I85PREP
⌘ K
CyberArk SECRET-SEN study materials
CyberArk SECRET-SEN study resources

CyberArk SECRET-SEN practice questions

One question at a time. Build your CyberArk SECRET-SEN understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Secrets Management Fundamentals and Nonhuman Identity Security

In CyberArk Secrets Manager, which term describes a nonhuman identity that is granted access to a secret through a policy rather than by holding a static credential of its own?

  1. A policy administrator
  2. A directory service account
  3. A managed secret consumer Correct answer.
  4. A human privileged user

Explanation

Secrets Manager governs access to secrets by nonhuman identities such as applications, scripts, containers, and service accounts. These consumers retrieve secrets at runtime based on authorization policy, which removes the need to embed static credentials in code or configuration.

Question 2Secrets Management Fundamentals and Nonhuman Identity Security

What is the primary security objective of moving application credentials into a centralized secrets management vault?

  1. Increasing the raw throughput of the application database connection pool
  2. Eliminating the need for any authentication between services
  3. Removing hardcoded credentials from code and configuration so they can be rotated and audited centrally Correct answer.
  4. Replacing the need for network segmentation inside the data center

Explanation

Centralized secrets management removes static credentials from source code and config files, where they are easily leaked and hard to change. It also enables centralized rotation, access control, and auditing of every retrieval.

Question 3Secrets Management Fundamentals and Nonhuman Identity Security

In a secrets management program, what distinguishes secret rotation from secret versioning?

  1. Versioning deletes old values immediately, while rotation archives them indefinitely
  2. Rotation applies only to human passwords, while versioning applies only to API keys
  3. Rotation is performed manually, while versioning is always automatic
  4. Rotation changes the credential value over time, while versioning retains prior values for retrieval and rollback Correct answer.

Explanation

Rotation is the act of replacing a credential with a new value on a schedule or on demand. Versioning keeps the previous values so dependent systems can still reference them during a transition or for rollback.

Question 4Secrets Management Fundamentals and Nonhuman Identity Security

An application authenticates to CyberArk Secrets Manager before it can fetch a database password. Which mechanism is designed for this machine authentication step?

  1. A user-chosen challenge question
  2. Application authentication using a trusted identity such as a certificate or platform-issued credential Correct answer.
  3. A shared administrator password stored in the application binary
  4. An emailed one-time code sent to the application owner

Explanation

Nonhuman identities authenticate to the vault using application authentication methods such as certificates, platform-issued credentials, or cloud identity tokens. This establishes the application's identity before any secret is released.

Question 5Secrets Management Fundamentals and Nonhuman Identity Security

Which practice best supports least privilege for nonhuman identities consuming secrets?

  1. Granting each application access only to the specific secrets and accounts it needs Correct answer.
  2. Storing secrets in environment variables readable by every process on the host
  3. Granting every application access to all secrets so future changes require no policy updates
  4. Sharing one service account across all applications to simplify auditing

Explanation

Least privilege means scoping each nonhuman identity to the minimum set of secrets and target accounts required for its function. Narrow scoping limits blast radius if the identity is compromised and makes audit trails meaningful.

Question 6Secrets Management Fundamentals and Nonhuman Identity Security

What is the main risk created by a long-lived static API key embedded in a CI/CD pipeline configuration?

  1. It prevents the pipeline from authenticating at all
  2. It remains valid if leaked and is difficult to rotate without breaking builds Correct answer.
  3. It cannot be used by automated jobs
  4. It consumes excessive storage in the repository

Explanation

A static key embedded in pipeline configuration stays valid until someone changes it, so a leak grants durable access. Rotation is risky because many jobs may depend on the same value, which is why short-lived, dynamically issued credentials are preferred.

Question 7Secrets Management Fundamentals and Nonhuman Identity Security

Which statement correctly describes a secret in the context of nonhuman identity security?

  1. A certificate revocation list published openly
  2. A credential or key that grants access and must be protected from disclosure Correct answer.
  3. A log entry recording that an application started
  4. Any public configuration value used to identify a service

Explanation

A secret is sensitive material such as a password, token, key, or certificate private key whose disclosure would grant unauthorized access. Protecting it from exposure is the core concern of secrets management.

Question 8Secrets Management Fundamentals and Nonhuman Identity Security

Why do auditors value a centralized record of every secret retrieval by a nonhuman identity?

