I85PREP
⌘ K
CyberArk CDE (CAU302) study materials
CyberArk CDE (CAU302) study resources

CyberArk CDE (CAU302) practice questions

One question at a time. Build your CyberArk CDE (CAU302) understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Account Onboarding and Management

In the CyberArk Vault, what is the primary purpose of a Safe?

  1. To define the network ports used by the Central Policy Manager
  2. To hold the Vault server's encryption keys for disaster recovery
  3. To schedule automatic password verification jobs across the estate
  4. To store and manage privileged accounts together with the access control that governs them Correct answer.

Explanation

A Safe is the fundamental container object in the Vault that holds accounts (and other objects such as files and SSH keys) while enforcing authorization rules for who may retrieve, use, or administer them. Access is granted through Safe membership combined with the authorizations assigned to each member. Other Vault objects handle key management and scheduling, not account storage.

Question 2Account Onboarding and Management

Which built-in Vault user is used by the Central Policy Manager to connect to the Vault and manage passwords?

  1. Master
  2. Auditor
  3. PasswordManager Correct answer.
  4. Administrator

Explanation

The PasswordManager user is the dedicated Vault account the CPM uses for its administrative work, including changing and verifying passwords on managed accounts. It is preconfigured with the authorizations the CPM requires. The Administrator user is for human administrators, and the Auditor is a read-only monitoring account.

Question 3Account Onboarding and Management

When onboarding a privileged account through the PVWA, which element must be selected to tell the CPM how to connect to, change, and verify the password on the target system?

  1. A platform Correct answer.
  2. A Safe category
  3. A Vault policy
  4. A user group

Explanation

The platform bundles the connection details, password-change and verification logic, and policy settings the CPM needs for a given target system type. Selecting the correct platform is therefore essential for automated management to work. Safe categories and user groups affect organization and access, not the mechanics of password management.

Question 4Account Onboarding and Management

What does the CPM do when it performs a password change on a managed account?

  1. It disables the account and waits for a human to reset the password
  2. It sends the current password to the account owner by email for manual rotation
  3. It copies the password to a shared network folder for application retrieval
  4. It logs in to the target system, sets a new password generated per policy, and stores the new value in the Vault Correct answer.

Explanation

The CPM connects to the target using the platform's connection component, generates a new password according to the platform's password policy, changes it on the target, and records the new value in the Vault. This automated rotation is the core of credential lifecycle management. The other options describe insecure or manual processes that are not part of CPM behavior.

Question 5Account Onboarding and Management

Which authorization must a user have to view the password of an account stored in a Safe?

  1. Manage Safe
  2. Use accounts
  3. List accounts
  4. Retrieve accounts Correct answer.

Explanation

Retrieve accounts is the authorization that allows a user to view or copy the password value of accounts in a Safe. Use accounts permits connecting through PSM without revealing the password, and List accounts only shows that accounts exist. Manage Safe is an administrative authorization.

Question 6Account Onboarding and Management

A security team wants to onboard a large set of local administrator accounts discovered on Windows servers. Which CyberArk capability is designed to import and reconcile these accounts in bulk?

  1. The PrivateArk Client audit log
  2. The Central Policy Manager's verification report
  3. The Password Upload utility Correct answer.
  4. The Vault's backup and restore process

Explanation

The Password Upload utility is a bulk onboarding tool that reads a structured file of account details and creates the accounts in the Vault, optionally triggering immediate CPM management. It is the standard approach for large-scale onboarding. The other options are monitoring, backup, or reporting functions and do not create accounts.

Question 7Account Onboarding and Management

What is the purpose of the 'Master Policy' in a CyberArk deployment?

  1. It stores the list of all Safes and their members
  2. It controls the network firewall rules between the Vault and the CPM
  3. It defines the Vault-wide default password and session policy settings that platforms inherit Correct answer.
  4. It holds the license key that determines how many accounts can be onboarded

Explanation

The Master Policy defines Vault-wide security settings, such as password complexity, rotation intervals, and session recording rules, which individual platforms can inherit or override. It establishes the baseline governance for all managed accounts. Safe membership, network rules, and licensing are handled elsewhere.

