GUARD CyberArk Guardian Exam Questions and Answers

The CyberArk Digital Vault uses the DBParm.ini configuration file to define operational parameters affecting the Vault Server, including logging, communication, and service behavior.

The LogRetention parameter specifies how long relevant Vault log records are retained before they become eligible for removal.

According to the behavior described by this legacy parameter, expired log records are cleared during the Vault Server startup process. At startup, the server can evaluate retention settings and perform the corresponding cleanup operations.

This means the retention period defines the eligibility threshold for removing records, while the server lifecycle determines when the cleanup operation is performed.

Stopping the service does not independently execute the startup cleanup operation. Additionally, an administrator is not ordinarily required to perform individual manual deletions of expired records governed by this mechanism.

It is important to distinguish operational log retention from other CyberArk retention controls. Vault audit records, external SIEM archives, privileged session recordings, and disaster recovery replicas may have separate retention requirements.

Administrators should therefore validate the relevant logging configuration and applicable audit obligations before modifying retention settings.

The architecture must deliver regional availability, disaster recovery, and centralized privileged-access governance without unnecessarily duplicating CyberArk infrastructure.

Option A establishes one authoritative Primary Vault in UK DC 1, maintaining a single Master Policy across the environment.

A DR Vault in UK DC 2 provides recovery capability if the primary datacenter becomes unavailable. Additional DR Vaults in the USA and Hong Kong provide geographically distributed recovery options.

PVWA and PSM instances are deployed across all six datacenters, supporting resilient user access and regional load balancing.

CPM instances are deployed in the primary UK datacenter and the principal remote regions, allowing credential management to be distributed according to target-system proximity and network availability.

The primary PTA and secondary PTA deployment provides additional resilience for privileged threat analytics.

Option B omits the DR Vault from the secondary UK datacenter, weakening local recovery arrangements.

Option C introduces independent Primary Vault environments, which conflicts with the requirement for one authoritative Master Policy.

Option D deploys additional DR Vaults and CPM instances beyond the stated minimum.

Technical warning / qualification: This is the minimum topology intended by the Guardian question, not a guarantee of zero-downtime recovery. DR promotion, component routing, licensing, replication integrity, and actual RTO/RPO requirements require independent design validation.

Technical warning / qualification: Hong Kong is a Special Administrative Region of China; the source's geographic designation “ROC” is inaccurate.

Original description / order

Correct match

Added and fetched in OpenSSH format

Public Keys

Manage policies and maintain consistency

Host Factory — intended by elimination

Immutable permission events and records across entire infrastructure

Audit

Engine to manage users, groups, hosts, and layers

Directory

CyberArk Conjur includes services for managing machine identities, authorization policies, cryptographic public keys, and security audit information.

The Public Keys service manages public keys associated with Conjur identities. These keys can support SSH-based authentication and are commonly represented in OpenSSH format.

The Directory service organizes identity resources, including users, groups, hosts, and layers. These resources provide the foundation for policy-based authorization and controlled secrets retrieval.

The Audit service records security-relevant activities, including authentication and authorization events. Such records support operational investigation, accountability, and security monitoring. Audit durability depends on the deployment and protected log-storage configuration.

Host Factory enables automated creation and enrollment of host identities. It uses policy-controlled, time-limited enrollment tokens to allow newly provisioned workloads to become members of authorized Conjur layers without granting broad administrative permissions.

The second description in the exhibit is technically imprecise. Host Factory is not the general mechanism for maintaining Conjur policies. Policy files and Conjur's policy-management interfaces govern authorization definitions.

Nevertheless, Host Factory is the intended remaining match among the four supplied choices.

Technical warning / qualification: The second description should be rewritten to Automates the creation and enrollment of host identities using policy-controlled tokens.

The CyberArk Digital Vault Security Standard establishes strict controls over the operating system and software installed on Vault servers.

The Vault is intended to operate as a dedicated, hardened security appliance with a minimized attack surface.

Installing unnecessary third-party applications introduces additional services, executables, network dependencies, and potential vulnerabilities that can undermine the Vault's security isolation.