  1. It proves the application code compiles successfully
  2. It provides traceability of which identity accessed which secret and when Correct answer.
  3. It guarantees that no secret has ever been compromised
  4. It replaces the need for encryption at rest

Explanation

A centralized audit trail links each retrieval to a specific identity and timestamp, which supports investigation and compliance reporting. It provides traceability, not a guarantee that no compromise occurred.

Question 9Secrets Management Fundamentals and Nonhuman Identity Security

A development team wants its containerized workload to obtain a short-lived database credential at startup instead of storing a password in an image. Which approach fits the Secrets Manager model?

  1. Disable database authentication for the workload
  2. Bake the password into the container image and rebuild it monthly
  3. Have the workload authenticate to the vault and request a dynamically issued credential for the target database Correct answer.
  4. Store the password in a public container registry annotation

Explanation

The workload authenticates to Secrets Manager, which issues a credential for the target database, ideally short-lived and dynamically created. Nothing sensitive is stored in the image, and the credential expires automatically.

Question 10Secrets Management Fundamentals and Nonhuman Identity Security

An application currently reads a static password from a configuration file. The team wants to migrate to Secrets Manager with minimal code change while still removing the static credential. What is the most appropriate first step?

  1. Shorten the password to reduce the chance of interception
  2. Move the password to a different configuration file with stricter file permissions
  3. Encrypt the configuration file with a key stored beside it
  4. Replace the configuration read with a vault API call that authenticates the application and fetches the secret at runtime Correct answer.

Explanation

Replacing the static read with a runtime fetch removes the credential from the configuration entirely and centralizes control. Application authentication establishes the workload's identity before the secret is returned.

Question 11Secrets Management Fundamentals and Nonhuman Identity Security

A security team discovers that a service account password was committed to a repository. Beyond rotating the password, what is the most important follow-up in a secrets management program?

  1. Increasing the password complexity requirement for human users
  2. Identifying every consumer of that credential and confirming the new value is distributed through the vault Correct answer.
  3. Deleting the repository to erase the history
  4. Adding the repository to a blocklist of known bad repositories

Explanation

Rotation only restores security if all dependent systems receive the new value and the old one stops working everywhere. Mapping consumers and distributing the rotated credential through the vault closes the exposure.

Question 12Secrets Management Fundamentals and Nonhuman Identity Security

Which scenario best demonstrates the principle of ephemeral, just-in-time access for a nonhuman identity?

  1. An application stores a credential in memory for the lifetime of the server
  2. A service account password is rotated annually by a spreadsheet reminder
  3. A deployment job requests a credential when it starts and the credential expires when the job finishes Correct answer.
  4. A batch job holds a permanent database credential that is never changed

Explanation

Just-in-time access issues a credential only when needed and lets it expire shortly after use, shrinking the window in which a leaked credential is useful. The deployment job's credential lifetime matches the task.

Question 13Secrets Management Fundamentals and Nonhuman Identity Security

A team wants to enforce that only workloads running in a specific cloud environment can retrieve a production secret. Which control most directly achieves this?

  1. Adding more characters to the secret value
  2. Renaming the secret to include the word production
  3. Reducing the number of secrets stored in the vault
  4. Restricting vault access policy to the trusted cloud identity or network origin of those workloads Correct answer.

Explanation

Access policy can be conditioned on the authenticating identity and its origin, such as a trusted cloud identity provider or network range. This binds secret retrieval to the environment where the workload legitimately runs.

Question 14Secrets Management Fundamentals and Nonhuman Identity Security

Why is storing secrets in a version control system such as Git considered a serious control failure even in a private repository?

  1. Private repositories cannot be cloned by developers
  2. Repository history retains the secret and access is often broader than the application's runtime needs Correct answer.
  3. Git automatically publishes all commits to a public mirror
  4. Git compresses files, which weakens encryption

Explanation

Once committed, a secret persists in history even if later removed, and repository access usually extends to many people and systems beyond the workload that needs it. This widens the exposure surface and complicates clean-up.

Question 15Secrets Management Fundamentals and Nonhuman Identity Security

A platform team is defining ownership for secrets used by an autonomous pipeline. Which assignment reflects sound nonhuman identity governance?

  1. Each pipeline has a named owning team responsible for its identity, access scope, and rotation policy Correct answer.
  2. The security team owns every secret and approves each pipeline run manually
  3. The vendor that supplied the pipeline tool owns all secrets it uses
  4. No team owns the secrets because they are managed by the vault automatically

Explanation

Every nonhuman identity needs a clear human owner accountable for its access scope and lifecycle. The vault automates enforcement, but accountability for what the identity may access remains with a team.

