Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CyberArk Defender > Standard Questions > Flashcards

Standard Questions Flashcards

1
Q

What can’t CyberArk overcome?

  • Penetration
  • Recon
  • Lateral Movement
  • Privilege Escalation
A

Penetration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What port does the Vault use to communicate?

A

TCP 1858

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is PACLI?

A 
The PrivateArk Command
Line Interface (or PACLI)
enables CyberArk Vault users
to access the Vault server from
any location using an intuitive
command-line environment.
• Bulk adding users
• Adding safes
• Modifying properties
• Any other scripting usages
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

The PrivateArk Client can
be installed on any station
with access to the Vault.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Vault Central Administration station can
be installed on any station
with access to the Vault.

A

False: Only available on Vault server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is RCC? Why is it used/better? What port does it use?

A

Remote Control Client: Executes tasks on vault via the Remote Control Agent. Now we don’t need to use RDP. Uses port 9022.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Difference users and accounts?

A

Users: People who have been granted
access to the system. Use the accounts and passwords.
Accounts: Priv accounts with passwords stored in vault. Such as an Domain admin account…

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Applications and CyberArk components are also users who access accounts.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Difference internal and transparent users and groups?

A

Internal are built-in (automatically created) or manual added in the vault.
Transparent: Users and Groups that are automatically provisioned from an external directory (LDAP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What will happen if you delete a transparent

user within CyberArk

A

It will be automatically re-created upon login if it still exists within AD and answers the mapping criteria.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is the Master user? How can you change the password?

A

The Master user is the most powerful user in the system, with full Safe and Vault authorizations that
cannot be removed.
To change the Master user password, log in with the Master user and click on User -> Set Password
Master user can only change the Master user password.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Requirements to log in with the Master User? In what file are these stored?

A

-PrivateArk Client
-Master Password
-Master CD (RecPrvKey)
-Vault or emergency console defined as (EmergencyStationIP)
The last 2 are defined in the dbparm.ini file.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Where are users stored? How is user management done (Such as creating)? Is it recommended that you
manage your users with an external LDAP directory,
such as Active Directory?

A

Stored: Vault database
User managemant: Privateark Client
Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is a Directory Map? Explain the two kinds.

A

A Directory Map determines whether a User Account will be created in the Vault, and the roles they will have.
-User Mapping – allows for authentication and
defines user’s attributes, such as Vault
Authorizations and Location.
• Group Mapping – makes LDAP groups
searchable from within CyberArk, allowing
mapped groups to be granted safe
authorizations and to be nested within built-in
CyberArk groups.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Explain: AutoSyncExternalObjects=Yes,24,1,5

A

Parameter in dbparm.ini. if, how
often, and when the Vault’s External users and groups will be synchronized with the
External Directory (LDAP)
Yes –> Will sync vault with the External Directory.
24 –> The number of hours in one period cycle.
1,5 –> The hours during which the sync will take place.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Verschil Safe en Vault authorizations?

A

Vault:
Can be assigned only to users (not groups).
• Cannot be inherited via group membership.
• Defined only via the Private Ark Client.

Safe: Assigned to users and/or groups.
• Can be inherited via group membership.
• Can be defined in the Private Ark Client or PVWA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q 
The list of groups that are
added automatically to
newly created safes is
controlled by a parameter in
the X file.
A

dbparm.ini

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

How to determine which rights a group has first?

A

Lower directory mapping number

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Access Control is applied to?

A

Safes –> Use this account…

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

How many objects can be stored in a safe? How many does Cyberark rec?
How many characters can a safe name be?
How do we apply least privilege?

A

20k
3-5k
28
Avoid situations where providing a user access to a Safe allows them to access accounts they don’t need to access For example: you may want to configure separate Safes for
Windows Desktop Accounts, Windows Local Administrators,
and Windows Domain Accounts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q 
What is the right workflow creating policies and accounts? Examples
Add Accounts 
Review/Edit Master Policy
Create
Platforms
Create Safes
Add exceptions
to Master policy based on Platforms
A 
Review/Edit Master Policy days
Create Platforms
Add exceptions
to Master policy
based on Platforms
Create Safes
Add Accounts
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

On what level do you set technical settings for passwords and exceptions?

A

Platform level.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

On what level do you set Global policy

settings/A baseline?

A

Master policy

24
Q

Privileged Access Workflow

  • Require dual access control approval
  • Enforce Check-in check-out
  • Enforce on time password access
  • Allow EPV transparent connections
  • Specify reason
A

-End users will will need to request access to
an account before connecting to a target
system. Depending on advanced
configuration, access authorization must be
given by one or more managers
-Only one user will be able to access and use
an account at any given point of time. When a
user checks out an account, it is locked and
cannot be retrieved by other users until it is
released by the user.
-Passwords are changed after each access.
When a user retrieves an account, the CPM
initiates a password change process that will
occur automatically. Users get a minimum
amount of time with the password before it
changes.
-Enables end users to click the Connect button
in the PVWA to access target devices without
exposing the password to the end user.
-End users will have to enter some text to justify
why they are accessing a particular target
system

25
Q

Password Management:
Require password change every X days
Require verification every X days

Will these be done automatically?

