CAD Central Policy Manager (CPM) 1 — Questions and Answers
Question 1: What is the primary function of the Central Policy Manager (CPM) in CyberArk?
- Managing user access to the PVWA
- Automatically rotating and verifying privileged account passwords (Correct answer)
- Recording privileged sessions for audit purposes
- Discovering privileged accounts across the network
Correct answer: Automatically rotating and verifying privileged account passwords
The CPM is responsible for automatically rotating, verifying, and reconciling privileged account passwords on target systems according to defined platform policies.
Question 2: Which CyberArk component does the CPM primarily interact with to store and retrieve credentials during password rotation?
- Privileged Session Manager
- Password Vault Web Access
- Digital Vault (Correct answer)
- Privileged Threat Analytics
Correct answer: Digital Vault
The CPM retrieves the current credentials from the Digital Vault, connects to the target system to change the password, and then stores the updated password back in the Digital Vault.
Question 3: What mechanism does the CPM use to connect to and manage passwords on different types of target systems (e.g., Windows, Unix, Oracle)?
- Session connectors
- CPM plugins (platform plugins) (Correct answer)
- Password providers
- Target adapters
Correct answer: CPM plugins (platform plugins)
CPM plugins (also called platform plugins) are modular components that define how the CPM connects to and manages passwords on specific target system types.
Question 4: Which configuration file contains the Vault address and connection parameters used by the CPM to connect to the Digital Vault?
- CPMparm.ini
- vault.ini (Correct answer)
- basic.ini
- pvconfig.ini
Correct answer: vault.ini
The vault.ini file contains the Vault address, port, and connection parameters required by CyberArk components, including the CPM, to connect to the Digital Vault.
Question 5: What happens when the CPM fails to change a password on a target system?
- The account is immediately disabled in the Vault
- The CPM logs the failure and retries according to the configured retry policy (Correct answer)
- The original password is permanently deleted from the Vault
- An alert is sent to all Vault administrators automatically
Correct answer: The CPM logs the failure and retries according to the configured retry policy
When a password change fails, the CPM logs the error in pm.log and retries according to the retry interval and retry count defined in the platform or CPM configuration.
Question 6: Which Master Policy rule, when enabled, instructs the CPM to periodically rotate account passwords on a scheduled basis?
- Enforce check-in/check-out exclusive access
- Require periodic password change (Correct answer)
- Enforce one-time password access
- Require dual control password access approval
Correct answer: Require periodic password change
The 'Require periodic password change' Master Policy rule enables the CPM to automatically rotate account passwords at intervals defined in the associated platform settings.
Question 7: What is the purpose of a 'Reconcile' account in CyberArk CPM?
- To synchronize passwords between multiple Vault instances
- To verify the password stored in the Vault against the target system
- To reset an account's password when the CPM cannot change it using the regular account credentials (Correct answer)
- To merge duplicate account entries found in the Vault
Correct answer: To reset an account's password when the CPM cannot change it using the regular account credentials
A reconcile account is used to forcibly reset a managed account's password when the CPM cannot change it directly, such as when the password has been manually changed outside of CyberArk.
CAD Central Policy Manager (CPM) 1
What is the primary function of the Central Policy Manager (CPM) in CyberArk?