Yes, this is a core capability of the Privileged Session Manager (PSM). When direct root login via SSH is disabled on a target Unix system (a security best practice), CyberArk uses a "logon account." The PSM-SSH connection component first initiates an SSH session to the target using the credentials of this less-privileged logon account. Once connected, the PSM automatically executes a command, typically su - root, to elevate the session's privileges to the root user. This entire two-step process is transparent to the end-user who simply clicks 'Connect', allowing them to gain root access securely without violating the target system's security policy.

A. PMTerminal.exe is a Central Policy Manager (CPM) process used for automated password management tasks, not for initiating interactive user sessions via PSM.

C. This statement is incomplete. While a logon account is necessary, the connection must be brokered by a PSM connection component configured to use it for privilege elevation.

D. This is incorrect. Facilitating privileged access in environments where direct root login is disabled is a fundamental function and security feature of CyberArk PSM.

1. CyberArk Privileged Access Security Documentation

"PSM for SSH": "When a user connects to a target machine with an account that does not have login permissions (for example

the root account)

you can associate a logon account with the privileged account. PSM for SSH first logs on to the target machine with the logon account

and then uses the privileged account to complete the login process." (This describes the exact mechanism in option B).

2. CyberArk Privileged Access Security Documentation

"Connect to Target Systems": In the section detailing PSM for SSH connections

the documentation outlines the workflow: "PSM for SSH uses the logon account to log on to the target machine

and then uses the su command to switch to the privileged target account." (This confirms the use of a logon account and subsequent privilege escalation).

3. CyberArk Privileged Access Security Documentation

"Platforms and Safes": When configuring a Unix platform

the parameters for connection components explicitly include options to use a logon account. The description for these settings clarifies that this is for scenarios where the target account (e.g.

root) cannot log in directly.