CAD Setup 3 — Questions and Answers
Question 1: Which CyberArk component should be installed in the DMZ to facilitate RDP and SSH session proxying?
- CPM
- PVWA
- PSM (Correct answer)
- AIM
Correct answer: PSM
The Privileged Session Manager (PSM) is typically deployed in the DMZ to act as a jump server for proxying RDP and SSH sessions to target systems.
Question 2: What is the significance of the 'Operator' CD in a CyberArk Vault installation?
- It contains the Vault installation binaries
- It holds the Vault encryption keys used for disaster recovery (Correct answer)
- It stores the PVWA configuration backup
- It contains the PSM recording files
Correct answer: It holds the Vault encryption keys used for disaster recovery
The Operator CD (or USB) contains the Vault's master encryption keys, which are essential for disaster recovery and Vault restoration scenarios.
Question 3: During CyberArk setup, Safe creation for CPM operations requires which minimum permission for the CPM user?
- List Accounts
- Manage Safe
- Add Accounts (Correct answer)
- Retrieve Accounts
Correct answer: Add Accounts
The CPM user needs at minimum 'Add Accounts' and related permissions on the Safe to store and manage the passwords it is responsible for rotating.
Question 4: What is the recommended network placement for the CyberArk Vault server itself?
- In the DMZ alongside the PVWA
- In an isolated network segment with strictly controlled access (Correct answer)
- On the same subnet as domain controllers
- In a publicly accessible cloud region
Correct answer: In an isolated network segment with strictly controlled access
The Vault should be placed in a highly restricted, isolated network segment with minimal open firewall rules to reduce its attack surface.
Question 5: When setting up CyberArk with high availability, what role does a 'DR Vault' play?
- It load-balances user authentication requests
- It serves as a hot standby that can take over if the primary Vault fails (Correct answer)
- It caches passwords locally for offline access
- It provides read-only reporting access to Vault data
Correct answer: It serves as a hot standby that can take over if the primary Vault fails
A DR (Disaster Recovery) Vault continuously replicates data from the primary Vault and can be promoted to take over operations if the primary becomes unavailable.
Question 6: Which file on the CyberArk Vault server controls the maximum number of concurrent Vault connections?
- PVWA.ini
- DBParm.ini
- Vault.ini (Correct answer)
- PARAgent.ini
Correct answer: Vault.ini
The Vault.ini file contains configuration parameters including connection limits that control how many concurrent client connections the Vault accepts.
Question 7: After installing PSM, which CyberArk configuration step enables users to connect through it via the PVWA?
- Enabling PSM in the PVWA System Configuration and linking it to a PSM Server Safe (Correct answer)
- Installing the PSM client agent on every end-user workstation
- Creating a dedicated Active Directory OU for PSM accounts
- Generating a new SSL certificate and importing it into the Vault
Correct answer: Enabling PSM in the PVWA System Configuration and linking it to a PSM Server Safe
The PSM must be enabled in PVWA's System Configuration settings and associated with the correct PSM Server Safe so PVWA can route connection requests through it.
CAD Setup 3
Which CyberArk component should be installed in the DMZ to facilitate RDP and SSH session proxying?