I85PREP
⌘ K
CyberArk PAM-SEN study materials
CyberArk PAM-SEN study resources

CyberArk PAM-SEN practice questions

One question at a time. Build your CyberArk PAM-SEN understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Privileged Access Management (Human Identity Security)

In CyberArk Privileged Access Management, which component is the primary repository where safe data, user records, and policy definitions are stored?

  1. The Privileged Session Manager
  2. The Vault Correct answer.
  3. The Password Vault Web Access server
  4. The Central Policy Manager

Explanation

The Vault is the hardened, encrypted database that holds safes, object data, user and group records, and policy definitions for the deployment. Other components such as PVWA, CPM, and PSM act as interfaces or services that read and write through the Vault rather than storing the authoritative data themselves.

Question 2Privileged Access Management (Human Identity Security)

A security team wants administrators to approve access to a sensitive safe before a user can retrieve credentials. Which CyberArk capability provides this workflow?

  1. Automatic password rotation
  2. Session recording
  3. Dual control Correct answer.
  4. One-time passwords

Explanation

Dual control requires one or more authorized approvers to confirm a request before another user can access a protected safe or account. It is configured per safe and enforces separation of duties between requester and approver. The other options address credential exposure, audit, or rotation rather than approval gating.

Question 3Privileged Access Management (Human Identity Security)

Which CyberArk safe member authorization allows a user to retrieve an account password but prevents them from viewing or editing the account properties?

  1. List accounts
  2. Manage safe
  3. Retrieve accounts Correct answer.
  4. Use accounts

Explanation

The Retrieve accounts authorization grants the ability to check out and view the password or connect using the account while not granting visibility into account configuration. List accounts only shows that the account exists, and Manage safe covers administrative control of the safe itself.

Question 4Privileged Access Management (Human Identity Security)

What is the primary purpose of the CyberArk Central Policy Manager?

  1. To provide a web portal for end users to request access
  2. To record and replay privileged sessions for auditors
  3. To synchronize directory users and groups from Active Directory
  4. To automatically change and verify account credentials according to policy Correct answer.

Explanation

The CPM executes password management policies, rotating and verifying credentials on managed accounts and reconciling them with the target systems. It runs as a service against platforms that define how each target type is handled. Session recording, the web portal, and directory synchronization belong to other components.

Question 5Privileged Access Management (Human Identity Security)

An auditor needs evidence of exactly what a vendor did during a remote privileged session on a production server. Which CyberArk feature directly satisfies this requirement?

  1. Account password reconciliation
  2. Safe-level dual control
  3. Privileged Session Manager recording Correct answer.
  4. Master policy password complexity rules

Explanation

PSM proxies the connection and records the session, producing an auditable record of the commands and screen activity performed. This is the control that documents what a user actually did on the target. Dual control, reconciliation, and complexity rules govern access approval and credential hygiene, not activity evidence.

Question 6Privileged Access Management (Human Identity Security)

Which statement best describes the role of a CyberArk platform in account management?

  1. It sets the retention period for recorded session files
  2. It defines how the CPM connects to and manages a specific type of target system Correct answer.
  3. It lists the users who are permitted to log on to the PVWA
  4. It specifies the network zones from which PSM connections are allowed

Explanation

A platform bundles the connection settings, password change and verification logic, and UI customization needed to manage a particular target system type. Multiple accounts of the same system type share the platform definition. Access permissions, network zoning, and recording retention are configured elsewhere.

Question 7Privileged Access Management (Human Identity Security)

A user must connect to a Linux server through CyberArk without ever seeing the root password. Which access method accomplishes this?

  1. Export the account to a personal safe and retrieve it later
  2. Connect using PSM with the account, letting PSM inject the credential Correct answer.
  3. Request that the CPM disable rotation for the account
  4. Copy the password from the PVWA and paste it into an SSH client

Explanation

PSM connection brokering authenticates the user to the target on their behalf and injects the privileged credential without disclosing it. This keeps the password unknown to the human while still recording the session. Manual copying, exporting, or disabling rotation all expose or weaken the credential.

Question 8Privileged Access Management (Human Identity Security)

Which CyberArk object is used to organize and protect a set of privileged accounts with shared access rules?

