Quiz PAM-DEF: CyberArk Defender - PAM

When a user is a member of more than one group that has authorizations on a safe, by default that
user is granted the cumulative permissions of all groups to which that user belongs. This means that
the user will have the highest level of access that any of the groups have on the safe. For example, if
one group has View and Retrieve permissions, and another group has Add and Delete permissions,
the user will have View, Retrieve, Add, and Delete permissions on the safe. This is the default
behavior of the vault, unless the Exclusive option is enabled on the safe. The Exclusive option
restricts the user’s permissions to only those of the group added to the safe first. Reference:
[Defender PAM eLearning Course], Module 3: Safes and Permissions, Lesson 3.2: Safe Permissions,
Slide 8: Cumulative Permissions
[Defender PAM Sample Items Study Guide], Question 1: Safe Permissions
[CyberArk Documentation Portal], CyberArk Privileged Access Security Implementation Guide,
Chapter 3: Managing Safes, Section: Safe Properties, Subsection: Exclusive

The correct answer is A. TRUE.
Many vault systems include configurable access policies that let administrators restrict when a user is allowed to log in. This means login can be limited to specific hours of the day, such as business hours or approved maintenance windows.
Why this is true:
- Administrators can define time-based access rules.
- These rules can control daily login windows for individual users or groups.
- This helps improve security by preventing access outside approved times.
So the statement “It is possible to control the hours of the day during which a user may log into the vault” is true.

Vault Authorizations
• Can be assigned only to users (not groups).
• Cannot be inherited via group membership.
• Defined only via the Private Ark Client.
Safe Auth
• Assigned to users and/or groups.
• Can be inherited via group membership.
• Can be defined in the Private Ark Client or PVWA

The correct answer is A. To control how often the CPM looks for System Initiated CPM work.
In a CPM policy, the Interval setting determines the frequency at which the Central Policy Manager (CPM) checks for new System Initiated CPM tasks. In other words, it defines how often CPM wakes up to look for accounts or passwords that need to be processed automatically by the system.
Why A is correct:
- System Initiated CPM work refers to password management tasks triggered automatically by the system, not by a user.
- The Interval setting controls the polling frequency for these tasks.
Why the other options are incorrect:
- B is incorrect because User Initiated CPM work is not what the Interval setting is primarily for.
- C is incorrect because it does not represent a rest period between password changes.
- D is incorrect because the setting does not define a maximum waiting time for password change completion.
In short, the Interval setting is about how often CPM checks for system-triggered password management work.

The correct answer is A, B, C.
Here is why:
This question is about safe permissions in a privileged access management context, where users need different levels of access to accounts stored in a safe. The key point is that the Unix root passwords are in the safe UnixRoot, and dual control is enabled for some of those accounts.
Let’s break down the requirements:
1. UnixAdmins need to use show, copy, and connect at any time without confirmation
This is a standard direct-use requirement, but this is not the group asked about in the question. It helps establish that some users can access accounts normally.
2. Operations Staff need to be able to use show, copy, and connect on an emergency basis
This means they need the ability to request and retrieve account credentials when needed.
3. Their access must be approved by a member of Operations Managers
That means dual control / approval workflow is required.
4. Operations Managers never need to use the buttons themselves
So they are only approvers, not users of the passwords.
Now let’s evaluate each permission:
A. Use Accounts
This permission lets users use the account actions such as show, copy, and connect. Since Operations Staff must be able to perform these actions, they need this permission.
B. Retrieve Accounts
This permission allows users to retrieve account passwords or access the account details, which is necessary for emergency use of the accounts.
C. Authorize Password Requests
This permission allows users to approve password requests. Since Operations Staff need access only with approval from Operations Managers, this permission supports the approval-based workflow. In the context of the question, Operations Staff must be granted the permissions that allow the request process to function properly for dual control.
D. Access Safe without Authorization
This would let users access the safe without needing approval. That directly conflicts with the requirement that Operations Staff can use the passwords only on an emergency basis and only with approval from Operations Managers.
Why A, B, C together?
Because Operations Staff must be able to request and use the account actions, and the access must go through an approval process rather than bypassing it. The combination of Use Accounts, Retrieve Accounts, and Authorize Password Requests matches that controlled emergency access model.
Therefore, the correct answer is A, B, C.

When the Master Policy enforces check-in/check-out exclusive access, passwords are changed when
the user clicks the Release button and releases the account. This is based on the ImmediateInterval
parameter in the applied platform. If the user forgets to release the account, it is automatically
released and changed by the CPM after a predetermined number of minutes, defined in the
MinValidityPeriod parameter specified in the platform
Questions PDF 3/69

PAR-Private Ark Remote Control Agent allows you to perform several Vault admin tasks (without
restarting the Vault) and view machine statistics.

The correct answer is B. FALSE.
A Master Policy is generally used to define broad policy settings that apply to multiple jobs, users, or workflows. It does not typically specify a Logon Account directly. Logon Accounts are usually configured at a more specific level, such as within a job, task, or scheduling definition, depending on the system.
So the statement "A Logon Account can be specified in the Master Policy" is false.

The correct answer is D.
The question is about a platform where Dual Control is enforced because of a Master Policy exception. Dual Control means that users normally need approval before they can access a password. The question asks how to configure a group of users so they can access a password without approval.
In this case, the relevant permission is configured on the safe that contains the account. The authorization that allows users to access a safe without triggering confirmation or approval is “Access safe without confirmation.”
Why D is correct:
- The account is stored in a safe.
- To bypass the approval step for a specific group, you grant that group the safe-level permission that allows access without confirmation.
- This directly matches the requirement to access the password without approval.
Why the other options are incorrect:
A. Create an exception to the Master Policy to exclude the group from the workflow process.
- This is not the standard way to handle safe access permissions.
- The question asks how to configure a group to access a password without approval, and the needed change is at the safe authorization level, not by broadly excluding them from workflow.
B. Edit the master policy rule and modify the advanced “Access safe without approval” rule to include the group.
- This is not the correct mechanism described for safe access control.
- Also, the wording is off; the specific permission is not framed this way in this context.
C. On the safe in which the account is stored grant the group the “Access safe without audit” authorization.
- “Without audit” means logging/auditing behavior, not approval workflow.
- This would not remove the need for confirmation or approval.
Summary:
To let a group access an account in a safe without approval under Dual Control conditions, you grant them “Access safe without confirmation” on that safe.
Answer: D

Being in Vault admins group only give you access to safes which are created during installation (safe
created in installation process ) -This is clearly mentioned in documents .