Question 16Secrets Management Fundamentals and Nonhuman Identity Security

Which characteristic most clearly identifies a workload as a nonhuman identity requiring secrets management rather than a human user account?

  1. It has a username and password
  2. It is subject to an access review
  3. It authenticates and acts without an interactive person present Correct answer.
  4. It is created by an administrator

Explanation

Nonhuman identities act autonomously, authenticating and using credentials without an interactive person. That autonomy is why their credentials must be issued, rotated, and scoped programmatically.

Question 17Secrets Management Fundamentals and Nonhuman Identity Security

An organization wants to reduce the number of standing privileges held by service accounts across its estate. Which strategy aligns with secrets management best practice?

  1. Increase the password length of every standing service account
  2. Store standing credentials in a shared team wiki for visibility
  3. Issue credentials on demand with short lifetimes and remove permanent entitlements Correct answer.
  4. Consolidate all service accounts into one superuser account

Explanation

Replacing standing privileges with on-demand, short-lived credentials removes persistent access that attackers can harvest. Permanent entitlements are eliminated rather than merely strengthened.

Question 18Secrets Management Fundamentals and Nonhuman Identity Security

A secret is configured with automatic rotation, but an application caches the old value indefinitely. What is the most likely operational consequence?

  1. The vault automatically pushes the new value into the application's memory
  2. The application continues to work because the vault accepts old values forever
  3. The application fails to authenticate after rotation because it presents a stale credential Correct answer.
  4. Rotation is silently disabled by the vault

Explanation

After rotation the old credential is no longer valid at the target system, so an application holding a cached copy will fail authentication. Consumers must re-fetch the current version or subscribe to change notifications.

Question 19Secrets Management Fundamentals and Nonhuman Identity Security

Which control most directly limits the damage if an application's vault authentication credential is stolen?

  1. Storing the authentication credential in a second configuration file
  2. Longer secret values for the target systems
  3. Scoped authorization so the stolen identity can reach only a small set of secrets Correct answer.
  4. Disabling audit logging to reduce noise

Explanation

Scoped authorization bounds what a stolen identity can retrieve, containing the blast radius. Combined with short credential lifetimes and anomalous-access detection, it limits the value of a compromised authenticator.

Question 20Secrets Management Fundamentals and Nonhuman Identity Security

A team proposes giving a single shared vault identity to fifty microservices to simplify onboarding. What is the strongest security objection?

  1. It requires more vault servers to be deployed
  2. It destroys per-workload attribution and lets any compromised service reach every secret granted to the shared identity Correct answer.
  3. It increases the number of secrets that must be stored
  4. It prevents the use of automatic rotation

Explanation

A shared identity collapses fifty distinct trust boundaries into one, so a compromise anywhere grants the union of all their access. It also makes audit records useless for determining which service retrieved a secret.

Question 21Secrets Management Fundamentals and Nonhuman Identity Security

An application retrieves a database password from the vault but then writes it to a local log file for troubleshooting. Which principle is most directly violated?

  1. Integrity of the application binary
  2. Confidentiality of the secret after retrieval Correct answer.
  3. Non-repudiation of the developer's commit
  4. Availability of the vault service

Explanation

Vaulting protects a secret in storage and in transit, but confidentiality must also hold after retrieval. Logging the value exposes it to anyone with log access and defeats the purpose of centralized management.

Question 22Secrets Management Fundamentals and Nonhuman Identity Security

A security architect must choose between embedding a static credential in an on-premises server and using a workload identity federation to the vault. Which argument most strongly favors federation?

  1. Federation removes the need for any authorization policy
  2. Federation issues short-lived credentials bound to the workload's attested identity, eliminating a long-lived secret on the host Correct answer.
  3. Federation works only for human interactive logins
  4. Federation increases the number of static secrets to manage

Explanation

Workload identity federation exchanges an attested platform identity for a short-lived vault credential, so no durable secret sits on the host. This removes a high-value target and ties access to verifiable workload identity.

Question 23Secrets Management Fundamentals and Nonhuman Identity Security

During a review, an auditor finds that a service account's credential is rotated every 90 days but the account holds domain administrator rights. Which finding should take priority?