  1. Safe Correct answer.
  2. Master policy
  3. User group
  4. Platform

Explanation

A safe is the container that holds accounts and other objects and carries its own member list with per-member authorizations. Access to privileged accounts is granted by adding users or groups to the safe with appropriate permissions. User groups, platforms, and the master policy support this model but are not the container itself.

Question 9Privileged Access Management (Human Identity Security)

An administrator wants a specific safe to require approval by two distinct approvers before any account in it can be retrieved. Which configuration achieves this?

  1. Add all users to the safe with the Auditor authorization
  2. Configure the master policy to require password complexity
  3. Enable one-time passwords on every account in the safe
  4. Set the safe's dual control to require two approvers and confirm the approvers are not members authorized to retrieve Correct answer.

Explanation

Dual control is configured on the safe, and the number of required approvers determines how many confirmations are needed. Approvers must hold the appropriate authorizations and should be separated from requesters so that separation of duties is meaningful. The other options affect credential reuse, audit visibility, or password strength rather than approval count.

Question 10Privileged Access Management (Human Identity Security)

A user reports that an account is visible in the safe but the Connect button is unavailable and the password cannot be displayed. Which authorization is most likely missing?

  1. View audit log
  2. Manage safe
  3. Use accounts Correct answer.
  4. Backup safe

Explanation

The Use accounts authorization permits a user to connect through PSM or retrieve the password for accounts in the safe. Without it, the account may appear if the user can list it, but connection and retrieval actions are blocked. Manage safe, backup, and audit permissions govern administration and oversight rather than day-to-day use.

Question 11Privileged Access Management (Human Identity Security)

A security policy states that no single person may both request and approve access to a tier-0 administrative account. Which CyberArk configuration enforces this?

  1. Dual control on the safe with requester excluded from the approver list Correct answer.
  2. Automatic rotation every 24 hours
  3. Session recording with keystroke logging
  4. One-time password access with automatic invalidation

Explanation

Dual control enforces separation of duties by requiring confirmation from authorized approvers who are distinct from the requester. Excluding the requester from the approver list ensures the same person cannot satisfy both roles. The other options strengthen credential handling or auditing but do not separate request from approval.

Question 12Privileged Access Management (Human Identity Security)

A privileged account's stored password no longer matches the target system, and logins through PSM fail. Which CyberArk process should be used to correct the stored value?

  1. Reconcile the account Correct answer.
  2. Change the account platform
  3. Verify the account
  4. Enable dual control on the account

Explanation

Reconciliation resets the password on the target to match the value stored in the Vault, restoring consistency after a mismatch. Verification only checks whether the stored credential still works and reports the result without correcting it. Dual control and platform changes do not resolve a credential mismatch.

Question 13Privileged Access Management (Human Identity Security)

Which CyberArk component enables users to check out, approve, and manage privileged accounts through a browser interface?

  1. Vault
  2. Password Vault Web Access Correct answer.
  3. Privileged Session Manager
  4. Central Policy Manager

Explanation

PVWA is the web front end where users browse safes, request and retrieve accounts, and where administrators configure many settings. It presents Vault data and workflow to the user but relies on the Vault for storage and on CPM and PSM for management and brokering.

Question 14Privileged Access Management (Human Identity Security)

An organization wants vendor sessions to be recorded and the vendor to be unable to copy files out of the session. Which combination of CyberArk capabilities addresses this?

  1. Master policy requiring minimum password length
  2. PSM recording with PSM restrictions configured for the platform Correct answer.
  3. CPM rotation with verification every hour
  4. Safe dual control with a single approver

Explanation

PSM records the brokered session, and PSM restrictions configured on the platform or connection component can block actions such as file transfer or clipboard copy. Together they deliver both audit evidence and preventive control over the session. Rotation, approval, and complexity rules do not restrict in-session actions.

Question 15Privileged Access Management (Human Identity Security)

A user needs temporary access to a production database account for a four-hour maintenance window. Which CyberArk practice best limits standing access?

  1. Disable rotation on the account during the window
  2. Place the account in a personal safe owned by the user
  3. Grant time-limited safe membership that expires after the window Correct answer.
  4. Add the user permanently with the Auditor authorization

Explanation

Time-limited membership grants the necessary authorization only for the approved period and then removes it automatically, reducing standing privilege. Permanent membership, personal safes, and disabling rotation all increase exposure rather than constrain it to the window.

