I85PREP
⌘ K
CyberArk Trustee study materials
CyberArk Trustee study resources

CyberArk Trustee practice questions

One question at a time. Build your CyberArk Trustee understanding.

First 50 of 190 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Traditional PAM architecture, safes and accountable access

Which definition best describes a privileged account?

  1. Any user account that has been active for more than 12 months
  2. An account with elevated permissions to access sensitive systems, data, or administrative functions beyond those of a standard user Correct answer.
  3. An account that belongs to a senior executive of the company
  4. An account that has been used to log in from outside the corporate network

Explanation

A privileged account is any identity (human or non-human) with elevated access rights that exceed those of standard users. This includes domain admins, root, local administrators, service accounts, application accounts, and any identity that can perform administrative or sensitive operations. Their elevated capabilities make them prime targets for attackers.

Question 2Traditional PAM architecture, safes and accountable access

Why is Privileged Access Management (PAM) considered a foundational layer of an identity security program?

  1. It eliminates the need for endpoint antivirus and firewalls
  2. It controls and monitors the most powerful accounts that attackers target to move laterally and reach crown-jewel data Correct answer.
  3. It removes the need for multifactor authentication for end users
  4. It provides physical access control to data centers

Explanation

PAM is foundational because privileged accounts grant the broadest access in any environment. Most data breaches involve abuse of privileged credentials at some point in the kill chain, so securing them limits both initial impact and lateral movement. Other controls remain necessary, but PAM directly addresses the highest-value targets.

Question 3Traditional PAM architecture, safes and accountable access

Which of the following is NOT typically considered a type of privileged account?

  1. Local administrator account on a Windows server
  2. Service account that runs a database engine
  3. Standard end-user account used to read email Correct answer.
  4. Root account on a Linux server

Explanation

A standard end-user account that only reads email and uses basic productivity apps is not privileged. Local admin, root, and service accounts that run system services all hold elevated rights and fall under PAM scope. Privilege is defined by capability, not by user title.

Question 4Traditional PAM architecture, safes and accountable access

What is a service account in the context of PAM?

  1. A non-human account used by an application or service to authenticate to other systems Correct answer.
  2. A help-desk ticketing account
  3. An account used by employees during onboarding
  4. A backup account used only when the main account is locked out

Explanation

Service accounts are non-human identities used by applications, scripts, scheduled tasks, and services to authenticate to databases, APIs, and other systems. They often have static passwords, broad permissions, and run continuously, which makes them an attractive target if not vaulted and rotated.

Question 5Traditional PAM architecture, safes and accountable access

Which of the following best describes an emergency or 'break-glass' account?

  1. An account used daily by all administrators
  2. A highly privileged account reserved for rare emergencies, with usage that is heavily monitored, alerted on, and post-reviewed Correct answer.
  3. A test account used by developers in production
  4. A guest account for external visitors

Explanation

Emergency or break-glass accounts are powerful accounts kept for rare scenarios, such as recovering from a directory outage. They are typically vaulted, require explicit approval, and trigger immediate alerts when used, with mandatory review of every session.

Question 6Traditional PAM architecture, safes and accountable access

What is a default vendor account?

  1. A pre-installed account with a known username and password shipped by hardware or software vendors Correct answer.
  2. An account reserved for the vendor relationship manager
  3. A guest Wi-Fi account given to vendors
  4. A vendor invoice account in the ERP system

Explanation

Default vendor accounts are built-in accounts shipped by manufacturers (network gear, databases, appliances) with documented usernames and default passwords. Attackers routinely scan for these, so PAM programs identify, rotate, and vault them as a baseline hygiene step.

Question 7Traditional PAM architecture, safes and accountable access

What is an application account in the context of PAM?

  1. An account used by application code to authenticate to databases, APIs, or other services Correct answer.
  2. A user's profile inside a SaaS application
  3. An account used to install applications on workstations
  4. A loyalty rewards account in a customer-facing app

Explanation

An application account is the identity an application uses to access other systems, typically with hard-coded or configuration-stored credentials. Removing those embedded secrets and replacing them with on-demand vaulted credentials is a core PAM use case (Application Access Manager / Conjur).

