PAM-DEF Sample Questions & Answers

Platform settings are the most appropriate place to define technical constraints like password length for a specific type of target system. The best practice is to set the general policy on a base platform and then duplicate and modify that platform for exception cases. This allows for granular control over the devices that cannot meet the standard, while the Master Policy can still enforce the 30-day rotation across both platforms. Using Master Policy exceptions for technical password constraints is less scalable than using platforms.

PSM provides two types of session recording: video and text (keystroke logging). To capture the specific commands typed during a session for auditing purposes, text recording must be enabled in the platform settings. This creates a searchable text log of all activity within the session, which is distinct from the video recording of the session.

The 'LDAP Branch' field specifies the starting point within the LDAP directory tree (e.g., an Organizational Unit) from which CyberArk will search for the users or groups being mapped. This allows administrators to limit the scope of the directory mapping to relevant parts of their Active Directory or LDAP structure.

The 'Access is denied' error (code 5) for remote operations on Windows servers, especially when credentials and network connectivity are correct, is a classic symptom of User Account Control (UAC) remote restrictions. For non-domain accounts (or even domain accounts under certain conditions), UAC can strip administrative tokens from remote connections. To resolve this, a specific registry key (LocalAccountTokenFilterPolicy) must be created and set to '1' on the target server to allow remote administrative tasks.

CyberArk's 'Safe Provisioning and Governance' feature is designed specifically for this use case. It allows administrators to create rules that automatically assign permissions to users and groups based on safe properties, including the safe name. By creating a rule that looks for safes starting with 'EU-' and automatically adds the 'CyberArk-Admins-EU' group, the company can achieve a fully automated, scalable, and policy-driven approach to safe delegation without manual scripting or cumbersome Master Policy exceptions.

This parameter is critical in environments where components like PVWA, CPM, or PSM communicate with the Vault through a firewall performing NAT. When set to 'Yes', it instructs the Vault to ignore the source IP address in the packet's header (which would be the NAT device's IP) and instead use the IP address embedded within the CyberArk protocol data, ensuring the component is correctly identified and authorized.

The 'Connect' button in the PVWA only appears if there is a Privileged Session Manager (PSM) server associated with the account's platform. This is configured by setting the PSMServerID in the platform settings. If this parameter is not defined, the PVWA does not know where to proxy the session, and therefore the 'Connect' button is not displayed, even if the user has appropriate permissions.

For the highest level of security, CyberArk strongly recommends storing the Server Key, which encrypts all other keys in the Vault, within a FIPS 140-2 compliant Hardware Security Module (HSM). This ensures the key never resides on the server's disk and is protected by dedicated hardware, preventing its theft even if the Vault server itself is compromised.

The PrivateArk Administrative Client is a thick client that can be installed on any hardened administrative workstation that has network connectivity to the Vault server on port 1858. It is not restricted to being installed only on the Vault server. In fact, installing it on a separate, secure machine is a common practice.

LDAP (or LDAPS) integration is the primary method used to configure the PVWA to authenticate users against an Active Directory domain.

Directory Mapping is the feature that allows an administrator to link an external group from LDAP/AD to an internal Vault group. This enables transparent user provisioning and automatic permission granting based on a user's existing AD group membership.