CyberArk CDE (CAU302) flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

Safe member authorization levels

Ordered from lowest to highest: Use accounts, Retrieve accounts, List accounts, Add accounts, Update account properties, Initiate CPM operations, Specify next account content, Rename accounts, Delete accounts, Manage safe, Manage safe members.

Dual control

A safe or account policy requiring two authorized users to approve an action such as password retrieval or change before it proceeds.

Exclusive access

An account policy that locks the account to one user for the duration of their session, preventing concurrent retrieval or connection by others.

Password retention

A safe setting that keeps prior password versions for a number of days or a version count, allowing retrieval of historical credentials after a change.

Safe member types

Vault users, groups, and roles can be safe members. Roles are reusable permission bundles applied across safes to standardize access.

Effective safe permissions

A user's rights are the union of permissions granted directly and through all groups and roles. Removing one path may not remove access.

Master policy

Global vault policy governing defaults such as session recording, dual control, exclusive access, password change rules, and authentication requirements across safes.

Authentication methods

CyberArk password, LDAP/Active Directory, RADIUS, SAML, and PKI certificate authentication, with MFA available as a second factor.

Least privilege in vault

Grant safe access to groups and roles rather than individuals, so offboarding and audits are simpler and orphaned permissions are reduced.

Account onboarding paths

Accounts enter the vault manually, through automatic discovery and the Accounts Feed, or by bulk CSV import. All paths create the same account object.

Verify versus change

Verify tests whether the stored credential still works on the target. Change sets a new password. They run on independent schedules.

Reconcile account

A dependent account linked to a parent account. After the parent password changes, the reconcile account updates dependent services such as Windows tasks.

Automatic management flag

The enableAutoMgmt attribute controls whether CPM manages an account. Disabling it requires a reason and excludes the account from CPM cycles.

Account status field

Shows the result of the last CPM operation, such as success, failure, or change in progress, along with the failure reason.

Platform components

A platform bundles UI and connection settings, automatic password management policy, password reconciliation rules, and associated PSM connection components.

CPM change policy fields

Includes change interval in days, retry count and interval, immediate interval after onboarding, and a separate verify schedule.

Password generation rules

Per-platform settings for password length, allowed character sets, excluded characters, and special characters, applied on change and reconcile.

CPM service account

The account CPM uses to log on to targets. It must hold the platform's required privileges, such as local admin or DBA rights.

Platform privileged account setting

Defines whether CPM changes a password using the account's own credential or a separate logon account with rights over the target.

Connection component

A PSM component attached to a platform that defines how a session is launched, such as RDP, SSH, Telnet, database, or web.

PSM session flow

The user authenticates to PVWA, requests a connection, PSM launches it through the connection component, and the session is recorded and audited.

PSM recording options

Sessions can record the full session, keystrokes only, or nothing. Recordings are stored in PSM storage and linked from the session audit.

PSM for SSH

PSMP runs on a Linux host and proxies SSH sessions without RDP, providing recording and auditing for Unix and network device access.

Session limits

Policies set maximum session duration, idle disconnect time, and concurrent session limits, enforced by the PSM or PSMP.

Live session monitoring

An authorized administrator can view an active PSM session in real time and, when permitted, terminate it.

Audit record contents

Each vault audit entry captures the user, source IP, target, action, and timestamp for authentication, retrieval, CPM, and session events.

Session recording retention

The retention period for PSM recordings and keystroke logs is configured at the PSM or recording level, not in the safe.

System Health page

A PVWA view showing status of vault components such as Vault, CPM, PSM, and PVWA, used to detect component failures.

SIEM forwarding

Vault audit records are forwarded to a SIEM using syslog or the REST API, enabling correlation with other security events.

CPM failure triage order

Check account status reason, then CPM user safe permissions, then platform logon account privileges, then network and firewall reachability to the target.

PSM session failure triage

Confirm PSM reachability, matching connection component and platform, user connect rights, and target host reachability from the PSM server.

Common vault error causes

Not authorized means safe membership or authorization is missing. Account locked means dual control or exclusive access is held. Authentication failed means directory or MFA mismatch.

CPM service account expiry

An expired or locked CPM service account causes mass password change failures, so it must be monitored and rotated before expiry.