I85PREP
⌘ K
CyberArk Guardian study materials
CyberArk Guardian study resources

CyberArk Guardian practice questions

One question at a time. Build your CyberArk Guardian understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Privileged Access Management (PAM)

In a CyberArk Privileged Access Management deployment, which component is the hardened, replicated vault that stores and encrypts privileged account credentials?

  1. The Digital Vault Correct answer.
  2. The Central Policy Manager (CPM)
  3. The Privileged Session Manager (PSM)
  4. The Password Vault Web Access (PVWA)

Explanation

The Digital Vault is the core secure storage tier: it encrypts and holds account objects, files, and policy data, and is deployed in a replicated cluster for resilience. Other components act as interfaces or automation layers that talk to the Vault rather than storing the secrets themselves.

Question 2Privileged Access Management (PAM)

An administrator wants users to request access to a privileged account through a browser without installing a client. Which CyberArk component provides that interface?

  1. PrivateArk Client
  2. Central Policy Manager
  3. Password Vault Web Access Correct answer.
  4. Event Notification Engine

Explanation

Password Vault Web Access (PVWA) is the web front end where users authenticate, browse safes they are authorized for, and request or retrieve accounts. PrivateArk is the thick client used mainly by administrators, and CPM handles rotation rather than user access.

Question 3Privileged Access Management (PAM)

What is the primary function of a Safe in CyberArk PAM?

  1. A rotating encryption key used to protect stored passwords
  2. A logical container that holds accounts and is governed by safe-level authorizations Correct answer.
  3. A network segment that isolates the Vault from the corporate LAN
  4. A scheduled job that reconciles accounts with Active Directory

Explanation

Safes are the fundamental authorization unit: accounts, files, and other objects are placed in safes, and users or groups receive permissions such as retrieve, use, or approve on that safe. Access to an account is therefore governed by safe membership and the authorization granted there.

Question 4Privileged Access Management (PAM)

A security team needs privileged sessions to be recorded and available for later audit. Which CyberArk component is responsible for recording and playing back sessions?

  1. Central Policy Manager
  2. Digital Vault
  3. Password Vault Web Access
  4. Privileged Session Manager Correct answer.

Explanation

Privileged Session Manager (PSM) proxies connections to target systems, isolates the session, and records it so auditors can replay activity. The recording is stored as a file that can be retrieved and reviewed through the PSM interface.

Question 5Privileged Access Management (PAM)

Which CyberArk capability lets an organization automatically rotate a privileged account password on a defined schedule?

  1. Privileged Session Manager
  2. Central Policy Manager Correct answer.
  3. Event Notification Engine
  4. Password Vault Web Access

Explanation

The Central Policy Manager (CPM) executes platform-defined actions such as change, verify, and reconcile on a schedule configured in the platform or master policy. It connects to the target system and updates the credential in the Vault after the change.

Question 6Privileged Access Management (PAM)

What does a platform in CyberArk PAM define?

  1. The connection and rotation logic for a specific target system type Correct answer.
  2. The list of users permitted to log in to the PVWA
  3. The encryption algorithm used by the Vault
  4. The network ports opened on the Vault firewall

Explanation

A platform bundles the properties, connection components, and CPM actions needed to manage accounts for a particular system type, such as Windows Domain Accounts or Oracle databases. It tells the CPM how to connect, change, verify, and reconcile credentials on that target.

Question 7Privileged Access Management (PAM)

Which statement best describes the purpose of dual control in CyberArk PAM?

  1. Two CPM instances must run simultaneously for redundancy
  2. Two authorized users must each approve before an account can be accessed Correct answer.
  3. A single user may approve their own request for efficiency
  4. The Vault encrypts each password with two independent algorithms

Explanation

Dual control requires that a defined number of authorized approvers confirm a request before the account is released, so no single person can unilaterally obtain a sensitive credential. It is configured at the safe level and enforces separation of duties.