  1. The account should be renamed to hide its purpose
  2. The credential should be stored in a second vault for redundancy
  3. The excessive privilege is the primary risk because rotation does not reduce the impact of a compromised highly privileged identity Correct answer.
  4. The rotation interval is too long and should be shortened to 30 days

Explanation

Rotation limits how long a leaked credential stays valid, but it does not reduce what that credential can do. A domain administrator service account gives an attacker domain-wide control, so reducing its privilege is the priority.

Question 24Secrets Management Fundamentals and Nonhuman Identity Security

An organization deploys secrets management but continues to allow developers to read production secrets directly from the vault console. Which outcome best explains why this undermines the program's goals?

  1. It forces all secrets to be stored unencrypted
  2. It prevents automatic rotation from being configured
  3. It reintroduces human access to machine credentials, weakening least privilege and expanding the exposure surface Correct answer.
  4. It reduces the vault's storage capacity

Explanation

The program's value comes from limiting production credentials to the nonhuman identities that need them. Broad human read access recreates the exposure the vault was meant to remove and blurs accountability for use.

Question 25Secrets Management Fundamentals and Nonhuman Identity Security

A pipeline needs a credential only during a five-minute build step, but the current design issues a credential valid for 24 hours. What change most improves the security posture without disrupting the build?

  1. Grant the pipeline a permanent credential to avoid renewal failures
  2. Issue the credential at build start with a lifetime slightly longer than the build and revoke it at completion Correct answer.
  3. Store the credential in the build cache for reuse across runs
  4. Keep the 24-hour lifetime but rotate it weekly

Explanation

Matching credential lifetime to the task, with revocation at completion, minimizes the window in which a leaked credential is usable. The build still has enough time to finish, so disruption is avoided.

Question 26Secrets Management Fundamentals and Nonhuman Identity Security

In Secrets Manager terminology, what distinguishes a secret from a non-secret configuration value such as a database hostname?

  1. A secret is a value that grants access or authenticates an identity and must be protected from disclosure Correct answer.
  2. A secret is any value stored in a vault regardless of sensitivity
  3. A secret is any string longer than 32 characters
  4. A secret is a value that is always encrypted with a customer-managed key

Explanation

A secret is defined by its function: it authenticates or authorizes access, so disclosure enables impersonation or unauthorized access. Non-secret configuration such as hostnames, ports, or feature flags can be widely readable without granting access. Length or encryption key ownership alone does not make a value a secret.

Question 27Secrets Management Fundamentals and Nonhuman Identity Security

Which statement best describes the concept of a nonhuman identity in a secrets management program?

  1. A human user who authenticates with a shared service account
  2. A machine or workload entity that authenticates to resources and therefore needs its own credentials and permissions Correct answer.
  3. Any account that has never logged in interactively
  4. A guest account created for temporary contractors

Explanation

Nonhuman identities are the machine entities such as applications, services, containers, and automation jobs that authenticate to systems and consume secrets. They require their own credentials, least-privilege permissions, and lifecycle management just like human users. Human accounts, including shared ones, remain human identities even when used by machines indirectly.

Question 28Secrets Management Fundamentals and Nonhuman Identity Security

Why does secret rotation alone fail to reduce exposure when a credential has already been copied outside the vault?

  1. Rotation does not change the credential value
  2. Rotation changes the credential, but the attacker's copy remains valid until the rotation actually takes effect on the target system Correct answer.
  3. Rotation requires manual approval and therefore never occurs
  4. Rotation only applies to certificates, not passwords

Explanation

Rotation replaces the credential, but any copy taken before the rotation stays usable until the rotation completes and the old value is invalidated on the target. Detection and revocation of the leaked copy, plus investigation of its use, are required to close the exposure. Rotation is a preventive control, not a retroactive one.

Question 29Secrets Management Fundamentals and Nonhuman Identity Security

A service needs to read a production secret. Which assignment follows least privilege for a nonhuman identity?

  1. Grant the identity access through a shared team account used by several services
  2. Grant the identity read and write access so it can rotate its own secret
  3. Grant the identity read access only to the specific secret it needs, scoped to the environment it runs in Correct answer.
  4. Grant the identity read access to all secrets in the vault to avoid future tickets

Explanation

Least privilege means granting only the specific secret and environment the workload actually needs, nothing broader. Broad vault-wide read, unnecessary write, or shared accounts all expand blast radius if the identity is compromised. Scoping by secret and environment keeps the permission minimal and auditable.