Question 8Traditional PAM architecture, safes and accountable access

Which of the following is the most common starting step in a credential-theft attack chain?

  1. Deploying ransomware on a domain controller
  2. Compromising a single endpoint or end-user account through phishing or malware Correct answer.
  3. Stealing physical hard drives from a data center
  4. Bribing a system administrator

Explanation

Most modern attacks begin with a single compromised endpoint or user account, often via phishing. From that foothold, attackers harvest cached credentials, escalate to local or domain admin, and move laterally. PAM disrupts this path by removing standing privilege and vaulting credentials.

Question 9Traditional PAM architecture, safes and accountable access

Pass-the-Hash is an attack technique that allows an adversary to:

  1. Crack a stored hash by brute force in seconds
  2. Authenticate to a remote system using the captured NTLM password hash without ever knowing the cleartext password Correct answer.
  3. Replace a user's biometric template
  4. Bypass network firewalls using DNS tunneling

Explanation

Pass-the-Hash leverages the fact that Windows authentication can use the NTLM hash itself as proof of identity. An attacker who reads a hash from memory or a SAM database can authenticate to other Windows systems without ever needing the plaintext password.

Question 10Traditional PAM architecture, safes and accountable access

Kerberoasting is an attack against which protocol?

  1. TLS
  2. Kerberos in Active Directory Correct answer.
  3. OAuth 2.0
  4. RADIUS

Explanation

Kerberoasting targets Active Directory's Kerberos protocol. An authenticated user requests a TGS (service ticket) for an SPN-registered service account, then takes the ticket offline and brute-forces the service account's password from the encrypted blob. Strong service-account passwords and PAM-managed rotation neutralize the attack.

Question 11Traditional PAM architecture, safes and accountable access

A Golden Ticket attack is possible when an attacker has obtained the password hash of which Active Directory account?

  1. A regular domain user
  2. The KRBTGT account Correct answer.
  3. The local Administrator on a workstation
  4. The Guest account

Explanation

Forging a Golden Ticket requires the NTLM hash of the KRBTGT account, which Kerberos uses to encrypt and sign TGTs. With it, an attacker can mint TGTs as any user, including domain admins, and persist for the lifetime of the ticket. Rotating KRBTGT is a key remediation step.

Question 12Traditional PAM architecture, safes and accountable access

Which of the following is the BEST description of credential theft as it relates to PAM?

  1. A user accidentally shares their password verbally with a coworker
  2. An attacker harvests, abuses, or escalates credentials, often privileged ones, to access systems and data Correct answer.
  3. A misconfigured backup tape is left in a desk drawer
  4. A laptop is stolen from a parked car

Explanation

In a PAM context, credential theft refers to the broad set of techniques attackers use to obtain or abuse credentials, especially privileged credentials, to authenticate to additional systems. PAM directly counters this by vaulting, rotating, and brokering access through monitored sessions.

Question 13Traditional PAM architecture, safes and accountable access

Which statement best summarizes why standing privilege is risky?

  1. It costs more in software licenses
  2. Permanently assigned privileged access widens the attack surface and increases blast radius if any account is compromised Correct answer.
  3. It is required by every compliance framework
  4. It uses too much network bandwidth

Explanation

Standing privilege means an identity holds elevated rights all the time, even when it is not performing administrative work. If that identity is compromised, the attacker inherits full privileged access immediately. Just-in-time access reduces this exposure.

Question 14Traditional PAM architecture, safes and accountable access

Which of the following is the most common reason organizations onboard accounts into a PAM solution?

  1. To make password sharing more convenient
  2. To centrally vault, rotate, broker, and audit privileged credentials and sessions Correct answer.
  3. To eliminate the need for SIEM tools
  4. To migrate end-user mailboxes

Explanation

The core value proposition of PAM is centralized control of privileged credentials and sessions: secure storage, automated rotation, brokered access through a session manager, and full audit trails. This addresses the highest-impact risk in most environments.