Question 8Account Onboarding and Management

Which account property determines the interval at which the CPM automatically changes the password?

  1. The user's session timeout
  2. The platform's password change policy Correct answer.
  3. The Safe's retention period
  4. The account's expiration date

Explanation

The interval for automatic password changes is governed by the platform's password change policy, which the CPM reads when scheduling management tasks. Account expiration is a separate lifecycle property, and Safe retention and session timeouts are unrelated. This is why choosing the correct platform during onboarding matters.

Question 9Account Onboarding and Management

An administrator onboards a database account but the CPM immediately reports a failure during the first password change. Which two items should be validated first?

  1. The Master Policy session recording settings and the firewall zone
  2. The Vault's license capacity and the PVWA theme settings
  3. The CPM's logon credentials for the target platform and the account's address/user properties Correct answer.
  4. The Auditor's permissions and the Safe retention period

Explanation

When a first password change fails, the most common causes are incorrect connection details in the platform or wrong account properties such as address, username, or port. Verifying the CPM's logon account and the account's target properties is the correct first diagnostic step. Licensing, theming, and session recording do not affect the change operation.

Question 10Account Onboarding and Management

Which object type in CyberArk is used to group accounts that share the same target system and management policy, while still allowing per-account settings?

  1. An account Correct answer.
  2. A user
  3. A Safe
  4. A platform

Explanation

Each managed credential is an account object that carries its own properties, such as address, username, and platform association, while the platform supplies shared management logic. Accounts are placed in Safes for access control, but the account itself is the unit that holds per-credential settings. Platforms define behavior, not individual credentials.

Question 11Account Onboarding and Management

What is the role of the 'reconcile' operation in CPM management?

  1. It compares the password stored in the Vault with the password on the target and corrects a mismatch Correct answer.
  2. It merges duplicate account objects discovered during onboarding
  3. It re-applies the Master Policy to all platforms after an upgrade
  4. It re-enables a disabled account after a lockout event

Explanation

Reconciliation detects and resolves drift between the Vault-stored password and the actual password on the target system, which can occur after manual changes or failed rotations. The CPM uses the platform's reconcile logic to bring the two back into sync. It does not apply policies, merge objects, or handle lockouts.

Question 12Account Onboarding and Management

Which statement best describes the relationship between a platform and the accounts that use it?

  1. Each account references a platform that supplies its connection and management settings Correct answer.
  2. Each platform references the accounts it manages inside its definition
  3. Platforms and accounts are independent and share no configuration
  4. A single platform can only ever be used by one account

Explanation

An account is associated with a platform, and the platform provides the connection components, password policy, and management behavior the CPM uses for that account. The account-to-platform reference is what allows many accounts to reuse shared management logic. Platforms do not embed account lists, and one platform can serve many accounts.

Question 13Account Onboarding and Management

A user can see an account in the PVWA but cannot connect to the target through PSM. Which authorization is most likely missing?

  1. Retrieve accounts
  2. Manage Safe
  3. Add accounts
  4. Use accounts Correct answer.

Explanation

Connecting to a target through PSM without exposing the password requires the Use accounts authorization. Retrieve accounts controls viewing the password, while Manage Safe and Add accounts are administrative permissions unrelated to connection. This separation is a core principle of least privilege in CyberArk.

Question 14Account Onboarding and Management

When onboarding an account for a Unix system, which platform component is responsible for actually connecting to the target to change the password?

  1. The audit record
  2. The connection component Correct answer.
  3. The Safe template
  4. The Master Policy

Explanation

The connection component within a platform contains the logic and credentials needed to connect to the target system and perform password changes or verifications. It is invoked by the CPM during management operations. Master Policy, Safe templates, and audit records do not perform target connections.

Question 15Account Onboarding and Management

An organization wants newly onboarded accounts to require dual approval before a password can be retrieved. Which CyberArk feature should be configured?

