PAM-DEF CyberArk Defender - PAM Question and Answers

the CA Certificate that signed the certificate used by the External Directory

a CA signed Certificate for the Vault server

a CA signed Certificate for the PVWA server

a self-signed Certificate for the Vault

Communicates with components

Sends email alerts from the Vault

Executes password changes

Maintains Vault metadata

To test that CyberArk is storing accurate credentials for accounts

To change the password of an account according to organizationally defined password rules

To allow CyberArk to manage unknown or lost credentials

To generate a new complex password

Update > General tab

Update > Authorizations tab

Update > Member Of tab

Update > Group tab

Create a privileged account on the target server. Allow this account the ability to SSH directly from the CPM machine. Configure this account as the Reconcile account of the target server’s root account.

Create a non-privileged account on the target server. Allow this account the ability to SSH directly from the CPM machine. Configure this account as the Logon account of the target server’s root account.

Configure the Unix system to allow SSH logins.

Configure the CPM to allow SSH logins.

Suspected Credential Theft

Over-Pass-The Hash

Golden Ticket

Unmanaged Privileged Access

True; this is the default behavior

False; this is not possible

True, if the AllowFailback setting is set to “yes” in the padr.ini file

True, if the AllowFailback setting is set to “yes” in the dbparm.ini file

an account stored in the Vault

an account specified by the user

the Vault Administrator

any user with Auditor membership

the PasswordManager user

Auditors

Vault Admin

DR Users

Operators

Master Policy

Safe Templates

PVWAConfig.xml

Platform Configuration

Accounts that were discovered by CyberArk in the last 30 days

Accounts that were discovered by CyberArk that have not yet been onboarded

All accounts added to the vault in the last 30 days

All users added to CyberArk in the last 30 days

To control how often the CPM looks for System Initiated CPM work.

To control how often the CPM looks for User Initiated CPM work.

To control how long the CPM rests between password changes.

To control the maximum amount of time the CPM will wait for a password change to complete.

PSM-SSH Connection Component

UnixPrompts.ini

UnixProcess.ini

PSM-RDP Connection Component

Vault Users

Vault Group

LDAP Users

LDAP Groups

List Accounts, View Safe Members

Manage Safe Owners

List Accounts, Access Safe without confirmation

Manage Safe, View Audit

TRUE

FALSE

Create a service ticket in the customer portal explaining the requirements of the custom platform.

Search common community portals like stackoverflow, reddit, github for an existing platform.

From the platforms page, uncheck the “Hide non-supported platforms” checkbox and see if a platform meeting your needs appears.

Visit the CyberArk marketplace and search for a platform that meets your needs.

They are synchronized once every 24 hours between 1 AM and 5 AM. Most Voted

They are synchronized once every 24 hours between 7 PM and 12 AM.

They are synchronized every 2 hours.

They are not synchronized according to a specific schedule.

The account does not have sufficient permissions to change its own password.

The domain controller is unreachable.

The password has been changed recently and minimum password age is preventing the change.

The CPM service is disabled and will need to be restarted.

Platform Management > (Platform) > UI & Workflows

Master Policy > Session Management

Master Policy > Privileged Access Workflows

Administration > Options > Connection Components

HeadStartInterval

Interval

ImmediateInterval

The CPM does not change the password under this circumstance

Select Update on the CyberArk group, and then click Add > LDAP Group

Select Update on the LDAP Group, and then click Add > LDAP Group

Select Member Of on the CyberArk group, and then click Add > LDAP Group

Select Member Of on the LDAP group, and then click Add > LDAP Group

Ensure that the Production Instance replicates changes that occurred from the Disaster Recovery Instance.

Briefly stop and start the Disaster Recovery Instance before attempting to fail components back to the Production Instance.

Stop the CPM services before starting the production server.

Perform an IIS Reset on all PVWA servers.

createcredfile.exe

cavaultmanager.exe

PrivateArk

PVWA

Kerberos

ODBC

VBScript

Sybase

in the PTAAuthorizationGroups parameter, found in Administration > Options > PTA

in the PTAAuthorizationGroups parameter, found in Administration > Options > General

in the SecurityEventsAuthorizationGroups parameter, found in Administration > Security > Options

in the SecurityEventsFeedAuthorizationGroups parameter, found in Administration > Options > General

True

False

PSM connections to target devices that are not managed by CyberArk.

Session Recording.

Real-time live session monitoring.

PSM connections from a terminal without the need to login to the PVWA.

Auditor

Administrator

Master

Operator

the server key

the recovery public key

the recovery private key

its own unique key

True

False

True

False

PrivateArk Client > Tools > Administrative Tools > Users and Groups > DR User > Update > Authentication > Update Password.

Create a new credential file, on the DR Vault, using the CreateCredFile utility and the newly set password.

С. Create a new credential file, on the Primary Vault, using the CreateCredFile utility and the newly set password.

PVWA > User Provisioning > Users and Groups > DR User > Update Password.

PrivateArk Client > Tools > Administrative Tools > Users and Groups > PAReplicate User > Update > Authentication > Update Password.

