I85PREP
⌘ K
CyberArk Defender - Identity study materials
CyberArk Defender - Identity study resources

CyberArk Defender - Identity practice questions

One question at a time. Build your CyberArk Defender - Identity understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Human Identity Security (Privileged Access Management)

In CyberArk Privileged Access Management, what is the primary purpose of a Safe?

  1. To generate reports only about failed login attempts
  2. To replace the organization's directory service for all user logins
  3. To encrypt all network traffic between the Vault and end users
  4. To store and manage privileged accounts with defined access permissions Correct answer.

Explanation

A Safe is the container that holds privileged accounts, and access to those accounts is granted to users and groups through Safe membership with specific authorization levels. It is the central unit for organizing and controlling who can retrieve, use, or manage credentials.

Question 2Human Identity Security (Privileged Access Management)

Which CyberArk component acts as the hardened, isolated repository where privileged credentials are stored and encrypted?

  1. The Password Vault Web Access front end
  2. The Central Policy Manager
  3. The Digital Vault Correct answer.
  4. The Privileged Session Manager

Explanation

The Digital Vault is the hardened server that stores and encrypts all privileged account data and enforces the security policy of the solution. Other components interact with it but do not hold the encrypted credential store themselves.

Question 3Human Identity Security (Privileged Access Management)

A security team wants CyberArk to automatically rotate the password of a local administrator account on a Windows server on a nightly schedule. Which component performs this rotation?

  1. The Privileged Session Manager
  2. The Endpoint Privilege Manager agent
  3. The Central Policy Manager Correct answer.
  4. The Password Vault Web Access

Explanation

The Central Policy Manager (CPM) is responsible for automated password changes, verification, and reconciliation of privileged accounts according to platform policy. Scheduling nightly rotation is configured through the platform settings the CPM enforces.

Question 4Human Identity Security (Privileged Access Management)

Which CyberArk capability lets an administrator record, monitor, and optionally isolate privileged sessions to remote servers through the Vault?

  1. Password Vault Web Access
  2. Privileged Session Manager Correct answer.
  3. Application Identity Manager
  4. Central Policy Manager

Explanation

Privileged Session Manager (PSM) proxies connections so that privileged sessions can be recorded, monitored, and controlled, and it can isolate the user from direct access to the target. This is the session management and audit capability of the platform.

Question 5Human Identity Security (Privileged Access Management)

What does the principle of least privilege require when granting access to a privileged account in CyberArk?

  1. Users receive only the minimum permissions and account access needed for their tasks Correct answer.
  2. Every user receives access to every Safe to avoid delays
  3. All administrators share one superuser account to simplify auditing
  4. Access is granted permanently so users never need to request it again

Explanation

Least privilege means granting each identity only the access necessary to perform its job, and no more, for only as long as needed. In CyberArk this is implemented through scoped Safe membership and authorization levels rather than broad or shared access.

Question 6Human Identity Security (Privileged Access Management)

In CyberArk, what is an account's 'platform' used for?

  1. It specifies the physical data center where the Vault server is racked
  2. It defines how the account is managed, including rotation and connection settings Correct answer.
  3. It determines the user's job title in the HR system
  4. It sets the color theme of the web interface for that account

Explanation

A platform is a policy template that defines how accounts of a given type are managed, including password change methods, connection components, and rotation parameters. Assigning the correct platform ensures the CPM and PSM handle the account appropriately.

Question 7Human Identity Security (Privileged Access Management)

What is the role of a Safe member's authorization level in CyberArk?

  1. It assigns the member a permanent superuser role across all Safes
  2. It defines which actions the member can perform on accounts within that Safe Correct answer.
  3. It controls the network bandwidth allocated to PSM sessions
  4. It determines the encryption algorithm used for the Vault database

Explanation

Authorization levels such as retrieve, use, manage, or approve define precisely which operations a Safe member may perform on the accounts in that Safe. This granular model supports least privilege and separation of duties.

