CyberArk PAM Key Features
444 Questions
8 Views

Choose a study mode

Play Quiz
Study Flashcards
Spaced Repetition
Chat to lesson

Podcast

Play an AI-generated podcast conversation about this lesson

Questions and Answers

What is the primary function of CyberArk PAM's discover feature?

  • To record and monitor privileged activity
  • To identify and manage credentials (correct)
  • To isolate credentials
  • To manage password complexity

    • What is the purpose of password rotation frequency in CyberArk PAM?

  • To monitor privileged activity
  • To regularly change passwords (correct)
  • To limit access to sensitive data
  • To manage credential length

    • What is the primary goal of CyberArk PAM's remediate feature?

  • To isolate credentials
  • To monitor privileged activity
  • To mitigate risky behavior (correct)
  • To manage credential length

    • What is the purpose of policies in CyberArk PAM?

    <p>To manage password complexity</p> Signup and view all the answers

    What is the primary function of CyberArk PAM's record feature?

    <p>To audit sessions</p> Signup and view all the answers

    What is the primary function of CyberArk PAM's monitor feature?

    <p>To monitor privileged activity</p> Signup and view all the answers

    What is the primary purpose of the Vault in the given diagram?

    <p>To store credentials</p> Signup and view all the answers

    What is the primary function of the Privileged Session Manager in the context of the Vault?

    <p>To manage and monitor privileged sessions of IT staff and auditors</p> Signup and view all the answers

    What type of encryption model is used in the given diagram?

    <p>Hierarchical Encryption Model</p> Signup and view all the answers

    What is the recommended factor of authentication in the given diagram?

    <p>Two Factor</p> Signup and view all the answers

    What is the primary benefit of using a Password Vault in the context of the Vault?

    <p>To secure and manage sensitive credentials and prevent insider threats</p> Signup and view all the answers

    What is the primary purpose of Auditing in the given diagram?

    <p>To track and analyze security events</p> Signup and view all the answers

    What is the role of the Central Policy Manager in the context of the Vault?

    <p>To enforce centralized policy management on target accounts and servers</p> Signup and view all the answers

    What is the benefit of using a Hierarchical Encryption Model?

    <p>Every object has a unique key.</p> Signup and view all the answers

    What is the primary risk associated with unmanaged target accounts and servers?

    <p>Insider threats and security breaches</p> Signup and view all the answers

    What is the primary purpose of the firewall in the given diagram?

    <p>To protect against external security breaches</p> Signup and view all the answers

    What is the primary purpose of the Vault in the context of Privileged Account Management?

    <p>To secure and manage sensitive credentials and prevent insider threats</p> Signup and view all the answers

    What is the primary benefit of using a Privileged Session Manager in the context of the Vault?

    <p>To monitor and control privileged access to sensitive resources</p> Signup and view all the answers

    What is the benefit of using granular permissions in the given diagram?

    <p>It provides role-based access control</p> Signup and view all the answers

    What is the primary purpose of the Authentication process in the given diagram?

    <p>To verify user identities</p> Signup and view all the answers

    What task can be performed via the PVWA interface?

    <p>Disable a user or activate a suspended user</p> Signup and view all the answers

    What type of users can be viewed via the PVWA interface?

    <p>Both LDAP and CyberArk users</p> Signup and view all the answers

    What can be created manually through the PVWA interface?

    <p>New CyberArk users</p> Signup and view all the answers

    What action can be taken on a user's password via the PVWA interface?

    <p>Reset the password</p> Signup and view all the answers

    What is a feature of the User Management module in the PVWA interface?

    <p>Create and edit CyberArk users</p> Signup and view all the answers

    What is a capability of the PVWA interface in terms of user management?

    <p>View all users</p> Signup and view all the answers

    Where are users stored in PrivateArk Client?

    <p>Vault database</p> Signup and view all the answers

    How can users be added to PrivateArk Client?

    <p>Manually through PrivateArk Client or via LDAP directory</p> Signup and view all the answers

    What is the recommended approach to managing users in PrivateArk Client?

    <p>Using an external LDAP directory, such as Active Directory</p> Signup and view all the answers

    What can be configured for a user in PrivateArk Client?

    <p>All of the above</p> Signup and view all the answers

    What is the purpose of the General Tab in PrivateArk Client?

    <p>To manually add a new user</p> Signup and view all the answers

    How can you change the Master user password in PrivateArk Client?

    <p>Through the User → Set Password option</p> Signup and view all the answers

    What is the primary distinction between Users and Accounts in the context of User Management?

    <p>Users represent individual entities, while Accounts represent access points.</p> Signup and view all the answers

    What is the main difference between Internal users and groups and Transparent users and groups?

    <p>Internal users and groups are managed by the system, while Transparent users and groups are managed by the administrator.</p> Signup and view all the answers

    What is the purpose of directory mapping in User Management?

    <p>To synchronize user data between directories</p> Signup and view all the answers

    What can be managed in PrivateArk Client and PVWA?

    <p>Internal users and groups</p> Signup and view all the answers

    What is the primary benefit of using custom directory mapping?

    <p>Streamlines user management by automating user provisioning</p> Signup and view all the answers

    What is the main difference between Vault authorizations and Safe authorizations?

    <p>Vault authorizations are used for managing privileged accounts, while Safe authorizations are used for managing shared accounts</p> Signup and view all the answers

    What is the primary role of predefined users and groups in User Management?

    <p>To provide a default set of roles and permissions</p> Signup and view all the answers

    What is the main benefit of using Transparent users and groups?

    <p>Streamlines user management by automating user provisioning</p> Signup and view all the answers

    What is the significance of the '30' in the platform name 'LIN SSH 30'?

    <p>Indicates the password rotation frequency</p> Signup and view all the answers

    What is the purpose of the 'Generate Password' section in the Edit Platform settings?

    <p>To manage password complexity</p> Signup and view all the answers

    Why would a Vault administrator deactivate a platform?

    <p>To improve performance by reducing platforms</p> Signup and view all the answers

    What is a key characteristic of the platform name 'LIN SSH 30'?

    <p>It is based on a logical naming convention</p> Signup and view all the answers

    What can be modified in the Edit Platform settings?

    <p>Password policy settings</p> Signup and view all the answers

    What is divided into two broad sections in the Edit Platform settings?

    <p>UI &amp; Workflows and Automatic Password Management</p> Signup and view all the answers

    What is the primary purpose of plug-ins in Platform Management?

    <p>To connect to different target systems</p> Signup and view all the answers

    What is a key aspect of password policy settings in Platform Management?

    <p>Defining the technical settings for password management</p> Signup and view all the answers

    How are platforms organized in Platform Management?

    <p>By target system type</p> Signup and view all the answers

    What is the basis for exceptions to the Master Policy?

    <p>The specific requirements of each platform</p> Signup and view all the answers

    Why is it necessary to duplicate a platform in Platform Management?

    <p>To create a new platform with different password policy settings</p> Signup and view all the answers

    Where are platforms located in the interface?

    <p>Under the Administration tab</p> Signup and view all the answers

    What can be viewed in the Platform Management page?

    <p>Password management policies applied to different platforms</p> Signup and view all the answers

    What was discussed in this session?

    <p>The general workflow when working with CyberArk PAM</p> Signup and view all the answers

    What is the next exercise after completing this session?

    <p>Securing Windows Domain Accounts</p> Signup and view all the answers

    What is the purpose of the CyberArk Marketplace?

    <p>To access additional resources and exercises</p> Signup and view all the answers

    What can be done in the Platform Management page?

    <p>All of the above</p> Signup and view all the answers

    What is the result of configuring key parameters in Platforms?

    <p>Password management policies</p> Signup and view all the answers

    What is the relationship between the Master Policy and Platforms?

    <p>The Master Policy is used to configure key parameters in Platforms</p> Signup and view all the answers

    What is the purpose of editing the Master Policy?

    <p>To configure password management policies</p> Signup and view all the answers

    What is the maximum number of objects recommended to be stored in a Safe?

    <p>3,000 to 5,000</p> Signup and view all the answers

    What is the principle that should be followed when storing objects in Safes?

    <p>Least privilege</p> Signup and view all the answers

    What type of accounts should have separate Safes?

    <p>Windows Desktop Accounts, Windows Local Administrators, and Windows Domain Accounts</p> Signup and view all the answers

    What is the character limit for safe names?

    <p>28 characters</p> Signup and view all the answers

    What is the recommended approach to managing access control to privileged identities in CyberArk?

    <p>Least privilege</p> Signup and view all the answers

    How many characters are double-byte characters limited to?

    <p>Not supported</p> Signup and view all the answers

    Who can be granted access to a Safe?

    <p>Users and groups</p> Signup and view all the answers

    What is the purpose of permissions in a Safe?

    <p>To manage accounts and their passwords</p> Signup and view all the answers

    How are permissions organized in a Safe?

    <p>Into groups for convenience</p> Signup and view all the answers

    What can be done to a Safe if you have the appropriate permissions?

    <p>Add new members and assign permissions</p> Signup and view all the answers

    What is a benefit of using granular permissions in a Safe?

    <p>It provides more flexibility in managing access</p> Signup and view all the answers

    What is managed through the permissions assigned to Members of a Safe?

    <p>Access to accounts and their passwords</p> Signup and view all the answers

    What is the maximum number of characters allowed in a safe name?

    <p>28</p> Signup and view all the answers

    What is the purpose of the AllowedSafes parameter?

    <p>To limit the scope of a platform to specific safes</p> Signup and view all the answers

    Why is object-level access control not recommended?

    <p>No reason is given in the text</p> Signup and view all the answers

    What can be used to add members and manage permissions in a safe?

    <p>The new wizard</p> Signup and view all the answers

    What is the benefit of using permission presets?

    <p>Simplifies the permission management process</p> Signup and view all the answers

    What can be searched for in the Vault or LDAP using the new wizard?

    <p>Users or groups</p> Signup and view all the answers

    What is the purpose of predefined users and groups?

    <p>To simplify user management</p> Signup and view all the answers

    What is the significance of the string 'Lin-' in the AllowedSafes parameter?

    <p>It is a regular expression pattern for limiting scope</p> Signup and view all the answers

    What is the purpose of the Scan Vault for Account step?

    <p>To retrieve account information and current passwords</p> Signup and view all the answers

    What happens after a successful login using new credentials?

    <p>The system stores new credentials</p> Signup and view all the answers

    What is discussed in this session?

    <p>How to add an account to CyberArk PAM via the PVWA</p> Signup and view all the answers

    What is the outcome of the Change Process?

    <p>A successful or failed login using new credentials</p> Signup and view all the answers

    What is the purpose of the Generate Password step?

    <p>To generate a new password</p> Signup and view all the answers

    What happens after a successful connection and run of the change password process?

    <p>The system logs in using new credentials</p> Signup and view all the answers

    What is the purpose of the Login using current credentials step?

    <p>To validate current credentials</p> Signup and view all the answers

    What is the outcome of the Login using current credentials step?

    <p>A successful or failed login using current credentials</p> Signup and view all the answers

    What is the purpose of the Store new credentials step?

    <p>To store new credentials</p> Signup and view all the answers

    What is the purpose of the Change Process diagram?

    <p>To illustrate the password management process</p> Signup and view all the answers

    What is the purpose of using CyberArk PAM to push private keys to application servers?

    <p>To authenticate using SSH keys</p> Signup and view all the answers

    What is the benefit of securing Unix accounts with SSH keys?