  1. Password verification
  2. Session recording
  3. Account expiration
  4. Dual control Correct answer.

Explanation

Dual control enforces a second approver before a user can retrieve or use a password, implementing separation of duties. It is configured as part of Safe or platform policy. Session recording, verification, and expiration serve different purposes and do not enforce approval workflows.

Question 16Account Onboarding and Management

Which setting on a platform determines whether the CPM will automatically verify a password after a change?

  1. The Vault's backup schedule
  2. The verification policy in the platform Correct answer.
  3. The Safe's retention period
  4. The user's authentication method

Explanation

The platform's verification policy controls whether and how often the CPM verifies that the stored password still works on the target, including verification after a change. This ensures rotation succeeded. Retention, backup, and user authentication settings are unrelated to verification behavior.

Question 17Account Onboarding and Management

A privileged account must be onboarded so that the CPM changes its password every 30 days, but the Master Policy default is 60 days. How should this be achieved?

  1. Change the Master Policy to 30 days for all accounts
  2. Disable CPM management for the account and rotate manually
  3. Edit the account's expiration date to 30 days
  4. Override the password change interval in the platform associated with the account Correct answer.

Explanation

Platforms can override Master Policy defaults for specific account types, so setting a 30-day interval in the platform achieves the requirement without affecting other accounts. Changing the Master Policy would alter behavior globally, and expiration dates or manual rotation do not provide automated 30-day changes.

Question 18Account Onboarding and Management

Which statement about the Password Upload utility is accurate?

  1. It replaces the need for Safes by storing accounts in flat files
  2. It can create accounts in bulk and optionally trigger immediate CPM management Correct answer.
  3. It requires manual creation of each account before it can be used
  4. It only works with accounts that are already managed by the CPM

Explanation

The Password Upload utility reads a structured file to create many accounts at once and can be configured to initiate password management immediately after creation. It still creates accounts inside Safes, so it does not replace them, and it is specifically used to onboard accounts rather than requiring them to exist already.

Question 19Account Onboarding and Management

What happens to an account when its platform is changed after onboarding?

  1. The account's Safe membership is reset to default
  2. The account adopts the connection and policy behavior of the newly assigned platform Correct answer.
  3. The account is automatically deleted and must be recreated
  4. The account's password is immediately disclosed to all Safe members

Explanation

Changing an account's platform causes the account to use the new platform's connection components and policy settings for subsequent management operations. It does not delete the account, reset Safe membership, or expose the password. This is commonly done when an account was onboarded with the wrong platform.

Question 20Account Onboarding and Management

Which practice best supports least privilege when onboarding a new set of service accounts?

  1. Place all accounts in a single Safe accessible to every administrator
  2. Grant Manage Safe to all users who need to view passwords
  3. Disable dual control so onboarding proceeds faster
  4. Create a dedicated Safe with only the required members and authorizations for those accounts Correct answer.

Explanation

A dedicated Safe scoped to the accounts and the personnel who need them enforces least privilege by limiting both the blast radius and the authorizations granted. Broadly shared Safes, excessive Manage Safe rights, and disabling dual control all violate least-privilege principles.

Question 21Account Onboarding and Management

A CPM password change succeeds on the target but the PVWA still shows the old password. Which explanation is most plausible?

  1. The target system rejected the new password
  2. The CPM could not update the Vault record, so the change should be investigated in the CPM log Correct answer.
  3. The account's platform was never assigned
  4. The Safe's retention period expired

Explanation

If the target accepted the new password but the Vault still shows the old one, the likely failure is in the step that writes the new value back to the Vault, which the CPM log will show. A target rejection would fail the change itself, and retention or platform assignment issues would produce different symptoms.

Question 22Account Onboarding and Management

An account is configured with both a platform-level password change policy and an account-level override. Which behavior should an administrator expect?

  1. The account is placed in an error state until the conflict is resolved
  2. The account-level setting takes precedence for that account Correct answer.
  3. Both settings are applied alternately on each cycle
  4. The platform-level setting always overrides the account setting

Explanation

CyberArk allows account-level overrides to take precedence over platform defaults for that specific account, enabling exceptions without changing behavior for other accounts. The settings do not alternate, and a valid override does not create an error condition. This hierarchy is central to managing exceptions at scale.