Question 8Privileged Access Management (PAM)

What is the main purpose of the CyberArk Master Policy?

  1. To host the PVWA web application
  2. To record interactive sessions for audit
  3. To define default privileged access management rules applied across safes Correct answer.
  4. To store the encrypted passwords for all accounts

Explanation

The Master Policy sets organization-wide defaults such as rotation intervals, dual control requirements, and session recording behavior that safes inherit unless overridden. It centralizes governance so administrators do not configure every safe individually.

Question 9Privileged Access Management (PAM)

A user needs to check out a Windows domain account password so that the CPM changes it immediately after the check-in. Which account property should be configured to achieve this behavior?

  1. Disable the CPM for the platform
  2. Set the account to 'Manual' so no rotation occurs
  3. Enable 'One-time password' so the CPM changes the password on check-in Correct answer.
  4. Assign the user as an approver on the safe

Explanation

The one-time password property instructs the CPM to change the credential immediately after the user checks the account back in, so the retrieved value is valid only for that session. This limits the window in which a disclosed password remains usable.

Question 10Privileged Access Management (PAM)

An account is configured with a CPM change policy, but the CPM reports verification failures after each change attempt. What is the most likely first area to investigate?

  1. The platform's connection component and the credentials used to perform the change on the target Correct answer.
  2. The PVWA IIS certificate binding
  3. The Event Notification Engine recipient list
  4. The number of Vault replicas in the cluster

Explanation

Verification failures after a change usually indicate the CPM cannot authenticate to the target or the change action is misconfigured, so the connection component and the privileged account used by the CPM are the first things to check. The CPM log shows the exact connection and action error.

Question 11Privileged Access Management (PAM)

Which mechanism ensures that a user who retrieves a password through PVWA cannot see it in clear text after the permitted window expires?

  1. The Vault deletes the account object automatically
  2. The Master Policy disables the user's safe membership
  3. The PSM terminates the user's Active Directory session
  4. The CPM changes the password according to the platform's rotation and one-time password settings Correct answer.

Explanation

Expiring usefulness of a disclosed credential depends on rotation: the CPM changes the password on schedule or on check-in so the previously retrieved value becomes stale. Deletion of the account, session termination, or membership changes do not by themselves invalidate a copied password.

Question 12Privileged Access Management (PAM)

A security architect wants connections to a Linux server to be brokered so that the user never learns the target credential. Which CyberArk feature accomplishes this?

  1. The Vault's automatic failover
  2. Safe-level dual control approval
  3. PSM with credential injection through a connection component Correct answer.
  4. CPM reconciliation of the local account

Explanation

PSM connects to the target on the user's behalf and injects the privileged credential, so the user interacts with the session without ever seeing the password. Connection components define how PSM launches the specific client protocol for that target.

Question 13Privileged Access Management (PAM)

What is the difference between an 'ad hoc' connection and an 'RDP' connection in PSM?

  1. Ad hoc records sessions, while RDP connections are never recorded
  2. Ad hoc connects to an arbitrary host supplied at launch, while RDP targets an account's defined address Correct answer.
  3. Ad hoc uses SSH, while RDP uses Telnet
  4. Ad hoc requires dual control, while RDP never does

Explanation

Ad hoc connections let an authorized user specify a target host at connection time, which is useful for unmanaged or one-off systems, whereas a standard RDP connection uses the address and credentials defined on the account. Both can be recorded according to policy.

Question 14Privileged Access Management (PAM)

An auditor needs to review who accessed a specific account and when. Which CyberArk data source provides this audit trail?

  1. The Master Policy editor
  2. The PSM connection component file
  3. The CPM platform definition
  4. The Vault audit records, viewable through reports and the PVWA Correct answer.

Explanation

The Vault records auditable events such as retrievals, changes, and logons, and these records can be reviewed through reports and the PVWA. This provides the who, what, and when needed for access reviews.

Question 15Privileged Access Management (PAM)

A user reports that an account is visible in PVWA but the Connect button is greyed out. Which configuration is the most likely cause?