    <p>To provide an additional layer of security</p> Signup and view all the answers

    What is the purpose of the 'Verify you can login with the Private Key' exercise?

    <p>To verify secure login using a private key</p> Signup and view all the answers

    What is the benefit of using linked accounts in CyberArk PAM?

    <p>To provide secure access to multiple platforms</p> Signup and view all the answers

    What is the purpose of generating a key-pair in SSH key management?

    <p>To generate a private and public key pair</p> Signup and view all the answers

    What is the benefit of securing Windows Server Local Accounts via a reconcile account?

    <p>To reduce the risk of unauthorized access</p> Signup and view all the answers

    What is the main benefit of using SSH keys instead of passwords?

    <p>More secure and less vulnerable to attacks</p> Signup and view all the answers

    What is the role of the Central Policy Manager in the context of the Vault?

    <p>To manage and change key-pairs frequently</p> Signup and view all the answers

    What is the primary purpose of storing private keys in the Vault?

    <p>To allow users to retrieve private keys for authentication</p> Signup and view all the answers

    What is the benefit of using unique key-pairs for each target system?

    <p>More secure and reduces the risk of compromised systems</p> Signup and view all the answers

    What happens when a target system is compromised?

    <p>All systems that trust the compromised system are vulnerable</p> Signup and view all the answers

    What is the primary function of the SSH Key Manager?

    <p>To create unique key-pairs for each target system</p> Signup and view all the answers

    What is the purpose of the Central Policy Manager changing key-pairs frequently?

    <p>To reduce the risk of compromised systems</p> Signup and view all the answers

    What is the benefit of using the SSH Key Manager to authenticate to target systems?

    <p>More secure and less vulnerable to attacks</p> Signup and view all the answers

    What is the main purpose of a Logon account?

    <p>To authenticate users to a system</p> Signup and view all the answers

    What is a best practice for Root account management?

    <p>Using the username 'root'</p> Signup and view all the answers

    What is the primary purpose of SSH key management?

    <p>To configure SSH keys</p> Signup and view all the answers

    What is the purpose of password reconciliation?

    <p>To synchronize passwords</p> Signup and view all the answers

    What is the primary concern of Privileged Access Security?

    <p>Securing sensitive credentials</p> Signup and view all the answers

    What is a key aspect of SSH policy configuration?

    <p>Defining access controls</p> Signup and view all the answers

    What type of files can the CPM manage application accounts in?

    <p>Plain text files, INI files, XML files, and Web configuration files</p> Signup and view all the answers

    What happens when the CPM changes the password for a privileged account?

    <p>The CPM pushes the updated password to the config file used by the application</p> Signup and view all the answers

    What is required to add a configuration file usage?

    <p>Manually add the relevant usage in the target account platform</p> Signup and view all the answers

    What type of file is used by the application to retrieve credentials?

    <p>Configuration file</p> Signup and view all the answers

    What is the purpose of the CPM in relation to the config file?

    <p>To update the password in the config file</p> Signup and view all the answers

    What is the role of the CPM in managing application accounts?

    <p>To manage application accounts in various file types</p> Signup and view all the answers

    What is the purpose of Usages in CyberArk PAM?

    <p>To synchronize an account password with all other occurrences of the same password</p> Signup and view all the answers

    What happens when the password for a target account is changed in CyberArk PAM?

    <p>The password is updated on all occurrences of the same password anywhere in the network</p> Signup and view all the answers

    What is the purpose of Dependent Platforms in CyberArk PAM?

    <p>To manage Usages of account passwords</p> Signup and view all the answers

    How does the CPM synchronize account passwords in CyberArk PAM?

    <p>By scanning for usages anywhere in the network</p> Signup and view all the answers

    What is an example of a Dependent Platform in CyberArk PAM?

    <p>A local Windows user used to run a scheduled task</p> Signup and view all the answers

    What is the result of setting SearchForUsages to Yes in CyberArk PAM?

    <p>The CPM scans for usages anywhere in the network</p> Signup and view all the answers

    What is the purpose of specifying the section and parameter in the INI config file usage?

    <p>To specify the location of the password in the file</p> Signup and view all the answers

    What is the benefit of encrypting passwords in configuration files?

    <p>To enhance the security of the password storage</p> Signup and view all the answers

    What is the purpose of associating a logon account with the usage?

    <p>To log onto the remote machine where the usage exists</p> Signup and view all the answers

    What is the purpose of the Encryption Command parameter?

    <p>To encrypt the password using an external command</p> Signup and view all the answers

    What is the effect of the CPM changing the password for dba01?

    <p>It changes the password in the database and the INI file</p> Signup and view all the answers

    What is the purpose of the INI file in the context of the CPM?

    <p>To store the password for the server</p> Signup and view all the answers

    What is required to log onto the remote machine where the usage exists?

    <p>A logon account</p> Signup and view all the answers

    What is the benefit of using the CPM to manage passwords?

    <p>It enhances the security of password storage</p> Signup and view all the answers

    What is the primary purpose of requiring users to specify a reason for access in Privileged Account Management?

    <p>To track accountability and ensure responsible access</p> Signup and view all the answers

    What is the primary role of Safe membership in Dual Control policies?

    <p>To authorize access requests from managers or peers</p> Signup and view all the answers

    What is the primary benefit of using Dual Control policies in Privileged Account Management?

    <p>To provide an additional layer of security and control</p> Signup and view all the answers

    What is the primary purpose of the Privileged Account Request section in a Platform?

    <p>To create a list of choices for users when accessing a password</p> Signup and view all the answers

    Who are the Requesters in the context of Dual Control policies?

    <p>The users who want to access privileged accounts</p> Signup and view all the answers

    What is the primary benefit of requiring users to specify a reason for access in a Platform?

    <p>To provide an audit trail for access requests</p> Signup and view all the answers

    What is the primary function of the multi-level approval process in Dual Control?

    <p>To require approval from multiple groups before a request is fulfilled</p> Signup and view all the answers

    What is the purpose of selecting 'All' in the number of confirmers for a request?

    <p>To require approval from all members of the group</p> Signup and view all the answers

    How does the multi-group approval process work?

    <p>At least one person from each group must approve the request before it is fulfilled</p> Signup and view all the answers

    What is the purpose of the IT Directors group in the multi-level approval process?

    <p>To approve requests after they have been approved by the IT Managers group</p> Signup and view all the answers

    What is the benefit of using a multi-level approval process?

    <p>It provides an additional layer of security and accountability</p> Signup and view all the answers

    What is the purpose of enabling direct manager approval?

    <p>To require approval from the manager of the requester</p> Signup and view all the answers

    What happens to the password when multiple users access it simultaneously?

    <p>It is reset as each user accesses</p> Signup and view all the answers

    What is the purpose of the password release mechanism?

    <p>To release the password after the Minimum validity period</p> Signup and view all the answers

    What is an essential component of the Dual Control workflow?

    <p>Reason for access</p> Signup and view all the answers

    What is the benefit of using Exclusive Passwords in Privileged Account Management?

    <p>To provide an additional layer of security</p> Signup and view all the answers

    What is the primary goal of the One-time Passwords workflow?

    <p>To use a unique password for each access</p> Signup and view all the answers

    What is the purpose of the Minimum validity period in password management?

    <p>To control password reset based on a set period</p> Signup and view all the answers

    What is a key aspect of the Dual Control policy?

    <p>Require users to specify a reason for access</p> Signup and view all the answers

    What is the primary benefit of using Safe Membership Configuration in Privileged Account Management?

    <p>To provide an additional layer of security and control</p> Signup and view all the answers

    What is the primary purpose of the Accounts Discovery and Onboarding Rules feature?

    <p>To discover and onboard new accounts</p> Signup and view all the answers

    What method can be used to add multiple accounts at once?

    <p>Add multiple accounts from file</p> Signup and view all the answers

    How can scripts and applications interact with the Vault?

    <p>Through the PAM Web Services API</p> Signup and view all the answers

    What is the purpose of Continuous Accounts Discovery?

    <p>To continuously discover new accounts</p> Signup and view all the answers

    What is the primary purpose of the Discovery and Audit (DNA) feature?

    <p>To discover and audit new accounts</p> Signup and view all the answers

    What is the primary benefit of integrating with the Vault using the Rest API?

    <p>To customize interactions with the Vault</p> Signup and view all the answers

    What is the primary benefit of using Accounts Discovery with Automatic Onboarding Rules?

    <p>Streamlined onboarding process</p> Signup and view all the answers

    What is the purpose of Continuous Accounts Discovery?

    <p>To discover new accounts</p> Signup and view all the answers

    What is an advantage of adding multiple accounts from a file?

    <p>Reduced administrative burden</p> Signup and view all the answers

    What is the purpose of the REST API integration in PAM Administration?

    <p>To enable automation of account discovery and onboarding</p> Signup and view all the answers

    Which onboarding method is preferred when dealing with a large number of accounts?

    <p>Adding multiple accounts from a file</p> Signup and view all the answers

    What is the benefit of using Accounts Discovery with Automatic Onboarding Rules?

    <p>Streamlined onboarding process</p> Signup and view all the answers

    What is the primary purpose of the Discovery and Audit (DNA) method?

    <p>To discover and audit existing accounts</p> Signup and view all the answers

    What is the benefit of using Continuous Accounts Discovery?

    <p>Reduced administrative burden</p> Signup and view all the answers

    What is the main purpose of the Add Account method in onboarding accounts?

    <p>To add an account when the target Safe and Platform are known</p> Signup and view all the answers

    Which method is used to upload discovered accounts to the Pending Safe?

    <p>Add Discovered Accounts</p> Signup and view all the answers

    What is the purpose of the Add Discovered Accounts method?

    <p>To upload discovered accounts to the Pending Safe or onboard the accounts directly via automatic onboarding rules</p> Signup and view all the answers

    How many main REST methods are relevant for the process of onboarding accounts?

    <p>3</p> Signup and view all the answers

    What is the purpose of automatic onboarding rules in the Add Discovered Accounts method?

    <p>To onboard the accounts directly</p> Signup and view all the answers

    What are the three main REST methods relevant for onboarding accounts?

    <p>Add Account, Add Discovered Accounts, Create Bulk Upload of Accounts</p> Signup and view all the answers

    What is the purpose of RDP over SSL in the PSM flow?

    <p>To connect to Windows Servers securely</p> Signup and view all the answers

    How does the Privileged Session Manager enhance privileged access control?

    <p>By isolating privileged sessions for added security</p> Signup and view all the answers

    What is the purpose of fetching credentials from the Vault?

    <p>To authenticate to privileged sessions securely</p> Signup and view all the answers

    What is the benefit of integrating with SIEM and PTA?

    <p>To monitor and analyze privileged access in real-time</p> Signup and view all the answers

    What is the purpose of the Vault in the PSM flow?

    <p>To manage and secure privileged credentials</p> Signup and view all the answers

    What is the purpose of logging and auditing in the PSM flow?

    <p>To monitor and analyze privileged access for compliance</p> Signup and view all the answers

    What is the primary benefit of using PSM in the given diagram?

    <p>To provide complete isolation of target systems</p> Signup and view all the answers

    What is the purpose of the Vault in the given diagram?

    <p>To manage privileged credentials for target systems</p> Signup and view all the answers

    What happens to logs in the given diagram?

    <p>They are forwarded to SIEM and PTA for analysis</p> Signup and view all the answers

    What is the primary purpose of using RDP over SSL in the given diagram?

    <p>To provide secure connections to Windows/UNIX servers</p> Signup and view all the answers

    What is the benefit of using PSM with the Vault?

