ACCESS-DEF Sample Questions & Answers

An authentication profile (Settings > Authentication > Add Profile) defines Multiple Authentication Mechanisms as Challenge 1 and Challenge 2. The user must pass both challenges and may choose any one of the mechanisms selected in each challenge column. Password in Challenge 1 plus Mobile Authenticator, Security Question(s) and OATH OTP Client in Challenge 2 gives a password followed by the user's choice of second factor. Mechanisms under Single Authentication Mechanism are each enough on their own and would bypass the two challenges. The same mechanism cannot be selected in both challenge menus, and a rule selects only one profile.

The CyberArk Identity Connector is a required component that is installed on a Windows server within the corporate network. It acts as a secure proxy between the CyberArk Identity cloud tenant and the on-premises Active Directory. It is responsible for handling authentication requests and synchronizing users, groups, and OUs.

The Admin Portal contains a dedicated 'Reports' section with numerous built-in reports for security and compliance. A report such as 'User Logins' or a similar audit event report can be filtered by date range (e.g., last 90 days) and will contain the necessary details, including username, application, timestamp, and source IP address.

When a user accesses an application through the App Gateway, the initial authentication and authorization are handled by the CyberArk Identity platform. Therefore, the platform itself generates the primary audit trail for the access event, which can be viewed in the built-in reports. The App Gateway acts as a reverse proxy, but the central logging occurs within the Identity tenant.

The 'Provisioning' feature for applications like Salesforce allows for detailed role mapping. An administrator can create mappings that link CyberArk Identity roles (which can be populated dynamically from AD groups or attributes) to specific destination roles and license types within Salesforce. This allows for fine-grained, automated assignment of the correct licenses upon user creation.

SSPR in CyberArk Identity requires the challenges in the authentication profile selected under User Security Policies > Self Service > Password Reset (for example, the Default Password Reset Profile). Profiles can use authentication mechanisms such as Security Question(s), Text message (SMS) confirmation code, and Email confirmation code (sent to the email address on the user's account). IP geolocation and a manager's access-request approval are not authentication mechanisms.

SSPR in CyberArk Identity requires the challenges in the authentication profile selected under User Security Policies > Self Service > Password Reset (for example, the Default Password Reset Profile). Profiles can use authentication mechanisms such as Security Question(s), Text message (SMS) confirmation code, and Email confirmation code (sent to the email address on the user's account). IP geolocation and a manager's access-request approval are not authentication mechanisms.

SSPR in CyberArk Identity requires the challenges in the authentication profile selected under User Security Policies > Self Service > Password Reset (for example, the Default Password Reset Profile). Profiles can use authentication mechanisms such as Security Question(s), Text message (SMS) confirmation code, and Email confirmation code (sent to the email address on the user's account). IP geolocation and a manager's access-request approval are not authentication mechanisms.

'Continue with additional challenges after failed challenge' is under Core Services > Policies > Authentication Policies > CyberArk Identity. When it is True, a user who fails a challenge (for example, enters a wrong password) still steps through the remaining required challenges. Only after the last one is the user told that authentication failed, without saying which challenge failed. This makes it harder for attackers to learn which factor they got wrong. When it is False, the user is notified immediately after the failed challenge. The companion setting 'Do not send challenge request when previous challenge response failed' controls whether SMS, email or phone challenges are still sent. The setting does not lock accounts or trigger MFA Unlock.

The CyberArk Identity App Gateway is a flexible component that can be deployed on-premises within a corporate DMZ or in a public/private cloud environment. Its purpose is to be co-located with the internal applications it is providing secure access to, making on-premises deployment a common and fully supported scenario.

Windows Device Trust supports only domain-joined Windows computers (with IWA configured and connectivity to a domain controller). AD users on devices that are not domain-joined, and CyberArk Cloud Directory users, are not supported. Group Policy, MAC address import and RADIUS are not Device Trust enrollment methods either. For non-domain-joined machines, a different CyberArk agent is required.

CyberArk Identity has a dedicated Blocked IP Ranges feature (Identity Administration portal > Settings > Network > Blocked IP Ranges > Add). You enter the custom IP range (or Outside Secure Zones) and choose the block type (Authentication only, which is the default, Sign-in page, or both). An Active entry blocks access from those addresses to CyberArk Identity. This targets the tenant directly, unlike an on-premises firewall, which cannot filter traffic to the SaaS portal. It is also simpler than building an authentication rule.