  1. The account password is older than the rotation interval
  2. The user's directory password is about to expire
  3. The user has retrieve permission but lacks use or connect authorization on the safe Correct answer.
  4. The Vault cluster has more than one replica

Explanation

Connecting through PSM requires the appropriate use or connect authorization in addition to being able to see the account. Visibility alone comes from list permissions, so a user with only retrieve or list rights cannot launch a session.

Question 16Privileged Access Management (PAM)

Which CyberArk component is responsible for reconciling a password that was changed outside of CyberArk back to the value stored in the Vault?

  1. The CPM using the platform's reconcile action Correct answer.
  2. The PVWA using the request workflow
  3. The PSM using the recording engine
  4. The Vault using its replication service

Explanation

Reconciliation is a CPM action that detects drift between the Vault value and the target system and restores the managed password. It is configured in the platform and runs on schedule or on demand.

Question 17Privileged Access Management (PAM)

What is the role of a 'Safe member' authorization such as 'Approve'?

  1. It allows the user to authorize another user's request to access accounts in that safe Correct answer.
  2. It allows the user to change the account password manually
  3. It lets the user record PSM sessions
  4. It grants the user Vault administrator rights

Explanation

The Approve authorization lets a designated user act as an approver in the request workflow for that safe, which is how dual control and approval chains are enforced. It does not by itself grant administrative rights or the ability to change passwords.

Question 18Privileged Access Management (PAM)

A company wants contractors to access privileged accounts only during business hours. Which CyberArk capability enforces this restriction?

  1. The PSM recording retention setting
  2. Time-based restrictions configured in the safe or Master Policy Correct answer.
  3. The CPM rotation schedule
  4. The Vault's encryption key rotation

Explanation

CyberArk supports time-based access restrictions that limit when authorized users can retrieve or connect to accounts, and these can be applied through safe settings or policy. Rotation schedules and recording retention govern other concerns entirely.

Question 19Privileged Access Management (PAM)

Which statement accurately describes the relationship between the Vault and the CPM?

  1. The CPM replaces the Vault during failover
  2. The CPM stores all passwords and the Vault only displays them
  3. The Vault initiates connections to target systems to change passwords
  4. The CPM retrieves account details from the Vault and writes updated credentials back to it Correct answer.

Explanation

The CPM is a client of the Vault: it reads the account and platform configuration, performs the change or verification on the target, and then updates the account object in the Vault. The Vault itself does not initiate connections to managed systems.

Question 20Privileged Access Management (PAM)

An organization wants to onboard 5,000 local administrator accounts across Windows servers. Which CyberArk feature supports automated discovery and onboarding of these accounts?

  1. The PSM recording engine
  2. Automatic detection of unmanaged privileged accounts followed by onboarding workflows Correct answer.
  3. The Event Notification Engine
  4. The PVWA certificate management page

Explanation

CyberArk can discover privileged accounts on the network and then onboard them into safes and platforms so they become managed and rotated. This discovery-and-onboard workflow is the standard way to bring large numbers of accounts under management efficiently.

Question 21Privileged Access Management (PAM)

A user is permitted to retrieve a password but the organization requires that the retrieval be justified and reviewed. Which combination best satisfies this requirement?

  1. Removing the account from the safe after each use
  2. Granting the user Vault administrator rights
  3. A request workflow with reason entry and approval, plus audit of the retrieval event Correct answer.
  4. Disabling CPM rotation so the password stays stable

Explanation

Requiring a reason and an approval through the request workflow, combined with Vault audit records of the retrieval, creates both a justification and a reviewable trail. Disabling rotation or granting excessive rights would weaken rather than strengthen control.

Question 22Privileged Access Management (PAM)

During a disaster recovery test, the primary Vault is unavailable. What design characteristic allows administrators to continue managing accounts?