Upload the license.xml file to the system Safe and restart the PrivateArk Server service

Upload the license.xml file to the system Safe

Upload the license.xml file to the Vault Internal Safe and restart the PrivateArk Server service

Upload the license.xml file to the Vault Internal Safe

The user must login as PSMAdminConnect

The PSM service is not running

The user is not a member of the PVWAMonitor group

The user is not a member of the Auditors group

network instabilities/outages

vault license expiry

credential de-sync

browser compatibility issues

installed location file corruption

PVWA> Administration > Platform Configuration > Edit Platform > UI & Workflow > Dual Control> Approvers

PVWA> Policies > Access Control (Safes) > Safe Members > Workflow > Authorize Password Requests

PVWA> Account List > Edit > Show Advanced Settings > Dual Control > Direct Managers

PrivateArk > Admin Tools > Users and Groups > Auditors (Group Membership)

Change settings on the CPM configuration safe so that access is permitted after business hours only.

Update the password change parameters of the platform to match the permitted time frame.

Disable automatic CPM management for all accounts that are assigned to this platform.

Add an exception to the Master Policy to allow the action for this platform during the permitted time.

PrivateArk Client

RestAPI

PVWA

Vault

the vault will not allow this situation to occur.

only those permissions that exist on the group added to the safe first.

only those permissions that exist in all groups to which the user belongs.

the cumulative permissions of all groups to which that user belongs.

Require password verification every X days and enforce one-time password access.

Enforce check-in/check-out exclusive access and enforce one-time password access.

Allow EPV transparent connections ('Click to connect') and enforce check-in/check-out exclusive access.

Allow EPV transparent connections ('Click to connect') and enforce one-time password access.

PSMAdminConnect

Shadowuser

PSMConnect

Credentials stored in the Vault for the target machine

require dual control password access approval

require password change every X days

enforce check-in/check-out exclusive access

enforce one-time password access

Vault Replicator

PAS Reporter

Remote Control Agent

Syslog

From PrivateArk, copy/paste the appropriate Policy.ini file; then rename it.

From the PVWA, navigate to the platforms page, select an existing platform that is similar to the new target account platform and then click Duplicate; name the new platform.

From PrivateArk, copy/paste the appropriate settings in PVConfiguration.xml; then update the policyName variable.

From the PVWA, navigate to the platforms page, select an existing platform that is similar to the new target account platform, manually update the platform settings and click “Save as” INSTEAD of save to duplicate and rename the platform.

1

2

3

4

All accounts in the pending accounts list

Any future accounts discovered by a discovery process

Both “All accounts in the pending accounts list” and “Any future accounts discovered by a discovery process”

account settings

platform settings

master policy

safe settings

service account settings

Address

Safe

Account Description

Platform

CPM

TRUE

FALSE

in Active Directory under "Users OU" => "User Properties" => "External Bindings" => "Port"

in PVWA, under "LDAP Integration" => "LDAP" => "Directories" => "" => "Hosts" => "Host"

in PrivateArk Client, under "Tools" => "Administrative Tools" => "Directory Mapping" => ""

From the PVWA, connect to the domain controller using Test-NetConnection on Port 636.

Use Accounts

Retrieve Accounts

Authorize Password Requests

Access Safe without Authorization

adding optional parameters in the request

adding additional REST methods

removing parameters

returning additional values in the response

PACli.ini

Vault.ini

conf.ini

A comma delimited upload file

PVWA > User Provisioning > LDAP Integration > Mapping Criteria

PVWA > User Provisioning > LDAP Integration > Map Name

PVWA > Administration > LDAP Integration > Mappings

PVWA > Administration > LDAP Integration > AD Groups

Configure one-time passwords for the appropriate platform in Master Policy.

Configure shared account mode on the appropriate safe.

Configure both one-time passwords and exclusive access for the appropriate platform in Master Policy.

Configure object level access control on the appropriate safe.

TRUE

FALSE

Windows

UNIX

Oracle

All of the above

Safes

Platforms

Policies

Accounts

True; this is the default behavior

False, the Vault administrator must manually set the DR Vault to DR mode by setting “FailoverMode=no” in the padr.ini file

True, if the AllowFailback setting is set to “yes” in the padr.ini file

False, the Vault administrator must manually set the DR Vault to DR mode by setting “FailoverMode=no” in the dbparm.ini file

PSM (i.e., launching connections by clicking on the connect button in the Password Vault Web Access (PVWA)

PSM for Windows (previously known as RDP Proxy)

PSM for SSH (previously known as PSM-SSH Proxy)

All of the above

Suspend, Terminate, None

Suspend, Terminate, Lock Account

Pause, Terminate, None

Suspend, Terminate

Privileged Account Compliance Status report

Activity log

Privileged Account Inventory report

Application Inventory report

TRUE

FALSE

Windows events text recorder with automatic play-back

Windows events text recorder and universal keystrokes recording simultaneously

Universal keystrokes text recorder with windows events text recorder disabled

Custom audio recording for windows events

TRUE

FALSE

time between a password retrieval and the account becoming eligible for a password change

timeout for users signed into the PVWA as configured in the global settings

minimum amount of time that Just in Time access is valid

time in minutes before an empty safe will be automatically deleted