Question 23Account Onboarding and Management

During bulk onboarding, several accounts fail with 'account already exists'. What is the most appropriate remediation?

  1. Delete all existing accounts and rerun the entire upload
  2. Disable the CPM until the duplicates are removed manually
  3. Identify the duplicates and either update the existing accounts or exclude them from the upload file Correct answer.
  4. Change the platform on the existing accounts to force creation

Explanation

The error indicates that accounts with matching identifiers already exist in the target Safe, so the correct approach is to reconcile the upload file against existing objects, updating or excluding duplicates. Deleting existing accounts risks losing managed credentials, and changing platforms or disabling the CPM does not resolve the duplication.

Question 24Account Onboarding and Management

A security architect wants CPM management traffic to reach targets through a controlled path while keeping the Vault isolated. Which design consideration is most relevant during onboarding?

  1. Storing target credentials in a shared file server for the CPM to read
  2. Granting the CPM the Vault Administrator role
  3. Deploying CPM components in the target network zones and confirming the platform's connection settings match Correct answer.
  4. Disabling verification to reduce network traffic

Explanation

CPM components are typically distributed so they can reach targets in their network zones while the Vault remains isolated, and the platform's connection settings must match that topology. Storing credentials outside the Vault, over-privileging the CPM, or disabling verification all undermine security and do not solve connectivity correctly.

Question 25Account Onboarding and Management

Which combination correctly describes how an account becomes fully managed after onboarding?

  1. The account is created in a Safe with a platform, and the CPM then performs change and verify according to policy Correct answer.
  2. The account is created outside the Vault and imported only for auditing
  3. The account is created in a Safe but requires the Master Policy to be disabled
  4. The account is created in a Safe, and a user must manually change the password each cycle

Explanation

Full management requires the account to exist in a Safe with the correct platform so the CPM can execute change and verify operations per policy. Manual rotation, external storage, or disabling the Master Policy would prevent automated management and weaken controls.

Question 26Account Onboarding and Management

When onboarding a new privileged account into the Vault, which property uniquely identifies the account record within a safe?

  1. The account name combined with the address and the platform ID Correct answer.
  2. The account name combined with the owner user
  3. The safe name combined with the CPM user
  4. The platform ID combined with the Master Policy name

Explanation

CyberArk treats an account as unique within a safe based on the combination of the account name, the target address, and the platform. Submitting the same triplet again returns an 'account already exists' condition, so uniqueness is defined by these three properties rather than by ownership or policy.

Question 27Account Onboarding and Management

Which PVWA workflow is designed to onboard many accounts at once from a structured file rather than creating them individually?

  1. The 'Add Account' wizard on the Accounts page
  2. The 'Password Upload' utility Correct answer.
  3. The 'Account Discovery' wizard
  4. The 'Safe Members' configuration page

Explanation

The Password Upload utility accepts a delimited file describing many accounts and creates them in bulk, including their initial secret values. It is the standard path for large onboarding batches, in contrast to the single-account wizard.

Question 28Account Onboarding and Management

An account was onboarded with an incorrect target address, so the CPM cannot reach the host. Which action corrects the record while preserving the account's history?

  1. Change the platform assigned to the account
  2. Edit the account's address property in the account details Correct answer.
  3. Delete the account and recreate it with the correct address
  4. Disable the CPM service until the address is fixed

Explanation

The address is an editable account property, so correcting it in the account details keeps the same account record and its audit trail intact. Deleting and recreating loses history and is unnecessary when the address is simply wrong.

Question 29Account Onboarding and Management

What is the primary purpose of associating an account with a platform during onboarding?

  1. To assign the human users who may retrieve the password
  2. To set the retention period for audit records
  3. To supply the connection and management behavior used for that account Correct answer.
  4. To determine which safe the account is stored in

Explanation

A platform bundles the connection components, password-change logic, and policy defaults that CyberArk applies to an account. Choosing the platform tells the CPM and PSM how to interact with that particular target system type.