  1. The CPM continuing to rotate accounts without any Vault
  2. The PSM storing account passwords in its recording files
  3. The PVWA caching passwords locally on the web server
  4. Vault replication to a secondary node that can be promoted, with clients redirected to it Correct answer.

Explanation

Vault high availability relies on replication so that a secondary node holds a copy of the data and can be promoted when the primary fails. Clients are then redirected to the available Vault, preserving management operations.

Question 23Privileged Access Management (PAM)

An administrator must ensure that a highly privileged account's password is never known to any human. Which configuration achieves this most completely?

  1. Recording all sessions without restricting retrieval
  2. PSM-only access with credential injection and CPM rotation, with no retrieve authorization granted Correct answer.
  3. Manual password management with quarterly changes
  4. Dual control approval with retrieve authorization for all users

Explanation

If no user holds retrieve authorization, the password is never displayed, and PSM injection lets users work on the target without seeing it while the CPM keeps it rotated. Dual control and recording add oversight but still allow human knowledge of the credential.

Question 24Privileged Access Management (PAM)

A safe is configured so that requests require approval by two of three designated approvers. A user submits a request and one approver confirms. What is the resulting state?

  1. The account password is rotated immediately
  2. The request is rejected and must be resubmitted
  3. The request is automatically confirmed because one approval was given
  4. The request remains pending until a second approver confirms Correct answer.

Explanation

When the safe requires multiple approvers, the request stays pending until the configured number of distinct approvals is reached. A single confirmation does not satisfy a two-approver requirement.

Question 25Privileged Access Management (PAM)

Why should the CPM's own logon account be managed and rotated like other privileged accounts?

  1. It defines the Master Policy settings
  2. It is used by end users to log in to the PVWA
  3. It stores the session recordings for auditors
  4. It holds powerful rights on target systems and is a high-value target if compromised Correct answer.

Explanation

The CPM logon account typically has administrative rights on managed systems so it can change passwords, making it a high-value credential that must be protected and rotated. Leaving it static would create a persistent path for attackers.

Question 26Privileged Access Management (PAM)

Which CyberArk Vault technology is used to store and protect the encrypted data at rest on the Vault server itself?

  1. A PostgreSQL cluster protected only by operating system permissions
  2. An Oracle database using tablespace encryption
  3. A standard Microsoft SQL Server database with transparent data encryption
  4. The CyberArk encrypted file system with a proprietary Vault database engine Correct answer.

Explanation

The CyberArk Vault uses its own hardened database engine and encrypted file system rather than a general-purpose RDBMS, so the data files are encrypted and protected by the Vault process itself. This design limits exposure because the underlying storage cannot be read with standard database tools even if files are copied.

Question 27Privileged Access Management (PAM)

In CyberArk PAM, which object is the logical container that groups accounts and controls which users can access them, together with the authorizations each user holds?

  1. The Platform
  2. The Connection Component
  3. The Vault
  4. The Safe Correct answer.

Explanation

A Safe is the authorization container: accounts are stored in Safes, and Safe membership plus per-member authorizations determine who can retrieve, use, approve, or administer those accounts. Platforms define how accounts are managed, while the Vault is the storage backend, so neither controls user access.

Question 28Privileged Access Management (PAM)

An administrator wants every password retrieval from a Safe to require the user to type a reason before the password is displayed. Which setting accomplishes this?

  1. Set the Master Policy to 'Require dual control'
  2. Configure the Platform's password change policy
  3. Enable 'Require approval' on the Safe
  4. Enable the 'Require reason' option on the Safe Correct answer.

Explanation

The Safe-level 'Require reason' setting forces users to enter a justification when they retrieve or connect to an account, and that reason is written to the audit trail. Approval and dual control change who must authorize an action, but they do not by themselves collect a free-text justification at retrieval time.

Question 29Privileged Access Management (PAM)

Which CyberArk component is responsible for automatically changing, verifying, and reconciling account credentials according to the Platform's configured policies?