    <p>It reduces the risk of credential exposure to users</p> Signup and view all the answers

    What is the primary benefit of integrating with SIEM/PTA in the given diagram?

    <p>It enables real-time analysis and threat detection</p> Signup and view all the answers

    What is the primary purpose of the PSM for SSH?

    <p>To enable privileged access control</p> Signup and view all the answers

    What happens after the user opens an SSH session to the PSM server?

    <p>PSM retrieves privileged account password from the vault</p> Signup and view all the answers

    What is the purpose of the Vault in the given diagram?

    <p>To store privileged account passwords</p> Signup and view all the answers

    What is the benefit of using PSM for SSH?

    <p>Improved security through session isolation</p> Signup and view all the answers

    What is the purpose of logging in the given diagram?

    <p>To forward logs to SIEM and PTA</p> Signup and view all the answers

    What is the role of PSM in the given diagram?

    <p>To manage privileged access control</p> Signup and view all the answers

    What is the benefit of integrating PSM with SIEM and PTA?

    <p>Enhanced monitoring and analysis of SSH sessions</p> Signup and view all the answers

    What is the primary purpose of the PSM connection?

    <p>To establish an SSH session to the target using the privileged account</p> Signup and view all the answers

    What can be viewed using the PSM for SSH?

    <p>Live session audit</p> Signup and view all the answers

    What action can the PSM take when notified by PTA or a third-party threat analytics tool?

    <p>Suspend or terminate sessions</p> Signup and view all the answers

    What can authorized users do with active sessions using the PSM?

    <p>Participate in controlling sessions and suspend or terminate them</p> Signup and view all the answers

    What protocol is being used for remote desktop connection in the given diagram?

    <p>RDP</p> Signup and view all the answers

    What is the purpose of the PSM in the given diagram?

    <p>To monitor and control active sessions</p> Signup and view all the answers

    What is the purpose of the PVWA interface in the given diagram?

    <p>To manage privileged sessions</p> Signup and view all the answers

    What is the unit of measurement for the average bit rate of recorded sessions?

    <p>KB/min</p> Signup and view all the answers

    What is the formula to calculate the required storage on the PSM Server?

    <p>SPSM = Csession * tsession * Rsession + 20GB</p> Signup and view all the answers

    What is the average length of a recorded session used in the example calculation?

    <p>180 minutes</p> Signup and view all the answers

    What is the required storage on the Vault Server calculated based on?

    <p>Retention history requirement and average number of recorded sessions per day</p> Signup and view all the answers

    What is the purpose of the calculation for the required storage on the PSM Server?

    <p>To determine the required storage for recorded sessions</p> Signup and view all the answers

    What is the result of the calculation for the required storage on the Vault Server?

    <p>1.96 TB</p> Signup and view all the answers

    Where can PSM video and text recordings be stored?

    <p>In an external storage device</p> Signup and view all the answers

    What is the purpose of monitoring privileged session recordings?

    <p>To identify security breaches</p> Signup and view all the answers

    What is the primary benefit of using the Vault for storage?

    <p>Improved security</p> Signup and view all the answers

    What can be monitored using the PSM?

    <p>Both active and recorded sessions</p> Signup and view all the answers

    What is the primary function of the PSM in the context of the Vault?

    <p>To create video and text recordings</p> Signup and view all the answers

    What is the primary benefit of using the PSM for SSH?

    <p>Improved security</p> Signup and view all the answers

    What can be managed using the PSM?

    <p>Both privileged session recordings and active sessions</p> Signup and view all the answers

    What is the primary purpose of privileged session management?

    <p>To prevent unauthorized access</p> Signup and view all the answers

    What is the primary function of the CyberArk Privileged Threat Analytics?

    <p>To detect and respond to suspicious activities</p> Signup and view all the answers

    What is the benefit of using CyberArk Privileged Threat Analytics?

    <p>Speedy response and automated containment</p> Signup and view all the answers

    What type of data does CyberArk Privileged Threat Analytics collect?

    <p>Data from a wide variety of sources</p> Signup and view all the answers

    What is the purpose of the ALERT feature in CyberArk Privileged Threat Analytics?

    <p>To notify security teams with detailed event information</p> Signup and view all the answers

    What is the primary goal of CyberArk Privileged Threat Analytics?

    <p>To detect and respond to suspicious activities</p> Signup and view all the answers

    What is the significance of real-time analytics in CyberArk Privileged Threat Analytics?

    <p>It enables rapid identification and detection of suspicious activities</p> Signup and view all the answers

    What is the primary purpose of modifying and adding rules for suspicious session activities in CyberArk?

    <p>To tailor the detection of threats to the organization's specific needs</p> Signup and view all the answers

    What is the function of the Category field in defining a rule in CyberArk?

    <p>To categorize the type of session activity being monitored</p> Signup and view all the answers

    What is the role of the Security Team in the Session Analysis and Response Life Cycle?

    <p>To perform manual response and risk review</p> Signup and view all the answers

    What is the purpose of the demos featured in the 'Demos' section?

    <p>To review recorded demos of threat detection and automatic response</p> Signup and view all the answers

    What is the primary benefit of using a customized set of rules for suspicious session activities in CyberArk?

    <p>To tailor the detection of threats to the organization's specific needs</p> Signup and view all the answers

    What is the primary objective of Privileged Threat Analytics (PTA)?

    <p>To detect and respond to privileged threats</p> Signup and view all the answers

    What is the purpose of the Threat Score in defining a rule in CyberArk?

    <p>To assign a severity rating to the rule</p> Signup and view all the answers

    What type of data sources are used by Privileged Threat Analytics (PTA)?

    <p>Various data sources, including network traffic, logs, and system events</p> Signup and view all the answers

    What is the primary benefit of configuring automatic responses in PTA?

    <p>To improve the speed of threat response</p> Signup and view all the answers

    What is the primary goal of session analysis in PTA?

    <p>To detect anomalies in user behavior</p> Signup and view all the answers

    What is the primary risk associated with unmanaged target accounts and servers?

    <p>All of the above</p> Signup and view all the answers

    What is the primary benefit of using real-time analytics in PTA?

    <p>Improved threat detection</p> Signup and view all the answers

    What is the primary purpose of threat profiling in PTA?

    <p>To identify high-risk users and systems</p> Signup and view all the answers

    What is the primary benefit of integrating PTA with Active Directory Security?

    <p>Enhanced threat detection and response</p> Signup and view all the answers

    What is the primary purpose of the Privileged Accounts Inventory Report?

    <p>To provide information about all the accounts in the system</p> Signup and view all the answers

    What is the main difference between Operational reports and Audit/Compliance reports?

    <p>Operational reports are used for daily operations, while Audit/Compliance reports are used for compliance and auditing</p> Signup and view all the answers

    What can be done with finished reports?

    <p>They can be downloaded in Excel or CSV formats</p> Signup and view all the answers

    What is the purpose of the Refresh button in report status?

    <p>To see if a report has been generated</p> Signup and view all the answers

    What information is provided by the Applications Inventory Report?

    <p>Information about application IDs in the system</p> Signup and view all the answers

    What is the benefit of adding subscribers to a report?

    <p>It allows subscribers to receive notifications by email when the report is generated</p> Signup and view all the answers

    What type of report is an Entitlement Report categorized as?

    <p>PVWA Report</p> Signup and view all the answers

    Which type of report provides information about Privileged Accounts?

    <p>Privileged Accounts Inventory</p> Signup and view all the answers

    What is the main focus of the Compliance Status report?

    <p>Privileged Accounts compliance</p> Signup and view all the answers

    Which report provides a record of all activities performed in the system?

    <p>Activity Log Report</p> Signup and view all the answers

    Which type of report would be of interest to Vault Admins?

    <p>PrivateArk Reports</p> Signup and view all the answers

    What is the main focus of the Applications Inventory report?

    <p>Application inventory management</p> Signup and view all the answers

    What type of report can be generated using the EVD Utility?

    <p>Privileged Accounts Inventory</p> Signup and view all the answers

    What is required to run different reports in PrivateArk Client?

    <p>Specific permissions</p> Signup and view all the answers

    What type of report provides a list of all users in the system?

    <p>Users List Report</p> Signup and view all the answers

    Which application can be used to generate various reports, including the Privileged Accounts Inventory report?

    <p>All of the above</p> Signup and view all the answers

    What type of report provides information on the compliance status of privileged accounts?

    <p>Compliance Status Report</p> Signup and view all the answers

    What is the primary purpose of generating reports using the PVWA and PrivateArk Client?

    <p>To generate reports on privileged accounts</p> Signup and view all the answers

    What type of report provides a list of all safes in the system?

    <p>Safes List Report</p> Signup and view all the answers

    What is the primary benefit of generating reports using the PVWA and PrivateArk Client?

    <p>Better management of privileged accounts</p> Signup and view all the answers

    What is the primary deployment model of PAM Self-Hosted?

    <p>Entirely on-premises installation</p> Signup and view all the answers

    What is a key benefit of PAM Self-Hosted?

    <p>Total ownership and control by the customer</p> Signup and view all the answers

    What is the primary concern for scalability planning in PAM Self-Hosted?

    <p>Scaling to meet increasing user demands</p> Signup and view all the answers

    What is a key infrastructure requirement for PAM Self-Hosted?

    <p>All of the above</p> Signup and view all the answers

    What is a primary security consideration for PAM Self-Hosted?

    <p>All of the above</p> Signup and view all the answers

    What is a key benefit of PAM Self-Hosted in terms of high availability?

    <p>Increased uptime and reduced downtime</p> Signup and view all the answers

    What is the primary purpose of the Vault in the provided architecture?

    <p>To store and manage privileged credentials</p> Signup and view all the answers

    What is the benefit of deploying the Vault in a High Availability (HA) cluster configuration?

    <p>To ensure the availability of the Vault in the event of a failure</p> Signup and view all the answers

    What is the role of the Central Policy Manager (CPM) in the provided architecture?

    <p>To manage and configure policies for the IT environment</p> Signup and view all the answers

    What is the primary consideration when deploying the CyberArk architecture in a distributed environment?

    <p>Planning for scalability and high availability</p> Signup and view all the answers

    What is the primary benefit of using a hierarchical encryption model in the CyberArk architecture?

    <p>Improved security of the Vault</p> Signup and view all the answers

    What is the primary reason for implementing a disaster recovery (DR) site in the provided architecture?

    <p>To ensure business continuity in the event of a disaster</p> Signup and view all the answers

    What is the primary function of the Central Policy Manager?

    <p>Performs password changes on devices</p> Signup and view all the answers

    What is the purpose of the Privileged Session Manager?

    <p>To isolate and monitor privileged account activity</p> Signup and view all the answers

    What is the primary benefit of using a Password Vault?

    <p>To store and manage privileged account information securely</p> Signup and view all the answers

    What is the function of the Secure Digital Vault?

    <p>To store privileged account information securely</p> Signup and view all the answers

    What is the role of the Privilege Threat Analytics?

    <p>To monitor and detect malicious privileged account behavior</p> Signup and view all the answers

    What is the purpose of the Password Vault Web Access?

    <p>To provide a web interface for users to access privileged account information</p> Signup and view all the answers

    What is the primary function of the Central Policy Manager in the context of the Vault?

    <p>To configure policies and perform password changes on devices</p> Signup and view all the answers

    What is the primary benefit of using a Privileged Session Manager in the context of the Vault?

