You are planning to configure Multi-Factor Authentication (MFA) for your CyberArk Privilege Cloud
Shared Service. What are the available authentication methods?
B
Explanation:
In CyberArk Privilege Cloud, Multi-Factor Authentication (MFA) can be configured to enhance
security by requiring multiple methods of authentication from independent categories of credentials
to verify the user's identity. The available authentication methods include:
Windows Authentication: Leverages the user's Windows credentials.
PKI (Public Key Infrastructure): Utilizes certificates to authenticate.
RADIUS (Remote Authentication Dial-In User Service): A networking protocol that provides
centralized Authentication, Authorization, and Accounting management.
CyberArk: Uses CyberArk's own authentication methods.
LDAP (Lightweight Directory Access Protocol): Protocol for accessing and maintaining distributed
directory information services.
SAML (Security Assertion Markup Language): An open standard that allows identity providers to pass
authorization credentials to service providers.
OpenID Connect (OIDC): An authentication layer on top of OAuth 2.0, an authorization framework.
Reference for this can be found in the CyberArk Privilege Cloud documentation, which details the
integration and setup of MFA using these methods.
When installing the first CPM within Privilege Cloud using the Connector Management Agent, what
should you set the Installation Mode to in the CPM section?
A
Explanation:
When installing the first CyberArk Privilege Management (CPM) instance in the Privilege Cloud using
the Connector Management Agent, the installation mode should be set to "Active". This
configuration sets the CPM to be actively involved in password management and task processing
without being in a standby or passive mode. Here are the step-by-step details:
Download the Connector Management Agent: Obtain the installer from the CyberArk Marketplace or
your installation kit.
Run the Installer: Start the setup and select the CPM component to install.
Choose Installation Mode: When prompted, select "Active" as the installation mode. This sets up the
CPM as the primary node responsible for handling password management operations.
This setup ensures that the CPM is immediately active and capable of handling requests without
waiting for manual intervention or failover.
Reference: CyberArk’s official documentation provides guidance on setting up the CPM, where it
specifies the modes and their purposes.
CyberArk User Neil is trying to connect to the Target Linux server 192.168.1.164 using a domain user
ACME\linuxuser01 on domain acme.corp using PSM for SSH server
192.168.65.145.
What is the correct syntax?
B
Explanation:
In CyberArk Privilege Cloud, when connecting to a target server using the Privileged Session
Manager (PSM) for SSH, the correct syntax for the SSH command includes the following format: ssh
neil@linuxuser01#[email protected]@192.168.65.145. This syntax breaks down as follows:
neil: The CyberArk username.
linuxuser01#acme.corp: The domain user on the target Linux server, formatted as
username#domain.
192.168.1.164: The IP address of the target Linux server.
192.168.65.145: The IP address of the PSM for SSH server.
This specific format ensures that the CyberArk Privileged Access Manager correctly interprets and
routes the connection through the PSM for SSH to the intended target server.
Reference:
CyberArk Privilege Cloud Introduction
CyberArk Privileged Access Manager
CyberArk Privilege Cloud - Manage Safe Members
CyberArk Security Fundamentals
After a scripted installation has successfully installed the PSM, which post-installation task is
performed?
A
Explanation:
After the successful scripted installation of the Privileged Session Manager (PSM), one of the post-
installation tasks is to disable the screen saver for the PSM local users. This is done to ensure that the
PSMConnect and PSMAdminConnect users, which are created during the installation process, do not
have a screen saver activated that could interfere with the operation of the PSM.
Reference:
CyberArk documentation on PSM post-installation tasks1
.
CyberArk documentation on disabling the screen saver for PSM local users
Which tool configures the user object that will be used during the installation of the PSM for SSH
component?
B
Explanation:
The tool used to configure the user object for the installation of the PSM for SSH component is
CreateCredFile. This tool is responsible for creating a credentials file that stores the necessary user
details required during the installation process, ensuring secure and correct authentication.
Reference:
CyberArk Privilege Cloud Introduction
You are configuring firewall rules between the Privilege Cloud components and the Privilege Cloud.
Which firewall rules should be set up to allow connections?
C
Explanation:
When configuring firewall rules for CyberArk Privilege Cloud, it is essential to allow bi-directional
communication between the Privilege Cloud components and the CyberArk Privilege Cloud. This
ensures that all necessary communications for operations and management can occur securely in
both directions.
Reference:
CyberArk documentation on system requirements for outbound traffic network and port
requirements1
.
CyberArk documentation on setting up an IP allowlist, which enables Privilege Cloud customer-side
components to communicate with the Privilege Cloud SaaS environment2
.
CyberArk documentation on connecting to organization firewalls
What is a requirement when installing the PSM on multiple Privileged Cloud Connector servers?
A
Explanation:
When installing the Privileged Session Manager (PSM) on multiple servers, it is required that each
PSM installation has the same path to the same recordings directory. This is necessary to ensure that
session recordings are stored consistently across different PSM instances, which is important for high
availability and load balancing implementations, as well as for maintaining a unified audit trail.
Reference:
CyberArk documentation on installing multiple PSM servers
What must be done to configure the syslog server IP address(es) for SIEM integration? (Choose 2.)
B, E
Explanation:
To configure the syslog server IP addresses for SIEM integration in a CyberArk Privilege Cloud
environment, the following steps are generally required:
Update the syslog server IP address through the Privilege Cloud Portal (Option B): This is typically
done via the administrative interface where system logging configurations can be managed. It allows
for straightforward integration of external logging tools by specifying the destination syslog server IP.
Configure the Secure Tunnel for SIEM integration (Option E): Establishing a secure tunnel is often
necessary for secure and reliable data transmission between the CyberArk Privilege Cloud and the
external syslog server, particularly when integrating SIEM systems that require encrypted and secure
data pathways.
