CyberArk Guardian flashcards
CyberArk Guardian · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Safe
- A logical container in the vault that holds accounts and their credentials, with members and permissions controlling who can list, retrieve, use, or administer the accounts inside.
- Dual control
- A Safe setting requiring one or two authorized approvers to confirm a retrieve or connect request before the credential is released or the session is opened.
- CPM rotation
- The Central Policy Manager changes an account's password at the target system according to the Platform's rotation period and change method, then stores the new value in the vault.
- Credential verification
- A CPM action that tests whether the stored credential still authenticates to the target without changing it, detecting drift between vault and target.
- PSM recording
- Privileged Session Manager proxies the connection to the target and records the session, storing the recording for playback and audit under the configured retention policy.
- PSM Gateway
- An isolated access component that lets users reach targets in a segmented network without deploying a connector directly on the target network, while still recording sessions.
- Platform
- A configuration object that defines how accounts of a given type are connected to, rotated, verified, and reconciled, including the plugins and policies used.
- On-demand elevation rule
- A time-limited rule that grants access to a Safe or account when a condition such as an approved ticket or a defined window is satisfied.
- Safe member permissions
- Granular rights granted to a member on a Safe, including Use, Retrieve, List, Add, Update, Delete, Approve, Audit, and Manage Safe Members.
- Multi-factor authentication
- Authentication using at least two distinct factor types, such as a password plus a one-time code or a FIDO2 security key, resisting single-factor compromise.
- Phishing-resistant authentication
- Authentication bound to the legitimate origin, such as FIDO2/WebAuthn, so a credential entered on a lookalike site cannot be replayed against the real service.
- Risk-based step-up
- Adaptive authentication that raises assurance when signals such as device, location, or behavior indicate risk, requiring an additional factor or blocking the session.
- Separation of duties
- A control ensuring no single person can both request and approve the same privileged access, preventing unilateral escalation.
- Just-in-time access
- Privileged access granted for a bounded duration and revoked automatically, reducing standing privilege compared with permanently assigned admin rights.
- Joiner-mover-leaver
- The identity lifecycle process that provisions access on hire, adjusts it on role change, and revokes it on termination to prevent orphaned accounts.
- Session monitoring
- Live observation and behavioral analysis of privileged sessions that can alert or terminate activity when suspicious commands or patterns appear.
- Least privilege
- Granting an identity only the entitlements needed for its current task, reviewed periodically, so compromise or error limits damage.
- Dynamic secret
- A credential generated on demand with a short time-to-live and revoked automatically after use, limiting the blast radius if it leaks.
- Static secret rotation
- A stored credential changed on a schedule at both the target and the vault, with reconciliation handling cases where the two fall out of sync.
- Secret sprawl
- Credentials scattered across code, configuration files, CI/CD variables, and logs, expanding exposure and making rotation and revocation difficult.
- Workload identity binding
- A policy restricting which workload, identified by namespace, service account, or network origin, may read a given secret path.
- Service account
- A nonhuman account used by an application or service, which cannot perform interactive MFA and therefore depends on vaulting, scoping, and rotation.
- Certificate lifecycle management
- The process of issuing, renewing, and revoking certificates, preferably with short lifetimes and automation to avoid expiry outages and stale trust.
- Secrets in CI/CD
- Pipeline credentials fetched at runtime from a vault, masked in logs, and never embedded in build artifacts or echoed in scripts.
- Nonhuman identity inventory
- A register of service accounts, keys, certificates, and tokens with assigned owners, used to detect unowned or excessive machine identities.
- Agentic identity
- A nonhuman identity that acts autonomously on behalf of a user or system, requiring its own credential, defined scope, and accountable owner.
- Delegated agent token
- A scoped, time-bound token issued to an agent from the delegating identity, carrying permissions limited to the intersection of both parties' rights.
- Audience-restricted token
- A token valid only for a named target service, so a token issued for one resource is rejected when presented to another.
- Access certification
- A campaign in which assigned reviewers attest each entitlement as certify, revoke, or delegate, producing timestamped audit evidence.
- Toxic entitlement combination
- A pair or set of entitlements that together enable fraud or escalation, detected by segregation-of-duties policy and prevented or remediated.
- Role mining
- Deriving roles from observed existing entitlements; over-granular results cause role explosion that makes governance unmanageable.
- Orphaned agent
- An autonomous nonhuman identity with no assigned owner or no expiry, treated as a privileged risk requiring decommissioning or reassignment.