    <p>To isolate and monitor privileged account activity</p> Signup and view all the answers

    Where are the Safes in the Vault stored?

    <p>In the Data sub-directory</p> Signup and view all the answers

    What is the purpose of the Credential File in the Replicator utility?

    <p>To authenticate to the Vault server</p> Signup and view all the answers

    What is essential to back up regularly in the Vault?

    <p>Both the Data and Metadata folders</p> Signup and view all the answers

    What is the command used to launch a backup at a command line?

    <p>PAReplicate.exe vault.ini /logonfromfile user.ini /FullBackup</p> Signup and view all the answers

    What is a requirement for integrating with an Enterprise Backup Solution?

    <p>Policy requires integration</p> Signup and view all the answers

    What is the purpose of the Vault.ini file?

    <p>To give the Replicator utility the network address of the Vault server</p> Signup and view all the answers

    What can be backed up and restored in the Vault?

    <p>Both a single Safe to a Vault and a complete Vault's data and metadata</p> Signup and view all the answers

    Where are database files stored in the Vault?

    <p>In the Metadata sub-directory</p> Signup and view all the answers

    What is the purpose of enabling the Backup user?

    <p>To enable the Replicator utility to backup data</p> Signup and view all the answers

    What is the purpose of setting a password on the Primary Vault?

    <p>To secure the Primary Vault</p> Signup and view all the answers

    What is the name of the solution that replicates data?

    <p>Replicate Utility</p> Signup and view all the answers

    What is the purpose of the Replicator module?

    <p>To replicate data to a backup folder</p> Signup and view all the answers

    What is a key requirement for the backup server when using the Replicate Utility?

    <p>It must have the same disk space as the Vault database on an NTFS volume</p> Signup and view all the answers

    What is the recommended approach to backing up the Vault using the Replicate Utility?

    <p>Install the Replicate Utility on a separate server on the network</p> Signup and view all the answers

    Why is the Indirect Backup method recommended over the Direct Backup method?

    <p>It reduces the risk of introducing an external application to the Vault</p> Signup and view all the answers

    What is a necessary feature of the backup server when using the Replicate Utility?

    <p>It must have accessibility by the enterprise backup system</p> Signup and view all the answers

    What is a key benefit of using the Replicate Utility for backup and restore?

    <p>It enables integration with enterprise backup systems</p> Signup and view all the answers

    What is a key consideration when installing the Replicate Utility on a separate server?

    <p>The server must have physical security that only permits authorized users</p> Signup and view all the answers

    What is the role of the Replicate Utility in the backup and restore process?

    <p>It pulls Vault data as encrypted files to the backup server</p> Signup and view all the answers

    What is a necessary step before installing the Replicate Utility?

    <p>Ensure the backup server meets the necessary requirements</p> Signup and view all the answers

    What is the recommended approach to avoid data loss during replication?

    <p>Save audit data via the activity log</p> Signup and view all the answers

    What is the purpose of using a DNS Alias for the Vaults?

    <p>To control which Vault is used by the components</p> Signup and view all the answers

    What is the primary goal of automatic failover in PVWA setup?

    <p>To allow users to access passwords without interruption</p> Signup and view all the answers

    What is the risk associated with not saving audit data during replication?

    <p>Data loss</p> Signup and view all the answers

    What is the purpose of using a Disaster Recovery Environment?

    <p>To provide a backup Vault in case of failure</p> Signup and view all the answers

    What is the primary benefit of using a Primary Vault Synchronization?

    <p>To ensure consistency across all Vaults</p> Signup and view all the answers

    What is the purpose of the CheckInterval parameter in automatic failover?

    <p>To indicate the time it takes for the DR Vault to contact the Primary Vault</p> Signup and view all the answers

    What happens when the DR Vault is unable to contact the Primary Vault after the retry attempts?

    <p>The DR Vault goes into DR mode</p> Signup and view all the answers

    What is the purpose of setting EnableFailover to No in manual failover?

    <p>To disable automatic failover</p> Signup and view all the answers

    What is required to perform a manual failover?

    <p>Setting ActivateManualFailover to Yes and restarting the DR service</p> Signup and view all the answers

    What is the sequence of events in the failover process?

    <p>Connection fails, retry attempts, failover started, data synchronization</p> Signup and view all the answers

    What is the purpose of EnableDbsync in manual failover?

    <p>To enable data synchronization</p> Signup and view all the answers

    What is the default setting for EnableDbsync in manual failover?

    <p>Yes</p> Signup and view all the answers

    What happens when the DR service is restarted with ActivateManualFailover set to Yes?

    <p>The service reads the config file and starts the failover process</p> Signup and view all the answers

    What occurs when a failover takes place in the Disaster Recovery Environment?

    <p>The DR service first synchronizes the information in its database with the Safe data files</p> Signup and view all the answers

    What is the default setting for the EnableDbsync parameter in the padr.ini file?

    <p>EnableDbsync=Yes</p> Signup and view all the answers

    What determines the length of time between synchronizations of the Vault file system?

    <p>The ReplicateInterval parameter</p> Signup and view all the answers

    What is the primary purpose of the DR service in the Disaster Recovery Environment?

    <p>To synchronize the information in its database with the Safe data files</p> Signup and view all the answers

    What is the default time interval for synchronizing the Vault file system?

    <p>3,600 seconds (or 1 hour)</p> Signup and view all the answers

    What is the purpose of the Primary Vault in the Disaster Recovery Environment?

    <p>To synchronize the information in its database with the DR Vault</p> Signup and view all the answers

    What is the primary function of the Server Key in the CyberArk PAM solution?

    <p>To install and operate CyberArk PAM</p> Signup and view all the answers

    What type of encryption is used to protect the keys in the Vault?

    <p>AES-256</p> Signup and view all the answers

    What is the purpose of the Recovery Private Key in the CyberArk PAM solution?

    <p>To recover encrypted vault objects</p> Signup and view all the answers

    How are vault objects encrypted in the CyberArk PAM solution?

    <p>Using a hierarchical encryption model</p> Signup and view all the answers

    What is the purpose of encrypting the key in the Vault?

    <p>To protect the key from unauthorized access</p> Signup and view all the answers

    What is the primary function of the Recovery Public Key in the CyberArk PAM solution?

    <p>To recover encrypted vault objects</p> Signup and view all the answers

    What is the purpose of the three files that form the cornerstone of the CyberArk PAM solution encryption methodology?

    <p>To install and operate CyberArk PAM</p> Signup and view all the answers

    What is the benefit of using a secure platform in the Vault?

    <p>To reduce the risk of key exposure</p> Signup and view all the answers

    What is the purpose of access control in the Vault?

    <p>To restrict access to authorized personnel</p> Signup and view all the answers

    What is the benefit of using digital vault configuration?

    <p>To increase the security of the Vault</p> Signup and view all the answers

    What is the purpose of encryption in the Vault?

    <p>To protect the data from unauthorized access</p> Signup and view all the answers

    What is the benefit of using granular permissions in the Vault?

    <p>To restrict access to sensitive data</p> Signup and view all the answers

    What is the purpose of the Vault's security controls?

    <p>To protect the Vault from external threats</p> Signup and view all the answers

    What is the benefit of using a hierarchical encryption model?

    <p>To increase the security of the Vault</p> Signup and view all the answers

    What is the purpose of the firewall in the Vault's security architecture?

    <p>To protect the Vault from external threats and unauthorized access</p> Signup and view all the answers

    What is the benefit of using a Hierarchical Encryption Model in the Vault?

    <p>It provides a unique encryption key for each object</p> Signup and view all the answers

    What is the primary purpose of Access Control in the Vault?

    <p>To restrict access to authorized users and roles</p> Signup and view all the answers

    What is the role of the Proprietary Protocol in the Vault's security architecture?

    <p>It provides a secure connection for encrypting data</p> Signup and view all the answers

    What is the primary benefit of using Granular Permissions in the Vault?

    <p>It enables more granular access control to sensitive data</p> Signup and view all the answers

    What is the purpose of Auditing in the Vault's security architecture?

    <p>To detect and respond to security incidents</p> Signup and view all the answers

    What is the primary function of the Firewall in the given diagram?

    <p>To control access to the Vault</p> Signup and view all the answers

    What type of encryption model is used in the Hierarchical Encryption Model?

    <p>Multi-layer encryption</p> Signup and view all the answers

    What is the primary benefit of using Granular Permissions in the Vault?

    <p>Fine-grained control over access</p> Signup and view all the answers

    What is the primary purpose of Auditing in the given diagram?

    <p>To track and monitor access to the Vault</p> Signup and view all the answers

    What is the recommended factor of authentication in the given diagram?

    <p>Two factor</p> Signup and view all the answers

    What is the primary purpose of the Proprietary Protocol in the Vault?

    <p>To provide an additional security layer</p> Signup and view all the answers

    What is the purpose of the Server Key in CyberArk PAM?

    <p>To operate CyberArk PAM</p> Signup and view all the answers

    What type of encryption is used in the Vault Object Encryption mechanism?

    <p>AES-256</p> Signup and view all the answers

    What is the role of the Recovery Public Key in CyberArk PAM?

    <p>To recover private keys</p> Signup and view all the answers

    What is the purpose of the Recovery Private Key in CyberArk PAM?

    <p>To recover private keys</p> Signup and view all the answers

    What are the three files required to install and operate CyberArk PAM?

    <p>Server Key, Recovery Public Key, and Recovery Private Key</p> Signup and view all the answers

    What is the primary purpose of the encryption methodology in CyberArk PAM?

    <p>To protect Vault objects</p> Signup and view all the answers

    What is the primary goal of security controls protecting the Vault and encryption keys?

    <p>To ensure data integrity and confidentiality</p> Signup and view all the answers

    What is the primary benefit of using a hierarchical encryption model in the Vault?

    <p>To simplify key management</p> Signup and view all the answers

    What is the role of permissions in the Vault's access control layer?

    <p>To control access to the Vault</p> Signup and view all the answers

    What is the primary purpose of encrypting the key with a 3rd-party tool in the Vault?

    <p>To protect the key from unauthorized access</p> Signup and view all the answers

    What is the primary risk associated with unmanaged target accounts and servers in the Vault?

    <p>Unauthorized access to sensitive data</p> Signup and view all the answers

    What is the primary benefit of using granular permissions in the Vault's access control layer?

    <p>To control access to sensitive data</p> Signup and view all the answers

    What is the primary purpose of the Vault in the context of Privileged Account Management?

    <p>To provide secure access to privileged accounts</p> Signup and view all the answers

    What is the primary goal of encryption mechanisms in the Vault?

    <p>To protect data at rest and in transit</p> Signup and view all the answers

    What are the methods used to monitor system health?

    <p>REST, Email, SIEM, SNMP</p> Signup and view all the answers

    What administrative task is related to system maintenance?

    <p>Monitoring replication and DR status</p> Signup and view all the answers

    What is monitored in terms of replication and DR status?

    <p>Replication and DR status</p> Signup and view all the answers

    What is the primary goal of monitoring system health?

    <p>To detect system failures</p> Signup and view all the answers

    What are the different ways to monitor components?

    <p>REST, Email, SIEM, SNMP</p> Signup and view all the answers

    What is the benefit of monitoring system health?

    <p>To detect system failures</p> Signup and view all the answers

    What is the purpose of the Remote Control Agent?

    <p>To execute tasks on a Vault component</p> Signup and view all the answers

    What information can be received through the Remote Monitoring feature?