Reference: CyberArk’s SIEM integration documentation and support articles often discuss these steps
as part of setting up comprehensive security and monitoring configurations.
In the directory lookup order, which directory service is always looked up first for the CyberArk
Privilege Cloud solution?
D
Explanation:
In the directory lookup order for the CyberArk Privilege Cloud solution, the "CyberArk Cloud
Directory" is always looked up first. This directory service is a part of the CyberArk Privilege Cloud
infrastructure and is specifically designed to handle identity and access management within the
cloud environment efficiently. It prioritizes the CyberArk Cloud Directory for authentication and
identity resolution before consulting any external directory services.
Reference: CyberArk's architectural documentation usually emphasizes the role of the CyberArk
Cloud Directory in managing and authenticating user access in cloud-based deployments,
highlighting its precedence in the directory lookup process.
Your customer recently merged with a smaller organization. The customer's connector has no
network connectivity to the smaller organization's infrastructure. You need to map LDAP users from
both your customer and the smaller organization. How is this achieved?
C
Explanation:
To map LDAP users from both your customer and the smaller organization they have merged with,
especially when there is no network connectivity between the two infrastructures, the best approach
is to:
Deploy Identity Connectors in the newly acquired infrastructure and create user mappings (Option
C). This involves setting up additional Identity Connectors within the smaller organization’s network.
These connectors will facilitate the integration of user directories from both organizations into the
customer’s Privilege Cloud environment.
Reference: CyberArk documentation on Identity Connectors often outlines the capability of
deploying multiple connectors to manage different user directories, especially useful in scenarios
involving mergers or acquisitions where separate infrastructures need integration.
After correctly configuring reconciliation parameters in the Prod-AIX-Root-Accounts Platform, this
error message appears in the CPM log: CACPM410E Ending password policy Prod-AIX-Root-Accounts
since the reconciliation task is active but the AllowedSafes parameter was not updated What caused
this situation?
C
Explanation:
The error message "CACPM410E Ending password policy Prod-AIX-Root-Accounts since the
reconciliation task is active but the AllowedSafes parameter was not updated" suggests an issue with
configuration parameters. The likely cause is:
The AllowedSafes parameter does not include the safe containing the reconciliation account defined
in the Platform (Option C). This parameter must accurately reflect all safes where the reconciliation
account operates to ensure proper management and access by the Central Policy Manager (CPM). If
the safe containing the reconciliation account is not listed, the CPM cannot perform its tasks, leading
to this error.
Reference: CyberArk’s error codes and troubleshooting guides detail how specific configuration
mismatches, like an incomplete AllowedSafes parameter, can disrupt normal operations, especially
in reconciliation processes.
How can a platform be configured to work with load-balanced PSMs?
B
Explanation:
To configure a platform to work with load-balanced Privileged Session Managers (PSMs), you should:
Create a new PSM definition that targets the load balancer IP address and assign it to the platform
(Option B). This approach involves configuring the platform settings to direct session traffic through a
load balancer that distributes the load across multiple PSM servers. This is effective in environments
where high availability and fault tolerance are priorities.
Reference: CyberArk’s setup guidelines for high-availability environments typically recommend
configuring platforms to utilize load balancers to ensure continuous availability and optimal
distribution of session management tasks.
You are deploying a CyberArk Identity Connector to integrate Privilege Cloud Shared Services with an
Active Directory environment. Which requirement must be met?
A
Explanation:
When deploying a CyberArk Identity Connector to integrate Privilege Cloud Shared Services with an
Active Directory environment, the server hosting the Identity Connector must meet specific
requirements to ensure proper integration and functionality. The necessary condition is:
The Identity Connector Server must be joined to the Active Directory (Option A). This requirement
ensures that the server can communicate effectively with the Active Directory services and manage
identity data securely and efficiently. Being part of the Active Directory domain facilitates
authentication and authorization processes required for the connector to function correctly.
Reference: CyberArk installation and configuration guides typically emphasize the importance of
having the Identity Connector server joined to the domain to allow seamless interaction with Active
Directory services.
Your customer is using Privilege Cloud Shared Services. What is the correct CyberArk Vault address
for this customer?
B
Explanation:
For customers using CyberArk Privilege Cloud Shared Services, the correct format for the CyberArk
Vault address is:
vault-<subdomain>.privilegecloud.cyberark.cloud (Option B). This format is used to access the vault
services provided by CyberArk in the cloud environment, where <subdomain> is the unique identifier
assigned to the customer’s specific instance of the Privilege Cloud.
Reference: CyberArk’s Privilege Cloud documentation provides details on how to access various
services, including the vault. The standard naming convention for accessing the vault services in the
cloud typically follows this format.
You are implementing LDAPS Integration for a standard Privilege Cloud environment.
Which information must be provided to the CyberArk Privilege Cloud support team through a Service
Request? (Choose 2.)
A, D
Explanation:
When implementing LDAPS Integration for a standard Privilege Cloud environment, certain
information is crucial and must be provided to the CyberArk Privilege Cloud support team through a
Service Request. The necessary details include:
LDAPS certificate chain for all domain controllers to be integrated (Option A): This information is
critical to establishing a trusted secure connection between the Privilege Cloud and the domain
controllers using LDAP over SSL (LDAPS).
Fully Qualified Domain Name and IP Address of the domain controllers to be integrated (Option D):
This information is essential for accurately identifying and configuring the network connections to
each domain controller that will be integrated with the Privilege Cloud.
Reference: The process of setting up LDAPS integration typically requires detailed network and
security information about the domain controllers to ensure secure and reliable connectivity.
CyberArk support documentation and service request forms usually specify the need for these
details.