CyberArk PAM-DEF flashcards
CyberArk PAM-DEF · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Safe
- A container in the Vault that holds privileged accounts and their permissions. Safe membership and safe-level permissions determine which users can list, retrieve, or use the accounts inside.
- Master policy
- The global policy that defines platform behavior for all safes in the Vault. Individual safes can receive exceptions that override specific master policy settings.
- Dual control
- A control requiring a second authorized user to approve a credential retrieval or connection. The password is not released until the approver confirms the request.
- One-time password
- A platform setting where the CPM changes the password immediately after a retrieval, so the value a user sees is valid only for that single use.
- CPM
- Central Policy Manager, the component that rotates and verifies privileged account passwords on the schedule defined by each account's platform.
- PSM
- Privileged Session Manager, the component that proxies privileged connections so users never see target credentials, while recording sessions and keystrokes for audit.
- Connection component
- A PSM plugin that maps a client protocol such as RDP, SSH, or a database protocol to the target system, enabling proxied privileged sessions.
- Safe permissions
- Per-user or per-group rights on a safe, such as use, retrieve, list, add, delete, and manage. 'Use' allows PSM connections; 'retrieve' allows viewing passwords.
- Account onboarding
- The process of adding a privileged account to the Vault, either manually, through automatic discovery, or from an external source, requiring a platform and safe.
- Directory mapping
- A configuration that links an LDAP or Active Directory group to a Vault group, so directory users inherit the Vault group's safe permissions.
- Vault user types
- Local users have credentials stored in the Vault; directory users authenticate against an external directory. Both can be granted safe permissions.
- Authentication methods
- The configured ways a user can prove identity to the Vault, including CyberArk passwords, LDAP/AD, RADIUS, SAML, and PKI certificates.
- Multi-factor authentication
- A second authentication factor required in addition to the primary method. The session token is issued only after both factors succeed.
- Session token lifetime
- A configurable idle timeout and maximum duration for an authenticated session. Exceeding either limit forces the user to re-authenticate.
- Vault audit log
- A record of authentications, authorization decisions, and privileged actions. Auditors can query it without being granted access to credentials.
- Least privilege grants
- Assigning permissions to groups rather than individuals, granting only the rights each role needs. Group grants propagate to members and simplify revocation.
- Vault Admin role
- A role responsible for system-level configuration of the Vault, such as authentication methods and policies, separate from day-to-day safe administration.
- EPM
- Endpoint Privilege Manager, the component that removes standing local admin rights on endpoints and elevates only applications approved by policy rules.
- Application rule
- An EPM policy element that matches an application by hash, path, publisher certificate, or file name, and specifies whether to elevate or block it.
- Hash-based matching
- An EPM rule that identifies an application by its file hash. It is the strongest match type because a modified binary produces a different hash.
- Path-based matching
- An EPM rule that identifies an application by its file location. It is weaker than hash matching because a file at that path can be replaced.
- Just-in-time elevation
- A temporary grant of administrative rights for a defined time window, after which the rights are removed, instead of permanent local admin membership.
- Audit-only mode
- An EPM enforcement mode that records attempted elevations without blocking or elevating them, used to baseline activity before enforcing policy.
- Computer group
- An EPM grouping of endpoints that receives a policy. Policy changes reach member agents on the next refresh interval.
- Secrets Manager
- The CyberArk component that stores application secrets such as API keys, tokens, and certificates, separate from interactive privileged account passwords.
- Host identity
- The non-human identity an application uses to authenticate to Secrets Manager, such as an API key or workload identity, instead of a human user.
- Secret variable path
- The identifier an application uses to fetch a secret at runtime. Applications reference the path rather than embedding the secret in code or configuration.
- Declarative policy
- A versioned policy file that defines roles and permissions and is applied to Secrets Manager. Permissions cascade from the layer to its members.
- Secret rotation
- Automatically replacing a stored secret value on a schedule. The new value is stored and the previous value is invalidated for consumers.
- Dynamic secrets
- Secrets generated on demand with a limited lifetime and revoked automatically after use, reducing the window in which a leaked secret is exploitable.
- Layered policy
- A Secrets Manager policy that includes other policies. Permissions defined at a layer apply to the members beneath it.
- Secret retrieval audit
- A record of each secret fetch that identifies the requesting host identity and the variable path, supporting detection of unauthorized access.