  1. The Central Policy Manager (CPM) Correct answer.
  2. The Password Vault Web Access (PVWA)
  3. The Privileged Session Manager (PSM)
  4. The Vault server

Explanation

The CPM is the component that performs automated password management actions such as change, verify, and reconcile, driven by the Platform settings and Master Policy. PVWA is the web interface, PSM brokers sessions, and the Vault stores and secures the data.

Question 30Privileged Access Management (PAM)

What is the primary function of a Connection Component in a CyberArk Platform?

  1. It records keystrokes and video for audited sessions
  2. It determines which users are authorized to approve requests
  3. It stores the encrypted password for the managed account
  4. It defines the plug-in logic used to connect to a target system for password management or session brokering Correct answer.

Explanation

Connection Components are the plug-ins that tell CPM or PSM how to talk to a particular target system, for example which protocol and parameters to use for a change or a brokered connection. They contain connection logic, not the credential itself or the authorization decisions.

Question 31Privileged Access Management (PAM)

A security team wants to prevent users from seeing a password in clear text during a PSM-brokered session while still allowing them to log on to the target. Which PSM capability supports this?

  1. Enabling 'Allow password copy' on the account
  2. Password retrieval through PVWA with 'Show password' enabled
  3. Storing the password in the user's personal Safe
  4. Session isolation with automatic password injection Correct answer.

Explanation

PSM can inject the credential into the brokered session so the user is authenticated without ever viewing the password, and session isolation keeps the target connection away from the user's desktop. Retrieval or copy features do the opposite by exposing the secret to the user.

Question 32Privileged Access Management (PAM)

Which statement correctly describes how the Master Policy and a Platform's own settings interact in CyberArk PAM?

  1. The Master Policy sets enterprise-wide rules, while Platform settings define per-system behavior and can be constrained by the Master Policy Correct answer.
  2. The Platform overrides every Master Policy rule whenever the two conflict
  3. Platform settings are ignored once an account is placed in a Safe
  4. The Master Policy applies only to Safes and never affects Platform behavior

Explanation

The Master Policy is the top-level rule set that applies across the environment, and Platform settings provide system-specific configuration such as connection details and password rules. Where the Master Policy mandates a behavior, Platform configuration operates within those boundaries rather than replacing them.

Question 33Privileged Access Management (PAM)

An organization must ensure that a sensitive account's password is changed only during an approved maintenance window. Which CyberArk configuration most directly controls this?

  1. The Vault's backup schedule
  2. The Safe's 'Require reason' option
  3. The PSM recording policy
  4. The CPM change schedule defined in the Platform's password management settings Correct answer.

Explanation

The CPM acts on a schedule configured in the Platform's password management settings, so restricting changes to a maintenance window is done by defining when the CPM is allowed to run the change. The other options affect justification, session recording, or backups, not the timing of credential rotation.

Question 34Privileged Access Management (PAM)

Which CyberArk feature allows an organization to import many accounts at once from a structured file instead of creating them individually in PVWA?

  1. PSM session recording export
  2. Account onboarding through the PVWA import/upload of accounts Correct answer.
  3. Manual account creation one at a time
  4. Vault backup and restore

Explanation

PVWA supports onboarding accounts in bulk from a structured file, which maps columns to Platform and Safe properties and creates the accounts in a single operation. Manual creation, session export, and backup/restore do not provide bulk onboarding of new accounts.

Question 35Privileged Access Management (PAM)

A managed account's password was changed directly on the target server by an administrator outside of CyberArk. Which CPM action detects the mismatch and brings the Vault value back in line?

  1. Verify
  2. Reconcile Correct answer.
  3. Connect
  4. Change

Explanation

Reconcile is the CPM action that detects a discrepancy between the Vault and the target and resets the target so both match again. Verify only confirms whether the stored credential still works, and Change rotates to a new value on the normal schedule.

Question 36Privileged Access Management (PAM)

Which CyberArk mechanism records a privileged session as video plus keystroke and window-title metadata for later review?

