CPC-CDE-RECERT CyberArk CDE-CPC Recertification Questions and Answers

In a PSM Load Balanced Virtual Server Configuration, the default service ports/protocols used are RDP/3389 and HTTPS/443. RDP (Remote Desktop Protocol) typically uses port 3389 for remote desktop services, which is essential for PSM functionalities involving remote sessions. HTTPS, which utilizes port 443, is used for the PSM Health Check service to ensure secure and encrypted communication during the monitoring and health verification processes of the PSM services.

The default authentication profile to access CyberArk Identity is typically the Default New Device Login Profile. This profile is used to manage the authentication settings and security measures for devices accessing CyberArk services for the first time. It includes configurations such as authentication methods, security checks, and compliance requirements, ensuring that new devices meet the organization’s security standards before gaining access.

https://docs.cyberark.com/privilege-cloud-shared-services/Latest/en/Content/Privilege%20Cloud/privCloud-connect-siem.htm

CyberArk’s official outbound traffic/network requirements explicitly list the two Privilege Cloud cloud-side endpoints that are required for Secure Tunnel communications (for REST/API calls over HTTPS/443):

Backend service management (Required for Secure Tunnel): https://console.privilegecloud.cyberark.com

Connector (Required for Secure Tunnel): https://connector- .privilegecloud.cyberark.com

These map directly to answer choices A (console) and B (connector-).

Note: Your options use the .cyberark.cloud domain, while CyberArk’s network requirements documentation shows these endpoints in the .cyberark.com domain for Privilege Cloud. The service roles (Console + Connector endpoint) are what Secure Tunnel must reach, and those are the two “Required for Secure Tunnel” services in the official requirements.

Why the other options are not selected (based on what’s “required for Secure Tunnel” in the official allowlist guidance):

C (backend-services…): Not listed in CyberArk’s published “Required for Secure Tunnel” FQDN allowlist entries (console + connector are).

D (telemetry…): Telemetry is a separate capability (dashboards / utilization tracking) and is not documented as the required Secure Tunnel service endpoint.

E (update…): Secure Tunnel upgrade/download processes are documented, but “update.*” is not listed as a required Secure Tunnel cloud endpoint in the outbound allowlist table.

https://docs.cyberark.com/pam-self-hosted/11.4/en/content/pas%20inst/following-central-policy-manager-installation.htm

On CyberArk Privilege Cloud, updating users' permissions on safes can be done through the Privilege Cloud Portal and the REST API. The Privilege Cloud Portal provides a user-friendly graphical interface where administrators can manage user permissions directly within the portal's safe management settings. Additionally, the REST API offers a programmable way to automate permission updates across safes, which is especially useful for bulk changes or integrating with other management tools. Both methods provide effective means to manage and customize access controls in a CyberArk environment, allowing for detailed permission settings per user on specific safes.

CyberArk’s PSM for SSH administration documentation explains how to create maintenance access by updating the SSH daemon configuration:

In /etc/ssh/sshd_config, add an AllowGroups entry that includes the maintenance group(s):AllowGroups PSMConnectUsers ..

This matches option C exactly: you enable the additional maintenance user by placing them in the group(s) referenced by AllowGroups in sshd_config.

CyberArk explicitly states that you must move PSM application users (PSMConnect/PSMAdminConnect) to domain users on Windows 2019/2022 when:

you are using RDS CAL per-user licensing, and

you want to extend PSM sessions beyond one hour.

To correctly change the default PSM recordings folder path on the Privilege Cloud Connector, the sequence of steps should be:

Create a corresponding folder in the new location.Before making changes to configuration files, ensure the new directory for PSM recordings is created. This is where all session recordings will be stored moving forward.

In the Basic_psm.ini file, set RecordingsDirectory with the new path.Update the Basic_psm.ini file to reflect the new path for the recordings. This step is crucial as it directs the PSM to start using the newly created directory for all future session recordings.

Restart the PSM service.After updating the path in the configuration file, restart the PSM service to apply the changes. This ensures that all new sessions are recorded in the new specified location.

Run the PSMHardening script.Once the service is restarted and the new settings are in place, run the PSMHardening script. This script ensures that all security measures are re-applied to the new recordings directory, maintaining the security integrity of the session recordings.

Following these steps in the given order will successfully change the recording directory for PSM sessions on the Privilege Cloud Connector, ensuring a smooth transition to the new storage location with all necessary security measures intact.

In the Privilege Cloud LDAP integration workflow, CyberArk lists the default maps (built-in directory maps) as:

Vault Admins

Safe managers

Auditors

Users

Since the question asks for the default roles in addition to Vault Admins and Auditors, the remaining two default map roles are Safe managers and Users, which correspond to A and D.

CyberArk recommends placing connector host machines geographically as close as possible to their targets to reduce latency and (practically) minimize WAN traffic between sites.