Question 15Traditional PAM architecture, safes and accountable access

Which of the following is NOT a privileged-account risk that PAM is designed to mitigate?

  1. Hard-coded passwords inside application code or configuration files
  2. Shared local admin passwords reused across workstations
  3. An end user choosing a personal email password that is short Correct answer.
  4. Service accounts whose passwords have not changed in years

Explanation

An end user's personal email password hygiene is outside the scope of enterprise PAM; consumer credential strength is generally addressed through end-user identity tools and education. PAM specifically targets privileged identities such as embedded application credentials, shared admin passwords, and stale service accounts.

Question 16Traditional PAM architecture, safes and accountable access

How does PAM specifically help reduce the impact of an attacker's lateral movement?

  1. By blocking all network traffic between subnets
  2. By eliminating shared local admin passwords and rotating credentials, removing the reusable secret an attacker needs to pivot Correct answer.
  3. By disabling Active Directory completely
  4. By reducing the number of email accounts

Explanation

Lateral movement often relies on reusing the same admin credential across many machines. PAM ensures every privileged credential is unique, rotated, and brokered, so even if one host is compromised the attacker cannot easily pivot to others.

Question 17Traditional PAM architecture, safes and accountable access

Which best describes 'shared accounts' in a privileged context?

  1. Accounts that have been deleted but not yet purged
  2. Accounts whose credentials are known and reused by multiple administrators Correct answer.
  3. Cloud storage shares between teams
  4. User mailboxes with delegate access

Explanation

Shared privileged accounts are identities, often local administrator or root, whose passwords are known to many people. They break individual accountability and are a common lateral-movement vector. PAM removes the shared-secret problem by brokering access without ever exposing the password.

Question 18Traditional PAM architecture, safes and accountable access

Which type of identity is increasingly outnumbering human identities in modern IT environments?

  1. Machine and application identities (service accounts, app accounts, secrets, workload identities) Correct answer.
  2. Customer support phone agents
  3. Wi-Fi guest accounts
  4. Printer queues

Explanation

Industry research and CyberArk's identity security messaging emphasize that machine and application identities now outnumber human identities, often by 10x or more, driven by microservices, cloud workloads, and DevOps pipelines. Securing these non-human identities is a major PAM and Secrets Management focus.

Question 19Traditional PAM architecture, safes and accountable access

Which of the following is the most accurate description of 'credential vaulting'?

  1. Encrypting a single user's email inbox
  2. Storing privileged credentials inside a hardened, encrypted, access-controlled repository instead of in scripts, files, or memorized form Correct answer.
  3. Converting passwords into facial-recognition templates
  4. Backing up user passwords to a removable USB drive

Explanation

Credential vaulting moves secrets out of insecure locations (scripts, sticky notes, config files) into a hardened encrypted vault that controls who can retrieve them, when, and under what policy. The vault is the central control plane for both credential storage and access workflows.

Question 20Traditional PAM architecture, safes and accountable access

Which of the following is the BEST example of 'privilege creep'?

  1. An administrator accumulates additional permissions across roles and projects over years and never has them reviewed or removed Correct answer.
  2. An admin's password expires monthly
  3. A user's screen resolution increases over time
  4. Two factor authentication adds an extra step at login

Explanation

Privilege creep is the gradual accumulation of unneeded entitlements as people change roles or projects. Without periodic access reviews and joiner-mover-leaver workflows, identities accrue rights they no longer need, expanding blast radius and violating least privilege.

Question 21Traditional PAM architecture, safes and accountable access

Which compliance or regulatory driver is commonly cited as a justification for deploying PAM?

  1. PCI DSS, SOX, HIPAA, NIST 800-53, and similar frameworks that require control over privileged access and audit trails Correct answer.
  2. Local building codes
  3. Trademark law
  4. Postal regulations

Explanation

Most security frameworks include explicit requirements for least privilege, separation of duties, audit logging of privileged access, and protection of administrative credentials. PAM is the most direct way to meet those control objectives.

