When a DR Vault Server becomes an active vault, it will automatically fail back to the original state once the Primary Vault comes back online.
Correct Answer: C
Explanation When a DR Vault Server becomes an active vault, it will automatically fail back to the original state once the Primary Vault comes back online, if the AllowFailback setting is set to "yes" in the padr.ini file. The padr.ini file is the configuration file for the Disaster Recovery application, which enables the DR Vault to replicate data from the Primary Vault and take over its role in case of a failure. The AllowFailback setting determines whether the DR Vault will automatically switch back to the passive mode when the Primary Vault is restored. The default value of this setting is "no", which means that the DR Vault will remain active until a manual failback is performed1. To enable the automatic failback, the setting must be changed to "yes" and the padr service must be restarted1. The dbparm.ini file is not relevant to this setting, as it is the main configuration file for the Vault database2. References: * Configure the DR Vault - CyberArk, section "AllowFailback" * DBParm.ini - CyberArk, section "Main parameters"
Question 32
Which of the Following can be configured in the Master Poky? Choose all that apply.
Correct Answer: A,B,C,H
Explanation The Master Policy is a centralized overview of the security and compliance policy of privileged accounts in the organization. It allows the administrator to configure compliance driven rules that are defined as the baseline for the enterprise. The Master Policy includes the following main concepts1: * Basic policy rules: These rules allow the administrator to define specific aspects of privileged account management, such as privileged access workflows, password management, session monitoring and auditing. * Advanced policy rules: Some basic policy rules have related advanced settings that provide more granular control over the policy enforcement. * Exceptions: These are policy rules that differ from the overall Master Policy for a specific scope of accounts, such as accounts associated with a specific platform. The Master Policy rules are divided into four sections2: * Privileged Access Workflows: These rules define how the organization manages access to privileged accounts, such as requiring dual control, one-time passwords, exclusive passwords, transparent connections, reason for access, etc. * Password Management: These rules determine how passwords are managed, such as requiring password change, password verification, password reconciliation, ticketing integration, required properties, custom connection components, etc. * Session Management: These rules determine whether or not privileged sessions are recorded and how they are monitored, such as requiring session isolation, session recording, session audit, etc. * Audit: This rule determines how Safe audits are retained, such as specifying the audit retention period. Based on the above information, the following options can be configured in the Master Policy: * A. Dual Control: This is a basic policy rule in the Privileged Access Workflows section that determines whether users need to get approval from authorized users before accessing a privileged account2. * B. One Time Passwords: This is a basic policy rule in the Privileged Access Workflows section that determines whether users can only use a password once before it is changed2. * C. Exclusive Passwords: This is a basic policy rule in the Privileged Access Workflows section that determines whether users need to check out a password and prevent other users from accessing it until it is checked in2. * H. Password Aging Rules: This is a basic policy rule in the Password Management section that determines how often passwords need to be changed2. The following options cannot be configured in the Master Policy: * D. Password Reconciliation: This is not a policy rule, but a process that restores the password of a privileged account to the value that is stored in the Vault, in case it is changed or out of sync3. * E. Ticketing Integration: This is not a policy rule, but a feature that enables the integration of the Vault with external ticketing systems, such as ServiceNow, Jira, etc. * F. Required Properties: This is not a policy rule, but a platform setting that determines which properties are mandatory for adding accounts to a platform. * G. Custom Connection Components: This is not a policy rule, but a platform setting that determines which connection components are used to connect to target systems, such as PVWA, PSM, PSMP, etc. References: * 1: The Master Policy * 2: Master Policy Rules * 3: Password Reconciliation * : Ticketing Integration * : Required Properties * : Custom Connection Components
Question 33
When should vault keys be rotated?
Correct Answer: D
Question 34
Which permissions are needed for the Active Directory user required by the Windows Discovery process?
Correct Answer: D
Question 35
To ensure all sessions are being recorded, a CyberArk administrator goes to the master policy and makes configuration changes. Which configuration is correct?
Correct Answer: C
Explanation This configuration ensures that privileged sessions are monitored and isolated, and all session activities are recorded and saved for future reference 1.