Question 8Human Identity Security (Privileged Access Management)

Why does CyberArk recommend that human administrators use a unique personal privileged account rather than a shared one?

  1. It eliminates the need for any session recording
  2. It preserves individual accountability and non-repudiation in audit trails Correct answer.
  3. It allows passwords to be stored in plain text
  4. It reduces the number of accounts the CPM must rotate

Explanation

Unique personal accounts ensure every privileged action is attributable to a specific individual, which supports non-repudiation and meaningful auditing. Shared accounts obscure who performed an action even when sessions are recorded.

Question 9Human Identity Security (Privileged Access Management)

An administrator needs a policy where a user can check out a privileged account only after a second person approves the request. Which CyberArk workflow supports this?

  1. Directory synchronization of group membership
  2. Automatic password rotation by the CPM
  3. Dual control with an approval workflow on the Safe Correct answer.
  4. Session recording by the PSM

Explanation

Dual control requires that a request to access or use an account be confirmed by one or more authorized approvers before it is granted. This is configured through the Safe's dual control and approval settings.

Question 10Human Identity Security (Privileged Access Management)

A team wants users to obtain a privileged account password only for a defined window and have it automatically changed afterward. Which two CyberArk features combine to deliver this?

  1. PSM session isolation combined with directory synchronization
  2. Endpoint policy enforcement combined with web access theming
  3. Safe membership combined with report scheduling
  4. Time-limited access via check-out combined with CPM one-time password rotation Correct answer.

Explanation

Check-out grants temporary access to an account, and configuring the platform so the CPM changes the password after check-in or expiry ensures the credential is not reusable beyond the window. Together they enforce just-in-time, time-bound access.

Question 11Human Identity Security (Privileged Access Management)

An auditor asks how CyberArk can prove who used a root account on a Linux server at a specific time. Which combination best provides that evidence?

  1. The CPM password change history alone
  2. PSM-recorded sessions tied to the individual's Vault identity plus Vault audit logs Correct answer.
  3. The Safe's member list alone
  4. The platform's connection component list alone

Explanation

PSM records the actual session and associates it with the authenticated Vault user who launched it, while Vault audit logs record the access events. Together they establish who did what and when, even when the underlying OS account is shared.

Question 12Human Identity Security (Privileged Access Management)

What is the main security benefit of CyberArk's 'connect through the PSM' model for administrative access to servers?

  1. Administrators never see or handle the target credential directly during the session Correct answer.
  2. The target server no longer needs any authentication
  3. Administrators can disable all logging to improve performance
  4. Passwords are emailed to administrators for convenience

Explanation

When connecting through the PSM, the credential is injected by the Vault so the administrator does not learn the password, reducing exposure and enabling full session control. This also supports recording and isolation of the session.

Question 13Human Identity Security (Privileged Access Management)

A CPM fails to rotate a database account password. Which troubleshooting step is most appropriate first?

  1. Verify the platform's connection settings and the account's reconciliation credentials Correct answer.
  2. Convert the account to a shared human account
  3. Disable session recording to reduce load
  4. Delete the Safe and recreate it

Explanation

Rotation failures usually stem from incorrect platform configuration, such as wrong connection details, insufficient permissions for the rotation account, or unreachable targets. Checking the platform's connection and reconciliation settings targets the likely cause.

Question 14Human Identity Security (Privileged Access Management)

Which CyberArk feature best supports separation of duties by preventing the person who requests access from also approving it?

  1. Configuring approval workflows so requesters cannot approve their own requests Correct answer.
  2. Sharing one approver account among the whole team
  3. Disabling dual control for speed
  4. Assigning every user the Vault administrator role

Explanation

Separation of duties is enforced by ensuring the requester and approver are distinct identities in the approval workflow. CyberArk approval settings can be configured so a user cannot confirm their own request.

Question 15Human Identity Security (Privileged Access Management)

What does 'reconciliation' mean in the context of CyberArk account management?

