In Conjur, secrets are stored as resources of the kind variable. The Conjur REST API provides the /resources endpoint to list all resources that the currently authenticated role has permission to see. To discover secrets, a client would make a GET request to this endpoint, typically filtering by kind=variable. This allows an application or user to programmatically discover which secrets they are authorized to retrieve without prior knowledge of the secret's specific path. This endpoint is fundamental to the service discovery capabilities within the Conjur platform.

B. Roles: This endpoint is used to list and manage roles (e.g., users, hosts, groups), which are identities, not the secrets themselves.

C. Policies: This endpoint is for loading and managing policy files. While policies define secrets, this endpoint does not list the instantiated secret resources.

D. WhoAmi: This endpoint is a utility that returns identity information about the currently authenticated client, not a list of accessible resources.

1. CyberArk Conjur Documentation

REST APIs

"List resources": The official documentation for the GET /resources/{account} endpoint explicitly states its function: "Lists resources visible to the current role. The list can be filtered by the resource kind and search string." This directly confirms that the Resources endpoint is used for discovery.

2. CyberArk Conjur Documentation

Policy

"Variable": This section of the documentation clarifies that a secret is declared in policy using the !variable tag. This establishes that secrets are a specific type of resource (kind: variable)

which can then be discovered via the /resources endpoint.

3. CyberArk Conjur Documentation

REST APIs

"Who Am I": The documentation for the GET /whoami endpoint confirms its purpose is to "Provide information about the current user

" which is unrelated to discovering secrets.

In the context of the CyberArk Vault Synchronizer, a Line of Business (LOB) is a construct used to delegate the administration of Safe synchronization. It is represented by a user group in the Vault or Privilege Cloud. This LOB group is responsible for managing which of its Safes are synced to Conjur. The LOB administrator grants the Synchronizer user the necessary permissions on their specific Safes, thereby facilitating the syncing of secrets required by that business group's applications without needing full Vault administrative privileges.

B. An LOB is a management construct for the Vault-to-Conjur sync process, not a direct grouping of application identities within Conjur policy itself.

C. This description is too generic. While policies are involved, the specific purpose of an LOB is to manage and delegate the synchronization of Safes.

D. LOBs are entirely unrelated to Conjur authenticators. Authenticators are mechanisms used by applications and hosts to prove their identity to Conjur.

1. CyberArk Vault Synchronizer Documentation

"Plan the Vault Synchronizer deployment"

Section: "Delegate Safe synchronization permissions": This section explicitly defines the LOB concept for the Synchronizer. It states

"To enable different lines of business (LOBs) to sync their Safes to Conjur

you can create LOBs and LOB Admins. An LOB is represented by a group of users in the Vault. The LOB Admin is a user who is a member of the LOB group. The LOB Admin adds the Synchronizer user as a member of the Safes that need to be synced to Conjur." This directly supports the role of an LOB as a business group facilitating the syncing of accounts.

The most common and recommended architecture for a production-grade Conjur deployment involves a hybrid model. The Conjur Leader cluster, which consists of the Leader and its Standbys, is deployed outside of the dynamic Kubernetes environment. This ensures the stability, resilience, and integrity of the central secrets management system of record. Followers, which are read-only replicas, are then deployed close to the applications they serve. This allows Followers to be flexibly deployed either inside the Kubernetes environment (e.g., as a DaemonSet) for low-latency access by pods, or outside the environment to serve other applications. This architecture decouples the core infrastructure from the application platform's lifecycle.

A. Standbys are integral to the Leader cluster's high-availability and are deployed with the Leader, not in a separate environment like Kubernetes while the Leader is outside.

C. This option is contradictory. If the "Leader cluster is deployed outside," its components, including Standbys, are by definition outside. Standbys cannot run independently inside Kubernetes in this scenario.

D. While an all-in-cluster deployment is technically possible, it is not the only scenario. The hybrid model (Leader outside, Follower inside) is a primary and officially documented deployment pattern.

