Safe and Safe Member Administration
What this domain tests
Safe administration is the authorization core of CyberArk. The exam asks who can see, retrieve, change, connect to, or approve an account, and how group membership and restrictions alter that answer. Expect scenario questions about least privilege and about members who can see an account but not use it.
Core rules
- A Safe is the authorization boundary, not a folder. An account is visible only through Safe membership; being a Vault administrator does not grant account access.
- Permissions are granted per member (user or group) and are additive across direct and group membership. Restrictions (allowed source machines, allowed hours) narrow access but do not add permissions.
- Know the high-traffic permissions: List Accounts, Retrieve Accounts, Add/Update/Delete Accounts, Initiate CPM account management operations, Use Accounts, Connect, Approve Authorized Requests, Manage Safe, Manage Safe Members.
- 'Manage Safe' covers Safe properties; 'Manage Safe Members' covers membership. Giving either to end users is a privilege-escalation path.
- Safe-level controls such as dual control, reason-for-access, and exclusive/check-in rules change the workflow without changing the permission list.
- Removing a user from an AD group removes inherited Safe access only at next logon/token refresh; direct membership must be removed separately.
Worked example
A DBA team must view Oracle accounts and open PSM sessions, but must not change passwords. Grant List Accounts, Retrieve Accounts, Use Accounts, and Connect - but not 'Initiate CPM account management operations' (that drives the Change button) and not Update Properties/Delete. Reasoning: viewing and connecting are separate from management operations; the CPM permission is what lets a non-owner trigger rotation, so withholding it enforces read-and-connect-only.
Traps that cost marks
- Confusing 'Manage Safe' with 'Manage Safe Members' and granting both.
- Forgetting that group membership grants access invisibly; auditors often miss inherited members.
- Giving Retrieve Accounts when Connect would do - retrieval exposes the password outside PSM recording.
- Deleting the last member with Manage Safe Members, leaving the Safe unmanageable.