Question 16Privileged Access Management (Human Identity Security)

Which statement correctly distinguishes verification from reconciliation in CyberArk credential management?

  1. Verification forces the target to match the stored credential; reconciliation confirms the stored credential works
  2. Verification confirms the stored credential works; reconciliation forces the target to match the stored credential Correct answer.
  3. Verification records the session; reconciliation rotates the credential
  4. Verification rotates the credential; reconciliation records the session

Explanation

Verification tests whether the password held in the Vault still authenticates to the target and raises an alert if it does not. Reconciliation goes further by changing the target so that it matches the Vault value, resolving the mismatch. Rotation and session recording are separate functions.

Question 17Privileged Access Management (Human Identity Security)

In CyberArk, which object determines enterprise-wide password policy settings that individual safes inherit unless overridden?

  1. Safe member list
  2. User directory
  3. Master policy Correct answer.
  4. Platform connection component

Explanation

The master policy defines default rules such as password change intervals and complexity that apply across safes, with safes able to override where permitted. It centralizes governance so administrators do not configure every safe individually. Member lists, connection components, and directories serve different purposes.

Question 18Privileged Access Management (Human Identity Security)

An administrator must ensure that a newly onboarded Unix account is automatically rotated daily and verified after each change. Where are these behaviors defined?

  1. In the PSM recording retention settings
  2. In the platform assigned to the account, with rotation and verification enabled Correct answer.
  3. In the PVWA authentication configuration
  4. In the safe member authorizations for the account owner

Explanation

The platform assigned to an account specifies the CPM connection details and the change and verification logic for that target type. Enabling rotation and verification on the platform causes the CPM to act on accounts using it. Safe authorizations, authentication settings, and retention settings govern other concerns.

Question 19Privileged Access Management (Human Identity Security)

A safe currently allows any member to retrieve accounts. Security wants retrieval limited to a named group while still allowing the help desk to see that accounts exist. Which change accomplishes this?

  1. Move all accounts to a personal safe
  2. Remove List accounts from all members and grant Manage safe to the help desk
  3. Remove Retrieve accounts from general members and grant it only to the named group, leaving List accounts for the help desk Correct answer.
  4. Enable dual control with zero approvers

Explanation

Authorizations are granted per safe member, so retrieval can be restricted to a specific group while other members retain only the ability to list accounts. This preserves visibility for support staff without exposing credentials. Removing listing entirely, misusing dual control, or moving to personal safes does not achieve the stated balance.

Question 20Privileged Access Management (Human Identity Security)

Which CyberArk capability allows an organization to require that a privileged session be initiated only through PSM rather than direct RDP to the server?

  1. Enabling dual control on the safe
  2. Configuring the platform so connections are brokered through PSM and blocking direct access at the network level Correct answer.
  3. Setting a short password change interval
  4. Assigning the Auditor authorization to all users

Explanation

Enforcement requires both the CyberArk side, where the platform routes connections through PSM, and network controls that prevent users from reaching the target directly. Only the combination guarantees that sessions are brokered and recorded. Approval, rotation, and audit permissions do not force brokering.

Question 21Privileged Access Management (Human Identity Security)

A privileged account is managed by the CPM, but the target system locks the account after three failed logons, and an attacker is deliberately submitting wrong passwords. Which CyberArk control most directly reduces this denial-of-service risk?

  1. Granting the Auditor authorization to the security team
  2. Increasing the recording retention period
  3. Enabling dual control with one approver
  4. Configuring the platform's password change and logon behavior to respect the target lockout policy and limiting who can retrieve the account Correct answer.

Explanation

Aligning CPM behavior with the target's lockout threshold avoids self-inflicted lockouts, while restricting retrieval reduces the number of parties who can deliberately submit bad credentials. Together they lower the denial-of-service exposure. Approval counts, retention, and audit visibility do not address failed-logon lockout mechanics.

Question 22Privileged Access Management (Human Identity Security)

An organization uses CyberArk to manage domain accounts and wants to eliminate shared administrative credentials on workstations. Which approach best aligns with the least-privilege principle?