    <p>Both Operating System and Vault component-specific information</p> Signup and view all the answers

    What is required to be installed on the same computer as the Remote Control Agent?

    <p>None of the above</p> Signup and view all the answers

    What is the purpose of the MIB files provided by CyberArk?

    <p>To describe the SNMP notifications sent by the Vault</p> Signup and view all the answers

    What is the function of the Remote Control feature in the Vault?

    <p>To carry out remote operations on the Vault and its components</p> Signup and view all the answers

    What is the benefit of using the Remote Monitoring feature?

    <p>To monitor the Operating System and Vault information remotely</p> Signup and view all the answers

    What is the ID of the email template that can be customized for component monitoring?

    <p>206</p> Signup and view all the answers

    Where can you configure the monitoring interval for a component?

    <p>dbparm.ini</p> Signup and view all the answers

    What is the purpose of the ComponentMonitoringInterval parameter?

    <p>To set the monitoring interval for a component</p> Signup and view all the answers

    What determines the actions taken when a component is disconnected?

    <p>ComponentNotificationThreshold</p> Signup and view all the answers

    What is the result of enabling email notifications for a component?

    <p>Vault Admins will receive a notification in their inbox</p> Signup and view all the answers

    What is used to monitor components via SNMP?

    <p>Remote Control Agent</p> Signup and view all the answers

    Where can you enable monitoring of a specific CyberArk component user account?

    <p>PrivateArk Client</p> Signup and view all the answers

    What is the purpose of the General tab in the PrivateArk Client?

    <p>To check the box for sending email notifications</p> Signup and view all the answers

    What is the purpose of creating a shadow user?

    <p>To run connection components and store user preferences</p> Signup and view all the answers

    What is the primary function of AppLocker in PSM?

    <p>To define a set of rules that allow or deny applications from running</p> Signup and view all the answers

    What should you do to isolate problems related to shadow users?

    <p>Run the component manually as the shadow user</p> Signup and view all the answers

    How do you disable AppLocker entirely?

    <p>By setting Executable Rules to Audit Only in the MMC snap-ins</p> Signup and view all the answers

    What is the recommended approach when adding a new component in PSM?

    <p>Adjust AppLocker by adding an exception to PSMConfigureApplocker.xml</p> Signup and view all the answers

    What should you do to the PSMConfigureApplocker.ps1 script?

    <p>Run it to adjust AppLocker</p> Signup and view all the answers

    What happens to a user who fails to log in 5 times?

    <p>The user is suspended</p> Signup and view all the answers

    How can a user be unsuspended after being locked out?

    <p>Automatically after a set time period</p> Signup and view all the answers

    What is the purpose of the UserLockoutPeriodInMinutes parameter?

    <p>To configure the timeout period for automatic unsuspend</p> Signup and view all the answers

    Why did the user's login attempt fail?

    <p>The user's password was changed recently</p> Signup and view all the answers

    What can the Vault administrator see in the ITAlog?

    <p>The user's failed login attempts</p> Signup and view all the answers

    What happens when a user's account is suspended?

    <p>The user is temporarily locked out</p> Signup and view all the answers

    Who can see the ITAlog?

    <p>Only the Vault administrator</p> Signup and view all the answers

    What is the result of a user's failed login attempt?

    <p>The user is suspended</p> Signup and view all the answers

    Where is the CreateCredFile.exe command located?

    <p>C:\Program Files\CyberArk\Password Manager\Vault</p> Signup and view all the answers

    What can cause interference with the CPM?

    <p>Local Computer Policy</p> Signup and view all the answers

    What is the purpose of the VaultPermissionsValidation.sh script?

    <p>To resynch the credentials for the PTA Vault users</p> Signup and view all the answers

    What is the command to run to resynch the credentials for the PTA Vault users?

    <p>VaultPermissionsValidation.sh</p> Signup and view all the answers

    What is the alias to navigate to the utility folder on the PTA server?

    <p>UTILITYDIR</p> Signup and view all the answers

    What can be done to resolve PTA connectivity issues?

    <p>Resynch the credentials for the PTA Vault users</p> Signup and view all the answers

    What is the primary reason for disabling Network Level Authentication (NLA) in a PSM-RDP connection?

    <p>To determine if it's causing the connection problem</p> Signup and view all the answers

    How can you manually test the PSMConnect user in a PSM-RDP connection?

    <p>By doing all of the above</p> Signup and view all the answers

    Where can you disable Network Level Authentication (NLA) in a Target Windows Account?

    <p>In the Control Panel → System and Security → System → Remote Settings</p> Signup and view all the answers

    What is the recommended approach to resolve issues with overloaded environments in a PSM connection?

    <p>Increasing the timeout values</p> Signup and view all the answers

    What is the primary purpose of checking the PSM Protocol version in a PSM connection?

    <p>To understand the problem with the PSM connection</p> Signup and view all the answers

    Why is it recommended to compare safe permissions with other safes in a PSM connection?

    <p>To ensure safe permissions are correctly configured</p> Signup and view all the answers

    What is the purpose of shadow users in PSM?

    <p>To run connection components and store user preferences</p> Signup and view all the answers

    What is the recommended approach to troubleshoot issues with PSM-RDP connections?

    <p>Run the component manually using the shadow user and adjust AppLocker rules</p> Signup and view all the answers

    How can AppLocker be adjusted to allow a new component to run on the PSM machine?

    <p>By uncommenting the line relating to the new component in PSMConfigureApplocker.xml</p> Signup and view all the answers

    What is the purpose of the AppLocker feature in Windows?

    <p>To define a set of rules that allow or deny applications from running on the PSM machine</p> Signup and view all the answers

    What is the result of deleting a shadow user on the PSM machine?

    <p>The PSM will create a new shadow user</p> Signup and view all the answers

    How can AppLocker be disabled on the PSM machine?

    <p>By using the MMC snap-ins to set Executable Rules to Audit Only</p> Signup and view all the answers

    What is the purpose of running the component manually as the shadow user?

    <p>To isolate problems related to PSM-RDP connections</p> Signup and view all the answers

    Why would you adjust AppLocker rules on the PSM machine?

    <p>To allow a new component to run on the PSM machine</p> Signup and view all the answers

    When troubleshooting Target Windows Accounts, what command can be used to verify the connection?

    <p>net use \/IPC$ /user:\</p> Signup and view all the answers

    In PSM-RDP Connection troubleshooting, what is an important aspect to consider?

    <p>PSM server hardening</p> Signup and view all the answers

    What can be checked in the Local Security Settings when troubleshooting Target Windows Accounts?

    <p>Unusual Local Security Settings</p> Signup and view all the answers

    What is a suggested troubleshooting step for Target Unix Accounts?

    <p>Run 'plink' command manually</p> Signup and view all the answers

    What is a common issue related to PSM?

    <p>PSM-RDP Connection issues</p> Signup and view all the answers

    When troubleshooting Target Windows Accounts, what can be added to the CPM server?

    <p>DEP exceptions</p> Signup and view all the answers

    What is the primary requirement for the basic troubleshooting methodology in the CyberArk environment?

    <p>Knowledge of the system implementation</p> Signup and view all the answers

    What is the recommended practice when troubleshooting issues in the CyberArk environment?

    <p>Write down all information gathered during the process</p> Signup and view all the answers

    What is the purpose of managing log files in the CyberArk environment?

    <p>To troubleshoot issues in the Vault</p> Signup and view all the answers

    What is the xRay agent used for in the CyberArk environment?

    <p>To troubleshoot issues in the Vault</p> Signup and view all the answers

    What is the primary goal of the troubleshooting methodology in the CyberArk environment?

    <p>To provide guidance for troubleshooting</p> Signup and view all the answers

    What is the importance of understanding the system implementation in the CyberArk environment?

    <p>It is essential for troubleshooting</p> Signup and view all the answers

    Where are CPM exceptions written to by default?

    <p>The trace log</p> Signup and view all the answers

    Where can you configure the Debug Level for CPM troubleshooting?

    <p>The web.config file</p> Signup and view all the answers

    What file would you check for CPM CASOS errors?

    <p>pm-error.log</p> Signup and view all the answers

    Where can you configure the logging level for PVWA troubleshooting?

    <p>PVWA administration tab</p> Signup and view all the answers

    What type of log files are stored in the \Program Files\CyberArk\PasswordManager\Logs\ThirdParty directory?

    <p>Plug-in log files</p> Signup and view all the answers

    Where can you find CyberArk Web application logs?

    <p>%windir%\temp\</p> Signup and view all the answers

    What is the purpose of the Debug Level setting in the web.config file?

    <p>To customize the logging level for CPM troubleshooting</p> Signup and view all the answers

    Where can the configuration file for the Central Password Manager be found?

    <p>Vault ➔ Safe “Password Manager”➔ root\policies.ini</p> Signup and view all the answers

    What is the default debug level for the Central Password Manager?

    <p>2</p> Signup and view all the answers

    Where can the logs for the Privileged Session Manager be found?

    <p>\Logs (and subfolders) or according to the 'LogsFolder' parameter</p> Signup and view all the answers

    Where can the server settings for the Privileged Session Manager be configured?

    <p>PVWA ➔ System tab ➔ Options ➔ Privileged Session Management</p> Signup and view all the answers

    What is the purpose of the TraceLevels setting in the Privileged Session Manager?

    <p>To configure the debug level for the PSM</p> Signup and view all the answers

    Where can the General Settings for the Privileged Session Manager be configured?

    <p>PVWA ➔ System tab ➔ Options ➔ Privileged Session Management ➔ General Settings</p> Signup and view all the answers

    What is the primary function of Privileged Threat Analytics (PTA)?

    <p>To detect malicious activity caused by privileged accounts and contain in-progress attacks</p> Signup and view all the answers

    What is the benefit of using On-Demand Privileges Manager?

    <p>It provides a comprehensive solution for IT and enables complete visibility and control of super users and privileged accounts</p> Signup and view all the answers

    What is the primary responsibility of the Central Policy Manager (CPM)?

    <p>To perform password changes and SSH key rotations on devices based on policies</p> Signup and view all the answers

    What is the primary security feature of the Digital Vault?

    <p>It is implemented in compliance with the CyberArk Digital Vault Server security standard</p> Signup and view all the answers

    What is the primary function of the 'Discover' feature in the Central Policy Manager?

    <p>To automate privileged account discovery</p> Signup and view all the answers

    What is the purpose of the Privileged Session Manager?

    <p>To monitor and control privileged session access</p> Signup and view all the answers

    What is the primary benefit of using a Password Vault in the context of the Vault?

    <p>To monitor and control privileged session access</p> Signup and view all the answers

    Which operating system has an administrator account with the password 'tops3cr3t'?

    <p>Windows</p> Signup and view all the answers

    What is the primary function of the Central Policy Manager?

    <p>To define master policy exceptions</p> Signup and view all the answers

    What is the primary purpose of the PVWA interface?

    <p>To view reports</p> Signup and view all the answers

    What is the primary purpose of the Digital Vault Security?

    <p>To secure and protect privileged account information</p> Signup and view all the answers

    Which of the following is NOT a type of user account in the diagram?

    <p>Guest</p> Signup and view all the answers

    What is the primary purpose of Privileged Account Discovery?

    <p>To discover and manage privileged accounts across the organization</p> Signup and view all the answers

    What is the purpose of the security policy in the diagram?

    <p>To define access control</p> Signup and view all the answers

    What is the primary purpose of the IT department in the diagram?