Question 30Secrets Management Fundamentals and Nonhuman Identity Security

An application authenticates to the vault using a static API key stored in an environment variable. Which change most directly reduces the risk of that authentication credential being stolen?

  1. Replacing the static key with a workload identity that obtains short-lived vault tokens Correct answer.
  2. Encrypting the environment variable at rest on the host
  3. Rotating the API key every 24 hours
  4. Increasing the length of the API key

Explanation

Moving from a static credential to a workload identity removes the long-lived secret entirely, so there is nothing durable to steal. Short-lived tokens bound to the workload's attested identity limit the window of misuse. Longer keys and faster rotation reduce but do not eliminate the standing credential.

Question 31Secrets Management Fundamentals and Nonhuman Identity Security

A platform team wants to prove to auditors that each secret retrieval was performed by an authorized workload. Which capability is most relevant?

  1. Encryption of secrets at rest with AES-256
  2. Network segmentation of the vault server
  3. An immutable audit trail recording the identity, secret, time, and outcome of each access Correct answer.
  4. Automatic rotation of every secret every 30 days

Explanation

An immutable audit log links each retrieval to the requesting identity, the secret accessed, the timestamp, and whether it succeeded. That record is what demonstrates authorized use and supports investigations. Encryption, rotation, and segmentation are protective controls but do not by themselves prove who accessed what.

Question 32Secrets Management Fundamentals and Nonhuman Identity Security

A microservice caches a rotated database password in memory and never refreshes it. What is the most likely operational outcome?

  1. The vault automatically pushes the new password into the running process
  2. The service continues to authenticate successfully because the database accepts old passwords
  3. The database reverts to the old password to keep the service working
  4. The service fails to authenticate once the old password is invalidated on the database Correct answer.

Explanation

Once rotation invalidates the old password on the target system, any process still holding the cached value will fail authentication. Applications must handle rotation by refreshing credentials on failure or subscribing to change notifications. The vault does not inject values into a running process, and the database does not revert to accommodate stale clients.

Question 33Secrets Management Fundamentals and Nonhuman Identity Security

Which practice best supports separation of duties for production secrets in a secrets management program?

  1. Allowing the same engineer to approve and retrieve any production secret
  2. Separating the ability to approve access from the ability to retrieve secrets, and limiting both to defined roles Correct answer.
  3. Storing production secrets in the same vault as development secrets with identical policies
  4. Requiring every engineer to hold the vault administrator role

Explanation

Separation of duties means no single person can both authorize and consume a sensitive secret without an independent check. Splitting approval from retrieval and scoping both to defined roles enforces that control. Broad administrator roles and merged environments collapse the separation the control depends on.

Question 34Secrets Management Fundamentals and Nonhuman Identity Security

Why is a dynamic secret, generated on demand for a specific consumer, generally preferred over a static shared credential for database access?

  1. Dynamic secrets never require any authentication to the vault
  2. Dynamic secrets eliminate the need for access policies
  3. Dynamic secrets are stored permanently in the application configuration
  4. Dynamic secrets are created per request with limited lifetime, so compromise affects a single short-lived credential Correct answer.

Explanation

Dynamic secrets are minted on demand for a specific consumer and expire quickly, so a leaked value has a narrow window and limited scope. This contrasts with a static shared credential whose compromise exposes every consumer. Dynamic secrets still require vault authentication and access policies; they do not remove them.

Question 35Secrets Management Fundamentals and Nonhuman Identity Security

A team wants to prevent a secret from being exposed in application logs. Which control addresses this most directly?

  1. Rotating the secret every hour
  2. Masking or redacting known secret fields before log output and restricting who can read logs Correct answer.
  3. Enabling verbose debug logging for all requests during troubleshooting
  4. Storing the secret in a base64-encoded configuration file

Explanation

Masking or redacting secret values before they reach log output prevents disclosure at the source, and restricting log access limits exposure if redaction fails. Verbose logging increases the chance of leakage, and encoding is not protection. Rotation does not stop a secret from being written to logs in the first place.

Question 36Secrets Management Fundamentals and Nonhuman Identity Security

An organization issues one shared vault identity to dozens of microservices to simplify onboarding. What is the strongest security objection?