  1. Grant all administrators membership in a single safe with Manage safe rights
  2. Assign each administrator a unique privileged account managed in a safe with just-in-time retrieval Correct answer.
  3. Store the domain administrator password in a personal safe for convenience
  4. Create one shared local administrator account per site and store it in a safe

Explanation

Unique per-person privileged accounts combined with just-in-time retrieval provide individual accountability and minimize standing privilege. Shared accounts obscure attribution, broad Manage safe membership grants excessive administrative rights, and personal safes undermine centralized governance.

Question 23Privileged Access Management (Human Identity Security)

A safe is configured with dual control requiring two approvers, but a request is confirmed by the requester and one other authorized approver. What is the expected outcome?

  1. The request is approved only if the requester holds Manage safe
  2. The request is escalated automatically to the Vault administrator
  3. The request is approved because two confirmations were recorded
  4. The request remains unapproved because the requester's confirmation does not satisfy an approver requirement Correct answer.

Explanation

Dual control counts confirmations from authorized approvers who are distinct from the requester, so a requester's own confirmation does not fulfill an approver slot. With only one valid approver confirmation, the required number is not met and access is not granted. There is no automatic escalation of this kind.

Question 24Privileged Access Management (Human Identity Security)

An administrator wants to prove that a specific vendor session was recorded and that the vendor could not transfer files. Which two CyberArk configuration areas must be validated?

  1. The CPM rotation schedule and the account verification interval
  2. The safe member authorizations and the master policy password complexity
  3. The PSM recording settings and the PSM restrictions applied to the platform used for the connection Correct answer.
  4. The PVWA authentication methods and the user directory mappings

Explanation

Recording is controlled by PSM recording configuration, and in-session actions such as file transfer are governed by PSM restrictions attached to the platform or connection component. Validating both areas confirms the audit trail exists and the restriction was enforced. The other pairs relate to access rights, credential hygiene, and authentication.

Question 25Privileged Access Management (Human Identity Security)

Which CyberArk feature allows an organization to require that the password for a highly sensitive account be changed immediately after any retrieval, ensuring the retrieved value becomes invalid?

  1. Dual control configured with two approvers
  2. Auditor authorization assigned to the account owner
  3. One-time password access configured for the account Correct answer.
  4. Session recording with keystroke capture

Explanation

One-time password mode causes the credential to be changed after use so that the value a user retrieved no longer works, limiting reuse. This is distinct from approval workflows, recording, and audit permissions. It is commonly applied to the most sensitive accounts where any exposure must be short-lived.

Question 26Privileged Access Management (Human Identity Security)

In CyberArk, which human identity type is typically authenticated directly against an external directory such as Active Directory and is used for day-to-day administration of the Vault?

  1. CyberArk user Correct answer.
  2. Privileged account
  3. Application identity
  4. Vault administrator

Explanation

CyberArk users are the human identities that log on to the PVWA and other interfaces, and they are normally mapped to directory users through LDAP or SAML integration so they authenticate with their corporate credentials. Privileged accounts are the credentials being managed, and application identities belong to non-human integrations.

Question 27Privileged Access Management (Human Identity Security)

A security team wants each administrator to authenticate to the PVWA with a password plus a one-time code from a mobile app. Which CyberArk capability satisfies this requirement?

  1. Session isolation
  2. Dual control approval
  3. Multi-factor authentication Correct answer.
  4. Password reconciliation

Explanation

Multi-factor authentication in CyberArk adds a second authentication factor, such as a TOTP code or RADIUS-delivered OTP, on top of the user's directory password during PVWA logon. Dual control governs approvals, session isolation governs PSM behavior, and reconciliation repairs drifted credentials.

Question 28Privileged Access Management (Human Identity Security)

Which CyberArk authorization concept determines what an individual user is allowed to do inside a specific safe, such as retrieve a password or initiate a PSM session?

  1. Platform settings
  2. Safe member permissions Correct answer.
  3. Trusted locations
  4. Master policy

Explanation

Safe membership carries a set of authorizations, including use accounts, retrieve accounts, list accounts, connect, and approve, so the safe member definition is where per-user rights inside a safe are granted. Master policy sets enterprise-wide rules, platform settings describe how accounts are managed, and trusted locations restrict network origin.

