CAD Access Controls 1 — Questions and Answers
Question 1: What is the purpose of role-based access control (RBAC) in CyberArk?
- Allow unrestricted access
- Assign access by age group
- Restrict access based on job role (Correct answer)
- Log keystrokes from users
Correct answer: Restrict access based on job role
Role-based access control (RBAC) in CyberArk allows administrators to define permissions and access rights based on a user's specific job function or role within the organization. This simplifies access management, enforces the principle of least privilege, and ensures users only have access to the resources absolutely necessary for their duties, enhancing security and compliance.
Question 2: Which CyberArk component allows definition of user access to safes?
- Session Manager
- Vault CLI
- PVWA (Correct answer)
- CPM
Correct answer: PVWA
The CyberArk PVWA (Privileged Access Security Web Access) is the primary interface through which administrators configure and manage user access to safes and their contents. It provides the graphical tools and functionalities to define permissions, assign users to safes, and set policies for credential usage, centralizing access control management.
Question 3: What permission is required to retrieve passwords from a safe?
- Delete
- List Contents
- Retrieve (Correct answer)
- Manage Policies
Correct answer: Retrieve
To access and utilize a password stored within a CyberArk safe, a user must be granted the specific 'Retrieve' permission for that safe. This permission allows the user to view or utilize the stored credential, adhering to the principle of least privilege by separating it from other management or administrative permissions within the safe.
Question 4: Which setting can enforce session approval in CyberArk?
- User preferences
- Dual control (Correct answer)
- Retention policy
- Session speed
Correct answer: Dual control
Dual control is a critical security setting in CyberArk that enforces a 'four-eyes' principle, requiring a second authorized user to approve a privileged session request before it can be initiated. This significantly enhances security for highly sensitive operations by preventing a single point of failure or malicious activity, adding an extra layer of oversight.
Question 5: Which user permission is required to manage other user roles in CyberArk?
- Backup Vault
- List Safes
- Manage Users (Correct answer)
- Edit Reports
Correct answer: Manage Users
To manage other user roles in CyberArk, the 'Manage Users' permission is explicitly required. This permission grants the necessary administrative privileges to create, modify, or delete user accounts and their associated roles and permissions within the CyberArk platform. It ensures proper access control and security management by allowing designated administrators to control who can access and perform actions within the system.
Question 6: What is the effect of the 'Audit' permission in a safe?
- Edit safe contents
- Delete safe records
- View audit trail (Correct answer)
- Create new safes
Correct answer: View audit trail
The 'Audit' permission in a CyberArk safe specifically grants the ability to view the audit trail. This allows users to review all actions performed within that safe, such as accessing, retrieving, or modifying credentials. Viewing the audit trail is crucial for security monitoring, compliance, and investigating any suspicious activities or incidents within the safe.
CAD Access Controls 1
What is the purpose of role-based access control (RBAC) in CyberArk?