  1. Safe audit reports
  2. Vault replication logs
  3. CPM verification logs
  4. PSM session recording Correct answer.

Explanation

PSM captures brokered sessions and can record them as video with textual metadata such as keystrokes and window titles, which reviewers use for forensic analysis. The other logs record policy actions, access events, or replication rather than the session content itself.

Question 37Privileged Access Management (PAM)

An auditor asks how to prove that a specific administrator actually viewed a recorded session. Which CyberArk capability supports this?

  1. Platform duplication
  2. Session monitoring and audit trails that log who viewed or played back a recording Correct answer.
  3. Safe membership export
  4. Password verification reports

Explanation

PSM maintains audit information about session playback, so the organization can show who accessed a recording and when. Verification reports, membership exports, and Platform duplication describe other administrative data and do not evidence playback of recordings.

Question 38Privileged Access Management (PAM)

What does the CyberArk 'dual control' requirement enforce during an approval workflow?

  1. That approval is granted automatically after a timeout
  2. That two different authorized users must approve before the requested action proceeds Correct answer.
  3. That the requester and approver must be the same person
  4. That one approver must approve twice to confirm the decision

Explanation

Dual control requires confirmation by a second, different authorized approver so no single person can authorize a sensitive action alone. It is a separation-of-duties control, so the same individual cannot satisfy both approvals.

Question 39Privileged Access Management (PAM)

A Safe is configured so that a request needs approval from two of three designated approvers. One approver has already confirmed. What happens to the request?

  1. It is automatically approved because one confirmation was received
  2. It is rejected because all three approvers must confirm
  3. It remains pending until a second distinct approver confirms Correct answer.
  4. It is escalated to the Vault administrator for a decision

Explanation

When the rule requires two confirmations, a single approval leaves the request pending until a second different approver acts. The count, not the identity of a specific approver, determines completion, so the request neither auto-approves nor fails on the first confirmation.

Question 40Privileged Access Management (PAM)

Which CyberArk capability lets an organization restrict when contractors may check out privileged credentials, for example only on weekdays between 08:00 and 18:00?

  1. Time-based restrictions configured on the Safe or through policy Correct answer.
  2. CPM password verification
  3. PSM session recording
  4. Vault replication

Explanation

CyberArk supports time-based access restrictions so that authorization to retrieve or connect is effective only during defined windows. Recording, verification, and replication address audit evidence, credential health, and availability rather than the permitted access window.

Question 41Privileged Access Management (PAM)

Which statement best describes the role of the Vault in relation to other CyberArk components?

  1. It is the proxy that records sessions to the target servers
  2. It is the web front end that users browse to request passwords
  3. It is the agent that executes password changes on targets
  4. It is the hardened, encrypted repository that all other components query for credentials and policy data Correct answer.

Explanation

The Vault is the central secured store for credentials and configuration, and components such as PVWA, CPM, and PSM retrieve what they need from it over protected channels. It does not itself present a UI, change passwords, or broker sessions.

Question 42Privileged Access Management (PAM)

An account appears in PVWA but the Connect button is unavailable to a user. Which configuration should be checked first?

  1. Whether the user's Safe membership includes the 'Connect' or 'Use' authorization for that account Correct answer.
  2. Whether Vault replication is healthy
  3. Whether the CPM change schedule is enabled
  4. Whether the account password was recently verified

Explanation

The Connect button depends on the user holding the appropriate use authorization on the Safe that contains the account, so membership and authorization are the first things to verify. Scheduling, replication, and verification affect other behaviors and do not grant connection rights.

Question 43Privileged Access Management (PAM)

Which CyberArk design element allows administrators to keep managing privileged accounts if the primary Vault becomes unavailable?

  1. A PSM recording archive on a separate server
  2. A Vault cluster with a failover Vault that holds a replica of the data Correct answer.
  3. A CPM installed on the same host as the Vault
  4. A single Vault with nightly exports to a file share

Explanation

CyberArk supports Vault clustering in which a standby Vault maintains a replica and can take over, preserving availability of credentials and policy. Exports, recording archives, and co-locating the CPM do not provide an operational failover Vault.