  1. Shared identities increase vault licensing costs
  2. Shared identities eliminate per-service attribution and let any one compromised service reach every secret the shared identity can access Correct answer.
  3. Shared identities require more network bandwidth
  4. Shared identities cannot be rotated

Explanation

A shared identity destroys attribution, so audit records cannot show which service retrieved a secret. It also means a compromise of any one service grants the aggregate access of all services using that identity. Onboarding convenience does not outweigh the loss of least privilege and accountability.

Question 37Secrets Management Fundamentals and Nonhuman Identity Security

Which approach best implements just-in-time access for a nonhuman identity that runs a nightly batch job?

  1. Granting access only during business hours for human operators
  2. Storing a static credential in the job's source repository
  3. Granting the identity permanent standing access to the production database
  4. Issuing a short-lived credential at job start that expires shortly after the job completes Correct answer.

Explanation

Just-in-time access grants the credential only for the window the job needs and expires it afterward, minimizing standing privilege. Permanent access and static credentials in source control create durable exposure. Business-hours rules apply to humans, not to an automated nightly job.

Question 38Secrets Management Fundamentals and Nonhuman Identity Security

A security review finds that a service account's password is rotated regularly but the account still holds domain administrator rights. Which conclusion is most accurate?

  1. The account should be rotated more frequently to compensate for its privileges
  2. Rotation fully mitigates the risk because the password changes often
  3. Domain administrator rights are irrelevant to secrets management
  4. Rotation reduces credential lifetime but excessive standing privilege still leaves a large blast radius if the account is compromised Correct answer.

Explanation

Rotation limits how long a stolen credential stays valid but does nothing about what the credential can do. An over-privileged account still grants broad access the moment it is compromised. The correct remedy is to reduce standing privileges to what the workload needs, in addition to rotation.

Question 39Secrets Management Fundamentals and Nonhuman Identity Security

A team proposes storing secrets in a private Git repository, arguing that only trusted engineers can read it. Which analysis best explains why this remains a control failure?

  1. Git repositories cannot store encrypted files
  2. Git does not support access control of any kind
  3. Version control history persists and propagates secret values to every clone, fork, backup, and CI cache, so access cannot be reliably revoked Correct answer.
  4. Private repositories are always publicly readable

Explanation

Once a secret enters version control it is copied into every clone, fork, backup, and CI cache, and history retains it even after deletion. Access cannot be reliably revoked across all those copies, so the exposure is effectively permanent. Private visibility reduces but does not eliminate the distribution problem.

Question 40Secrets Management Fundamentals and Nonhuman Identity Security

An application must run in two clouds and retrieve secrets at startup. Which design best preserves least privilege across both environments?

  1. Separate workload identities and policies per cloud and environment, each scoped to only the secrets that deployment needs Correct answer.
  2. Embedding the secrets directly in the container image to avoid runtime retrieval
  3. A single static credential distributed to both deployments through a shared configuration file
  4. One vault policy shared by both deployments granting access to all secrets in both clouds

Explanation

Per-cloud, per-environment identities with narrowly scoped policies ensure each deployment can reach only its own secrets, containing the blast radius of a compromise. A shared policy or shared static credential spreads access across environments. Embedding secrets in images bakes them into every registry copy.

Question 41Secrets Manager Architecture and Deployment

In a CyberArk Secrets Manager deployment, which component is the central policy engine that authenticates workload requests and decides which secret can be retrieved?

  1. The Secrets Manager Central Policy Manager service Correct answer.
  2. The Vault (Digital Vault)
  3. The Password Vault Web Access
  4. The CyberArk Connector (CPM)

Explanation

Secrets Manager splits responsibilities: the Digital Vault stores and encrypts secrets, while the central Secrets Manager service authenticates application identities and applies authorisation policy before any secret is released. The CPM performs rotation, and PVWA is the human web interface.

Question 42Secrets Manager Architecture and Deployment

An application authenticates to Secrets Manager using an identity that is bound to a cloud provider's instance role rather than a stored credential. Which authentication method category does this represent?

  1. Certificate-based Vault user authentication
  2. LDAP directory authentication
  3. Trusted platform / cloud identity authentication Correct answer.
  4. Vault user password authentication

Explanation

Secrets Manager supports authenticating workloads using trusted platform mechanisms such as cloud instance roles or platform attestation, so no static credential must be stored in the application. LDAP, Vault user passwords, and certificates are human or certificate identity methods, not cloud instance-role attestation.

Question 43Secrets Manager Architecture and Deployment

What is the primary reason Secrets Manager deploys a Connector or agent close to the target systems rather than having the central service reach targets directly?

