ACCESS-DEF CyberArk Defender Access (ACC-DEF) Questions and Answers

CyberArk Identity provides several predefined roles, but the primary ones include the ‘Everybody’ role and the ‘System Administrator’ role. The ‘Everybody’ role is assigned by default to all CyberArk Identity users. This role is essential for ensuring that all users are automatically included in the system and have access to the user portal upon their first login or device enrollment. The ‘System Administrator’ role grants full access to all the Identity Administration portal settings and is typically assigned to the initial account that sets up the CyberArk Identity service.

References: Detailed information about these roles can be found in the CyberArk documentation, which explains the purpose of each predefined role and the permissions associated with them1.

The Self-Service Password Reset (SSPR) in CyberArk Defender Access allows users with Active Directory accounts who have forgotten their password to reset it themselves (A). It also provides security measures such as setting a maximum number of times a user can reset their password within a specific timeframe (D), and requiring users to respond to a CAPTCHA before resetting their password (E), to prevent abuse of the password reset feature.

References: The information is based on the CyberArk documentation which outlines the configuration of self-service options for users, including the ability to enable SSPR for Active Directory users, the option to limit password resets within a timeframe, and the requirement for CAPTCHA responses for added security12.

The user behavior risk score in CyberArk Defender Access is influenced by a variety of factors that can indicate potentially risky behavior or anomalies. Geolocation is a significant factor as it can signal unusual access patterns if logins are occurring from locations not typically associated with the user1. The AD joined status of a device is also a critical factor, as devices that are not part of the Active Directory may represent a higher risk when accessing resources2.

References:

• CyberArk’s official documentation on configuring risk-based access control highlights the importance of location as a risk factor and describes how to adjust individual risk factor weights1.
• The CyberArk Docs also detail how administrators can assign unique risk scores based on variables like geo-location data and the AD joined status of the device23.

If you forget your CyberArk Authenticator PIN, you should click on the “Reset PIN code” button. This action will reset your PIN, but please note that it will also delete all existing accounts from CyberArk Authenticator. You will need to re-register CyberArk Authenticator and add your accounts again after resetting your PIN1.

References:

• The CyberArk documentation provides a step-by-step guide on how to reset your PIN if you forget it. It explains the consequences of resetting your PIN and the process to re-register the Authenticator and add accounts again1.

 MFA filters can be used in various scenarios within the CyberArk Defender Access environment to enhance security. Specifically, they can be applied to the User and Admin Portal login to ensure that multi-factor authentication is required for access, providing an additional layer of security beyond just a username and password. At the application level, 2FA/MFA can be enforced to protect sensitive applications by requiring users to authenticate with multiple factors before gaining access. Additionally, MFA filters can be utilized for self-service password reset processes, ensuring that users are who they claim to be before allowing them to change their passwords.

References: The information provided is based on the CyberArk Defender Access documentation, which outlines the use of MFA filters in securing access to portals and applications, as well as safeguarding password reset procedures12.

• Secure communication between a company's internal network (AD or LDAP) and CyberArk Identity: is a connector function
• Radius Server and Client: is a connector function
• VPN gateway: is not a connector function
• User Behavior Analytics gateway: is not a connector function
• App gateway: is a connector function
• Integrated Windows authentication (IWA): is a connector function
• LDAP proxy: is a connector function
• Firewall: is not a connector function

CyberArk Identity connectors serve as bridges between CyberArk Identity and other components of an organization's IT infrastructure:

• Secure communication with a company's internal directory services like Active Directory (AD) or Lightweight Directory Access Protocol (LDAP) is facilitated by CyberArk Identity connectors to ensure secure user authentication and synchronization.
• Radius Server and Client functionality is often supported by CyberArk Identity connectors to enable multi-factor authentication (MFA) and integrate with various network devices and services.
• VPN gateways are typically separate network devices or services that handle the security for virtual private network traffic and are not managed by CyberArk Identity connectors.
• User Behavior Analytics (UBA) gateways are specialized services for analyzing user activities and detecting potential security threats; they are separate from the standard connector functions.
• App gateways refer to application gateways that manage traffic to web applications, which can be part of CyberArk Identity's connector functionalities for single sign-on (SSO) and secure application access.
• Integrated Windows Authentication (IWA) is a secure method for users to sign in to applications that can be facilitated by CyberArk Identity connectors to allow seamless authentication.
• LDAP proxy functionality is within the scope of CyberArk Identity connectors to provide additional security and abstraction layers for LDAP operations.
• Firewall management is beyond the scope of CyberArk Identity connectors as it is a network security system that controls incoming and outgoing network traffic based on predetermined security rules.

In a typical MFA configuration, users are often allowed to answer security questions as part of the authentication process. This can be an admin-defined question, a user-defined question, or both. The requirement for the number of questions and the minimum number of characters in the answers can vary based on the organization’s security policy.References: This explanation is based on common MFA practices and not on specific CyberArk Defender Access (ACC-DEF) course materials.

For detailed and accurate information, please refer to the official CyberArk Defender Access (ACC-DEF) course materials or contact a certified CyberArk instructor.