Question 30Account Onboarding and Management

A service account must be managed by the CPM but its password must never be changed automatically because the application vendor forbids rotation. Which configuration achieves this?

  1. Set the account to 'reconcile only' and disable password change
  2. Delete the CPM user's permissions on the target system
  3. Assign a platform whose CPM change policy is set to 'No change' for that account Correct answer.
  4. Remove the account from the safe so the CPM ignores it

Explanation

CPM behavior is driven by the platform's password-change policy, and an account can use a platform configured so no automatic change occurs while still being verified or reconciled. This keeps the account managed without rotating the secret against vendor requirements.

Question 31Account Onboarding and Management

An administrator needs the CPM to verify an account's password on the target without changing it. Which CPM operation performs this check?

  1. Change
  2. Reconcile
  3. Verify Correct answer.
  4. Connect

Explanation

The Verify operation logs into the target and confirms that the password stored in the Vault still works, without altering it. Change rotates the secret, Reconcile forces the target to match the Vault, and Connect is a PSM session action.

Question 32Account Onboarding and Management

During onboarding of a domain account, the CPM reports 'authentication failure' when attempting the first change. Which cause is most likely?

  1. The platform's CPM user lacks the rights to reset that account's password in Active Directory Correct answer.
  2. The account was created with a password that meets complexity rules
  3. The account's safe has no owner assigned
  4. The Vault is running at capacity

Explanation

CPM changes are performed by the platform's CPM user, which needs delegated rights to reset passwords for the target accounts in Active Directory. If that delegation is missing, the first change fails with an authentication or authorization error even though the account itself is valid.

Question 33Account Onboarding and Management

A security team wants the CPM to change an account's password only during an approved maintenance window. Which platform setting controls when changes occur?

  1. The PSM connection component timeout
  2. The CPM change schedule defined in the platform's password-change settings Correct answer.
  3. The account's owner field
  4. The safe's retention policy

Explanation

The platform's password-change settings include a schedule that determines the days and times the CPM is allowed to rotate the secret. Adjusting that schedule confines changes to the approved window without affecting other management operations.

Question 34Account Onboarding and Management

Which object in the Vault should an administrator configure to define default password complexity and rotation rules shared by many accounts of the same system type?

  1. The platform Correct answer.
  2. The individual account record
  3. The safe
  4. The user's personal preferences

Explanation

A platform holds the shared policy defaults, including password complexity and rotation rules, that apply to every account using it. Centralizing these rules on the platform avoids configuring each account separately.

Question 35Account Onboarding and Management

An account is onboarded into a safe where the user has 'Use password' but not 'Retrieve password' permission. What can the user do with that account?

  1. Change the account's platform
  2. Delete the account record
  3. Connect to the target through PSM without seeing the password Correct answer.
  4. View the clear-text password on the Accounts page

Explanation

'Use password' allows a user to launch a PSM session that supplies the credential to the target without revealing it. Viewing the clear-text value requires the separate 'Retrieve password' permission.

Question 36Account Onboarding and Management

An organization onboards accounts for a new target system and wants the CPM to log in with a dedicated privileged identity rather than the account being managed. Which platform component provides that identity?

  1. The Master Policy administrator
  2. The safe's auditor
  3. The CPM user configured in the platform's privileged account settings Correct answer.
  4. The account's owner

Explanation

The platform's privileged account settings define the CPM user that performs management actions on the target. Using a dedicated CPM identity separates management access from the credentials being rotated.

Question 37Account Onboarding and Management

After a successful bulk onboarding, an administrator notices that several accounts show an 'unmanaged' status. Which condition best explains this state?

  1. The accounts have passwords longer than 20 characters
  2. The accounts were placed in a safe with auditing enabled
  3. The accounts were created by a user with the auditor role
  4. The accounts were created without a platform that supports CPM management Correct answer.

Explanation

An account is only actively managed when its assigned platform includes CPM capabilities and the necessary settings. Accounts created without such a platform remain stored but are not rotated or verified by the CPM.