Question 44Privileged Access Management (PAM)

What is the purpose of the 'Approve' authorization on a Safe member?

  1. It allows the member to add or remove other Safe members
  2. It allows the member to view the audit log for the Safe
  3. It allows the member to confirm or reject requests made by other users for accounts in that Safe Correct answer.
  4. It allows the member to change the account password manually

Explanation

The Approve authorization makes a member an approver who can act on pending requests for accounts in that Safe. It is distinct from authorizations that permit password changes, membership administration, or audit review.

Question 45Privileged Access Management (PAM)

A security architect wants Linux logons to be brokered so users never learn the target credential. Which CyberArk component and connection method should be used?

  1. PVWA password retrieval with copy enabled
  2. A Safe with the 'Require reason' option enabled
  3. CPM verification over SSH
  4. PSM with an SSH connection component that injects the credential Correct answer.

Explanation

PSM brokers the connection and, using an SSH connection component, can authenticate to the Linux target on the user's behalf without revealing the password. Retrieval with copy exposes the secret, and verification and reason settings do not broker sessions.

Question 46Privileged Access Management (PAM)

Which statement accurately describes the difference between an 'ad hoc' connection and a standard brokered connection in PSM?

  1. An ad hoc connection lets a user initiate a session to a host that is not pre-onboarded as a managed account, subject to policy Correct answer.
  2. An ad hoc connection bypasses all auditing and recording
  3. An ad hoc connection requires a pre-existing managed account in a Safe
  4. An ad hoc connection is only available for database platforms

Explanation

Ad hoc connections allow brokered access to targets that are not yet onboarded as managed accounts, while still applying policy and recording where configured. They do not eliminate auditing, and they are not limited to a single platform type.

Question 47Privileged Access Management (PAM)

An organization wants to demonstrate that a password was successfully rotated on the target after a CPM change. Which CPM action provides that confirmation?

  1. Connect
  2. Verify Correct answer.
  3. Record
  4. Reconcile

Explanation

After a change, the CPM can run a verify action that logs on with the stored credential to confirm it works on the target. Reconcile resolves mismatches, Connect brokers a session, and Record captures session content.

Question 48Privileged Access Management (PAM)

Which CyberArk capability supports onboarding thousands of local administrator accounts across Windows servers with minimal manual effort?

  1. Automatic discovery and onboarding of local accounts using platform-based rules Correct answer.
  2. PSM session recording of administrator logons
  3. Vault backup and restore procedures
  4. Manual creation of each account in PVWA

Explanation

CyberArk can discover local accounts on Windows systems and onboard them automatically according to defined rules, which scales to large estates. Manual creation, recording, and backup do not provide discovery-driven bulk onboarding.

Question 49Privileged Access Management (PAM)

What is the primary purpose of the CyberArk Master Policy?

  1. To provide the web interface for requesting credentials
  2. To record and store session video for auditors
  3. To store the encrypted passwords for all managed accounts
  4. To define enterprise-wide rules that govern account management and session behavior across Platforms Correct answer.

Explanation

The Master Policy is the global rule set that applies across the environment, covering behaviors such as password management and session requirements. Storage, the web interface, and session recording are handled by the Vault, PVWA, and PSM respectively.

Question 50Privileged Access Management (PAM)

A user is permitted to retrieve a password but the organization wants each retrieval reviewed before the password is shown. Which CyberArk configuration achieves this?

  1. Enable CPM verification for the account
  2. Enable 'Require approval' on the Safe so a designated approver must confirm the request Correct answer.
  3. Enable 'Require reason' on the Safe
  4. Enable PSM recording for the account

Explanation

Require approval places a human authorization step between the request and the release of the credential, so a designated approver must confirm before the user sees the password. Require reason only collects a justification, and recording or verification do not gate retrieval.