The “Something you are” requirement in multi-factor authentication (MFA) refers to biometric verification methods that rely on unique biological characteristics of an individual. The CyberArk Identity mobile app can fulfill this requirement by using biometric inputs like fingerprints or facial recognition, which are unique to each user. Similarly, F1D02 likely refers to a hardware token or similar device that can support biometric verification, such as fingerprint scanning, to authenticate a user’s identity.

References: The information is based on the official CyberArk documentation which discusses the broad set of supported factors for MFA, including mobile authenticators and hardware tokens that can use biometric verification1. This is also in line with general MFA best practices that categorize biometric factors as “Something you are” due to their inherent uniqueness to the individual23.

In the context of web application connectors:

• OpenID Connect is an identity layer on top of the OAuth 2.0 protocol, which allows for the secure issuance of access tokens representing user identity. It relies on JSON Web Tokens (JWTs) for the identity information of the users, which enables client applications to verify the identity of the end-user based on the authentication performed by an Authorization Server, as well as to obtain basic profile information about the end-user in an interoperable and REST-like manner.
• Bookmark is a simple type of web app connector that doesn't provide single sign-on (SSO) capabilities. Instead, it acts as a shortcut, allowing users to quickly access web applications or URLs without requiring any form of automated authentication.
• Browser Extension refers to a tool that automates the process of entering a user's credentials into applications that do not support standard SSO protocols. The extension can store the username and password and automatically input these details when the user navigates to the login page of a web application, effectively simulating an SSO experience for non-SSO applications.

In order to restrict access to the CyberArk Identity user portal to only corporate-issued domain-joined laptops without the need for a VPN, you would utilize the Windows Device Trust agent with certificate-based authentication. This agent can ensure that only devices with a trusted certificate, typically deployed through domain-joined status, can access the portal. This method relies on the presence of a specific certificate on the laptop which confirms its trust status and domain-joined condition. It provides secure and seamless user access while ensuring compliance with corporate security policies, allowing access only from corporate-managed devices.

In the context of device enrollment settings within CyberArk's solution:

A.Send notification on device enrollment:This is a valid setting that enables administrators to be notified when a device is enrolled. It is important for maintaining visibility over the devices being added to the system.

B.Enable invite-based enrollment:This setting is valid and allows for a controlled enrollment process where users can only enroll their devices after receiving an invite. This helps in managing and securing the enrollment process by ensuring that only authorized devices are added.

When local account linking is configured between Active Directory (Source) and CyberArk Cloud Directory (Target) with the email attribute as the directory user mapping attribute, it means that user authentication will be cross-referenced between the two directories based on the email attribute. Since the option "Use this mapping only for MFA re-direction" is selected, it implies that the initial MFA challenge is not necessarily redirected. However, after a successful logon, the user session will be associated with the account in the CyberArk Cloud Directory (Target) because this is the directory service where the final user account resolution takes place.

The “Provisioning” feature within a Web App connector in CyberArk Identity is used to automate the process of on-boarding and off-boarding users in third-party applications. When this feature is enabled, it allows for the automatic creation, update, and deletion of user accounts in the connected application, based on the user’s status in CyberArk Identity. This ensures that access rights are granted and revoked in a timely manner, which is crucial for maintaining security and compliance within an organization.

References: The role of the provisioning feature in automating user account management can be found in the CyberArk documentation related to the CyberArk Provisioning Connector1.

CyberArk Identity’s App Gateway is designed to provide secure remote access to on-premises applications without the need for VPNs, code changes, or additional infrastructure. It enables users to access on-premises apps such as an Oracle web app by extending Single Sign-On (SSO), adaptive Multi-Factor Authentication (MFA), and fine-grained access policies to these applications. This ensures that users can authenticate once and gain one-click access to all the apps they need, including on-premises Oracle web apps, in a secure manner. References: The information is based on CyberArk’s official documentation and resources which detail the capabilities of the App Gateway feature, specifically its ability to secure remote access to on-premises applications like Oracle web apps12.

If users cannot use their mobile device for two-factor authentication (2FA) or multi-factor authentication (MFA), they can use other methods such as FIDO2 keys, which are external security keys that provide a strong form of hardware-based authentication. Additionally, security questions can serve as a knowledge-based authentication factor, which is something the user knows. These options are part of the broad set of supported factors provided by CyberArk for secure authentication. References: The information is based on the CyberArk documentation which details the various MFA options available, including FIDO2 keys and security questions as alternative methods when mobile devices are not usable12.

The “Land and Catch” feature is supported by browsers that are compatible with the CyberArk Identity Browser Extension. This feature allows users to add applications to their User Portal by recognizing when users enter credentials and offering to store the user’s credentials. The supported browsers for this feature are Google Chrome, Firefox, and Microsoft Edge12.

References: The information about supported browsers for the “Land and Catch” feature can be found in the CyberArk public documentation and the CyberArk training resources123. It’s important to note that the Browser Extension for Internet Explorer and Safari is deprecated, which means these browsers are no longer supported for new features like "Land and Catch"2.