    <p>To provide Enterprise IT Environment</p> Signup and view all the answers

    Study Notes

    CyberArk PAM Key Features

    • CyberArk PAM provides a comprehensive solution for discovering, isolating, recording, monitoring, and remediating privileged credentials and sessions.

    Discover and Manage Credentials

    • Automated processes for account discovery
    • Policies for managing credentials, including:
      • Password complexity
      • Rotation frequency
      • Others

    The Vault

    • A secure storage for credentials
    • Clients of the Vault include:
      • End users (IT staff, auditors, etc.)
      • Custom applications
      • Reporting tools
    • The Vault provides a centralized policy management system

    The Vault: End-to-End Security

    • Secure storage of credentials
    • Discretionary and mandatory access control
    • Encryption of sessions and files
    • Proprietary protocol and hardened built-in firewall
    • Single or two-factor authentication
    • Granular permissions and role-based access control
    • Subnet-based access control and time limits
    • Event-based alerts and tamper-proof audit trail
    • Hierarchical encryption model, with every object having a unique key

    User Management in PVWA

    • User management module introduced in PAM version 13, accessible through PVWA
    • Create and edit CyberArk users
    • Create groups and assign users to them
    • View all users (LDAP and CyberArk)
    • Disable or activate a suspended user
    • Reset a user's password

    Managing Users

    • Create new CyberArk users manually through PVWA
    • Edit CyberArk users through PVWA
    • Create groups and assign users to them through PVWA
    • Disable or activate a suspended user through PVWA
    • Reset a user's password through PVWA

    Changing Master Password

    • Change the Master user password by logging in as Master user and clicking User → Set Password

    User Management in PrivateArk Client

    • Manage users and groups via PrivateArk Client
    • Adding users: authorized interfaces, authentication, vault authorizations, group membership, and general tabs
    • Users stored in Vault database
    • Recommended to manage users with an external LDAP directory, such as Active Directory
    • Can manually create users via PrivateArk Client

    General Tab

    • Manually add new users through PrivateArk Client interface

    Authorized Interfaces

    • Select which interfaces a user can log in from

    Authentication

    • Select the authentication method for a user

    Vault Authorizations

    • Configure Vault authorizations for a user

    Group Membership

    • Select which groups a user is a member of

    User Management Overview

    • Users vs. Accounts: understand the differences between the two
    • Internal Users and Groups vs. Transparent Users and Groups: understand the differences between the two

    Platform Management

    • Platforms have three main functions: defining technical settings, pointing to relevant plug-ins and connection components, and basis for exceptions to the Master Policy.

    Platform Functions

    • Define password policy settings such as minimum length, forbidden characters, and more.
    • Manage how you log in and change a password on different target systems (e.g., Unix, Windows).

    Creating and Managing Platforms

    • Platforms are located under the Administration tab.
    • Platforms are grouped by target system type.
    • There are several dozen baseline platforms that function out of the box with little or no configuration.

    Duplicating Platforms

    • Duplicating a Platform is required when accounts of the same system type require different policies.
    • Example: Unix accounts in different regions need to be rotated on a different basis.

    Platform Naming Convention

    • Use a logical naming convention based on business rules (e.g., LIN SSH 30 indicates Linux accounts via SSH connections with 30-day password rotation).

    Editing Platform Settings

    • Select Edit to modify Platform settings (e.g., password policy settings).
    • Platforms are divided into two broad sections: UI & Workflows, and Automatic Password Management.

    Password Complexity

    • The Generate Password section controls password creation policy, including length, complexity, forbidden characters, and more.

    Activating/Deactivating Platforms

    • The Vault administrator can deactivate Platforms that are not currently relevant to your implementation, providing better administration and performance.

    Policy By Platform

    • The Platform Management page displays password management policies applied to different platforms.

    Summary

    • The general workflow when working with CyberArk PAM involves configuring key parameters in the Master Policy and Platforms.
    • Key parameters include password policy settings, plug-ins, and connection components.

    Granular Safe Permissions

    • In the Safe Members tab, users and groups with access to the Safe are displayed.
    • Members can be added and permissions assigned, managing access to accounts and passwords.

    Permissions

    • Permissions are organized into groups: Access, Account management, Safe management and monitoring, Workflow, and Advanced.

    Safe Naming

    • Safe names are limited to 28 characters and do not support double-byte characters.
    • A naming convention is recommended, such as P-BOS-SRV-WIN-LAD-HR for local admin accounts on HR production servers.

    Safe Constraints

    • The number of objects stored in a Safe should be limited to 20,000, including versions of passwords.
    • The recommended number of accounts or files stored in a Safe is between 3,000 and 5,000.

    Access Control

    • The principle of “least privilege” should be followed, storing objects in Safes according to need-to-know access.
    • Separate Safes are recommended for Windows Desktop Accounts, Windows Local Administrators, and Windows Domain Accounts.
    • Object-level access control is not recommended.

    Adding Safe Members

    • A new wizard streamlines the process of creating Safes and adding initial members.
    • Permission presets and user/group searching are available.

    Platforms and Safes

    • The AllowedSafes parameter can limit the scope of a platform to specific Safes using a regular expression pattern.
    • This helps improve CPM performance and simplifies administrative tasks.

    Accounts

    • Accounts store privileged account IDs and passwords in Safes
    • Examples of accounts include:
      • Domain administrators
      • Local administrators
      • Root accounts
      • Service accounts
    • Every account resides in a single Safe
    • Every account is associated with a single Target Account Platform

    Adding a Linux Account

    • To add a new Linux account, provide the following information:
      • Platform: LIN SSH 30
      • Safe: Lin-Fin-US
      • Master Policy:_Exception: Change password every 30 days
      • Username: logon01
      • Password: ****** (hidden for security)
      • Address: target-lin.acme.corp

    Account Management Operations

    • Central Policy Manager (CPM) manages passwords and SSH keys on devices based on policies set by Vault Administrators
    • CPM performs three actions:
      1. Password Verification: Confirms passwords in Vault match target system
      2. Password Change: Changes passwords automatically based on expiration period or user intervention
      3. Reconciliation of unknown or lost passwords: Process used when Vault password doesn't match target system

    Password Management Overview

    • CPM manages privileged accounts through three actions: Verification, Change, and Reconciliation
    • Verification confirms passwords in Vault match target system
    • Change updates passwords automatically or through user intervention
    • Reconciliation resolves unknown or lost passwords

    Verification Process

    • Scan Vault for Account
    • Login using current credentials
    • Notify Vault of success or failure

    Change Process

    • Scan Vault for Account
    • Login using current credentials
    • Generate new password
    • Connect and run change password
    • Store new credentials

    Push Private Keys to Application Servers

    • CyberArk PAM allows pushing private keys to application servers for SSH key authentication.

    Linked Accounts

    • There are two types of linked accounts commonly used and supported by default for most platforms:
      • Logon account
      • Reconcile account

    Logon Account

    • No additional information provided about logon accounts.

    Root Account Best Practices

    • Using a username "root" is not recommended as it compromises all systems that trust it if it is compromised.
    • SSH keys are more difficult to change than passwords.

    SSH Key Manager

    • Creates unique key-pairs for each target system.
    • Private keys are stored in the Vault, not on user workstations.
    • The CPM (Central Policy Manager) changes key-pairs often and automatically disseminates public keys to target systems.
    • End users retrieve the private key from the Vault to authenticate to the target system.

    Agenda and Objectives

    • By the end of this session, you will be able to:
      • Describe and configure linked accounts (logon accounts and reconcile accounts)
      • Describe and configure SSH key management

    Configuration File Management

    • Certain applications retrieve credentials from configuration files, which can be managed by the CPM.
    • Supported file types include plain text, INI files, XML files, and web configuration files.

    Config File Usage

    • Applications use configuration files to retrieve passwords for authentication.
    • When the CPM changes a password, it must also update the corresponding configuration file.

    Adding Config File Usage

    • To add a configuration file usage, the relevant usage must be added manually to the target account platform.
    • The parameter SearchForUsages must be enabled.

    Dependent Platforms

    • Dependent Platforms are used for managing Usages.
    • A usage refers to an instance where an account is used to perform a task somewhere else.

    Usages

    • The CPM can synchronize an account password with all other occurrences of the same password on the same server or anywhere in the network.
    • This is done through Usages, which are registered in CyberArk PAM.

    Scheduled Task Example

    • A scheduled task can be used to run a task with a specific account.
    • In this example, a local Windows user – sendmail01 – is used to run a scheduled task – SchedTask01.

    Adding Config File Usage (2)

    • The specific INI config file usage must be added to the relevant account.
    • The usage specifies the server address, full path to the INI file, and where in the file the password can be found.

    Configuration Files

    • When the CPM changes a password, it will also change the password in the corresponding configuration file.
    • The password can be encrypted using an external command.

    Logon Account

    • An extra account may be required to log onto the remote machine where the usage exists.
    • A logon account can be associated with the usage.

    Encrypting the Password in Config Files

    • Passwords stored in configuration files can be encrypted using an external command.
    • The encryption command and encryption regex parameters are used to handle the encryption process.

    Advanced Settings

    • End users can connect transparently using privileged accounts and are allowed by default to view passwords.
    • Users can specify a reason for access, which forces them to provide a reason why they are using a particular account.

    Privileged Account Request

    • The list of options for the drop-down is defined at the Platform level, so it can have a different set of reasons on a platform-by-platform basis.
    • Predefined Reasons can be added to create a list of choices for users when accessing a password in the PVWA.

    Dual Control

    • Dual control requires end users to get authorization before accessing privileged accounts.
    • Authorization must be given by one or more managers or peers, depending on the configuration.
    • Dual Control is controlled through Safe membership, where Requesters are the people who want to use the privileged accounts.
    • At least one person from each group with approver permissions must approve the request before the requester can use the password.

    Multi-Group Approval Process

    • If more than one group with approver permissions is set up, at least one person from each group must approve the request before the requester can use the password.
    • In advanced settings, a multi-level approval process can be enabled, where a request must first be approved by one group before it is forwarded for approval to another group.
    • Direct manager approval can be enabled, determined by the Manager attribute on the requester's AD user object.

    Exclusive Access

    • Exclusive access allows multiple users to access the password simultaneously.
    • The password is changed automatically upon manual release, and the system will release it automatically based on the Minimum validity period.
    • In later versions, the password can be auto-released by the PSM.

    Summary

    • The session covered five workflows: Allow transparent connections, Require users to specify reason for access, Dual Control, Exclusive Passwords, and One-time Passwords.

    PAM Web Services API

    • PAM Web Services API is a set of REST-based services running on the PVWA.
    • It allows scripts and applications to communicate with the Vault.
    • Used by CyberArk applications as well as third-party applications.
    • Enables organizations to develop custom interactions with the Vault to automate business processes.

    Discovery and Onboarding Methods

    • Discovery and Onboarding Methods include:
      • Add a single account
      • Add multiple accounts from file
      • Discovery and Audit (DNA)
      • Continuous Accounts Discovery
      • Accounts Discovery & Onboarding Rules
      • Rest API

    Onboarding Accounts

    • Onboarding accounts can be done using three main REST methods:
      • Add account
      • Add discovered accounts
      • Create bulk upload of accounts

    Add Account Method

    • Used when the target Safe and Platform are known to the onboarding utility.

    Add Discovered Accounts Method

    • Used by CyberArk discovery and upload mechanisms, as well as third-party discovery mechanisms.
    • Uploads discovered accounts (and dependencies) to the Pending Safe or onboards the accounts directly via automatic onboarding rules.