  1. Deleting all inactive accounts from the Vault
  2. Restoring a managed account's password to the value stored in the Vault when they diverge Correct answer.
  3. Converting a domain account into a local account
  4. Merging two Safes into one

Explanation

Reconciliation detects when a managed account's actual password no longer matches the Vault and resets it back to the Vault-managed value, restoring control. It is part of the account lifecycle managed by the CPM.

Question 16Human Identity Security (Privileged Access Management)

A user reports they can see an account in a Safe but cannot retrieve its password. What is the most likely cause?

  1. Their Safe membership lacks the retrieve authorization for that account Correct answer.
  2. The PSM recording quota is exhausted
  3. The account's platform was recently updated
  4. The Vault server's disk is full

Explanation

Visibility of an account and permission to retrieve its password are controlled separately by authorization levels. A member may be able to see the account listing without holding the retrieve authorization needed to view the password.

Question 17Human Identity Security (Privileged Access Management)

Which statement best describes how CyberArk supports privileged access for applications and scripts that must authenticate without a human?

  1. Applications bypass authentication entirely
  2. Application identities obtain credentials through a controlled interface rather than hard-coded secrets Correct answer.
  3. Applications share the administrator's personal account
  4. Applications store their passwords in source code repositories

Explanation

Application Identity Manager and related capabilities allow applications to retrieve or use credentials through a controlled, auditable interface, removing hard-coded secrets. This extends privileged access governance to non-human identities.

Question 18Human Identity Security (Privileged Access Management)

Why is onboarding and managing privileged accounts important even when those accounts are rarely used?

  1. Rarely used accounts never need password rotation
  2. Dormant accounts cannot be exploited by attackers
  3. Dormant privileged accounts remain attractive targets and often escape routine monitoring Correct answer.
  4. Unused accounts automatically expire from the directory

Explanation

Unused or dormant privileged accounts are high-value targets because they may retain powerful rights while receiving less scrutiny. Bringing them under Vault management enables rotation, monitoring, and eventual decommissioning.

Question 19Human Identity Security (Privileged Access Management)

A security architect wants to enforce that all interactive privileged sessions to domain controllers pass through CyberArk with full recording. Which configuration approach fits best?

  1. Store the domain controller passwords in a spreadsheet
  2. Route connections through PSM using connection components and require PSM for those accounts Correct answer.
  3. Disable the accounts after business hours only
  4. Rely on users to voluntarily start a screen recorder

Explanation

Connection components define how PSM connects to target systems, and policy can require that access to specified accounts occurs only through PSM. This makes recording and isolation enforceable rather than voluntary.

Question 20Human Identity Security (Privileged Access Management)

What is the purpose of a 'master policy' in CyberArk Privileged Access Management?

  1. It sets organization-wide defaults that platforms inherit, such as rotation and dual control behavior Correct answer.
  2. It defines only the visual layout of reports
  3. It stores the Vault's encryption keys in plain text
  4. It replaces the need for any Safe-level authorization

Explanation

The master policy establishes global defaults and enforcement rules that apply across platforms, such as password change intervals and dual control requirements. Individual platforms can inherit or refine these settings.

Question 21Human Identity Security (Privileged Access Management)

An organization wants to reduce standing administrative rights on endpoints while keeping Vault-managed emergency accounts available. Which combination is most appropriate?

  1. Endpoint least-privilege enforcement plus Vault-managed break-glass accounts with monitored retrieval Correct answer.
  2. Removing all privileged accounts from the Vault
  3. Giving every user local administrator rights permanently
  4. Disabling audit logging on endpoints

Explanation

Endpoint least-privilege controls remove routine administrative rights, while Vault-managed break-glass accounts provide controlled emergency access that is monitored and auditable. This balances operational resilience with reduced standing privilege.

Question 22Human Identity Security (Privileged Access Management)

A CPM rotates a Unix root password successfully, but PSM logon then fails. Which is the most likely root cause to investigate?

