When installing the PSM and CPM components on the same Privilege Cloud Connector and

considering the hardening process, it's important to note that PSM settings override the CPM

settings when referring to the same parameter. This hierarchy is crucial in ensuring that the more

stringent security settings required by PSM, which typically handles direct interaction with end-user

sessions, take precedence over CPM settings. This setup helps maintain robust security practices by

applying the most restrictive configuration where conflicts occur.

For a Privilege Session Manager (PSM) server, the network requirements primarily focus on its ability

to interact with target systems securely and efficiently. The most accurate statement regarding these

requirements is:

It must reach the target system using its native protocols (Option A). This is essential for the PSM to

manage sessions effectively, as it needs to communicate using the protocols that the target systems

are configured to accept, such as SSH for Linux servers or RDP for Windows servers.

Reference: CyberArk’s PSM documentation typically outlines the need for PSM servers to have

network paths configured to communicate directly with target systems using the relevant protocols

to ensure secure and controlled session management.

In CyberArk Privilege Cloud, Multi-Factor Authentication (MFA) can be configured to enhance

security by requiring multiple methods of authentication from independent categories of credentials

to verify the user's identity. The available authentication methods include:

Windows Authentication: Leverages the user's Windows credentials.

PKI (Public Key Infrastructure): Utilizes certificates to authenticate.

RADIUS (Remote Authentication Dial-In User Service): A networking protocol that provides

centralized Authentication, Authorization, and Accounting management.

CyberArk: Uses CyberArk's own authentication methods.

LDAP (Lightweight Directory Access Protocol): Protocol for accessing and maintaining distributed

directory information services.

SAML (Security Assertion Markup Language): An open standard that allows identity providers to pass

authorization credentials to service providers.

OpenID Connect (OIDC): An authentication layer on top of OAuth 2.0, an authorization framework.

Reference for this can be found in the CyberArk Privilege Cloud documentation, which details the

integration and setup of MFA using these methods.

For customers using CyberArk Privilege Cloud Shared Services, the correct format for the CyberArk

Vault address is:

vault-.privilegecloud.cyberark.cloud (Option B). This format is used to access the vault

services provided by CyberArk in the cloud environment, where is the unique identifier

assigned to the customer’s specific instance of the Privilege Cloud.

Reference: CyberArk’s Privilege Cloud documentation provides details on how to access various

services, including the vault. The standard naming convention for accessing the vault services in the

cloud typically follows this format.

The correct statement about using the AllowedSafes platform parameter is that it prevents the

Central Policy Manager (CPM) from scanning all safes, restricting it to scan only safes that match the

AllowedSafes configuration. This parameter is crucial in large-scale deployments where efficiency

and resource management are key. By specifying which safes the CPM should manage, unnecessary

scanning of irrelevant safes is avoided, thus optimizing the CPM's performance and reducing the load

on the CyberArk environment. This configuration can be found in the platform management section

of the CyberArk documentation.

To correctly change the default PSM recordings folder path on the Privilege Cloud Connector, the sequence of steps should be: Create a corresponding folder in the new location. Before making changes to configuration files, ensure the new directory for PSM recordings is created. This is where all session recordings will be stored moving forward. In the Basic_psm.ini file, set RecordingsDirectory with the new path. Update the Basic_psm.ini file to reflect the new path for the recordings. This step is crucial as it directs the PSM to start using the newly created directory for all future session recordings. Restart the PSM service. After updating the path in the configuration file, restart the PSM service to apply the changes. This ensures that all new sessions are recorded in the new specified location. Run the PSMHardening script. Once the service is restarted and the new settings are in place, run the PSMHardening script. This script ensures that all security measures are re-applied to the new recordings directory, maintaining the security integrity of the session recordings. Following these steps in the given order will successfully change the recording directory for PSM sessions on the Privilege Cloud Connector, ensuring a smooth transition to the new storage location with all necessary security measures intact.

To properly arrange the steps for failing over to a passive Central Policy Manager (CPM) in CyberArk, the sequence should be as follows: Validate that the active CPM's services are stopped and set to manual. Before enabling the passive CPM, ensure that the services on the active CPM are stopped. This prevents any conflicts or data corruption by making sure that only one CPM is active at a time. Setting the services to manual ensures they do not restart automatically, which is crucial during a failover scenario. On the passive CPM, confirm details in the Vault.ini configuration file, reset the password to the CPM user, and recreate the credential file. This step involves making sure the passive CPM has the correct configuration to seamlessly take over operations. Adjustments in the Vault.ini file may be necessary to ensure it is pointing to the correct Vault and network settings. Resetting the password and recreating the credential file are critical to secure the login and authentication process for the newly active CPM. Enable the CPM services on the passive CPM. Once the passive CPM is correctly configured and ready, enable its services to begin handling the tasks and responsibilities of the primary CPM. This action effectively switches the role from passive to active, enabling the passive CPM to function as the new operational manager. Review logs to confirm the passive CPM services are running as expected. Finally, review the system and application logs to confirm that the now-active CPM is operating correctly and that all services have started without errors. This step is vital for verifying that the failover process was successful and that the system is stable. Following this ordered sequence ensures a smooth transition of roles from the active CPM to the passive CPM, minimizing downtime and potential disruptions in the privileged access management operations.

PSM for SSH supports various authentication methods, specifically focusing on secure and verified

access mechanisms. The supported methods include:

RADIUS (D): Remote Authentication Dial-In User Service (RADIUS) is a networking protocol that

provides centralized Authentication, Authorization, and Accounting management for users who

connect and use a network service. PSM for SSH utilizes RADIUS to authenticate SSH sessions, which

adds an additional layer of security by centralizing authentication requests to a RADIUS server.

Client Authentication Certificate (E): This method uses certificates for authentication, where a client

presents a certificate that the server verifies against known trusted certificates. This type of

authentication is highly secure as it ensures that both parties involved in the communication are

precisely who they claim to be, making it suitable for environments that require stringent security

measures.

These methods provide robust security options for SSH sessions managed through CyberArk's PSM,

ensuring that only authorized users can access critical systems.

The default username for the Privileged Session Manager (PSM) for SSH maintenance user in

CyberArk Privilege Cloud is psmp_maintenance. This account is used for maintenance purposes and

is integral for administrative tasks and configurations related to SSH sessions managed by the PSM.

The username is predefined and standardized across deployments to maintain consistency and

ensure security best practices are adhered to. The username is mentioned in the CyberArk official

documentation regarding PSM configuration for SSH.