    PAM Administration

    • Involves Discovery and Onboarding.

    PSM Flow

    • PSM provides complete isolation of target systems, ensuring privileged credentials never reach users or their devices.
    • Connections can be made from Unix, Linux, Mac, or Windows end-user machines.
    • The PSM flow involves:
      • Logging on through PVWA
      • Connecting to PSM using RDP/TLS
      • Fetching credentials from Vault
      • Connecting using native protocols
      • Forwarding logs to SIEM and PTA
      • Storing session recordings

    PSM for Windows

    • The PSM for Windows flow involves:
      • Connecting to PSM using RDP/TLS
      • Fetching credentials from Vault
      • Connecting using native protocols
      • Forwarding logs to SIEM and PTA
      • Storing session recordings

    PSM for SSH

    • The PSM for SSH flow involves:
      • Opening an SSH session to the PSM server
      • Retrieving a privileged account password from the Vault
      • Opening an SSH session to the target using the privileged account
      • Forwarding logs to SIEM and PTA
      • Storing SSH session audits

    Summary

    • The Privileged Session Manager (PSM) features include:
      • PSM Connection Components
      • PSM Ad-Hoc Connections
      • PSM via HTML5 Gateway
      • PSM for Windows
      • PSM for SSH

    Active Session Monitoring (PSM)

    • PSM enables authorized users to monitor active sessions, take part in controlling these sessions, and suspend or terminate them.
    • PSM can automatically suspend or terminate sessions when notified by PTA or a third-party threat analytics tool.

    Active Session Monitoring (PSM for SSH)

    • It is not possible to monitor or control live PSM for SSH sessions, but it is possible to view the live session audit.
    • Recordings created by PSM for SSH are displayed in the classic interface.

    Monitor Active Sessions

    • Users can monitor active sessions using PVWA, HTTP/S, Unix, Administrator, RDP, and SSH (using putty).

    Sizing Calculations for the PSM Server

    • The required storage on the PSM Server (SPSM) is calculated using the formula: SPSM = Csession * tsession * Rsession recording + 20GB.
    • The average bit rate of recorded video for different sessions is:
      • 100 KB/min for average SSH session
      • 200 KB/min for average low activity RDP session
      • 300 KB/min for average high activity RDP session with rich wallpaper

    Sizing Calculations for the Vault Server

    • The required storage on the Vault Server (SVault) is calculated using the formula: SVault = tretention * Nsession * tsession * Rsession recording + 20GB.
    • The retention history requirement (tretention) is a factor in calculating the required storage.

    PAM Administration

    • The goal of this section is to enable participants to monitor and manage privileged session recordings, audits, and active sessions.
    • The participant will be able to monitor and manage privileged session recordings, audits, and active sessions upon completion of this session.

    Recordings

    • PSM and PSM for SSH create video and text recordings for privileged sessions and store them in the Vault.
    • Authorized users can view these recordings at any time.
    • Recordings can be stored in an external storage device.

    Configuring Rules

    • Rules are defined by category, pattern, session response, threat score, and scope
    • Categories include SSH, Universal Keystrokes, SCP, SQL, and Windows title
    • Patterns are regular expressions to be monitored
    • Session responses include Suspend, Terminate, and None
    • Threat score ranges from 1-100
    • Scope determines who or what the rule will apply to

    Session Analysis and Response Life Cycle

    • The life cycle includes analytics, define risks, alerts, automatic response, manual response, and risk review
    • The security team is involved in the manual response and risk review stage

    Privileged Threat Analytics

    • It quickly gathers and analyzes critical data
    • Enables speedy response and automated containment
    • Detects suspicious activities
    • Alerts security teams with detailed event information
    • Collects data from a wide variety of sources
    • Part of CyberArk's PAM administration

    Agenda

    • Describe the main functionality of Privileged Threat Analytics (PTA)
    • Describe the different data sources used by the PTA
    • Describe the different attacks and risks detected by the PTA
    • Describe the alert flow by the PTA
    • Configure and test PTA automatic responses
    • Describe the session analysis and response flow

    Report Categories

    • There are two categories of reports: Operational reports and Audit/Compliance reports.

    Filter Options

    • Each type of report has differing filtering criteria.

    Scheduling Reports

    • Reports can be run immediately, saved, or scheduled to run on a regular basis.
    • Subscribers can be added to receive notifications by email when the report is generated, containing a link to the report.

    Report Status

    • The Refresh button can be used to check if a report has been generated.

    Finished Reports

    • Reports can be downloaded in Excel or CSV formats.

    Report Types

    • PrivateArk Reports are of interest to Vault Admins and include:
      • License capacity of the system
      • Lists of Users
      • Active/Non-active Users
      • Safes List
      • Active/Non-active Safes
    • PVWA Reports are of interest to Auditors and include:
      • Privileged Accounts Inventory
      • Applications Inventory
      • Privileged Accounts Compliance Status
      • Entitlement Report
      • Activity Log

    Report Generation

    • Reports can be generated using the PVWA and the PrivateArk Client.
    • The Export Vault Data (EVD) Utility can be used to extract data for reports.

    Permissions

    • Different reports require different permissions to run.

    CyberArk's Scalable Architecture

    • The architecture consists of auditors, PVWA, CPM, PSM, and a Vault (HA Cluster) in the main data center, with replicated environments in London and Hong Kong.
    • The IT environment is integrated with the Vault and other components.

    PAM Self-Hosted Components

    • PAM Self-Hosted is a Privileged Access Manager solution where all components are owned and operated by the customer.
    • It can be deployed on-premises, in the cloud, or in a hybrid environment.
    • The components include:
      • Secure Digital Vault: a secure server for storing privileged account information.
      • Password Vault Web Access (PVWA): a web interface for users to access privileged account information.
      • Central Policy Manager (CPM): performs password changes on devices and configures policies.
      • Privileged Session Manager (PSM): isolates and monitors privileged account activity, recording sessions.
      • Privilege Threat Analytics (PTA): monitors and detects malicious privileged account behavior.

    CyberArk PAM Offerings

    • PAM Self-Hosted is an entirely on-premises or cloud-based deployment.
    • CyberArk Privilege Cloud is a PAM solution delivered as Software as a Service (SaaS).

    Before Installing

    • Enable the Backup user
    • Set the password on the Primary Vault

    Install the Utility

    • Install the Replicator module and specify a path to a backup folder for the replicated data

    Configure Vault.ini

    • Edit the Vault.ini to give the Replicator utility the network address of the Vault server

    Create Cred File

    • The Credential File is used by the utility to authenticate to the Vault
    • The password for the Backup user is changed in the Vault and the Credential File is updated after every successful login

    Performing a Backup

    • The backup is launched at a command line using the PAReplicate.exe executable file
    • The syntax of the command specifies the vault.ini file and uses the logonfromfile and fullbackup switches

    Overview

    • The CyberArk Vault enables you to backup and restore a single Safe to a Vault, as well as a complete Vault’s data and metadata
    • The Data and Metadata folders are extremely important and it is imperative to back them up regularly

    Backup Considerations

    • Vault backup can be implemented in two ways: Direct Backup (Not Recommended) and Indirect Backup (Recommended)
    • Direct Backup introduces an external application to the Vault and potentially reduces the level of security
    • Indirect Backup uses the PrivateArk Replicate Utility to pull Vault data as encrypted files to a server, and then enterprise backup software can backup these files

    Installation and Setup

    • Before installing the Replicator utility, ensure the backup server has at least the same disk space as the Vault database on an NTFS volume, accessibility by your enterprise backup system, and physical security that only permits authorized users to access it

    Enhanced DR Replication

    • Database synchronization occurs between the Primary Vault and Disaster Recovery Environment
    • The DR Service is responsible for synchronization
    • Data and metadata synchronization can be enabled in the padr.ini configuration file with the default setting EnableDbsync=Yes

    Data Replication Interval

    • The ReplicateInterval parameter determines the length of time between synchronizations of the Vault file system
    • The default interval is 3,600 seconds (or one hour)

    PVWA Failover Setup

    • PVWA servers can be configured for automatic failover to allow users to access passwords without interruption
    • Audit data should be saved via the activity log before re-enabling replication
    • SIEM integration can mitigate the issue of saving audit data

    DNS Load Balancing

    • A DNS Alias can be used to control which Vault is used by the components (CPMs, PSMs, PVWAs)
    • The DNS Alias is set in the Vault.ini file
    • DNS Alias updates are a manual process and will extend the outage

    Failover

    • Automatic failover can be enabled with the parameter EnableFailover=Yes
    • The CheckInterval indicates the DR Vault will contact the Primary Vault every 60 seconds, and if it fails, it will try again 4 times, once every 30 seconds
    • After which, the DR Vault considers that the Primary is down and it goes into DR mode

    Manual Failover

    • To configure the DR Vault for manual failover, padr.ini should be configured as follows: EnableFailover to No, EnableDbsync to Yes, and ActivateManualFailover to No
    • To perform a proper manual failover, set the parameter ActivateManualFailover to Yes and restart the DR service

    The Failover Process

    • The failover process involves connection failure, retry attempts, failover started, data synchronization, starting PrivateArk, stopping the Server, and disaster recovery service

    CyberArk PAM Solution Encryption

    • Three files form the cornerstone of the CyberArk PAM solution encryption methodology: Server Key, Recovery Public Key, and Recovery Private Key.
    • These files are required to install and operate CyberArk PAM.

    Vault Object Encryption - Day-to-Day Operations

    • Vault objects are encrypted using AES-256.
    • Server Key is used to encrypt vault objects.
    • Safe objects are encrypted using AES-256.
    • Safe Key is used to encrypt safe objects.
    • Password files are encrypted using AES-256.
    • File Key is used to encrypt password files.

    The Vault: End-to-End Security

    • The Vault provides end-to-end security with features like:
      • Discretionary and Mandatory Access Control
      • Session Encryption
      • Firewall Authentication
      • Granular Permissions
      • Subnet-Based Access Control
      • Tamperproof Audit Trail
      • Hierarchical Encryption Model
    • The Vault uses a proprietary protocol and hardened built-in Windows firewall.
    • OpenSSL encryption is used.
    • Role-Based Access Control and Time Limits are available.
    • Every object in the Vault has a unique key.

    Vault Encryption and Key Management

    • Keys are encrypted using a 3rd-party tool.
    • Keys are not stored in RAM.
    • Keys are always available, even when the Vault is restarted.
    • Inserting a medium is required to encrypt the key.

    Summary

    • The session covered security controls protecting the Vault and encryption keys.
    • It also covered encryption mechanisms protecting Vault data.

    CyberArk PAM Solution Encryption

    • Three files form the cornerstone of the CyberArk PAM solution encryption methodology: Server Key, Recovery Public Key, and Recovery Private Key.
    • These files are required to install and operate CyberArk PAM.

    Vault Object Encryption - Day-to-Day Operations

    • Vault objects are encrypted using AES-256.
    • Server Key is used to encrypt vault objects.
    • Safe objects are encrypted using AES-256.
    • Safe Key is used to encrypt safe objects.
    • Password files are encrypted using AES-256.
    • File Key is used to encrypt password files.

    The Vault: End-to-End Security

    • The Vault provides end-to-end security with features like:
      • Discretionary and Mandatory Access Control
      • Session Encryption
      • Firewall Authentication
      • Granular Permissions
      • Subnet-Based Access Control
      • Tamperproof Audit Trail
      • Hierarchical Encryption Model
    • The Vault uses a proprietary protocol and hardened built-in Windows firewall.
    • OpenSSL encryption is used.
    • Role-Based Access Control and Time Limits are available.
    • Every object in the Vault has a unique key.

