PAM-SEN CyberArk Sentry PAM Questions and Answers

Install the Vault in the cloud the same way you would in an on-premises environment. Place the server key in a password protected folder on the operating system.

Install the Vault in the cloud the same way you would in an on-premises environment. Purchase a Hardware Security Module to secure the server key.

Install the Vault using the native cloud images and secure the server key using native cloud Key Management Systems.

Install the Vault using the native cloud images and secure the server key with a Hardware Security Module.

Port 1858 to Vault and Port 443 to PVWA

Port 1858 only

all ports to the Vault

Port UDP/1858 to Vault and all required ports to targets and Port 389 to the PSM

PTA

PSM

PVWA

EPM

This setup is already fault tolerant.

Install more PVWAs in each data center.

Continuously monitor PVWA status and send users the link to another PVWA if issues are encountered.

Load balance all PVWAs under same URL.

Log into the vault locally and navigate to the Server folder under the PrivateArk install location.

Log into the PVWA and go to the Reports tab.

Access the System Safe from the PrivateArk client.

Go to the Thirdpary log directory on the CPM

CPMs should only access the primary Vault. When it is unavailable, CPM cannot access any Vault until another Vault is promoted as the new primary Vault.

CPMs should access only the satellite Vaults.

CPMs should only access the primary Vault. When it is unavailable, CPM cannot access any Vault until the original primary Vault is operational again.

CPM should access all Vaults - primary and the satellite.

PSMConnect

PSMAdminConnect

PSM

The credentials the end user retrieved from the vault

TRUE

FALSE

CAVaultManager Most Voted

StorageManager

CloudVaultManager

CACert

CyberArk Password (SRP)

LDAP

SAML

PKI

RADIUS

OracleSSO

Biometric

dbparm ini

paragent.ini

ENEConf.ini I

padr ini

Manage Directory Mapping

Activate Users

Backup All Safes, Restore All Safes

Audit Users, Add Network Areas

DBparm.ini and CAVaultManager.exe

VaultKeys.ini and CAVaultManager.exe

DBparm.ini and ChangeServerKeys.exe

VaultKeys.ini and ChangeServerKeys.exe

server.key

recpub.key

recprv.key

mdbase.dat

Recovery Time Objectives or Recovery Point Objectives are at or near zero

Integration with an Enterprise Backup Solution is required.

Off site replication is required.

PSM is used

TRUE

FALSE

retention period

number of PSMs

number of users

number of targets

CyberArk password LDAP, RADIUS, SAML

LDAP, Windows Authentication, SSH keys

RADIUS, Oracle SSO, CyberArk Password

CyberArk Password, LDAP, RADIUS

Remove IIS settings which can be considered security vulnerabilities.

Validate that the PSM is ready to be placed behind a load balancer.

Confirm that the Windows Services for PSM are running on the server.

Ensure that the AppLocker script does not have any syntax errors.

Vault, CPM. PVWA, PSM

CPM, Vault. PSM, PVWA

Vault, CPM. PSM, PVWA

PVWA, Vault, CPM, PSM

RabbitMQ

Disaster Recovery

Remote Control Client

Distributed Vault Server

The system will use the template for the mapping listed first.

The system will use the template for the mapping listed last.

The system will grant all of the vault authorizations from the two templates.

The system will grant only the vault authorizations that are listed in both templates

TRUE

FALSE

IdP “EntityID” and “PartnerIdentityProvider Name” in PVWA saml.config file

IdP “User name” and “SingleSignOnServiceUrl” in PVWA saml.config file

IdP “Audience” and “ServiceProviderName” in the PVWA saml.config file

IdP “Secure hash algorithm” and “Certificate” in the PVWA saml.config file

Web Services Role

NET 4.5.1 Framework Feature

Remote Desktop Services Role

Windows BitLocker

on the Vault server in C:\Windows\System32\drivers\etc\hosts and in the PVWAApplication under Administration > LDAP Integration > Directories > Hosts

on both the Vault and the PVWA servers in C:\Windows\System32\drivers\etc\hosts

in the Private Ark client under Tools > Administrative Tools > Directory Mapping

on the Vault server in the certificate store and on the PVWA server in the certificate store

Use a load balancer

Use a backup solution

CPM must be in all data centers

Install the Vault in an HA cluster

TSparm.ini Most Voted

Vault.ini

DBparm.ini

user.ini

vault.ini

user.cred

psmpparms

psmgw.config

PSMUnmanagedSessionAccounts Safe

PSMRecordingsSessionAccounts Safe

PSMUnmanagedApplicationAccounts Safe

PSMSessionBackupAccounts Safe

The PSM ID of the first installed PSM server was changed and the additional PSM server can use the same PSM ID.

The user performing the installation is a direct owner in the PSMUnmanagedSessionAccounts Safe, PSM safe and member of PVWAMonitor group.

The user performing the installation is not a direct owner in the PSMUnmanagedSessionAccounts Safe. Most Voted

The path of the Recordings Folder must be different on all PSM installations.

six or more

four

two or less

three

TRUE

FALSE

Import CyberArk policy settings from the provided file into a new GPO. Most Voted

Apply advanced audit on the PSM server.

Link GPO to a dedicated OU containing CyberArk PSM servers. Most Voted

Import an INF file to the local machine.

Configure AppLocker rules to block running unknown executables.

HardenAzureFW.ps1 Most Voted

ExecuteStage ./Hardening/HardeningConf.xml

HardenVaultFW.ps1

ExecuteStage ./PostInstallation/PostInstallation.xml

Upload the license.xml file to the System Safe

Upload the license.xml file to the Vaultlnternal Safe.

Upload the license.xml file to the System Safe and restart the PrivateArk Server service.

Upload the license.xml file to the Vaultlnternal Safe and restart the PrivateArk Server service.

maximum number of concurrent connections that can be opened between the CPM and the remote machines for the platform

maximum number of concurrent connections that can be between the PSM and the remote machines for the platform

maximum number of concurrent connections allowed for a specific account on the platform through the PSM

maximum number of concurrent connections to the Vault allowed for sending audit activities relating to the platform