  1. The Vault's disk encryption settings
  2. The PSM's stored or cached credential handling and connection component configuration for that platform Correct answer.
  3. The number of Safe members assigned to the account
  4. The report schedule for failed logins

Explanation

If rotation succeeds but logon fails, the issue is usually in how the PSM obtains and injects the credential or in the connection component configuration, not in rotation itself. Verifying the connection component and credential retrieval path is the right diagnostic.

Question 23Human Identity Security (Privileged Access Management)

Which design best prevents a compromised administrator workstation from silently harvesting Vault-managed credentials?

  1. Use PSM brokering so credentials are injected without being exposed to the workstation Correct answer.
  2. Disable dual control to reduce steps
  3. Allow check-out of all passwords to local clipboards by default
  4. Store passwords in a shared team wiki for quick access

Explanation

When PSM brokers the session, the credential is supplied by the Vault to the target and is not revealed on the user's workstation, so malware on that host cannot simply capture it. Check-out to clipboards, shared wikis, and removing approvals all increase exposure.

Question 24Human Identity Security (Privileged Access Management)

An auditor finds that several privileged accounts were accessed outside approved change windows. Which CyberArk control most directly limits access to defined time periods?

  1. Extending password length on all accounts
  2. Increasing the number of Safe members
  3. Adding more approvers to every request
  4. Time-limited access windows configured on the Safe or account Correct answer.

Explanation

Access windows restrict when members may retrieve or use accounts, directly enforcing approved time periods. Longer passwords, more approvers, or broader membership do not by themselves constrain access to a schedule.

Question 25Human Identity Security (Privileged Access Management)

A company must demonstrate that a terminated employee can no longer retrieve any Vault-managed credentials. Which approach most reliably achieves this?

  1. Disable or remove the identity in the authoritative directory that the Vault uses for authentication Correct answer.
  2. Rely on the employee to return a written promise not to access systems
  3. Rotate only the accounts the employee previously used
  4. Change the Safe's display name

Explanation

Because the Vault authenticates users through the directory, disabling or removing the identity there promptly blocks authentication and thus all Vault access. Relying on promises or partial rotation does not revoke the identity's ability to log in.

Question 26Human Identity Security (Privileged Access Management)

Which CyberArk component stores privileged credentials in encrypted form and enforces access control over them?

  1. The Password Upload Utility
  2. The Central Policy Manager
  3. The Privileged Session Manager
  4. The Digital Vault Correct answer.

Explanation

The Digital Vault is the hardened repository where CyberArk encrypts and stores privileged account credentials and where all access decisions are enforced. Other components interact with the Vault through the Vault protocol but do not themselves hold the credential store.

Question 27Human Identity Security (Privileged Access Management)

In CyberArk, what term describes a logical grouping of accounts, members, and permissions that governs who may access which privileged credentials?

  1. A connection component
  2. A master policy
  3. A platform
  4. A Safe Correct answer.

Explanation

A Safe is the container that holds accounts and their objects and defines which users and groups are members and what each member may do. Access to a privileged credential in CyberArk is granted through Safe membership plus platform-level policy.

Question 28Human Identity Security (Privileged Access Management)

Which CyberArk capability provides a secure way for a human administrator to launch a remote session to a target server without ever seeing the target credential?

  1. Privileged Session Management with credential injection Correct answer.
  2. Account discovery scanning
  3. Password reconciliation
  4. Dual control authorization

Explanation

PSM connects to the target on the user's behalf and injects the credential, so the administrator never learns the password. The session can also be recorded and audited.

Question 29Human Identity Security (Privileged Access Management)

A user is a Safe member with only the 'List Accounts' authorization. What can that user do with accounts in the Safe?

  1. Retrieve passwords and initiate PSM sessions
  2. Approve other users' access requests
  3. See that the accounts exist but not retrieve their passwords Correct answer.
  4. Retrieve passwords but not connect to the targets

Explanation

Authorization levels in a Safe are cumulative, and 'List Accounts' is the lowest level that lets a member view account names and properties. Retrieval requires at least the 'Retrieve Accounts' authorization.