    Vault Encryption and Key Management

    • Keys are encrypted using a 3rd-party tool.
    • Keys are not stored in RAM.
    • Keys are always available, even when the Vault is restarted.
    • Inserting a medium is required to encrypt the key.

    Summary

    • The session covered security controls protecting the Vault and encryption keys.
    • It also covered encryption mechanisms protecting Vault data.

    Remote Control

    • Enables users to perform remote operations on Vault, DR Vault, and ENE components.
    • Consists of Remote Control Agent (Windows service) and Remote Control Client (command-line interface utility).
    • Remote Control Agent runs on Vault components, while the Client can run on any computer without requiring other Vault components.

    Remote Monitoring

    • Enables users to receive Operating System and Vault information, including CPU, memory, and disk usage, event log notifications, and service status.
    • Uses SNMP to send Vault traps to a remote terminal.
    • CyberArk provides two MIB files for SNMP v1 and v2 that describe SNMP notifications sent by the Vault.

    System Monitoring and Administrative Tasks

    • Can monitor system health via REST, email, SIEM, and SNMP.
    • Can monitor replications and DR status.
    • Perform common administrative tasks related to system maintenance.

    Monitoring Components

    • Can monitor components via REST, email, SIEM, and SNMP.
    • Examples of components that can be monitored include PVWAAppUser, PasswordManager, DR, and Backup.

    Enabling Component Monitoring

    • Can customize email notifications by editing the body parameter in the Component is inactive template (ID: 206).
    • Can enable monitoring of a specific CyberArk component user account using the PrivateArk Client.
    • Can add the ComponentMonitoringInterval parameter to dbparm.ini to set the monitoring interval.
    • Can define the actions taken when the Vault detects a disconnected component using the ComponentNotificationThreshold parameter.

    Troubleshooting PSM-RDP

    • Same troubleshooting recommendations as for PSM-RDP
    • Run component manually using shadow user
    • Delete Shadow users (from PSM computer management)
    • Adjust AppLocker (or remove it manually in Windows for isolation)

    Shadow Users

    • Created by the PSM upon first connection
    • Used to run connection components and store user preferences
    • Can isolate problems related to shadow users by:
      • Running the component manually as the shadow user (after password reset)
      • Deleting the user (this will allow the PSM to create the user again)

    Adjust AppLocker

    • PSM uses Windows AppLocker feature to define rules for allowing or denying applications
    • When adding a new component, adjust AppLocker by:
      • Uncommenting the line relating to the new component in PSMConfigureApplocker.xml
      • Running the PSMConfigureApplocker.ps1 script

    Disable AppLocker

    • Can disable AppLocker entirely for isolating the problem only
    • Steps to disable AppLocker:
      • Open secpol.msc or gpedit.msc
      • Go to Computer Configuration → Windows Settings → Security Settings → Application Control Policies → AppLocker
      • Click on Configure rule enforcement and set Executable Rules to Audit Only
      • Turn Enforce rules back on after testing

    CPM Services

    • Restart the CPM Services to troubleshoot issues

    Resynch PTA Credentials

    • Run the VaultPermissionsValidation.sh script in the utility folder on the PTA server to resynch credentials for PTA Vault users and PTA_PAS_Gateway account
    • Local Computer Policy conflicts with password policy on target device
    • Platform and Master Policy settings must not conflict with password policy on target device

    User Authentication Issues

    • User Receives an Authentication Failure due to:
      • Trying to log in to PVWA with old password after changing network password
    • Identifying the Error in the ITA log on the Vault
    • Unsuspend the User or use Automatic Unsuspend feature

    Automatic Unsuspend

    • Configure the Vault to unsuspend users automatically after a predefined time period using the UserLockoutPeriodInMinutes parameter in dbparm.ini

    Troubleshooting PSM Server Issues

    • To troubleshoot PSM server issues, disable NLA (Network Level Authentication) on the PSM machine or target machine by going to Control Panel → System and Security → System → Remote Settings
    • Manually connect with PSMConnect by disabling the Start Program in the Environment tab, getting the PSMConnect account password, and connecting to the PSM with PSMConnect and running MSTSC to the target

    Increasing Timeouts

    • Timeout parameters determine how long the PSM will wait for certain components to work before considering them as ‘failed’ and ending the session
    • In overloaded environments, it is recommended to double the timeout values, e.g., ConnectionComponentTimeout: 20000

    PSM Component Issues

    • Verify if PSM users (PSMConnect / Shadow users) are supported and if Mapping drives is enabled

    Target Windows Accounts

    • Verify / Change / Reconcile API and “net use” command
    • Use alternative plugins: WMI plugin / PowerShell plugin
    • Suggested troubleshooting:
      • Check Windows Event Viewer
      • Check for unusual Local Security Settings
      • Run “net use” manually from the CPM server to verify the connection

    Target Unix Accounts

    • Verify / Change / Reconcile operations are affected
    • Suggested troubleshooting:
      • Run plink manually
      • Disable DEP / add exceptions for DEP on the CPM server
      • Prompts and Process files – add a basic prompt

    PSM-RDP Connection Troubleshooting

    • Understanding the problem:
      • At what stage does the problem occur?
      • One account? Multiple accounts? Same type?
      • Is the PSM hardened? Is the PSM in a domain?
      • Which connection type is being used? RDP file / RemoteApp
    • Suggested troubleshooting:
      • Check the PSM service – is it off/hanging?
      • Run component manually using shadow user
      • Delete Shadow users (from PSM computer management)
      • Adjust AppLocker (or remove it manually in Windows for isolation)

    Shadow Users

    • Shadow users are created by the PSM upon first connection
    • Shadow users are used to run connection components and store user preferences
    • Isolate problems related to shadow users by:
      • Running the component manually as the shadow user (after password reset)
      • Deleting the user (this will allow the PSM to create the user again)

    Adjusting AppLocker

    • The PSM uses the Windows AppLocker feature which defines a set of rules that allow or deny applications from running on the PSM machine
    • When adding a new component, adjust AppLocker by:
      • Adding an exception to PSMConfigureApplocker.xml
      • Running the PSMConfigureApplocker.ps1 script

    Disabling AppLocker

    • Disable AppLocker entirely (for isolating the problem only) using the MMC snap-ins
    • Set Executable Rules to Audit Only and turn Enforce rules back on after testing

    PSM Configuration

    • PSM configuration file is located at C:\Program Files\CyberArk\PSM\Basic_psm.ini
    • Debug settings can be found at PVWA &gt; Administration Tab &gt; Options &gt; Privileged Session Management

    CPM Configuration

    • CPM configuration file is located at Vault &gt; Safe "Password Manager" &gt; root\policies\.ini
    • Debug settings can be found at PVWA &gt; Administration Tab &gt; CPM settings

    Debugging and Troubleshooting

    • Debug levels can be set to 0 (no messages), 1, 2, 3, 4, 5, 6, or 7
    • Trace levels can be set to 1, 2, 3, 4, 5, 6, or 7
    • Log files can be found at \Logs and subfolders, or according to the LogsFolder parameter in Basic_psm.ini file
    • CPM debug levels can be set to 1 (exceptions), 2 (trace messages), 3 (CASOS activities), 4 (CASOS debug activities), 5 (CASOS errors), or 6 (all CASOS activities and errors)

    Log Files

    • PSM logs can be found at \Logs and subfolders
    • CPM logs can be found at \Program Files\CyberArk\PasswordManager\Logs\pm.log, \pm-error.log, \PMConsole.log, and \PMTrace.log
    • Plug-in logs can be found at \Program Files\CyberArk\PasswordManager\Logs\ThirdParty\*.log
    • PVWA logs can be found at %windir%\temp\

    Troubleshooting Flow

    • The basic troubleshooting methodology involves understanding the system implementation, component communication, and current behavior compared to expected behavior
    • It is important to write down any information gathered during the troubleshooting process and any tests performed, as this information will be required when opening a case with CyberArk support

    Privileged Threat Analytics (PTA)

    • Detects malicious activity caused by privileged accounts and contains in-progress attacks.

    On-Demand Privileges Manager

    • Empowers IT and enables complete visibility and control of super users and privileged accounts across the enterprise.

    Digital Vault

    • A hardened and secured digital vault used to store privileged account information.
    • Implemented in compliance with the CyberArk Digital Vault Server security standard, resulting in a highly secure repository for privileged account passwords.

    Central Policy Manager (CPM)

    • Performs password changes and SSH key rotations on devices based on policies set by Vault Administrators.
    • Responsible for Accounts Feed operations, including:
      • Discover: Automates privileged account discovery.
      • Analyze: Provides an easy view of all discovered accounts.
      • Provision: Provisions the scope of accounts to manage in the Vault in a simple and intuitive way.

    Policy Management

    • Manages password policies for various systems, including Unix, Oracle, Windows, z/OS, and Cisco.

    PVWA - Password Vault Web Access

    • A web interface used by Administrators to perform administrative tasks and by end users to gain access to privileged account information.

    PSM – Privileged Session Manager

    • Isolates desktops from sensitive target machines to prevent cyber attacks.
    • Creates accountability and control over privileged session access with policies, workflows, and single sign-on.
    • Delivers continuous monitoring and compliance with session recording with zero footprint on target machines.

    Enterprise Password Vault Solution Overview

    • Master/exception policy definition.
    • Initial load and reset accounts discovery through REST API or manual loading.
    • Auditor access and policy management.
    • Request access to privileged accounts through PVWA and PSM.

    Studying That Suits You

    Use AI to generate personalized quizzes and flashcards to suit your learning preferences.

    Quiz Team

    Related Documents

    01-PAM-ADMIN-Introduction to-CyberArk-PAM.pdf
    02-PAM-ADMIN-User-Management.pdf
    PAM Administration Policies & Platforms PDF
    PAM Administration Safes PDF
    CyberArk PAM Administration Accounts – Part 1 PDF
    PAM Administration Accounts – Part 2 PDF
    07-PAM-ADMIN-Dependents.pdf
    CyberArk PAM Administration - Privileged Access Workflows PDF
    PAM Administration Discovery and Onboarding PDF
    PAM Administration Privileged Session Management Part 1 PDF
    Pam Administration Privileged Session Management Part 2 PDF
    12-PAM-ADMIN-Privileged-Threat-Analytics.pdf
    PAM Administration Reports PDF
    CyberArk PAM Self-Hosted Architecture PDF
    Pam Administration Backup And Restore PDF
    CyberArk PAM Disaster Recovery PDF
    PAM Administration Vault Security PDF
    18-PAM-ADMIN-System-Monitoring.pdf
    19-PAM-ADMIN-Common-Issues.pdf
    20-PAM-ADMIN-Troubleshooting.pdf
    Core PAM Review and Security PDF

    Description

    This quiz covers the key features of CyberArk's Privileged Access Management (PAM) solution, including credential management, session isolation, and risk remediation. Test your knowledge of CyberArk PAM's capabilities.

    More Like This

    Managing Account Groups in CyberArk's PAS Quiz
    10 questions

    CyberArk Account Groups Quiz & Flashcards

    AstoundingScholarship avatar
    AstoundingScholarship
    CyberArk PAM: Key Features
    20 questions

    CyberArk PAM: Key Features

    FancySarod avatar
    FancySarod
    Use Quizgecko on...
    Browser
    Open
    Browser
    Browser