  1. To keep traffic local to the target network and avoid exposing targets inbound to the central tier Correct answer.
  2. To replace the Digital Vault for secret storage
  3. To eliminate the need for rotation policies
  4. To reduce licence consumption on the Vault

Explanation

Connectors and agents sit inside the target network zone so rotation and retrieval traffic originates locally, minimising firewall openings and keeping targets unreachable from the central tier. They do not store secrets themselves; the Vault remains the storage tier.

Question 44Secrets Manager Architecture and Deployment

Which statement best describes the role of the Digital Vault in a Secrets Manager architecture?

  1. It provides the REST API that applications call
  2. It performs scheduled rotation of target account passwords
  3. It brokers every application request and caches secrets for performance
  4. It stores and encrypts secrets and enforces Vault-level access control Correct answer.

Explanation

The Digital Vault is the hardened, encrypted repository that persists secrets and applies Vault authorisation. Request brokering and the application-facing API belong to the Secrets Manager service tier, and rotation belongs to the CPM.

Question 45Secrets Manager Architecture and Deployment

A team wants applications to fetch secrets over HTTPS using a REST call with a short-lived token. Which Secrets Manager capability directly enables this?

  1. The Central Credential Provider web service Correct answer.
  2. The Vault's built-in SFTP service
  3. The PrivateArk administrative client
  4. The Password Vault Web Access portal

Explanation

The Central Credential Provider exposes a REST interface that applications call to retrieve secrets after authenticating, typically using a short-lived token or application identity. PVWA and PrivateArk are administrative interfaces, and the Vault is not an application-facing SFTP endpoint.

Question 46Secrets Manager Architecture and Deployment

Which deployment model places the Secrets Manager service and Connector components inside the customer's own data centre under customer administration?

  1. Secrets Manager self-hosted Correct answer.
  2. Secrets Manager SaaS
  3. Secrets Manager Privilege Cloud
  4. Secrets Manager hosted by the cloud provider

Explanation

The self-hosted model installs the Secrets Manager service and Connector components in the customer's environment, with the customer responsible for the infrastructure and patching. SaaS and Privilege Cloud are vendor-operated offerings where that operational burden shifts.

Question 47Secrets Manager Architecture and Deployment

What does a Secrets Manager 'safe' represent in the architecture?

  1. A backup file containing the Vault database
  2. A logical container in the Vault that holds accounts and governs who can access them Correct answer.
  3. A physical hardware security module attached to the Connector
  4. A network segment where Connectors are deployed

Explanation

Safes are logical Vault containers that group accounts and carry authorisation rules, and Secrets Manager uses them to scope which applications can reach which secrets. They are not hardware devices, network zones, or backup artefacts.

Question 48Secrets Manager Architecture and Deployment

Which component is responsible for rotating a managed account's password on its target system according to a defined schedule?

  1. The Secrets Manager service
  2. The Digital Vault
  3. The CyberArk Connector (CPM) Correct answer.
  4. The Central Credential Provider

Explanation

The CyberArk Connector, historically the Central Policy Manager, executes rotation and verification against target platforms on the schedule defined by policy. The Vault stores the result, the service brokers requests, and the provider serves retrieval.

Question 49Secrets Manager Architecture and Deployment

An architect must ensure that if the Secrets Manager service tier fails, applications can still retrieve secrets. Which design decision best addresses this requirement?

  1. Increase the rotation frequency of all managed accounts
  2. Move the Connector to the same host as the Digital Vault
  3. Consolidate all applications into a single safe
  4. Deploy multiple Secrets Manager service instances behind a load balancer with health checks Correct answer.

Explanation

High availability for the service tier comes from running multiple instances behind a load balancer that removes unhealthy nodes, so retrieval continues during a node failure. Rotation frequency, safe consolidation, and Connector co-location do not provide service-tier resilience.

Question 50Secrets Manager Architecture and Deployment

A security team wants applications to authenticate to Secrets Manager without embedding any static credential in code or configuration. Which approach fits best?

  1. Use workload identity attestation such as a cloud instance role or platform token Correct answer.
  2. Use a shared service account stored in a config file
  3. Hard-code an application certificate in the container image
  4. Store a Vault user password in an environment variable

Explanation

Workload identity attestation lets the platform prove the workload's identity to Secrets Manager, so no static secret must be shipped with the application. Environment variables, baked-in certificates, and shared service accounts all reintroduce a stored credential.