Architecture

What happens when a scheduled rotation fails because the functional account password is outdated?

  1. The managed password silently stays unchanged and the failure is logged Correct answer.
  2. The vault reverts to a plaintext storage mode
  3. The appliance automatically deletes the managed system
  4. The access policy is permanently disabled

Explanation

A failed rotation leaves the managed credential as it was and generates an audit or alert entry so administrators can remediate. The appliance does not take destructive action on the target.

Question 19Password Safe Fundamentals and Architecture

Which protocol is commonly used by Password Safe to broker remote sessions to Windows servers?

  1. SMTP
  2. SNMP
  3. NTP
  4. RDP Correct answer.

Explanation

Remote Desktop Protocol is the standard means of brokering interactive sessions to Windows targets through the appliance. The proxy injects credentials so the user never sees them.

Question 20Password Safe Fundamentals and Architecture

What is the benefit of grouping managed systems in Password Safe?

  1. It automatically patches the operating systems of the targets
  2. It removes the need for any access policy
  3. It encrypts each system with a unique hardware key
  4. It allows policies and functional accounts to be applied consistently across many assets Correct answer.

Explanation

Grouping lets administrators apply access policies, functional accounts, and rotation settings to many systems at once. This reduces administrative overhead and configuration drift.

Question 21Password Safe Fundamentals and Architecture

Which statement about Password Safe's high availability design is most accurate?

  1. It relies on client workstations to replicate the vault
  2. It requires no database and stores everything in flat files
  3. It can be deployed with redundant appliances backed by a shared database Correct answer.
  4. It runs only as a single appliance with no redundancy option

Explanation

Password Safe supports redundant appliance deployments backed by a shared database so service continues if one node fails. Clients connect to the available appliance without losing vault access.

Question 22Password Safe Fundamentals and Architecture

Why should the Password Safe appliance itself be protected by strong administrative controls?

  1. Because the appliance cannot be patched
  2. Because the appliance has no audit logging
  3. Because the appliance stores only public certificates
  4. Because compromise of the appliance could expose all vaulted credentials Correct answer.

Explanation

The appliance holds the keys and data protecting every managed credential, making it a high-value target. Strong administrative controls and monitoring reduce the risk of a catastrophic vault compromise.

Question 23Password Safe Fundamentals and Architecture

What does 'check-in' mean in the Password Safe credential lifecycle?

  1. Deleting the managed account from the target system
  2. Creating a new functional account for rotation
  3. Assigning an approver to an access policy
  4. Returning a checked-out credential so the vault regains exclusive control Correct answer.

Explanation

Check-in returns a released credential to the vault's control, often triggering a rotation so the user's copy becomes invalid. This closes the exposure window opened by checkout.

Question 24Password Safe Fundamentals and Architecture

Which factor most directly determines whether a user can retrieve a password without an approval step?

  1. The version of the target operating system
  2. The configuration of the applicable access policy Correct answer.
  3. The number of managed systems in the vault
  4. The size of the appliance's disk volume

Explanation

The access policy defines whether approval is required, who may approve, and under what conditions. Other environmental factors do not change the authorization decision.

Question 25Password Safe Fundamentals and Architecture

An auditor asks how Password Safe proves that a specific administrator accessed a root account last month. Which evidence is most direct?

  1. The network switch's MAC address table
  2. The audit record of checkout and associated session recording Correct answer.
  3. The target server's package installation log
  4. The appliance's CPU utilization graph

Explanation

Audit records tie a specific user to a checkout event, and session recordings show what occurred during the brokered connection. Together they provide direct, attributable evidence.

Question 26Password Safe Fundamentals and Architecture

Which component of Password Safe is responsible for storing encrypted credentials and policy data?

  1. The remote session client on the admin workstation
  2. The central Password Safe appliance or cluster Correct answer.
  3. The end-user browser plug-in
  4. The target server's local security authority

Explanation

Password Safe uses a hardened central appliance (or clustered appliances) as the system of record, holding the encrypted credential vault, policy definitions, and audit data. Clients and target systems do not store the authoritative vault contents.

