CPC-SEN Sample Questions & Answers

The PSM's Live Session Monitoring feature is designed for this exact use case. It allows authorized users (like security analysts) to view active privileged sessions in real-time. This interface includes controls to take over or terminate the session immediately, providing the necessary oversight and intervention capabilities required by the organization.

The AWS access keys plugin connects to AWS through the REST API, which is its only connection method. Its supported actions are Verify (connect to AWS) and Change (the IAM user must be allowed to change its own access key, globally or by group). Reconcile and Delete are not supported, so a reconcile account cannot recover an unsynchronized key. The required account parameters are Username (the IAM user), AWS Account ID, and AWS Access Key ID, and the access key secret is stored as the password.

When the IdP confirms a successful authentication but the assertion is rejected, and clock skew and the Audience value have been ruled out, the most likely cause is a trust problem. Privilege Cloud verifies the signature of the SAML response with the IdP's signing certificate (IdentityProviderCertificate, or the certificate in the IdP metadata provided for the configuration: "used to verify the authenticity of the responses"). If that certificate is missing, expired or different from the one the IdP signs with, the assertion is rejected even though the user authenticated at the IdP. In Privilege Cloud Standard this information is provided to Technical Support; in Shared Services it is part of the external IdP's inbound metadata in Identity Administration.

In the Privilege Cloud Standard architecture, the Secure Tunnel client is an optional on-premises component that 'enables you to securely connect Privilege Cloud with your LDAP and SIEM servers' (and set up legacy offline/remote access). The Privilege Cloud backend uses it to reach the on-premises directory for LDAPS integration and to deliver Vault audit records to the customer's SIEM over syslog. CPM and PSM do not use the tunnel: they connect directly to the Vault backend on TCP 1858 (and 443 for REST), and session isolation and recording are PSM functions. In Shared Services, AD/LDAP integration is handled by the Identity Connector and SIEM by the Audit service, and Secure Tunnel is no longer supported for new deployments as of June 30, 2026.

In the Privilege Cloud Standard architecture, the Secure Tunnel client is an optional on-premises component that 'enables you to securely connect Privilege Cloud with your LDAP and SIEM servers' (and set up legacy offline/remote access). The Privilege Cloud backend uses it to reach the on-premises directory for LDAPS integration and to deliver Vault audit records to the customer's SIEM over syslog. CPM and PSM do not use the tunnel: they connect directly to the Vault backend on TCP 1858 (and 443 for REST), and session isolation and recording are PSM functions. In Shared Services, AD/LDAP integration is handled by the Identity Connector and SIEM by the Audit service, and Secure Tunnel is no longer supported for new deployments as of June 30, 2026.

Safes are the access boundary and the Master Policy is applied per platform. Placing the AWS accounts in an 'AWS-JIT' Safe on a dedicated platform lets a Master Policy exception activate 'Require dual control password access approval' for them only: each request states the access timeframe, team leads who are Safe members with 'Authorize account requests' confirm it, and EnforceDualControlTimeframeOnPSMConnections ends PSM sessions when the approved timeframe expires. IT-Ops receive standing 'Use accounts' access in 'Legacy-Persistent', whose accounts use platforms without dual control. 'Record and save session activity' is active by default, so both teams' PSM sessions are recorded. Giving IT-Ops 'Retrieve accounts' would allow unrecorded direct use, and exceptions cannot be created for an Okta group.

A classic onboarding rule's scope is defined by System type (Windows/Unix), Machine type (Any/Workstation/Server), Account type (Local) and Account category (Any/Privileged/Non-privileged), and can be refined by keyword (for example user name or machine name; the API offers UserNameFilter/AddressFilter with Equals/Begins/Ends). The Platform and Safe are the rule's destination, not its scope. There are no last-logon, password-age, OU or group-membership filters in onboarding rules. Accounts that match no rule go to the Pending Accounts list. Classic Discovery is being deprecated in favor of Discovery remediation rules.

The Connector requirements list virtual machine installation settings recommended 'to ensure optimal performance': in VMware environments install VMware Tools on every Connector VM (it also exposes the PerfMon counter VM Processor > Effective VM Speed in MHz), allocate enough memory, use the latest VM version, make sure hyper-threading is enabled (VMware 5.5 and later), and set a fixed processing-power (MHz) reservation. These are performance recommendations - VMware Tools is not a registration prerequisite, and no static MAC address is required.

In Identity Administration an administrator can create CyberArk (Idira) Cloud Directory users one at a time or in bulk (Users > Add User), and service users - non-human users for API and automation work, created with Add user > Service user or with 'Is Service User'/'Is OAuth confidential client' selected. Federated users are not created manually: they are created automatically in the Cloud Directory when a user first signs in through an external IdP, and their lifecycle stays with that IdP. 'Vault User' and 'Guest User' are not Identity user types.

In Identity Administration an administrator can create CyberArk (Idira) Cloud Directory users one at a time or in bulk (Users > Add User), and service users - non-human users for API and automation work, created with Add user > Service user or with 'Is Service User'/'Is OAuth confidential client' selected. Federated users are not created manually: they are created automatically in the Cloud Directory when a user first signs in through an external IdP, and their lifecycle stays with that IdP. 'Vault User' and 'Guest User' are not Identity user types.

Privilege Cloud requires Network Level Authentication to be disabled on the Connector (PSM) server. Sessions launched from the portal use an RDP file generated by Privilege Cloud (which includes the EnableCredSspSupport setting), and CyberArk notes that when NLA is enabled on the PSM server this portal connection method is not supported, so the user's RDP client reports that the remote computer requires NLA. Disabling NLA on the PSM server (for example, excluding the Connectors from a GPO that enforces it) restores the documented configuration; NLA can remain enabled on the target servers, because it is not the PSM-to-target connection that fails. There is no EnableNLA connection-component parameter, and target-side group changes do not affect the client-to-PSM connection.

False. Privilege Cloud supports both in-domain and out-of-domain Connector deployments: the prerequisites script has an -OutOfDomain switch, and out-of-domain Connectors are hardened with an INF-based procedure instead of the domain GPO. The CPM manages domain accounts over the network using the account's own credentials or linked logon/reconcile accounts (CyberArk recommends the Windows Domain Accounts via LDAP plugin), so the Connector does not have to be a domain member. Domain membership is required only in specific scenarios - for example, customers who enforce NLA for native RDP connections through PSM must install PSM on an in-domain machine.