Question 30Human Identity Security (Privileged Access Management)

Which CyberArk feature requires a second authorized user to approve before a requested password is displayed to the requester?

  1. Password reconciliation
  2. One-time passwords
  3. Exclusive access
  4. Dual control Correct answer.

Explanation

Dual control enforces that a password request must be confirmed by another authorized user before the credential is released. This supports separation of duties for sensitive accounts.

Question 31Human Identity Security (Privileged Access Management)

What is the primary purpose of the CyberArk Central Policy Manager?

  1. To automatically change and verify passwords on managed target systems according to policy Correct answer.
  2. To authenticate users against the corporate directory
  3. To discover unmanaged accounts across the network
  4. To record and replay privileged sessions for audit

Explanation

The CPM executes password rotation, verification, and reconciliation against target systems based on the platform and master policy settings. It is the automation engine behind credential lifecycle management.

Question 32Human Identity Security (Privileged Access Management)

Which statement best describes the purpose of CyberArk account discovery?

  1. It enforces dual control on password retrieval
  2. It records sessions initiated by administrators
  3. It rotates passwords for accounts that already exist in the Vault
  4. It scans target systems to find privileged accounts that are not yet managed in the Vault Correct answer.

Explanation

Discovery scans endpoints and systems to identify privileged accounts, including local administrator and service accounts, so they can be onboarded for management. It addresses the risk of unmanaged credentials outside Vault control.

Question 33Human Identity Security (Privileged Access Management)

What does the CyberArk term 'onboarding' refer to in privileged account management?

  1. Installing the PSM connector on a target server
  2. Creating a new user in the corporate directory
  3. Bringing an existing privileged account under Vault management so its credential is stored, rotated, and audited Correct answer.
  4. Assigning a Safe to a new platform template

Explanation

Onboarding is the process of adding an account to the Vault so it becomes subject to management policies such as rotation, verification, and access control. Until an account is onboarded, CyberArk cannot protect or audit its credential.

Question 34Human Identity Security (Privileged Access Management)

A security team wants a privileged account password to be valid for only one retrieval and then automatically changed. Which CyberArk setting accomplishes this?

  1. Enable one-time password mode on the platform so the CPM changes the password after each use Correct answer.
  2. Configure reconciliation to run after each retrieval
  3. Set the Safe to require exclusive access for the account
  4. Enable dual control on the Safe so a second user approves each retrieval

Explanation

One-time password mode instructs the CPM to change the credential immediately after it is retrieved or checked in, so the disclosed value becomes stale. This limits the window in which a leaked password is useful.

Question 35Human Identity Security (Privileged Access Management)

An administrator wants members of a Safe to see account passwords only during an approved change window. Which CyberArk mechanism is designed for this?

  1. Enable exclusive access on the account
  2. Set the platform to rotate the password nightly
  3. Apply dual control to the Safe
  4. Configure the Safe's allowed access hours so retrieval is blocked outside the window Correct answer.

Explanation

Safe member properties include allowed access hours that restrict when a user may retrieve or use accounts in that Safe. Access outside the defined window is denied regardless of authorization level.

Question 36Human Identity Security (Privileged Access Management)

A privileged account's password is changed directly on the target system by an administrator, so the Vault copy no longer matches. Which CyberArk process corrects this?

  1. Session recording, which captures the manual change
  2. Verification, which only confirms that the stored password still works
  3. Reconciliation, which detects the mismatch and resets the target to the Vault value or updates the Vault Correct answer.
  4. Discovery, which finds the account on the target

Explanation

Reconciliation handles drift when the credential on the target differs from the Vault, restoring a known good state. Verification alone only tests whether the stored credential works and does not resolve a mismatch.

Question 37Human Identity Security (Privileged Access Management)

Which CyberArk object defines platform-level behavior such as password change commands, rotation intervals, and connection details for a class of accounts?

  1. The platform Correct answer.
  2. The Safe
  3. The master policy
  4. The user's authorization level

Explanation

A platform is the template that carries the settings and connection components used to manage a category of accounts, such as Windows domain accounts or Oracle accounts. Accounts inherit management behavior from their assigned platform.