Question 27Password Safe Fundamentals and Architecture

In Password Safe, what does a managed system represent?

  1. A backup appliance used for disaster recovery
  2. A target host whose accounts Password Safe controls and rotates Correct answer.
  3. A network segment defined for session isolation
  4. A directory group synchronized from an identity provider

Explanation

A managed system is the record of a target host (server, network device, database) that Password Safe administers, and its associated accounts are the credentials under management. Grouping managed systems organizes them for policy assignment.

Question 28Password Safe Fundamentals and Architecture

Which statement best describes the Password Safe functional account?

  1. An account that only reads audit logs
  2. A privileged account on a target used by Password Safe to perform password changes Correct answer.
  3. A shared account that end users retrieve manually
  4. A user account that approves access requests

Explanation

A functional account is a privileged account on the target system that Password Safe itself uses to execute tasks such as rotating managed account passwords. It is not intended for interactive human use.

Question 29Password Safe Fundamentals and Architecture

A user opens a brokered RDP session through Password Safe. Which statement describes credential exposure in that session?

  1. The password is emailed to the user for the session
  2. The credential is injected by the broker and the user never sees the password Correct answer.
  3. The user receives the password in a pop-up before connecting
  4. The password is displayed in the session window title

Explanation

Session brokering lets Password Safe authenticate to the target on the user's behalf, so the plaintext credential is never disclosed to the user. This is a core benefit of session management over simple password retrieval.

Question 30Password Safe Fundamentals and Architecture

What is the primary purpose of the Password Safe request-and-approval workflow?

  1. To encrypt traffic between the appliance and targets
  2. To synchronize users from Active Directory
  3. To require authorization before a credential is released to a user Correct answer.
  4. To schedule automatic password rotation

Explanation

The approval workflow inserts an authorization decision between a user's request and credential release, supporting separation of duties and documented justification. Encryption, directory sync, and rotation are separate functions.

Question 31Password Safe Fundamentals and Architecture

Which item is stored as part of a managed account record in Password Safe?

  1. The credential, its rotation settings, and the systems it belongs to Correct answer.
  2. The user's browser bookmarks
  3. The approver's calendar availability
  4. The target server's hardware serial number

Explanation

A managed account record ties a credential to its managed system and carries policy attributes such as rotation interval and release rules. Unrelated client or hardware data is not part of that record.

Question 32Password Safe Fundamentals and Architecture

How does Password Safe typically integrate with an enterprise directory for user authentication?

  1. By creating a separate local account for every employee
  2. By relying on the target servers to authenticate users
  3. By synchronizing or federating user identities from the directory service Correct answer.
  4. By reading credentials from spreadsheets

Explanation

Password Safe integrates with directory services such as Active Directory to import or federate user identities and groups, which then map to roles and access policies. This avoids maintaining a parallel identity store.

Question 33Password Safe Fundamentals and Architecture

Which benefit does the Password Safe audit trail provide to compliance teams?

  1. A list of pending software patches
  2. A record of who accessed which credential or session and when Correct answer.
  3. A report of network bandwidth usage
  4. A copy of the target server's file system

Explanation

The audit trail captures access events, approvals, retrievals, and session activity with user and timestamp attribution. This supports compliance evidence and investigations.

Question 34Password Safe Fundamentals and Architecture

An organization wants administrators to reach target servers without opening direct network paths from user workstations. Which Password Safe design element accomplishes this?

  1. Session brokering through the appliance in a controlled network zone Correct answer.
  2. Allowing direct RDP from any workstation to any server
  3. Giving each administrator a local copy of the vault
  4. Storing passwords in a shared team folder

Explanation

Brokered sessions terminate at the Password Safe appliance, which then connects to targets from a controlled zone, so workstations need no direct path to servers. This reduces the attack surface and centralizes session control.

Question 35Password Safe Fundamentals and Architecture

Which element of Password Safe decides whether a given user may check out a specific account?