Question 22Traditional PAM architecture, safes and accountable access

Which one of the following is a 'non-human' identity?

  1. A help desk technician
  2. A microservice running in Kubernetes that calls another microservice using an API token Correct answer.
  3. A finance analyst
  4. An external auditor

Explanation

A microservice authenticating to another service with a token, secret, or certificate is a non-human identity. CyberArk Conjur and Secrets Manager are designed to vault and broker these workload credentials at scale.

Question 23Traditional PAM architecture, safes and accountable access

Which of the following is a hallmark of a mature privileged access program?

  1. Every administrator memorizes every password
  2. Privileged credentials are vaulted, rotated, sessions are brokered and recorded, and standing privilege is replaced with just-in-time access Correct answer.
  3. Local admin rights are granted to all desktop users
  4. Security is handled solely by antivirus

Explanation

A mature PAM program combines vaulting, rotation, session brokering, recording, monitoring, and just-in-time elevation. Together, these controls minimize standing privilege, enforce least privilege, and provide complete audit visibility.

Question 24Traditional PAM architecture, safes and accountable access

Which of the following is the most accurate description of a domain admin account?

  1. A privileged Active Directory account with administrative rights across the entire domain, including the ability to manage all members and policies Correct answer.
  2. A DNS record for a website
  3. A subscriber to a domain newsletter
  4. An account that owns a custom domain name registration

Explanation

Domain admins hold the highest level of administrative privilege in an Active Directory domain. Compromise of even one domain admin account effectively compromises the domain. PAM specifically targets these tier-zero identities for vaulting, rotation, and tightly brokered access.

Question 25Traditional PAM architecture, safes and accountable access

Which is the most accurate statement about default credentials shipped with hardware or software?

  1. They are safer than custom credentials because vendors test them
  2. They are publicly documented and are routinely scanned for and abused by attackers Correct answer.
  3. They cannot be changed after installation
  4. They require MFA out of the box

Explanation

Default credentials such as admin/admin, root/calvin, or vendor-specific defaults are documented in product manuals and exploited by automated scanners. Discovering and rotating them is a baseline PAM hygiene step.

Question 26Traditional PAM architecture, safes and accountable access

Which of the following best illustrates 'separation of duties' as it relates to PAM?

  1. One administrator both requests and approves their own privileged access
  2. Different individuals are responsible for requesting, approving, and reviewing privileged access, so no single person can act unilaterally Correct answer.
  3. Admins and end users use the same account
  4. All privileged work is performed off-hours

Explanation

Separation of duties prevents a single identity from completing an entire sensitive workflow. In PAM, this typically appears as request/approve/review splits and dual control on high-impact accounts.

Question 27Traditional PAM architecture, safes and accountable access

What does 'discovery' mean in the context of privileged access management?

  1. Browsing public websites for new exploits
  2. Automatically scanning the environment to find privileged accounts, SSH keys, and secrets that are not yet under management Correct answer.
  3. Inviting new users to a chat tool
  4. Creating new domain controllers

Explanation

Account and credential discovery is the systematic identification of privileged identities (Windows local admins, Linux root accounts, service accounts, SSH keys, embedded secrets) that are not yet vaulted. CyberArk includes built-in discovery to feed onboarding workflows.

Question 28Privileged sessions, rotation and application-secret dependencies

What is the primary goal of credential rotation?

  1. To make passwords easier to remember for users
  2. To reduce the window of opportunity for stolen credentials by changing them frequently and automatically Correct answer.
  3. To force users to re-enroll their MFA tokens
  4. To remove the need for any authentication at all

Explanation

Rotation shrinks the time during which a stolen password is valid. CyberArk's CPM automates rotation according to policy and can rotate after every use, on a schedule, or after a session ends, so even captured credentials quickly become useless.

Question 29Privileged sessions, rotation and application-secret dependencies

Which of the following is a primary benefit of session monitoring and recording in a PAM solution?

