CyberArk PAM-SEN flashcards
CyberArk PAM-SEN · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Vault
- The encrypted repository in CyberArk PAM that stores privileged account credentials, files, and metadata; access is controlled by safes and permissions.
- Safe
- A container in the Vault that holds accounts and objects and defines which users or groups can access them through safe-level permissions.
- Master Policy
- The global policy in CyberArk PAM that defines password change, dual control, exclusive access, and session recording rules, with exceptions applied per safe or account.
- CPM
- Central Policy Manager, the component that automatically changes and verifies privileged account passwords on target systems according to platform policy settings.
- Dual control
- A policy requiring two authorized users to approve a sensitive action such as credential retrieval or password change before it is executed.
- Exclusive access
- A policy that locks an account to one user for a defined period, preventing other users from retrieving or using the account during that time.
- PSM
- Privileged Session Management, the component that proxies and records privileged sessions to targets such as Windows, Unix, and database servers.
- PSM for SSH
- The CyberArk component that proxies and records SSH sessions to Unix and Linux targets, supporting connection components for SSH-based access.
- Account discovery
- A CyberArk process that scans domains and network ranges to find unmanaged privileged accounts and can onboard them into safes automatically.
- Ticketing integration
- A PSM feature that requires a valid ticket number from systems such as ServiceNow before a privileged session is launched.
- Secrets Manager
- CyberArk's machine identity solution (Conjur) that stores, rotates, and distributes secrets to applications and workloads via policy-based access.
- Conjur policy
- A YAML document defining users, hosts, layers, variables, and permissions; policy statements grant privileges via !permit entries.
- Conjur authenticator
- A mechanism such as authn, authn-iam, authn-azure, authn-k8s, or authn-jwt that verifies the identity of a workload requesting a Conjur access token.
- Dynamic secret
- A credential generated on demand by Secrets Manager, such as a database account, that is created for a session and expires after use.
- CCP
- Central Credential Provider, a CyberArk REST API service that lets applications retrieve credentials at runtime without embedding them in code.
- AAM
- Application Access Manager, the CyberArk component that manages application identities and controls which applications can access which credentials.
- Conjur follower
- A Secrets Manager node that replicates data from the leader and serves API requests; multiple followers support load balancing and high availability.
- Secrets Provider
- A CyberArk component that injects secrets into Kubernetes pods, typically via init or sidecar containers, using the Conjur Kubernetes authenticator.
- Secret rotation
- The scheduled or on-demand replacement of a stored secret, such as a password or API key, to limit the window of credential exposure.
- EPM
- Endpoint Privilege Manager, the CyberArk component that enforces application control, privilege elevation, and threat protection policies on endpoints.
- Application control
- An EPM policy that allows or blocks application execution based on rules matching file hash, publisher certificate, file path, or file name.
- Just-in-time elevation
- An EPM workflow where a standard user requests elevated execution, an approver authorizes it, and the application runs elevated for a limited time.
- Threat protection
- An EPM capability that detects and blocks suspicious endpoint behavior such as ransomware encryption patterns and credential dumping attempts.
- EPM agent
- The endpoint software installed on Windows or macOS that enforces EPM policies and reports application execution and elevation events to the server.
- Policy precedence
- The ordering rule that determines which EPM policy applies when multiple rules match an application, resolving conflicts between allow and block rules.
- IGA
- Identity Governance and Administration, the discipline covering identity lifecycle, access requests, certifications, and role management, integrated with CyberArk for privileged access.
- Access certification
- A review campaign in which assigned reviewers confirm or revoke user access to safes or entitlements, producing audit evidence of periodic access review.
- Segregation of duties
- A policy that detects conflicting access combinations, such as a user who can both request and approve the same access, and flags violations for remediation.
- Role mining
- The IGA process of analyzing existing access assignments to identify candidate roles that group commonly co-assigned permissions.
- Access request workflow
- An IGA process where a user requests access, approvers evaluate it per policy, and approved entitlements are provisioned in the target system.
- Joiner-mover-leaver
- The identity lifecycle events that trigger provisioning for new hires, access updates for role changes, and prompt deprovisioning for departures.
- Authoritative source
- The system of record, typically an HR system, that supplies identity data used to reconcile and provision accounts in target systems.