  1. The version of the remote session client
  2. The length of the password being requested
  3. The target server's local firewall rules
  4. The access policy attached to the account and the user's group membership Correct answer.

Explanation

Access policies bind users or groups to accounts and define the conditions of release, such as approval requirements and time windows. Firewalls, client versions, and password length do not grant vault access.

Question 36Password Safe Fundamentals and Architecture

A managed account's password must change every 30 days, and the target's password policy forbids reuse of the last 12 passwords. What must Password Safe do to keep rotation reliable?

  1. Generate compliant passwords and track password history for the account Correct answer.
  2. Store the last 12 passwords in plaintext for reference
  3. Rotate the password manually each month
  4. Disable the target's password history requirement

Explanation

Password Safe generates passwords that satisfy the target's complexity and history rules and records prior values so new ones do not collide. Manual rotation or weakening target policy undermines the control.

Question 37Password Safe Fundamentals and Architecture

Which Password Safe capability lets an administrator observe a live session in progress and take over control if needed?

  1. Automatic password complexity enforcement
  2. Session monitoring with the option to terminate or intervene Correct answer.
  3. Directory group synchronization
  4. Password checkout without a session

Explanation

Session monitoring provides real-time visibility into brokered sessions and allows an authorized monitor to intervene or end the session. Checkout, group sync, and complexity rules do not provide live oversight.

Question 38Password Safe Fundamentals and Architecture

What is the effect of assigning an account to a password safe (container) in Password Safe?

  1. It moves the account to the target server's local store
  2. It disables rotation for that account
  3. It encrypts the account with a separate key the user chooses
  4. It groups the account with related credentials so one policy set can govern them Correct answer.

Explanation

Safes are logical containers that collect related accounts so administrators can apply consistent access and rotation policy to the group. They do not change where the credential is stored or disable rotation.

Question 39Password Safe Fundamentals and Architecture

A privileged account is shared by three administrators who each need occasional access. Which Password Safe configuration best supports accountability?

  1. Allow all three to retrieve the password at any time without logging
  2. Rotate the password only once per year
  3. Store the password in a team wiki for convenience
  4. Require individual requests with justification and brokered sessions for each use Correct answer.

Explanation

Requiring individual requests, justifications, and brokered sessions ties each use to a named person and records it in the audit trail. Unlogged retrieval or long rotation intervals destroy accountability.

Question 40Password Safe Fundamentals and Architecture

Which statement describes how Password Safe handles credentials for accounts it cannot rotate automatically?

  1. It stores them only after the vendor certifies the target
  2. It can still store and release them under policy while flagging them as unmanaged for rotation Correct answer.
  3. It converts them into functional accounts automatically
  4. It refuses to store any account lacking a functional account

Explanation

Password Safe can vault and release credentials even when automated rotation is not feasible, and administrators can track such accounts for manual attention. Refusing storage or auto-converting account types would be inaccurate.

Question 41Password Safe Fundamentals and Architecture

What is the purpose of the Password Safe heartbeat or verification check on a managed account?

  1. To confirm the stored credential still authenticates to the target Correct answer.
  2. To measure network latency to the target
  3. To back up the target's configuration files
  4. To synchronize the target's clock with the appliance

Explanation

A verification or heartbeat test logs on with the stored credential to confirm it remains valid and matches the target. Failures alert administrators to drift or manual changes.

Question 42Password Safe Fundamentals and Architecture

Which Password Safe feature limits a released credential so it is automatically changed after the user finishes with it?

  1. Permanent checkout with no expiry
  2. Automatic rotation triggered on check-in Correct answer.
  3. Shared account pooling
  4. Read-only audit export

Explanation

When a credential is checked in, Password Safe can trigger an immediate rotation so the value the user saw is no longer valid. This one-time-use pattern limits exposure from shared credentials.

Question 43Password Safe Fundamentals and Architecture

How does Password Safe's role-based access model reduce administrative overhead?

