CyberArk CDE (CAU302) key terms

A logical container in CyberArk that holds accounts and defines which users and groups can access them. Every account must belong to exactly one Safe, and permissions are granted at the Safe level rather than per account.

A user or group granted permissions on a Safe. Each membership carries a set of authorizations such as retrieve, use, update, and approve, plus optional time-limited access windows and access restrictions.

A Safe member holding the full administrative authorization set on that Safe, including the ability to add or remove members and change member permissions. Ownership is delegated per Safe, not globally.

A discrete permission granted to a Safe member, for example retrieve password, connect, update password, or approve requests. Authorizations are cumulative across group memberships, so effective rights are the union of all granted permissions.

A per-membership setting that limits when, from where, or for how long a member may use a Safe. It can restrict by source IP, by time window, or by an expiration date on the membership itself.

A privileged credential record stored in the Vault, combining a username, a secret, and the address of the target system it authenticates to. Accounts carry platform association, CPM management state, and Safe membership.

The process of creating an account object in the Vault so that the CPM can manage it. Onboarding includes choosing the platform, specifying the target address and username, and assigning the account to a Safe.

A configuration template that defines how the CPM manages a class of accounts, including password change and verification commands, connection method, character sets, and rotation policy. Every account is linked to one platform.

The underlying connection and management definition a platform inherits from, such as Windows Domain, Unix, or Oracle. A platform base supplies the core logic while the platform adds policy and customization on top.

The Central Policy Manager, the component that automatically changes and verifies account passwords according to platform policy. It connects to target systems using its own credentials and logs every rotation attempt.

The scheduled or on-demand replacement of an account's secret by the CPM. Rotation frequency, retry behavior, and verification are governed by the account's platform and any account-level overrides.

A CPM action that logs on to the target system with the stored credentials to confirm the password in the Vault still works. Verification results appear in the account's activity log and drive failure alerts.

A CPM operation that resets a target account password using privileged credentials when the Vault password no longer matches the target. Reconcile is used to recover from out-of-band password changes.

An approval rule requiring one or more additional authorized users to confirm an action, such as retrieving a password or creating an account, before it completes. It enforces separation of duties on sensitive operations.

The Vault-wide policy that sets system behavior such as password change intervals, connection timeouts, session recording requirements, and whether dual control is mandatory. Individual platforms and accounts can only be stricter, not looser.

The Privileged Session Manager, a component that proxies privileged connections so sessions can be recorded, isolated, and monitored. It sits between the user and the target system and injects credentials without revealing them.

The PSM-side definition describing how to launch a session to a particular target type, for example RDP or SSH. It specifies the client application, parameters, and which platform it serves.

The platform-level binding that links a platform to a connection component and determines how PSM launches and records sessions for accounts using that platform. Without it, PSM cannot broker the connection.

The capture of a privileged session by PSM into a replayable file stored in the Vault. Recording policy, retention, and whether keystrokes are captured are governed by Master Policy and platform settings.

An interactive connection to a target system made through PSM using Vault-managed credentials. It is subject to recording, monitoring, and the authorization checks defined on the account's Safe.

The hardened, encrypted repository that stores accounts, Safes, policies, and audit data. All administrative and user operations are mediated by Vault services, and the Vault itself is not directly accessible to end users.

The mechanism a user presents to prove identity to the Vault, such as password, LDAP directory, RADIUS, SAML, or certificate. Multiple methods can be enabled and combined with authorization rules.

A rule that determines which authentication methods a user must satisfy, and under what conditions, before access is granted. Rules can require a single method or a combination for stronger assurance.

A configuration that links an LDAP directory group to a Vault group so directory users are provisioned automatically. Mappings control which Safes and authorizations directory users receive on logon.

The immutable record of actions performed in the Vault, including logons, retrievals, policy changes, and CPM operations. Auditors query it to reconstruct who did what, when, and from where.

A predefined or custom query that summarizes Vault data, such as accounts due for rotation, Safes without owners, or users with dormant access. Reports support compliance reviews and operational hygiene.

The per-account history of CPM and user actions, including password changes, verifications, retrievals, and failures. It is the first place to look when diagnosing why a rotation did not succeed.

A configuration that requires a valid ticket or incident number before a user can retrieve a password or connect. It ties privileged access to an approved change or incident record for auditability.

An account configured so that only one user may check it out at a time, and the password is changed on check-in. This prevents concurrent use of a shared credential and limits exposure.

A credential mode where the CPM changes the password immediately after a user retrieves it, so the value the user sees is valid only for that single use. It provides strong control over shared accounts.

A web service that lets applications retrieve credentials programmatically without a human user, after authenticating with an application certificate or hash. It is commonly used for application-to-database access.

A non-human identity object representing an application that needs Vault access. It is granted Safe permissions like a user and is typically authenticated by certificate or hash rather than password.

An account whose password is managed in relation to another account, such as a Windows service account tied to a domain account. Rotation order and linkage are defined in the platform configuration.

An account record that references another account's password rather than storing its own, so a single rotation updates multiple logon entries. Linking reduces duplicate management for the same credential.

The metadata view in the PVWA showing an account's platform, CPM status, last rotation and verification times, and current management state. It is used to confirm whether the CPM is successfully managing the account.

The Password Vault Web Access, the browser interface through which users retrieve accounts, request approvals, and administrators configure Safes, platforms, and policies. Most day-to-day administration happens here.

A Vault-level rule that restricts which source addresses may perform certain operations, such as CPM connections or administrative logons. It is a network-layer control complementing authentication.

The flag indicating whether an account is actively managed by the CPM or excluded from automatic rotation. Common states include active, suspended, and unmanaged, and they explain why a password is not rotating.