1. CyberArk Conjur Enterprise Documentation - Conjur Enterprise Architecture: This official documentation page presents a clear architectural diagram showing the "Conjur cluster (Leader and Standbys)" as a central

external component. It then depicts Followers being deployed within various application environments

including a "Kubernetes/OpenShift Cluster". This directly supports the model described in option B. (Reference: CyberArk Documentation

Conjur Enterprise > Architecture and scaling > Conjur Enterprise Architecture).

2. CyberArk Conjur Open Source Documentation - System Architecture: The documentation for Conjur OSS describes the roles of each component. It explains that Followers "are used to scale out read access to Conjur" and are "typically located as close to the client population as possible." This principle justifies deploying Followers inside a Kubernetes cluster while the Leader remains external. (Reference: Conjur Open Source Documentation > Get Started > System Architecture).

3. CyberArk Conjur Open Source Documentation - Deploy a Follower in Kubernetes: This guide provides instructions for deploying a Follower into a Kubernetes cluster. The prerequisite is having an existing

running Conjur Leader

which in this hybrid model

resides outside the Kubernetes cluster being configured. This guide operationalizes the scenario described in option B. (Reference: Conjur Open Source Documentation > Platform Integrations > Kubernetes > Deploy a Follower in Kubernetes).

Auto-failover occurs in Option B (labeled "Leader unavailable; Leader not in quorum"). In a Distributed Vault or Conjur HA cluster using the Raft consensus algorithm, automatic promotion requires two conditions: the current Leader must be unreachable, and a healthy group of Standby nodes must possess a Quorum (majority). In this scenario, the Leader is network-partitioned away from the majority. The remaining Standby nodes still constitute a Quorum (2 out of 3 nodes), allowing them to safely elect a new Leader and maintain service availability.

Option A ("Leader unavailable; Leader in quorum") is incorrect because CyberArk logic prevents promotion if the unavailable Leader node is still part of the Quorum partition, avoiding potential data corruption or split-brain if the Leader service restarts.

Option C ("Leader available...") is incorrect because the system is operating normally; failover is only triggered during a failure.

Option D ("Leader unavailable; no quorum") is incorrect because the remaining nodes do not form a statistical majority (Quorum). Without a Quorum, the cluster cannot elect a new Leader and defaults to Read-Only mode.

CyberArk Docs, "Auto-failover | Secrets Manager Enterprise (Conjur)", Section: The quorum rule.

Quote: "Auto-failover does not occur in the following situations: ... If the Leader is in the quorum, promotion attempts are not started."

CyberArk Docs, "Auto-failover | Secrets Manager Enterprise (Conjur)", Section: How it works.

Quote: "If the number of nodes still able to communicate represents a majority (i.e. a quorum), those nodes make decisions about what to do about the failure."

CyberArk Docs, "Distributed Vaults during Vault failure", Section: Failover scenarios.

Context: Describes the promotion of a Candidate Vault when the Primary is unavailable and conditions (Quorum) are met.

An "SSL connection refused" error is a specific Transport Layer Security (TLS) handshake failure. In a CyberArk Conjur environment, this error commonly occurs when the client attempts to connect to a Follower whose hostname is not included in the Subject Alternative Name (SAN) field of the server certificate. The client's TLS library cannot validate the identity of the server it is connecting to, as the name in the URL does not match any of the names the certificate is valid for. The correct and secure resolution is to generate a new certificate that includes the DNS names of the Master, all Standbys, and all Followers in the SAN list, and then redeploy it across the cluster.

B. PostgreSQL ports (5432, 1999) are used for database replication between the Master and Followers, not for client-facing REST API traffic, which occurs over HTTPS.

C. A blocked port 443 would typically cause a TCP-level "connection timed out" or generic "connection refused" error, preventing the TLS handshake from even starting.

D. Suppressing SSL certificate checking is a significant security vulnerability. It circumvents the problem rather than solving it and should never be used in a production environment.