Question 38Account Onboarding and Management

A platform's CPM settings specify a 24-hour verification interval, but the account-level record specifies a 7-day verification interval. Which interval governs verification for that account?

  1. The shorter of the two intervals
  2. The longer of the two intervals
  3. The platform interval, because platform settings always override account settings
  4. The account-level interval, because account-specific settings take precedence Correct answer.

Explanation

Account-level properties override the platform defaults for that specific account. When an administrator sets a verification interval on the account, that value governs rather than the platform-wide setting.

Question 39Account Onboarding and Management

An administrator must onboard accounts whose target systems use a proprietary protocol not supported by any existing platform. What is the correct approach?

  1. Rely on Account Discovery to manage them automatically
  2. Place them in a safe without a platform
  3. Onboard them with an existing platform and accept failures
  4. Create a custom platform that includes the required connection and management components Correct answer.

Explanation

When no existing platform supports a target's protocol, the correct path is to build a custom platform with the appropriate connection components and CPM logic. Reusing an incompatible platform produces management failures rather than working accounts.

Question 40Account Onboarding and Management

An account is onboarded and the CPM immediately performs a change, but the application that uses the credential keeps failing authentication. Which onboarding step was most likely omitted?

  1. Adding the account to a second safe
  2. Configuring the application to retrieve the credential from the Vault or updating it after rotation Correct answer.
  3. Assigning an owner to the account
  4. Enabling auditing on the safe

Explanation

Once the CPM rotates a password, any consumer of that credential must obtain the new value from the Vault or be updated after the change. If the application still holds the old password, authentication fails even though the CPM change succeeded.

Question 41Safe and Safe Member Administration

A vault administrator wants a new Safe to be usable by a specific group of developers without granting them any ability to change the Safe's configuration. Which Safe member authorization should be granted so they can retrieve and store accounts but cannot manage members or Safe properties?

  1. Use Safe Correct answer.
  2. Manage Safe
  3. Audit Safe
  4. Full Control

Explanation

The Use Safe authorization allows a member to retrieve, store, and use accounts placed in the Safe, but it does not include administrative rights over the Safe itself. Managing members and Safe properties requires the Manage Safe authorization, and Full Control bundles all authorizations. Therefore Use Safe is the least-privilege choice for day-to-day consumers.

Question 42Safe and Safe Member Administration

An auditor must be able to review who accessed accounts in a Safe and when, but must never be able to retrieve the account passwords themselves. Which authorization assignment best fits this requirement?

  1. Full Control limited to the audit log
  2. Audit Safe without Use Safe Correct answer.
  3. Use Safe combined with Retrieve Accounts
  4. Manage Safe with read-only password access

Explanation

Audit Safe provides access to the Safe's activity and audit information without granting the ability to retrieve account content. Because Use Safe is what enables retrieval and usage of accounts, an auditor should be given Audit Safe and not Use Safe. Combining audit with retrieval rights would violate the least-privilege requirement.

Question 43Safe and Safe Member Administration

A security team wants one member to be able to approve or reject incoming access requests for accounts in a Safe, while that member should not be able to retrieve the passwords directly. Which Safe member authorization supports this?

  1. Retrieve Accounts
  2. Use Safe
  3. Manage Safe
  4. Approve Safe Requests Correct answer.

Explanation

Approve Safe Requests authorizes a member to act on confirmation requests raised for accounts in the Safe without requiring the ability to retrieve those accounts. It is designed for approvers who authorize others' access. Retrieve Accounts and Use Safe concern direct consumption of account content, and Manage Safe concerns Safe administration.

Question 44Safe and Safe Member Administration

A Safe owner needs to add a new user as a member of a Safe. What is the minimum authorization the owner's own membership must include to perform this action?

  1. Use Safe
  2. Manage Safe Correct answer.
  3. Audit Safe
  4. Retrieve Accounts

Explanation

Adding or removing Safe members is an administrative action governed by the Manage Safe authorization. Use Safe, Retrieve Accounts, and Audit Safe cover consumption, retrieval, and auditing respectively, none of which permit membership changes. A member without Manage Safe cannot modify the member list even if they own accounts in the Safe.

