CyberArk SECRET-SEN flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Nonhuman identity

A credential or account used by software, services, containers, or automation rather than a person. It includes API keys, service accounts, certificates, tokens, and SSH keys.

Secret sprawl

The uncontrolled spread of credentials across source code, config files, wikis, chat, and build logs. Each copy is an unmanaged identity that survives rotation of the original.

Secret Zero problem

The bootstrap credential an application uses to authenticate to the vault must itself be protected. Solutions include platform identity, workload attestation, and client certificates.

Dynamic secrets

Credentials generated on demand with a defined time-to-live and revoked automatically at expiry. They remove standing privilege because the secret exists only for the requested window.

Least privilege for NHI

Each application identity receives only the safes, accounts, and actions it needs to function. Broad shared access increases blast radius when any one workload is compromised.

Blast radius

The set of systems and data reachable with a given credential. Rotation frequency and privilege scope should be set according to the size of that reachable set.

Digital Vault

The encrypted storage component of Secrets Manager that holds safes, accounts, and audit records. Its contents are protected by encryption keys stored within the vault itself.

Server Key

The key held by the Vault administrator that protects the Digital Vault. A Vault backup cannot be restored or opened without the corresponding Server Key material.

Central Policy Manager

The component that rotates, verifies, and reconciles passwords on target systems. It uses platform plugins and needs network reachability plus rights to change credentials on each target.

PVWA

Password Vault Web Access, the web interface and REST API layer for user and application interaction with the Vault. It is stateless and can be load-balanced across multiple servers.

Platform

A definition of how a credential type is managed, including the password change plugin, verification, reconciliation, and rotation interval. Account settings can override platform defaults.

Vault replication

Active-passive clustering that keeps a standby Vault synchronized with the primary. Failover promotes the standby, and replication lag is a key health metric to monitor.

Vault zone placement

A network design rule placing the Vault in a restricted zone and CPM, PSM, and PVWA in a mid-tier zone, with firewall rules permitting only required ports between tiers and targets.

Safe

The container inside the Vault that holds accounts and objects. Authorization is granted on safes, and users receive the union of permissions from all groups they belong to.

Use accounts permission

A safe permission allowing a user or the CPM/PSM to connect with the account and inject the credential without revealing the cleartext password to the requester.

Retrieve accounts permission

A safe permission allowing the user or API caller to obtain the cleartext password value. It is more sensitive than Use and should be limited to required roles.

Manage safe members

A safe permission allowing a user to add, remove, or modify safe members. It is effectively an escalation path and should be tightly restricted.

Master policy

Vault-wide rules covering password complexity, rotation intervals, session recording, and dual control. Platform, safe, and account settings narrow these rules further.

Dual control

An approval workflow requiring one or more authorized approvers before a sensitive action such as password retrieval is fulfilled. It separates the requester from the approver role.

Account onboarding

Registering a target credential in a safe with a platform, address, and username. The CPM then verifies and rotates it; unreconciled accounts show failures until verification succeeds.

Central Credential Provider

A REST API service that returns credentials to authorized applications. The caller supplies an AppID and a source identifier that must match the allowed machines list.

AppID authentication

The mechanism by which CCP identifies a requesting application. It combines an application identifier with a source check such as IP address, hostname, or client certificate.

Certificate-based AppID

An AppID authentication method where the application presents a client certificate. It is preferred over IP matching because certificates resist spoofing and survive host changes.

ASCP

Application Server Credential Provider, a local agent that caches credentials in an encrypted store for a configured period. It reduces Vault calls but widens exposure if the host is compromised.

CCP query parameters

A retrieval request includes AppID plus Safe and Object to identify the target account. The response returns username and password in XML or JSON format.

CI/CD workload identity

A short-lived identity issued by the pipeline platform, such as an OIDC token or workload identity, used to authenticate to the vault instead of a stored static secret.

Just-in-time pipeline secret

A dynamic credential requested at the start of a build or deploy step with a short TTL. It is used for that step and expires rather than persisting in the pipeline.

Vault audit log

The tamper-evident record of retrievals, password changes, and sessions, including user, source, target account, action, and timestamp. It can be forwarded to a SIEM.

Reconciliation

The CPM process that checks whether the stored password still matches the target system and corrects drift. Failures indicate the vault value and target value have diverged.

Secret scanning

Automated detection of credentials committed to repositories or logs. A finding requires immediate rotation, because deleting the file does not remove the value from history.

Access certification

A periodic review of safe memberships and privileged group membership, revoking access no longer justified by role. It produces evidence for audit and compliance controls.

Remediation priority order

Exposed credentials in code or logs are rotated first, then standing privileged credentials, then shared accounts, then unused accounts. Ordering follows exposure and blast radius.