1. CyberArk Conjur Enterprise Documentation

"Deploy a Conjur Cluster": In the "Before you begin" section for deploying a cluster

the documentation explicitly states a key prerequisite: "A server certificate/key pair for the Conjur Leader

Standbys

and Followers. The certificate must include the DNS names and/or IP addresses of all the nodes in the cluster in the Subject Alternative Name (SAN) extension." This directly supports the reasoning that a missing SAN for the Follower will cause connection issues.

2. CyberArk Conjur Enterprise Documentation

"Troubleshooting": The troubleshooting guide for installation often lists certificate misconfiguration as a primary cause for connectivity problems. Specifically

it notes that for SSL/TLS to work correctly

"the FQDN of every node in your HA cluster (Leader

Standbys

and Followers) must be included in the certificate's Subject Alternative Name (SAN) list." This confirms that the absence of the Follower's hostname is the root cause of the SSL error.

An HTTP 422 Unprocessable Entity response code is specifically used by the Conjur API to indicate that the server understood the request to load a policy, but the content of the policy file itself is invalid. While the request format is correct, the policy YAML contains semantic errors, such as incorrect syntax, references to non-existent entities, or logical inconsistencies. The server cannot process or apply these invalid instructions, and therefore rejects the policy file with a 422 status, often accompanied by a message detailing the specific error within the policy.

B. An incorrect Leader URL would cause a client-side connection failure, a DNS error, or a 404 Not Found HTTP response, not a 422.

C. A misconfigured load balancer health check would affect service availability, likely resulting in connection timeouts or 503 Service Unavailable errors.

D. The Vault Conjur Synchronizer is a separate component; its configuration is irrelevant to a user or script directly loading a policy via the Conjur API.

1. CyberArk Conjur Documentation

REST APIs

"Load policy": The official API documentation for the policy loading endpoint (POST /policies/{account}/policy/{policyid}) explicitly lists the possible response codes. It states that a 422 Unprocessable Entity code is returned when "The policy text is invalid." This directly links the error code to a malformed or invalid policy file. (Reference: Conjur v13.2 Documentation

REST APIs > Policies > Load policy).

2. IETF RFC 4918

Section 11.2: This RFC defines the 422 Unprocessable Entity status code. It specifies that this code is used when "the server understands the content type of the request entity... but was unable to process the contained instructions." This aligns with Conjur's use of the code for a syntactically correct request containing a semantically flawed policy file. (DOI: https://doi.org/10.17487/RFC4918).

To enable authenticators in CyberArk Conjur, you must first define the security policy that governs them. Once the policy is loaded, the specific authenticator instances (identified by type and Service ID) must be whitelisted in the conjur.yml configuration file on the Conjur Master/Follower. Finally, to commit these environment-level changes and restart the necessary internal services to recognize the new authenticators, the evoke configuration apply command must be executed. This sequence ensures that the identity provider is both logically defined in the database and physically enabled in the server configuration.

CyberArk Documentation: Enable authenticators, Section: "Configure the Authenticator," steps for defining policy and updating configuration files.

CyberArk Conjur Reference: The evoke command utility, Section: "evoke configuration apply" usage for applying changes to conjur.yml.

CyberArk Implementation Guide: Authenticator Policy Management, Chapter 4: Identity and Access Management, Subsection: "Loading Authenticator Web Services."

The configuration process follows a logical progression of establishing a core and then replicating it. First, Configure the Leader initializes the Conjur appliance and database. Once the Leader is running, you Import 3rd-party certificates (using commands like evoke ca import) to replace the default self-signed certificates. This step must happen before Standbys are created because Standbys inherit their security configuration and certificate chain from the Leader via "seed files." Before generating these seeds, you must Verify the Conjur Leader configuration to ensure the new certificates are correctly loaded and the service is healthy. Finally, you Configure Standbys using the seed files generated from the verified Leader, ensuring a consistent SSL/TLS identity across the cluster.