Question 45Safe and Safe Member Administration

A user is a member of a Safe through two different groups. One group grants Use Safe, and the other grants Full Control. How are the user's effective authorizations in that Safe determined?

  1. The authorizations are combined, so the user effectively has Full Control Correct answer.
  2. Only the most recently added group membership applies
  3. The most restrictive group membership overrides the others
  4. The user is prompted to choose which group to use at logon

Explanation

CyberArk evaluates Safe authorizations additively across all memberships, including direct user membership and group membership. When one path grants broader rights, the user effectively receives those broader rights. There is no most-restrictive-wins or last-added-wins behavior for Safe authorizations.

Question 46Safe and Safe Member Administration

A Safe is configured so that members can only access accounts during a defined maintenance window. Which Safe-level setting enforces this restriction?

  1. The Safe's object-level audit retention
  2. The Safe's allowed access hours (access window) Correct answer.
  3. The Safe's retention period for versions
  4. The Safe's password policy requirements

Explanation

The Safe can be configured with permitted access hours, sometimes called an access window, that restrict when members may retrieve or use accounts. Outside that window, access is denied regardless of the member's authorizations. Retention, password policy, and audit retention affect other behaviors and do not gate access by time.

Question 47Safe and Safe Member Administration

An administrator wants accounts stored in a Safe to be inaccessible from the CPM until a human approves a request, even for users who hold Use Safe. Which Safe configuration supports this?

  1. Enabling dual control on the Safe
  2. Requiring confirmation (authorization) for access requests on the Safe Correct answer.
  3. Setting the Safe to read-only mode
  4. Enabling the Safe's audit-only flag

Explanation

Requiring confirmation for access requests means a member who requests an account must have that request approved before access is granted, even if they hold Use Safe. Dual control is a related but distinct concept typically applied to password changes and requires two approvers for an action. Read-only and audit-only flags do not implement per-request human approval.

Question 48Safe and Safe Member Administration

Which statement accurately describes how a Safe member's authorization to retrieve an account interacts with the account's own properties?

  1. Safe authorizations alone always permit retrieval regardless of account settings
  2. Retrieval is controlled only by the platform's master policy
  3. Account properties override Safe authorizations in all cases
  4. The member must hold the relevant Safe authorization and the account must permit the requested operation Correct answer.

Explanation

Effective access requires both the appropriate Safe-level authorization and compatibility with the account's own configuration. A Safe authorization does not by itself bypass account-level restrictions. Neither account properties nor master policy alone fully determine retrieval; the layers combine.

Question 49Safe and Safe Member Administration

A Safe owner wants to delegate the ability to add and remove other Safe members to a deputy without giving that deputy the ability to change the Safe's retention settings. Which approach is most appropriate?

  1. Grant the deputy Retrieve Accounts and Approve Safe Requests
  2. Grant the deputy Use Safe and Audit Safe together
  3. Grant the deputy Full Control on the Safe
  4. Grant the deputy Manage Safe and review which administrative capabilities it includes Correct answer.

Explanation

Manage Safe is the authorization that governs Safe administration such as membership changes, and it is the closest fit for delegating member management. Full Control would grant every authorization, which is broader than needed. Use, Audit, Retrieve, and Approve authorizations do not confer membership administration.

Question 50Safe and Safe Member Administration

A user reports they can see a Safe in the interface but cannot retrieve any accounts from it. Which is the most likely cause within Safe membership administration?

  1. The user's membership lacks the Retrieve Accounts authorization Correct answer.
  2. The user's membership lacks the Audit Safe authorization
  3. The Safe has too many members assigned
  4. The user's account is expired in the identity provider

Explanation

Visibility of a Safe and the ability to retrieve accounts are separate. A member may be listed in the Safe yet lack the Retrieve Accounts authorization, which is required to pull passwords. Audit Safe affects log visibility, member count is not a retrieval gate, and an expired identity would typically block authentication entirely.