Question 29Privileged Access Management (Human Identity Security)

A user is a member of a safe with the Use accounts authorization but not Retrieve accounts. What can the user do with an account in that safe?

  1. View the password in clear text from the PVWA
  2. Connect to the target through PSM without seeing the password Correct answer.
  3. Reset the password manually from the PVWA
  4. Approve other users' access requests for the account

Explanation

Use accounts allows a user to launch a connection to the account, typically through PSM, while the credential is injected without being displayed. Retrieve accounts is the separate authorization required to view or copy the password, and approval rights come from the Approve authorization.

Question 30Privileged Access Management (Human Identity Security)

An organization wants administrators to log on to CyberArk with their existing corporate credentials and have group membership drive safe permissions automatically. Which configuration supports this?

  1. Issue shared Vault administrator accounts to the team
  2. Map Active Directory groups to safes as members Correct answer.
  3. Create local Vault users for each administrator
  4. Disable directory integration and use Vault-only authentication

Explanation

Directory integration lets CyberArk users authenticate with their domain credentials, and adding an Active Directory group as a safe member means group membership drives authorization without per-user maintenance. Local or shared Vault accounts break the accountability and lifecycle benefits of directory integration.

Question 31Privileged Access Management (Human Identity Security)

A help desk group must be able to see that an account exists in a safe and view its metadata, but must never see or use the password. Which safe authorization set meets this requirement?

  1. Approve and Connect
  2. Use accounts and Retrieve accounts
  3. List accounts only Correct answer.
  4. List accounts and Retrieve accounts

Explanation

List accounts allows a member to see the account record and its properties without exposing the credential, which is the minimum needed for inventory or help desk visibility. Adding Retrieve accounts or Use accounts would grant access to the credential itself, which the requirement forbids.

Question 32Privileged Access Management (Human Identity Security)

Which CyberArk mechanism enforces that a user requesting access to an account in a dual-control safe cannot also be the one who approves the request?

  1. The master policy's dual control setting evaluated against the requester identity Correct answer.
  2. The safe's retention period for recordings
  3. The trusted location definition for the safe
  4. The platform's password change interval

Explanation

Dual control is defined in the master policy and requires a defined number of approvers who are distinct from the requesting user, so the requester cannot self-approve. Retention, rotation interval, and trusted locations govern other concerns entirely.

Question 33Privileged Access Management (Human Identity Security)

An auditor asks how CyberArk proves that a specific administrator, rather than a shared team identity, retrieved a password. Which two elements together provide that evidence?

  1. Safe name and platform name
  2. Account address and CPM name
  3. Vault server name and license key
  4. Individual CyberArk user identity and the recorded audit event Correct answer.

Explanation

Because each human authenticates with a unique CyberArk user, retrieval actions are logged against that individual, and the audit trail records who did what and when. Safe and platform names describe the object but do not identify the person, so they cannot establish individual accountability.

Question 34Privileged Access Management (Human Identity Security)

A contractor needs to use a privileged account for a limited engagement. Which combination best applies least privilege to this human identity in CyberArk?

  1. Grant time-limited safe membership with only the authorizations the task requires Correct answer.
  2. Share the account password with the contractor by email
  3. Add the contractor to the safe with full safe authorizations permanently
  4. Create a local Vault administrator account for the contractor

Explanation

Least privilege means granting only the authorizations the task needs and limiting their duration, so time-limited membership with minimal rights is the correct approach. Permanent broad membership, password sharing, and elevated local accounts all exceed what the engagement requires.

Question 35Privileged Access Management (Human Identity Security)

Which statement best describes how CyberArk supports the joiner-mover-leaver process for human identities?

  1. Safe permissions are assigned per account rather than per user or group
  2. Users are created manually in the Vault and never synchronized with the directory
  3. Leavers keep their safe memberships because audit records require it
  4. Directory users and groups are imported so that disabling a directory account removes CyberArk access Correct answer.

Explanation

With directory integration, CyberArk users and groups are imported and refreshed from the directory, so disabling or removing a directory identity removes that person's ability to authenticate and inherit group-based safe access. Manual, per-account, or retained memberships undermine the lifecycle controls.