  1. Each user's rights are hard-coded at account creation
  2. Permissions are assigned to roles or groups rather than to each user individually Correct answer.
  3. Access is granted only by the target server's administrator
  4. Permissions are derived from password length

Explanation

Assigning entitlements to roles or directory groups means new users inherit appropriate access through membership, avoiding per-user configuration. This scales better and reduces misconfiguration.

Question 44Password Safe Fundamentals and Architecture

Which deployment pattern provides resilience if the primary Password Safe appliance fails?

  1. A single appliance backed up monthly to tape
  2. A standalone appliance with a longer session timeout
  3. A clustered appliance configuration with replicated data Correct answer.
  4. A workstation acting as a secondary vault

Explanation

Clustering replicates vault and configuration data across appliances so service continues if one node fails. Monthly tape backups and timeout changes do not provide failover.

Question 45Password Safe Fundamentals and Architecture

An auditor needs proof that a specific administrator retrieved a database credential and what commands ran in the resulting session. Which Password Safe records satisfy this?

  1. The appliance's operating system patch list
  2. The administrator's email inbox
  3. The target database's query plan cache
  4. The access request record, the retrieval event, and the session recording with keystroke logs Correct answer.

Explanation

Password Safe ties requests, approvals, retrievals, and session recordings together with user attribution, giving a complete evidence chain. External caches or mailboxes do not establish who accessed the credential.

Question 46Password Safe Fundamentals and Architecture

Why does Password Safe separate the functional account credential from the managed account credential it rotates?

  1. The functional account performs the change while the managed credential is the object being changed Correct answer.
  2. The managed account is used to log into the appliance
  3. The two credentials must be identical to allow rotation
  4. The functional account is disclosed to end users during checkout

Explanation

Rotation requires a privileged account on the target that can change another account's password; the managed credential is the one being updated. Keeping the roles distinct prevents users from receiving the privileged changer account.

Question 47Password Safe Fundamentals and Architecture

A rotation job fails repeatedly with an authentication error from the target. Which Password Safe element should be investigated first?

  1. The stored functional account credential and its permissions on the target Correct answer.
  2. The session recording storage quota
  3. The user's browser cache
  4. The audit log retention period

Explanation

Rotation depends on the functional account authenticating to the target with sufficient rights to change passwords. An authentication error points to that credential or its permissions rather than to client or storage settings.

Question 48Password Safe Fundamentals and Architecture

Which design choice best limits the blast radius if a Password Safe administrator account is compromised?

  1. Disable audit logging for that account to reduce noise
  2. Store the administrator's password in a shared spreadsheet
  3. Grant the account access to every safe for operational convenience
  4. Restrict that account to specific safes and require approval for high-value accounts Correct answer.

Explanation

Scoping an administrative identity to the safes it needs and requiring approval for sensitive accounts limits what a compromise can reach. Broad access, disabled logging, or shared storage all increase exposure.

Question 49Password Safe Fundamentals and Architecture

An organization must prove that a released password could not have been reused after the session ended. Which combination of Password Safe controls provides that assurance?

  1. Check-in-triggered rotation plus session recording and audit logging Correct answer.
  2. Single sign-on plus a longer session timeout
  3. Manual rotation plus a paper logbook
  4. Longer password length plus a shared team safe

Explanation

Rotating on check-in invalidates the disclosed value, while recording and audit logs document the session and the change. Length, manual logs, or timeouts do not prevent reuse of a disclosed password.

Question 50Password Safe Fundamentals and Architecture

Which statement accurately describes the relationship between Password Safe users and the target accounts they access?

  1. Users log into Password Safe using the target account's password
  2. Users bypass Password Safe and log directly into targets
  3. Users authenticate to Password Safe with their own identity and are then mapped to target accounts by policy Correct answer.
  4. Users share a single Password Safe login for all administrators

Explanation

Users authenticate to the appliance with their own directory identity, and policy maps that identity to the target accounts they may use. This preserves individual accountability and avoids shared logins.