  1. It speeds up TLS handshakes
  2. It provides a tamper-resistant audit trail of what was actually done with privileged access, enabling forensic review and behavior analytics Correct answer.
  3. It eliminates the need for backups
  4. It replaces antivirus software

Explanation

Recording every privileged session creates an authoritative record of administrative activity. Security teams use it for forensics, compliance, and behavioral baselining, and PAM platforms can flag anomalous commands or actions.

Question 30Privileged sessions, rotation and application-secret dependencies

Which best describes a 'privileged session'?

  1. Any time a user is logged in to email
  2. An interactive or programmatic connection in which an identity uses elevated rights to administer a system or access sensitive data Correct answer.
  3. A guest Wi-Fi session in the lobby
  4. A two-minute screen lock

Explanation

A privileged session is any session in which elevated rights are used: SSH as root, RDP as a domain admin, a database admin console, a cloud console with admin role, etc. These sessions are the focus of session brokering, recording, and monitoring controls.

Question 31Privileged sessions, rotation and application-secret dependencies

In the traditional CyberArk PAM self-hosted component model used here, which listed component is the protected central repository for managed credentials and relevant stored recordings?

  1. Privileged Session Manager (PSM)
  2. Enterprise Password Vault (EPV) / Digital Vault Correct answer.
  3. Central Policy Manager (CPM)
  4. Password Vault Web Access (PVWA)

Explanation

The Digital Vault is the protected central repository for managed account objects and relevant stored data under the traditional model. Other components broker access, manage credentials or present interfaces. Actual topology, domain membership and storage arrangements must follow the specific supported deployment; no universal current-cloud layout is inferred.

Question 32Privileged sessions, rotation and application-secret dependencies

Which CyberArk component is responsible for automatically changing, verifying, and reconciling passwords on managed targets?

  1. PSM (Privileged Session Manager)
  2. CPM (Central Policy Manager) Correct answer.
  3. EPV (Enterprise Password Vault)
  4. EPM (Endpoint Privilege Manager)

Explanation

The Central Policy Manager (CPM) executes password change, verify, and reconcile operations against managed targets according to platform-defined policies. It is the workhorse that keeps every vaulted credential current and synchronized with the actual system.

Question 33Privileged sessions, rotation and application-secret dependencies

Which CyberArk component brokers privileged sessions to target systems, isolating the user's workstation from direct access and recording the session?

  1. PSM (Privileged Session Manager) Correct answer.
  2. CPM (Central Policy Manager)
  3. PVWA (Password Vault Web Access)
  4. Conjur

Explanation

PSM proxies privileged sessions to RDP, SSH, web, and other targets. It injects credentials transparently so the user never sees the password, isolates the user's endpoint from the target, and records every session to the Vault.

Question 34Privileged sessions, rotation and application-secret dependencies

Which CyberArk component is purpose-built to broker SSH sessions to Linux/Unix targets?

  1. PSM for SSH (PSMP) Correct answer.
  2. CPM
  3. PVWA
  4. Conjur

Explanation

PSM for SSH (PSMP) is the SSH-specific session manager. Users SSH to PSMP, which authenticates them, retrieves the target credential from the Vault, and proxies an SSH session to the target while recording keystrokes and command output.

Question 35Privileged sessions, rotation and application-secret dependencies

Which CyberArk component analyzes user and account behavior to detect anomalies such as suspicious credential use, irregular session activity, or potential Golden Ticket attacks?

  1. PTA (Privileged Threat Analytics) Correct answer.
  2. CPM
  3. EPV
  4. PSM

Explanation

Privileged Threat Analytics (PTA) consumes Vault, PSM, and AD events to baseline normal behavior and flag anomalies, including suspicious password changes, irregular logon times, and Kerberos ticket-related attacks. PTA can also trigger automatic responses such as suspending an account.

Question 36Privileged sessions, rotation and application-secret dependencies

Which CyberArk product is purpose-built to manage application and DevOps secrets, with native integrations for Kubernetes, Ansible, Jenkins, and similar pipelines?