Question 38Human Identity Security (Privileged Access Management)

A company wants administrators to reach servers only through recorded PSM sessions, with no direct RDP from workstations. Which control most directly enforces this?

  1. Setting one-time passwords on the server accounts
  2. Network segmentation and firewall rules that allow administrative protocols only from PSM hosts Correct answer.
  3. Requiring reconciliation on the server accounts
  4. Enabling dual control on the server accounts

Explanation

Technical enforcement of a PSM-only model requires that target systems accept administrative connections solely from PSM infrastructure, which is achieved with network and firewall controls. Vault policy alone cannot stop a user who has another path to the target.

Question 39Human Identity Security (Privileged Access Management)

Which CyberArk capability helps an organization justify why a particular user holds standing access to a sensitive Safe?

  1. Session recording by the PSM
  2. Automatic password rotation by the CPM
  3. Periodic access certification and recertification of Safe membership Correct answer.
  4. Account discovery scanning

Explanation

Access certification requires reviewers to periodically confirm that each member's Safe permissions are still justified, supporting least privilege and audit evidence. Rotation, recording, and discovery address different risks and do not validate entitlement.

Question 40Human Identity Security (Privileged Access Management)

A user can retrieve a password from a Safe but the PSM connection to the target fails with an authentication error. Which cause should be investigated first?

  1. The user lacks the List Accounts authorization
  2. The Safe's allowed access hours are misconfigured
  3. The session recording storage is full
  4. The credential stored in the Vault does not match the current password on the target Correct answer.

Explanation

A successful retrieval followed by a failed PSM logon points to a credential mismatch between the Vault and the target, often caused by an out-of-band password change or a failed rotation. Verifying and reconciling the account is the appropriate first step.

Question 41Human Identity Security (Privileged Access Management)

What is the effect of marking an account as 'exclusive' in CyberArk?

  1. Only one platform may be assigned to the account
  2. Only one approver may authorize requests for the account
  3. Only one Safe may contain the account
  4. Only one user may use the account at a time, and the account is locked to that user until released Correct answer.

Explanation

Exclusive accounts prevent concurrent use by locking the account to a single user for the duration of use, which preserves accountability for actions taken with a shared credential. The lock is released when the user checks the account back in or the session ends.

Question 42Human Identity Security (Privileged Access Management)

Which statement best explains why CyberArk recommends rotating privileged credentials on a schedule even when no compromise is suspected?

  1. Rotation removes the need for Safe membership reviews
  2. Rotation improves the performance of PSM session recording
  3. Rotation eliminates the need for dual control on sensitive accounts
  4. Routine rotation limits the useful lifetime of a credential that may have been exposed without detection Correct answer.

Explanation

Scheduled rotation bounds the window in which a silently leaked or cached credential remains valid, which is valuable precisely because exposure may go unnoticed. It complements, rather than replaces, authorization and review controls.

Question 43Human Identity Security (Privileged Access Management)

An application needs to authenticate to a database using a privileged credential without a human involved. Which CyberArk approach fits this requirement?

  1. Have an administrator retrieve the password and paste it into the application config
  2. Disable rotation for the database account so the password never changes
  3. Store the password in a plaintext configuration file on the application server
  4. Use an application identity with a Safe and credential provider so the application retrieves the password programmatically Correct answer.

Explanation

CyberArk supports application access through application identities that are authorized on a Safe and retrieve credentials through a supported credential provider or SDK. This keeps the secret in the Vault and avoids hardcoding it.

Question 44Human Identity Security (Privileged Access Management)

Which CyberArk control most directly limits the risk of a terminated employee continuing to retrieve credentials through an existing authenticated session?

  1. Increasing the password rotation frequency for all accounts
  2. Adding the user to additional Safes before departure
  3. Enabling session recording for all PSM connections
  4. Disabling the user in the directory and configuring the Vault to reject disabled users, combined with session timeouts Correct answer.