Since CPM password rotations/verifications occur between the CPM component and the target systems in the customer network, deploying CPM connectors in each data center (near those local targets) and organizing/segregating by region (for example via region-specific Safes/target scoping) is the design that best reduces cross–data-center traffic.

In Privilege Cloud, each Safe controls its own retention policy for account/password objects. CyberArk documentation states that when retention is set by Number of days, the default retention is 7 days.

In CyberArk Privilege Cloud, when connecting to a target server using the Privileged Session Manager (PSM) for SSH, the correct syntax for the SSH command includes the following format: ssh neil@linuxuser01#acme.corp@192.168.1.164@192.168.65.145. This syntax breaks down as follows:

neil: The CyberArk username.

linuxuser01#acme.corp: The domain user on the target Linux server, formatted as username#domain.

192.168.1.164: The IP address of the target Linux server.

192.168.65.145: The IP address of the PSM for SSH server.

This specific format ensures that the CyberArk Privileged Access Manager correctly interprets and routes the connection through the PSM for SSH to the intended target server.

For PSM Web Connectors developed using the CyberArk Plugin Generator Utility (PGU), the supported browser is Google Chrome. This is because the PGU is designed to create plugins that are most compatible with Chrome's web technologies and security frameworks. Chrome is generally recommended by CyberArk for its up-to-date security features and extensive support for web applications. This is further supported by the CyberArk documentation on the Plugin Generator Utility, which specifies browser compatibility and the optimal environment for deploying web connectors.

CyberArk’s Privilege Cloud guidance for PSM high availability explicitly ties multiple PSM instances to high availability and load balancing implementations, i.e., redundancy is achieved by deploying multiple PSMs and placing them behind a load balancer.

In large-scale environments, to enable the Central Policy Manager (CPM) to focus its search operations on specific Safes instead of scanning all Safes it sees in the Vault, the AllowedSafes parameter on each platform policy is used. This parameter can be configured within the platform settings in the CyberArk administration interface. By specifying safes in the AllowedSafes parameter, the CPM will only manage credentials within those designated safes, thereby optimizing performance and managing resources more efficiently by not scanning unnecessary safes. This setting is crucial for large environments where the CPM needs to be as efficient as possible due to the volume of managed accounts.

CyberArk defines MaxConcurrentConnections as: “The maximum number of connections that can be opened between the Central Policy Manager and the remote machine where the passwords are replaced.”

That is exactly option A.

In the Privilege Cloud Shared Services model, user access and MFA are driven through CyberArk Identity / Shared Services, and CyberArk publishes a dedicated list of “MFA options in Shared Services” for the user portal and supported challenges.

In CyberArk PAM Self-Hosted, MFA is typically achieved by enabling and integrating additional authentication methods such as RADIUS, SAML, PKI, LDAP, Windows, CyberArk, etc., depending on the organization’s design.

So, the accurate comparison is that Privilege Cloud (Shared Services) leverages CyberArk Identity, while PAM Self-Hosted relies on enabling/integrating the relevant authentication/MFA methods in the self-hosted environment → B.

In the Shared Services model, MFA enforcement is done in CyberArk Identity / Identity Administration using Core Services > Policies:

To enforce MFA broadly, CyberArk documents configuring MFA for all users by enabling authentication policy controls and creating/assigning an authentication profile (the mechanisms/challenges).

To require users to set up MFA factors, CyberArk documents the setting under User Security Policies > User Account Settings where you specify the minimum number of authentication factors users must configure upon login.

Option B is the only choice that correctly points you to the right place and activity (Identity Administration Policies to configure authentication/MFA requirements and enrollment requirements).

CyberArk documents that the health check service returns HTTP 200 (OK) when the PSM service is healthy, and returns 503 (Service unavailable) when it is not healthy (in code-based behavior).

https://docs.cyberark.com/pam-self-hosted/latest/en/content/pas%20inst/install_psm_harden.htm#HardenInDomaindeployments

To configure a platform to work with load-balanced Privileged Session Managers (PSMs), you should:

Create a new PSM definition that targets the load balancer IP address and assign it to the platform (Option B). This approach involves configuring the platform settings to direct session traffic through a load balancer that distributes the load across multiple PSM servers. This is effective in environments where high availability and fault tolerance are priorities.

CyberArk’s Connector Management prerequisites check defines the exact network connectivity rules that must pass before installation:

VaultConnectivity → Connect to the Privilege Cloud backend on TCP 1858

TunnelConnectivity → Connect to the Secure Tunnel on TCP 443

CustomerPortalConnectivity → Connect to the service backend URL on TCP 443

This matches option A exactly.

CyberArk’s Privilege Cloud SAML configuration documentation explicitly states: Privilege Cloud supports only one assertion and instructs you to ensure only one assertion is configured in the IdP.