  1. CyberArk Conjur Secrets Manager Correct answer.
  2. CyberArk Identity
  3. CyberArk EPM
  4. PSM

Explanation

Conjur Secrets Manager is CyberArk's solution for application and DevOps secrets. It provides REST APIs, native authenticators (Kubernetes, AWS IAM, Azure, OIDC, JWT), and policy-as-code so workloads can fetch secrets at runtime without hard-coding them.

Question 37Privileged sessions, rotation and application-secret dependencies

Where are CyberArk PSM session recordings ultimately stored?

  1. Inside the CyberArk Vault, in dedicated PSM Recordings Safes Correct answer.
  2. In the user's local browser cache
  3. On a public S3 bucket by default
  4. In SMS messages to the auditor

Explanation

PSM uploads session recordings to dedicated PSM Recordings Safes inside the Vault. The recordings inherit Vault encryption and access controls, providing a tamper-resistant, auditable archive of every privileged session.

Question 38Privileged sessions, rotation and application-secret dependencies

Which CyberArk concept defines the rules for credential management, such as how often passwords change, whether sessions are recorded, and dual-control requirements?

  1. Master Policy Correct answer.
  2. Group Policy Object (GPO)
  3. DNS zone
  4. Firewall ACL

Explanation

Master Policy is CyberArk's central rule set for credential management behavior: password change frequency, exclusive use, one-time password, dual control, session monitoring, and more. Platforms can extend or override Master Policy for specific account types.

Question 39Privileged sessions, rotation and application-secret dependencies

What does the CPM 'reconcile' action do?

  1. Generates a billing report
  2. Restores synchronization between the Vault's stored password and the target system when they have drifted out of sync, using a reconciliation account Correct answer.
  3. Reformats the target system disk
  4. Deletes the account from the Vault

Explanation

Reconciliation uses a privileged 'reconcile' account configured on the Platform to log into the target and reset the managed account's password back to a value the Vault knows. It recovers from drift caused by manual changes, outages, or interrupted rotations.

Question 40Privileged sessions, rotation and application-secret dependencies

Which CyberArk capability lets an authorized user retrieve a privileged credential without ever seeing the password by transparently injecting it into a session?

  1. PSM credential injection Correct answer.
  2. Reading the DBParm.ini file
  3. Calling the SQL admin command shell
  4. Exporting passwords to CSV

Explanation

PSM injects credentials retrieved from the Vault directly into the connection (RDP, SSH, web, database client) so the user never has to know or type the password. This dramatically reduces credential exposure and theft risk.

Question 41Privileged sessions, rotation and application-secret dependencies

Which CyberArk component or product is most associated with 'Credential Provider' (CP) and 'Central Credential Provider' (CCP)?

  1. Application Access Manager (AAM) Correct answer.
  2. Endpoint Privilege Manager
  3. PSM for SSH
  4. CyberArk Identity

Explanation

CP and CCP are part of CyberArk's Application Access Manager (AAM). CP is a local agent on the application server, while CCP is a centralized REST service. Both let applications retrieve secrets from the Vault on demand instead of hard-coding them.

Question 42Privileged sessions, rotation and application-secret dependencies

Which CyberArk component is most directly responsible for enforcing 'one-time password' (OTP) behavior, where a credential is rotated immediately after each use?

  1. CPM (Central Policy Manager) Correct answer.
  2. PVWA
  3. EPV directly
  4. Conjur

Explanation

When the Master Policy or Platform enables 'Enforce one-time password access', CPM rotates the credential the moment a user is finished using it. This makes any captured credential immediately useless.

Question 43Privileged sessions, rotation and application-secret dependencies

Which of the following is true about CyberArk PSM Recordings Safes?

  1. They store session recordings inside the Vault, inheriting Vault encryption and access controls Correct answer.
  2. They are stored on user laptops
  3. They are world-readable by default
  4. They cannot be searched

Explanation

PSM uploads session recordings to dedicated Recordings Safes inside the Vault, where they are encrypted and access-controlled like any other Safe object. Auditors with the right permissions can search and play them back.