However, certain infrastructure integrations require supported device drivers or vendor-specific cryptographic libraries.

Examples include Hardware Security Module drivers, storage-controller drivers, and supported network-interface components required for the Vault to communicate with essential hardware.

Such components may be installed when they are necessary for the supported architecture and comply with CyberArk's installation and security requirements.

The presence of an organizational policy requiring antivirus software does not automatically establish that installing an arbitrary antivirus agent on the Vault is supported.

Likewise, compliance with a general organizational software standard does not override the Vault Security Standard.

Option A is too absolute because some infrastructure integrations require approved third-party components.

Technical warning / qualification: Option B is the intended answer, but it should not be interpreted as unrestricted permission to install any SAN, HSM, or NIC driver. Supported versions and approved installation procedures must be confirmed.

CyberArk Export Vault Data (EVD) provides a reporting interface that extracts Vault information into structured files or supported database destinations.

It can be used for operational reporting, compliance analysis, entitlement reviews, and integration with external reporting platforms.

The OwnersList export provides information about Safe ownership and the permissions associated with Safe members.

This makes it relevant when an administrator needs to determine which authorizations have been assigned to a particular Vault user or group.

In this scenario, the administrator must identify Safe permissions granted to the built-in DR Users group.

The relevant ownership records can be examined to determine the Safes in which this group is a member and the corresponding authorizations.

The SafesList output primarily concerns Safe inventory information, while UsersList describes Vault users rather than providing the required Safe-permission mapping.

The uploaded question identifies OwnersList as the appropriate export.

The CyberArk Blueprint establishes a risk-based, phased approach to implementing privileged access management and identity security controls. C3 Alliance integrations should be introduced according to their contribution to risk reduction, security operations, and organizational readiness.

Stage 1 prioritizes foundational security controls and integrations with third-party security tools. These may include vulnerability management, security monitoring, and discovery solutions that rely on highly privileged credentials. Securing these integrations early reduces the exposure of powerful service accounts and improves the organization's ability to monitor privileged activity.

Stage 2 extends the program to commonly deployed technologies and third-party business applications. Robotic Process Automation platforms, such as UiPath and Automation Anywhere, frequently use service accounts to interact with enterprise systems. Integrating these applications with CyberArk enables centralized credential management and reduces dependence on embedded or hard-coded credentials.

Implementing every integration in Stage 1 would unnecessarily increase deployment complexity and potentially delay foundational security improvements. Conversely, deferring essential security integrations until Stage 3 would postpone meaningful risk reduction.

The appropriate implementation sequence balances security impact, operational dependencies, and deployment effort.

CyberArk Master Policy provides centralized governance over privileged account access, session management, and password security workflows. Individual rules may include advanced settings that offer more granular control over how privileged credentials are accessed and exposed.

The Allow EPV transparent connections rule enables users to connect to privileged systems without manually obtaining or entering account passwords. Within its advanced configuration, administrators can control whether users are permitted to view password values.

This distinction is important because permission to initiate a privileged session does not necessarily imply permission to retrieve the underlying credential.

When password viewing is restricted, authorized users can establish sessions through CyberArk Privileged Session Manager without exposing the account password to their workstation. This reduces the risk of credential disclosure, unauthorized sharing, and subsequent misuse.

Option A concerns the requirement to provide a reason for accessing privileged accounts, which is managed through a separate privileged-access workflow. Option B is a platform-level password management setting rather than the advanced Master Policy control requested. Option D does not accurately describe the available dual-control approval configuration.

Therefore, option C represents the advanced setting associated with password visibility and transparent privileged connections.

CyberArk Privileged Session Manager supports horizontally scaled deployments in which multiple PSM servers operate behind a load balancer. This architecture distributes privileged sessions across available servers and increases service availability.

When implementing a PSM farm with a physical load balancer, each PSM server must independently expose its health status. The PSM Health Check integration provides an application-level mechanism for determining whether the individual PSM instance is operational.

The health-check service should be installed and configured on both PSM servers. The load balancer must query each server's health-check endpoint rather than relying exclusively on network connectivity.