CyberArk Docs (Secrets Manager Enterprise 13.x/14.x): "Certificate requirements" section states that 3rd-party certificates are imported onto the Master (Leader) as part of the cluster configuration and are subsequently shared with Standbys.

CyberArk Evoke Command Reference: The evoke configure leader command sets up the initial node, while evoke ca import is used post-configuration to apply custom TLS/SSL credentials.

CyberArk Installation Guide (CAU-02 Conjur Fundamentals): Explicitly lists the implementation sequence as: (1) Run Evoke to Configure Leader, (2) Import Third-Party SSL Certificates, (3) Verify Configuration/Health, (4) Configure Standbys.

CyberArk Documentation: "Configure the Secrets Manager cluster" outlines that Standby nodes are configured only after the Leader is established and the necessary environment (including certs) is ready for seed generation.

The CreateEnv utility is a critical part of the Credential Provider (CP) installation process. It is responsible for creating the necessary Vault environment, which includes the CP application user, the safe for storing the appprovideruser.cred file, and the required permissions. Even if the main installation wizard completes, errors reported during the CreateEnv stage indicate that the CP will not be able to authenticate to the Vault or function correctly. The CreateEnv.log file contains the detailed output and specific error messages from this utility, making it the essential first step for diagnosing and resolving the underlying issue, which is often related to permissions of the installing user.

A. Ignoring the error is incorrect. A failure during environment creation means the CP cannot authenticate to the Vault, rendering it non-functional despite a "successful" software installation.

C. Rerunning the installation without first diagnosing the problem from the log file is inefficient. The issue might not be related to privileges, and this action would not address the root cause.

D. The CreateEnv utility primarily uses command-line communication with the Vault, not PVWA REST APIs. Therefore, PVWA logs are not the correct place to investigate these specific installation errors.

1. CyberArk Credential Provider and ASCP Implementation Guide: In the "Install the Credential Provider" section

under "Troubleshooting the Credential Provider installation

" the guide specifies reviewing the installation log files. The CreateEnv.log is explicitly mentioned as the log file for the Vault environment creation stage. It states

"During installation

the following log files are created in the Temp folder: ... CreateEnv.log – Contains information about the creation of the Credential Provider environment in the Vault." This confirms that this log is the designated source for investigating such errors.

2. CyberArk Privileged Access Security Installation Guide: The guide details the prerequisites for the user performing the installation

including the necessary Vault authorizations (e.g.

Add/Update Users

Add Safes). The CreateEnv.log file will contain errors if these permissions are insufficient

directly linking the log file to troubleshooting permission-related installation failures. The section on "Credential Provider Installation" outlines the steps performed by CreateEnv

confirming its role and the importance of its successful execution.

Conjur is designed for cloud-native and DevOps environments, supporting modern identity protocols like OIDC and JWT for workload authentication. The Credential Provider (CP) is a local agent that provides the fastest performance because it caches secrets locally, eliminating network latency during retrieval. The Central Credential Provider (CCP) is the agentless deployment of the Secrets Manager, which utilizes a REST API and authenticates callers based on their OS User, IP address, or Client Certificate without requiring a local agent on the application host. ASCP (Application Server Credential Provider) is a specific solution for legacy Java application servers and does not fit the primary descriptors of these scenarios.

CyberArk Documentation: Credential Providers - Credential Provider (CP) Overview. This section highlights the use of local caching to provide the highest performance and availability for business-critical applications.

CyberArk Documentation: Central Credential Provider (CCP) - Introduction. This documentation defines CCP as the agentless method of secrets retrieval and lists "OS User" as a primary authentication method.

CyberArk Conjur Documentation: Authenticators - JWT/OIDC. This section details how Conjur handles secret retrieval via token-based authentication for Kubernetes and cloud platforms.

CyberArk University: Secrets Management Fundamentals (Course Materials). Discusses the selection criteria between CP (performance/availability) and CCP (low footprint/agentless).