Question 44Privileged sessions, rotation and application-secret dependencies

Which of the following is the most accurate statement about how a user typically launches a privileged session in CyberArk?

  1. The user logs into PVWA, finds the account in a Safe they have access to, and clicks Connect, which initiates a PSM session to the target Correct answer.
  2. The user emails the password to themselves
  3. The user calls the help desk for the credential
  4. The user uses the local 'sa' password

Explanation

The standard flow is: user authenticates to PVWA (with MFA), browses or searches Safe contents, and clicks Connect on an account. PVWA orchestrates a PSM session, PSM retrieves the credential from the Vault, and the user gets a brokered, recorded session without ever seeing the password.

Question 45Privileged sessions, rotation and application-secret dependencies

Which best describes the role of a CyberArk 'connection component' in PSM?

  1. A reusable definition of how PSM connects to a specific target type (e.g., RDP, SSH, web app) Correct answer.
  2. A type of Ethernet cable
  3. A patch-management module
  4. A backup script

Explanation

Connection components are the reusable building blocks that tell PSM how to launch and manage a session to a specific target type, including the underlying tool (mstsc, PuTTY, web browser), credential injection method, and any custom command transformations.

Question 46Traditional PAM architecture, safes and accountable access

Which CyberArk component provides the web-based user interface for end users and administrators to interact with the Vault?

  1. PVWA (Password Vault Web Access) Correct answer.
  2. CPM (Central Policy Manager)
  3. PTA (Privileged Threat Analytics)
  4. Conjur

Explanation

PVWA (Password Vault Web Access) is the browser-based portal users hit to retrieve credentials, launch sessions, and request access. Administrators also use PVWA to manage Safes, Master Policy, Platforms, and reports.

Question 47Traditional PAM architecture, safes and accountable access

Which CyberArk product provides workforce single sign-on, multifactor authentication, and lifecycle management for end-user identities?

  1. CyberArk Identity Correct answer.
  2. CyberArk Endpoint Privilege Manager
  3. CyberArk Conjur
  4. PSM for SSH

Explanation

CyberArk Identity is the workforce and customer identity platform offering SSO, adaptive MFA, lifecycle management, and directory services. It complements PAM by securing the front door for human users before privileged workflows ever begin.

Question 48Traditional PAM architecture, safes and accountable access

What is a 'Safe' in CyberArk PAM?

  1. A logical container in the Vault that groups credentials and applies access permissions to the users and groups who can use them Correct answer.
  2. A physical lockbox in the data center
  3. A backup tape
  4. A hardware HSM

Explanation

Safes are logical containers inside the Vault. They group accounts, files, or recordings that share an access scope, and Safe-level permissions (use, retrieve, manage, audit) determine who can do what with the contents.

Question 49Traditional PAM architecture, safes and accountable access

What is a 'Platform' in CyberArk PAM?

  1. A virtualization hypervisor used to run the Vault
  2. A reusable definition that tells CyberArk how to manage a particular type of account, including connection method, password complexity, and rotation behavior Correct answer.
  3. A physical server type
  4. A Windows desktop image

Explanation

A Platform is the configuration template for an account type (Windows Domain, Linux SSH, Oracle DB, AWS IAM, etc.). It specifies the connection plug-in, password complexity, rotation cadence, reconcile behavior, and any overrides to Master Policy.

Question 50Traditional PAM architecture, safes and accountable access

Which CyberArk service offers PAM as a SaaS-delivered solution that customers can adopt without operating the Vault and components themselves?

  1. CyberArk Privilege Cloud Correct answer.
  2. On-premises Vault only
  3. Conjur Open Source
  4. EPM Standalone

Explanation

CyberArk Privilege Cloud is the SaaS delivery of PAM. CyberArk operates the Vault and core components in the cloud; customers deploy lightweight connectors (CPM, PSM) on premises or in their cloud accounts to reach managed targets.