A typical endpoint is /psm/api/health , subject to the deployed PSM Health Check version.

The least-connections algorithm distributes new connections toward the server handling fewer active connections. This is useful because privileged sessions can have substantially different durations.

If a PSM instance becomes unavailable, health monitoring allows the load balancer to exclude it from new session assignments.

A single health-check deployment cannot reliably report the independent application status of both servers. Furthermore, PSM supports external load-balancing solutions and is not restricted to round-robin distribution.

The customer requires a resilient Privileged Access Management architecture that accommodates substantial on-premises infrastructure while supporting gradual cloud migration.

With approximately 80% of managed systems located in privately owned data centers, relying exclusively on a cloud-hosted Central Policy Manager introduces unnecessary dependency on connectivity between AWS and the on-premises environment.

Deploying an additional active CPM within the privately owned data center enables local management of assigned privileged accounts and reduces network dependency for password-management operations.

CPM performs periodic password verification, password changes, and reconciliation according to the configured management policies. The required 25-day password rotation and seven-day verification intervals make reliable connectivity between CPM and its target systems particularly important.

The new CPM should manage appropriately assigned Safes and target accounts, while the existing AWS-based CPM continues managing its assigned cloud infrastructure.

Important architectural distinction: Adding another CPM does not automatically create an active-active pair managing the same Safe. CPM assignments, Safe design, network accessibility, and management responsibilities must be configured correctly.

Migrating the existing CPM entirely on-premises would undermine the customer's cloud-first strategy. Deploying a separate PAM infrastructure in another cloud would introduce unnecessary complexity.

The hybrid CPM deployment provides the strongest balance between present operational requirements and future migration objectives.

CyberArk Digital Vault hardening establishes the security controls required to protect the Vault operating system and minimize exposure to unauthorized access.

These controls include restrictive network communication, operating-system configuration, service hardening, and the removal or disabling of unnecessary system functionality.

In the AWS deployment procedure referenced by this question, the standard Vault installation and hardening sequence differs from the conventional installation process.

During the initial Vault installation, the administrator selects the option to skip automatic machine hardening.

After completing the initial installation, the applicable AWS-specific hardening procedure is performed.

This sequence accounts for cloud infrastructure requirements, including instance configuration, virtual networking, supported access mechanisms, and cloud-specific operating-system dependencies.

Skipping hardening during the initial installation does not mean that hardening is optional.

The final deployed Vault must still satisfy CyberArk's supported security requirements before being placed into production.

Option B is incorrect because a cloud-hosted Vault requires appropriate hardening. Option C describes the conventional installation sequence rather than the specific AWS procedure presented. Option D does not reflect the documented sequence for this deployment method.

Technical warning / qualification: This answer applies to the AWS installation procedure represented by the Guardian source. CyberArk-provided cloud images and automated deployment scripts may implement hardening differently in newer releases.

The CyberArk Blueprint provides a structured, risk-based approach to implementing Identity Security controls. Its initial stage concentrates on reducing exposure associated with identities that possess the broadest administrative authority.

Stage 1 prioritizes privileged accounts capable of controlling entire environments, whether those environments are hosted in privately owned datacenters or public cloud platforms.

Examples include Active Directory Domain Administrators, cloud tenant administrators, highly privileged infrastructure accounts, and identities responsible for managing critical authentication systems.

Compromise of these identities can enable attackers to establish persistence, modify security configurations, access sensitive information, or move across substantial portions of an organization.

By addressing these identities first, organizations can achieve significant risk reduction without initially onboarding every privileged account.

The recommended controls include secure credential storage, controlled privileged access, password lifecycle management, session isolation, and appropriate monitoring.

Broad technology-platform coverage, including ordinary Windows and Unix local administrative accounts, is generally expanded during subsequent implementation stages.

The Blueprint does not recommend prioritizing integrations or selecting use cases solely because they are convenient to implement.

Instead, initial activities should concentrate on the privileged identities whose compromise would have the greatest enterprise-wide security impact.

CyberArk Central Credential Provider (CCP) and Conjur both provide secure credential retrieval, but they address different application architectures and operational requirements.