Question 36Privileged Access Management (Human Identity Security)

An administrator must review which human users hold the Approve authorization across all safes. Where is this information primarily managed and reviewed?

  1. In the account's remote machine address field
  2. In the CPM configuration file on the target server
  3. In the PSM RDP properties of the platform
  4. In each safe's member list and the Vault audit Correct answer.

Explanation

Safe member lists define who holds each authorization such as Approve, and the Vault audit records changes to those memberships for review purposes. CPM and PSM configuration and account address fields do not hold user authorization data.

Question 37Privileged Access Management (Human Identity Security)

A user with Retrieve accounts permission in a safe cannot see the Connect button for an account. Which factor most likely explains the missing button?

  1. The account's platform does not support PSM connections
  2. The safe's retention period has expired
  3. The user's safe membership lacks the Connect authorization Correct answer.
  4. The account has never been rotated by the CPM

Explanation

The Connect action is a distinct authorization in the safe membership, separate from Retrieve accounts, so a user may read the password yet be unable to launch a PSM session. Platform support, recording retention, and rotation history do not remove the button for an otherwise authorized user.

Question 38Privileged Access Management (Human Identity Security)

An organization wants administrators to request access to sensitive safes through a workflow with justification and approver review instead of direct standing access. Which CyberArk human-identity control implements this?

  1. PSM session recording
  2. Exclusive access with dual control approval Correct answer.
  3. Automatic CPM rotation
  4. Trusted location restriction

Explanation

Exclusive access combined with dual control requires users to request access with a reason and have approvers confirm it, so access is granted for the approved window rather than standing. Rotation, recording, and trusted locations address credential freshness, session evidence, and network origin respectively.

Question 39Privileged Access Management (Human Identity Security)

Which CyberArk feature lets an organization require that a user supply a reason and ticket number before a PSM session to a sensitive server is allowed to start?

  1. CPM reconciliation
  2. Password verification
  3. Session recording retention
  4. Access request workflow with required fields Correct answer.

Explanation

The access request workflow can be configured to require fields such as a reason and ticket reference, and the session is not permitted until the request is submitted and, where configured, approved. Verification, retention, and reconciliation concern credential state and stored evidence, not pre-session gating.

Question 40Privileged Access Management (Human Identity Security)

A security policy requires that administrators cannot copy files from a sensitive server during a PSM session, while still allowing them to work on the desktop. Which PSM capability addresses this?

  1. Shorten the CPM password change interval
  2. Enable dual control on the safe
  3. Restrict the safe to trusted locations
  4. Disable the clipboard and file transfer options in the platform's PSM settings Correct answer.

Explanation

PSM connection settings can disable clipboard copy and file transfer so data cannot leave the session, while the rest of the desktop session remains usable. Rotation interval, dual control, and trusted locations address different risks and do not block data transfer.

Question 41Privileged Access Management (Human Identity Security)

Which statement best explains why CyberArk recommends that each human administrator use an individual CyberArk user rather than a shared Vault account?

  1. Shared accounts cannot be assigned safe permissions
  2. Individual users bypass the need for multi-factor authentication
  3. Individual users allow actions to be attributed to a specific person in the audit trail Correct answer.
  4. Shared accounts increase license consumption per safe

Explanation

Unique CyberArk users make the audit trail attributable, so retrievals, approvals, and sessions can be tied to one person. Licensing, permission assignment, and MFA are not the reason; shared accounts actually weaken accountability and typically still require MFA.

Question 42Privileged Access Management (Human Identity Security)

An administrator wants to see which human users have connected to a specific privileged account over the past quarter. Which CyberArk data source should be used?

  1. The account's platform configuration file
  2. The CPM's logon account properties
  3. The safe's retention policy settings
  4. The Vault audit records and PSM session records Correct answer.

Explanation

Vault audit records capture user actions such as connections and retrievals, and PSM session records provide the recorded evidence of those sessions, together answering who connected and when. Platform configuration, retention settings, and CPM logon account properties do not record human connection history.

Question 43Privileged Access Management (Human Identity Security)

A user's safe membership includes Approve, but the safe does not require dual control. What is the practical effect of that authorization?

