CyberArk Sentry - PAM Free Sample Questions

When a PVWA is placed behind a load balancer that uses X-Forwarded-For headers to pass the original client IP, the LoadBalancerClientAddressHeader parameter must be configured in the web.config file on the PVWA server. This tells the PVWA to look for the specified header (e.g., 'X-Forwarded-For') to identify the true client IP address for logging and auditing, rather than logging the IP of the load balancer itself.

The error 'ITACM024S User is not defined' indicates the user attempting to authenticate does not exist in the Vault's user database. In a DR scenario, this most commonly occurs when the component user (like the CPM user) was created or had its credentials updated on the Primary Vault, but a full replication cycle did not complete before the failover. As a result, the DR Vault does not have the user's definition, causing authentication to fail.

The PSM is required to establish, record, and control the privileged session. It is the component that can physically terminate the active session upon receiving a command.

PTA analyzes the session data from PSM in real-time. It contains the security engine and policy configuration to detect specific commands like useradd and trigger an automated response, such as instructing the PSM to terminate the session.

False. The PSM for SSH installation script (psmp_install.sh) automatically configures the sshd_config file with the required parameters, including AllowTcpForwarding yes. Manual editing for this specific purpose is not required and could lead to misconfiguration if done incorrectly.

This is the correct, built-in CyberArk solution for distributed PSM deployments. The PSM is designed to cache recordings locally in a secure, encrypted format if it cannot immediately connect to the Vault. Once connectivity is restored, it automatically uploads the recordings, ensuring no data is lost and providing resilience against network interruptions. This architecture meets all stated requirements for performance, central storage, and resilience.

The VFPerformAfterChange (Verify-Fail-Perform After Change) parameter in a platform's password management settings controls whether the CPM performs a password verification immediately after a password change. Setting this to 'Yes' ensures the new password is valid and functional before the change is considered successful.

The Central Credential Provider (CCP) is a web service component of AAM designed for this exact use case. It allows applications like Jenkins to retrieve credentials via a secure REST API call without requiring a local agent (Credential Provider) installation. The Jenkins server authenticates to the CCP using methods like client certificates or IP address validation, eliminating the need to store secrets locally.

The core principle of JIT access with ephemeral accounts is that the account is provisioned only for the duration of the approved access window. Once the session ends or the time expires, the de-provisioning process is automatically triggered by the CPM, which removes the user account entirely from the target system, leaving no standing privileges.

The Vault hardening script creates specific inbound and outbound Windows Firewall rules to ensure that only necessary communication for Vault operations (e.g., on port 1858) is allowed, blocking all other non-essential traffic.

A key part of the hardening process is reducing the server's attack surface. The script disables a list of predefined Windows services (e.g., Print Spooler, Windows Audio) that are not needed for the Vault to function, thereby improving its security posture.

The WinWaitActive function is the correct and most reliable method in AutoIt for this purpose. It pauses the script's execution until a window with the specified title becomes the active window, ensuring that subsequent ControlSend and ControlClick commands are sent to the correct target. This is a fundamental function for creating robust connection components.