Explanation

Timely deprovisioning in the identity source, enforced by the Vault, plus bounded session lifetimes, ensures the former employee cannot continue to authenticate or ride an old session. Rotation and recording are useful but do not revoke access.

Question 45Human Identity Security (Privileged Access Management)

Which statement best describes the relationship between the master policy and individual platform settings in CyberArk?

  1. The master policy sets enterprise-wide rules that can take precedence over platform-level settings Correct answer.
  2. The master policy applies only to Unix accounts
  3. Platform settings always override the master policy
  4. Platform settings apply only to PSM sessions

Explanation

The master policy defines organization-wide behavior, such as whether dual control or one-time passwords are required, and can override platform configuration. This lets security teams enforce minimum standards across all platforms.

Question 46Human Identity Security (Privileged Access Management)

A security architect must ensure that a highly sensitive account requires approval from two different people before the password is shown, and that the requester cannot be one of them. Which combination achieves this?

  1. Session recording plus account discovery
  2. One-time password mode plus exclusive access
  3. Dual control on the Safe plus a master policy rule that the requester cannot confirm their own request Correct answer.
  4. Reconciliation plus verification

Explanation

Dual control supplies the second approver, and the master policy setting prevents self-authorization so the requester cannot satisfy the requirement alone. Together they enforce separation of duties for the release of the credential.

Question 47Human Identity Security (Privileged Access Management)

An auditor needs proof that a specific administrator used a shared Unix root account at a given time. Which CyberArk evidence is most direct?

  1. The discovery scan report listing the root account
  2. The CPM's password change history for the root account
  3. The Safe's member list at the time of the event
  4. The PSM session recording and keystroke log tied to that user's authenticated session Correct answer.

Explanation

Because the shared credential is injected by PSM, the session is bound to the authenticated individual, and the recording and keystroke log attribute the activity to that user. Rotation history, discovery reports, and membership lists do not show who performed specific actions.

Question 48Human Identity Security (Privileged Access Management)

A CPM rotation succeeds, but PSM logons to the target immediately fail. Which investigation is most likely to reveal the root cause?

  1. Disable session recording to reduce load
  2. Increase the rotation interval on the platform
  3. Add the account to a second Safe
  4. Compare the platform's logon sequence with the target's authentication requirements, such as whether the new password propagates to a domain controller first Correct answer.

Explanation

A rotation that succeeds but breaks logon often reflects a sequencing or dependency problem, such as replication delay or a logon sequence that does not match how the target authenticates. Comparing the platform's change and logon configuration against the target's requirements isolates the mismatch.

Question 49Human Identity Security (Privileged Access Management)

An organization wants to reduce standing local administrator rights on endpoints while retaining Vault-managed emergency access. Which design best meets this goal?

  1. Grant all users Retrieve Accounts on the endpoint Safe to simplify access
  2. Keep all users in the local administrators group but rotate the local administrator password nightly
  3. Remove users from the local administrators group and provide on-demand elevation through PSM or a Vault-managed local account with approval Correct answer.
  4. Disable the local administrator account and rely on shared domain administrator credentials

Explanation

Removing standing rights and supplying just-in-time elevation or approved retrieval of a managed local account eliminates permanent administrative privilege while preserving break-glass access. Rotating a password on an account everyone still uses does not reduce standing rights.

Question 50Human Identity Security (Privileged Access Management)

A risk assessment finds that administrators' workstations could be used to harvest credentials that are checked out from the Vault. Which design most reduces this risk?

  1. Shorten password rotation intervals for all accounts
  2. Require PSM brokering so credentials are injected on the PSM host and never reach the workstation Correct answer.
  3. Enable dual control for every Safe
  4. Increase the number of Safe members who can approve requests

Explanation

When PSM performs the authentication, the credential is used on the PSM host and never exposed to the administrator's workstation, removing the harvesting opportunity. Rotation and approval controls reduce exposure but do not prevent a compromised endpoint from capturing a disclosed password.