  1. The user can add new members to the safe
  2. The user must approve every retrieval before it occurs
  3. The user's approval rights have no gating effect because requests are not required Correct answer.
  4. The user can reset the account password without further rights

Explanation

Approve only matters when the master policy or safe configuration requires confirmation before access, so without dual control there is no pending request for the user to approve. It does not grant password changes or membership management, which are separate authorizations.

Question 44Privileged Access Management (Human Identity Security)

An organization wants to delegate safe administration so that a team lead can add and remove safe members without gaining the ability to retrieve the accounts. Which approach fits least privilege?

  1. Grant the team lead safe-level administrative rights on that safe only Correct answer.
  2. Make the team lead a Vault administrator
  3. Grant the team lead Retrieve accounts and Approve
  4. Add the team lead to every safe as a member

Explanation

Safe-level administration can be delegated for a specific safe, allowing membership changes without granting credential retrieval or broad Vault control. Vault administrator rights, retrieval rights, or membership in every safe all exceed the stated need.

Question 45Privileged Access Management (Human Identity Security)

Which CyberArk control most directly limits the damage a compromised human credential can cause by restricting where that user may authenticate from?

  1. Password reconciliation
  2. Dual control
  3. Session recording
  4. Trusted locations Correct answer.

Explanation

Trusted locations restrict authentication and connections to approved network ranges, so a stolen credential used from an unapproved network is rejected. Reconciliation, recording, and dual control address credential drift, evidence capture, and approval separation rather than network origin.

Question 46Privileged Access Management (Human Identity Security)

A manager must be able to approve access requests for a safe but must never retrieve or use the accounts. Which safe membership best satisfies this?

  1. Approve authorization without Use accounts or Retrieve accounts Correct answer.
  2. Retrieve accounts and Approve
  3. Use accounts and List accounts
  4. Vault administrator with no safe membership

Explanation

The Approve authorization can be granted independently of credential access, so a manager can act as approver without seeing or using passwords. Combining Approve with retrieval or use rights, or granting Vault administrator, gives more access than the role requires.

Question 47Privileged Access Management (Human Identity Security)

Which statement best describes the relationship between a CyberArk user and the privileged accounts that user can access?

  1. The user is a service account used by the CPM
  2. The user is a human identity whose access is granted through safe membership Correct answer.
  3. The user is the managed credential stored in the safe
  4. The user is a platform definition applied to accounts

Explanation

A CyberArk user represents a human identity, and access to managed privileged accounts is granted by making that user or its directory group a member of the relevant safe. The managed credential, the CPM service account, and platform definitions are separate object types.

Question 48Privileged Access Management (Human Identity Security)

An auditor finds that a terminated employee's CyberArk user still appears as a safe member, though the directory account is disabled. What is the most accurate risk assessment?

  1. No risk exists because the directory account is disabled
  2. The account should be deleted from the directory to fix the safe membership
  3. The membership is harmless because safe membership does not grant access
  4. The stale membership should be removed because it can be reactivated or misused if the identity is re-enabled Correct answer.

Explanation

Disabling the directory account blocks current logon, but leaving the safe membership in place means the access would return if the identity were re-enabled, and it obscures the true access picture during review. Periodic membership review should remove stale entries rather than relying solely on directory state.

Question 49Privileged Access Management (Human Identity Security)

A team needs to view session recordings for audit purposes but must not be able to retrieve the underlying account passwords. Which authorization supports viewing recorded sessions?

  1. Update password on the safe
  2. Audit users or an audit role granted access to session recordings Correct answer.
  3. Use accounts on the safe
  4. Retrieve accounts on the safe

Explanation

Viewing PSM recordings is an audit function granted to audit users or roles, and it does not require any credential access authorizations in the safe. Retrieve, Use, and Update password all concern the credential itself rather than recorded evidence.

Question 50Privileged Access Management (Human Identity Security)

Which practice best supports periodic recertification of human access in CyberArk?

  1. Reviewing safe memberships and removing users or groups whose duties no longer require access Correct answer.
  2. Increasing the CPM rotation frequency for all accounts
  3. Extending recording retention to several years
  4. Adding all administrators to a single shared safe

Explanation

Recertification means periodically reviewing who holds safe memberships and authorizations and removing access that is no longer justified, which keeps human access aligned with current duties. Rotation frequency, retention, and shared safes do not review or reduce human entitlements.