PAM-SEN CyberArk Sentry - PAM Practice Questions

Session recording behavior is controlled at the platform level. Even if the PSM is fully functional, if the specific platform associated with the target account has 'Record and Safe Session' set to 'No', the PSM will establish the connection but will not record it. This is a common reason for sessions to connect successfully but not appear in the recordings list.

CyberArk recommends using cookie-based persistence, often referred to as 'sticky sessions,' on the load balancer for PVWA high availability. This method ensures that once a user establishes a session with a particular PVWA server, all subsequent requests from that user during the same session are directed to the same server. This maintains session state and prevents the user from being unexpectedly logged out or losing their work.

A Reconciliation Account is a highly privileged account used by the CPM as a last resort. If the CPM fails to change a password because the password stored in the Vault is out of sync with the target system (e.g., it was changed manually), the CPM will use the reconciliation account—which has permissions to reset other users' passwords—to log in and forcefully reset the managed account's password, bringing it back into a known, managed state.

Dual Control, also known as a 'four-eyes principle' or quorum, is the specific feature designed for this purpose. It is configured in the Master Policy to require that certain sensitive actions must be confirmed by one or more other authorized users before they can be executed. This prevents any single administrator from performing critical, irreversible actions alone.

The CreateCredFile utility is solely used to encrypt the user's password into a credential file (.ini or .cre). It requires the username and prompts for the password, but it does not require any information about the Vault server, such as its IP address. The Vault address is specified separately in the component's own configuration file (e.g., vault.ini).

When a PVWA is placed behind a load balancer that uses X-Forwarded-For headers to pass the original client IP, the LoadBalancerClientAddressHeader parameter must be configured in the web.config file on the PVWA server. This tells the PVWA to look for the specified header (e.g., 'X-Forwarded-For') to identify the true client IP address for logging and auditing, rather than logging the IP of the load balancer itself.

The error 'ITACM024S User is not defined' indicates the user attempting to authenticate does not exist in the Vault's user database. In a DR scenario, this most commonly occurs when the component user (like the CPM user) was created or had its credentials updated on the Primary Vault, but a full replication cycle did not complete before the failover. As a result, the DR Vault does not have the user's definition, causing authentication to fail.

The PSM is required to establish, record, and control the privileged session. It is the component that can physically terminate the active session upon receiving a command.

PTA analyzes the session data from PSM in real-time. It contains the security engine and policy configuration to detect specific commands like useradd and trigger an automated response, such as instructing the PSM to terminate the session.

False. The PSM for SSH installation script (psmp_install.sh) automatically configures the sshd_config file with the required parameters, including AllowTcpForwarding yes. Manual editing for this specific purpose is not required and could lead to misconfiguration if done incorrectly.

This is the correct, built-in CyberArk solution for distributed PSM deployments. The PSM is designed to cache recordings locally in a secure, encrypted format if it cannot immediately connect to the Vault. Once connectivity is restored, it automatically uploads the recordings, ensuring no data is lost and providing resilience against network interruptions. This architecture meets all stated requirements for performance, central storage, and resilience.