CCP is an agentless credential retrieval service accessed through HTTPS. Applications authenticate using supported methods, including client certificates, and submit requests containing an authorized Application ID and criteria identifying the requested account.

This makes CCP suitable for traditional applications, automation scripts, and systems that can integrate with an HTTPS-based credential retrieval interface.

Conjur is designed primarily for cloud-native applications, containers, orchestration platforms, and CI/CD workflows.

It supports workload-oriented authentication mechanisms, including API-key authentication and integrations with cloud identity services and signed identity tokens.

Conjur also supports policy-based secrets management, allowing development teams to define application identities and authorized access through structured policies.

Option C incorrectly suggests that Conjur is limited to static secrets and that all workloads authenticate exclusively through API keys.

Option D incorrectly attributes local executable path and hash authentication mechanisms to CCP as its defining capability. Option E is incorrect because supported Conjur architectures can integrate with CyberArk PAM through synchronization mechanisms.

CyberArk Conjur is designed to protect secrets used by cloud-native applications, containerized workloads, DevOps pipelines, and automated services.

The application described in this scenario runs in Docker containers on AWS and requires privileged credentials to access storage and database resources.

Embedding these credentials in container images, application configuration files, or environment variables can expose them through compromised containers, source repositories, diagnostic logs, or deployment artifacts.

Conjur addresses this risk by centralizing secrets management and enforcing policy-based authorization for application identities.

Containerized applications authenticate through an appropriate supported authenticator and obtain the secrets they are explicitly authorized to retrieve.

This design enables credentials to be managed independently of application code and container images.

Conjur also supports scalable architectures suitable for workloads that generate continuous and substantial transaction volumes.

A properly designed deployment should include high-availability secrets delivery, secure workload authentication, credential rotation, and appropriate application-side handling of temporary secrets-service interruptions.

Although Central Credential Provider and conventional Credential Provider solutions can serve application credential requests, Conjur is the strongest architectural fit for cloud-native Docker workloads.

CyberArk Central Policy Manager (CPM) automates privileged credential management, including scheduled password changes, verification, and reconciliation.

When a password change operation fails, CPM retries the operation according to the password-management policy configuration. Two relevant parameters are MaximumRetries and MinDelayBetweenRetries.

The MaximumRetries parameter determines the maximum number of unsuccessful attempts permitted, while MinDelayBetweenRetries specifies the minimum interval between subsequent retry attempts.

In the documented default configuration, CPM permits five retries with a minimum delay of 90 minutes between attempts.

Once the configured retry limit is exhausted, CPM disables automatic password management for the affected account to prevent continuous unsuccessful operations.

After resolving the underlying problem, an administrator must explicitly resume CPM management.

This can be accomplished through the Resume action in PVWA. Multiple affected accounts can also be selected and resumed together.

Restarting CPM does not automatically reactivate accounts disabled after exhausting their retry attempts. Reconciliation is a separate operation used to restore credential synchronization when appropriate.

Deleting and re-onboarding accounts is unnecessary and may disrupt their existing configurations and audit continuity.

CyberArk Digital Vault implements a granular authorization model that controls access to Safes and their stored privileged credentials. Permissions may be assigned directly to individual Vault users or indirectly through their membership in authorized groups.

Under the default authorization model, Safe permissions are cumulative. When a user receives access through multiple applicable authorization assignments, the Vault evaluates the effective combination of those permissions.

In this scenario, Alice is assigned Safe ownership directly through her user ID while also receiving permissions through group membership. Her effective authorizations therefore include the applicable permissions granted through both assignments.

For example, if Alice receives the ability to list accounts through a group and receives permission to manage Safe members directly, her effective access can include both capabilities.

This behavior simplifies role-based access administration but requires careful permission reviews because indirect group membership can provide privileges beyond those explicitly assigned to an individual account.

Administrators should regularly inspect Safe memberships, nested group relationships where applicable, and effective permissions to identify excessive access.

Options B and C incorrectly treat one authorization source as automatically overriding the other. Option D incorrectly assumes that multiple authorization assignments create an access conflict.