A

Require password change every X days
determines the maximum number of days
that can elapse between two password
changes.
Require password verification every X days
ensures that passwords stored in the Vault
are always synchronized with passwords in
the target systems.

Note that Platform settings determine if
passwords will be changed automatically/verified
for an account.

26
Q

Session Management:
-Require privileged session monitoring
and isolation
-Record and save session activity

A 
-This is the parameter that activates
privileged session management. This is disabled by default. 
-which is ACTIVE by default,
instructs the PSM servers to
upload recordings and session
activity to the Vault.
27
Q

Audit Management:

-Activities audit retention period

A

-Determines how long the Vault will

store the history of audit activities

28
Q

What are 3 functions of a platform?

A

-Define the technical settings required to manage
passwords. Examples: How long is a password, how complex…
-Point to the relevant plug-ins and connection
components. Examples: You log in differently to Windows Machines then to Unix Machines.
-The basis for exceptions to the
Master Policy

29
Q

Two types of platforms:

A

*Target Account Platforms:
-Define the technical settings required to manage accounts
• Used to define exceptions to the Master Policy
• Every account is associated with one platform

*Service Account Platforms

30
Q

How many platforms can an account be associated with?

A

One, account = not a user

31
Q

The technical settings for
managing passwords can
be found in the

A

Automatic Password Management

32
Q

What is the purpose of deactivating platforms?

A 
• Better administration:
Inactive platforms are hidden
from users when they add
accounts
• Better performance: the CPM
does not manage Inactive
platforms
33
Q

Is object level access control recommended (OLAC) by Cyberark?

A

No

34
Q

Pros of AllowedSafes option?

A 
-You can limit
the scope of a particular
platform to only those
Safes that match the
regular expression pattern (Linux --> When adding an account can only add to Safes that start with Linux) 
-This will help improve the
performance of the CPM
35
Q

In how many safes can an account be? In how any platforms?

A

1

36
Q

How does the password change of a root account on unix?

A

Log in with login account –> su to go to root account –> change password

37
Q

How can the login account be set?

A

The logon account
can be set on the
individual account or
via the Platform.

38
Q

A ‘super user’ such as root should be used as a logon account

A

FALSE

39
Q

Automatic reconciliation

must be enabled for a reconcile account.

A

TRUE

40
Q

Where are private keys stored?

A

In the vault

41
Q

Where are public keys stored?

A

On the target server.

42
Q

One private key can be used to access multiple systems

A

TRUE

43
Q

SSH Keys need their own platform

A

True

44
Q

SSH Keys need their own safe, it can’t be shared with a safe with passwords

A

False

45
Q

You can rotate the SSH keys
using the Change button, just
like with passwords

A

TRUE

46
Q

You can retrieve a copy of the private key and this can’t be disallowed.

A

This can be disallowed.

47
Q

What are dependents and usages?

A 
Dependents are a sort of platform. Usages refer to instances
when an account, which is
created at the operating
system or domain level, is
also used to perform some
task somewhere else
48
Q

What needs to be enabled to search for usages?

A

SearchForUsages

49
Q

What sort of usages are there?

A

NON-DISCOVERABLE USAGES and DISCOVERABLE USAGES. Both need to be manually in PVWA, but only non-discoverable need to be done on platform level.

50
Q

Can passwords in files be encrypted? How and where is it stored?

A

Encryption Command – The encryption file can
be stored in any location on the
CPM machine.

51
Q

What happens when a user has view and list, but Allow EPV connections ‘Allow users to view password’ is disabled?

A

The user will not be able to see the password.

52
Q

What does ‘Access Safe

without confirmation’ do?

A

Bypasses Dual Control

53
Q

What does A MinValidityPeriod of 60

mean?

A 
The password will
be changed 60 minutes after
it is accessed
During that time, other users
are able to access the
password
This is when OTP is enabled without Exclusive passwords
54
Q

Explain OTP and Exclusive passwords together and apart

A

Exclusive passwords
• When a user accesses a password, the account
is locked, no other user can access the password
until it has been released.
• User must release the password manually
• Password is changed automatically upon manual
release

One-time passwords
• After a user accesses a password, it is changed
automatically based on the minimum validity
period
• Multiple users are able to access the password
simultaneously
• Minimum validity period is reset as each user
accesses the password

Exclusive and One-time passwords combined
• Account is locked to a single user, no other user can
access it
• If the user does not release the account manually, the
system will release it automatically based on the
Minimum Validity Period and change the password

55
Q

If the Request timeframe contains a
specified time period, the password
will only be changed by the CPM after
the timeframe has expired, even though the MinValidityPeriod might be less. Only when dual control password is enabled.

A

True

CyberArk Defender (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions