GUARD: CyberArk GuardianDemo

A CyberArk PTA secondary server functions as a disaster-recovery replica. Promoting it during failover requires a manual procedure; PTA Network Sensors do not automatically promote the server.

A non-distributed CyberArk Vault deployment supports only two Vault servers: a Primary Vault and one DR Vault. Deploying an additional DR Vault requires the Distributed Vault architecture.

Hardened Vaults require regular operating-system patching while preserving their isolated, hardened configuration. A dedicated WSUS server provides controlled distribution of approved Windows updates, enabling the Vault to receive the monthly patches without domain integration. WSUS supports centrally configuring clients to obtain automatic updates from an intranet update service.

The advanced settings for Allow EPV Transparent Connections can control whether users are permitted to view passwords, independently of transparent connection access.

CyberArk recommends using at least two Central Credential Providers (CCPs) behind a load balancer to achieve high availability and better performance.

NFNotifyOnPasswordUsed generates notifications only for password use from the PVWA interface. Retrieving/copying the password through PVWA and initiating a connection from PVWA meet that condition. Account onboarding, password verification, and a PSM-for-SSH connection do not constitute qualifying PVWA password-use events.

CyberArk Vault Server clears log records whose retention period has expired when the Server starts.

A PAM program needs leadership buy-in communicated from the initial stakeholder engagement, along with a dedicated sponsor who champions the program’s goals to the CTO and across the technology organization. These practices establish executive support and sustained organizational advocacy.

A failed CPM verification followed by reconciliation indicates that the secret on the managed target no longer matches the secret held in CyberArk. This can mean the secret was changed outside CyberArk and may have been compromised through an unauthorized or uncontrolled process.

CyberArk xRay Agent is CyberArk’s diagnostic tool for collecting logs and configuration files needed by Technical Support. It centralizes the collection of support data across PAS components, making it more efficient than manually gathering files from each server.

PSMSV is a Privileged Session Manager service message prefix. This error is logged by PSM when downloading files from the Vault completes with errors.

An active CPM in the privately owned data center can manage the large on-premises portion of the environment locally, including the required periodic password changes and verifications. Keeping the AWS CPM while adding this CPM provides resiliency and reduces reliance on potentially unavailable AWS-to-data-center connectivity during the cloud migration.

Dual Control exceptions can be granted through Safe permissions for selected users or groups, or through object-level permissions on individual vaulted accounts. These scopes allow designated users to access an account without the normal Dual Control approval requirement.

SCIM stands for System for Cross-domain Identity Management, an HTTP-based standard for provisioning and managing identity data across domains. Choice B is the intended expansion, despite omitting “domain.”

A top-down approach provides executive sponsorship, strategic direction, funding, and cross-functional accountability, which are necessary to drive organization-wide adoption and transformation of an Identity Security program.

The CyberArk Blueprint focuses on mitigating three identity-attack-chain stages: credential theft, lateral and vertical movement, and privilege escalation and abuse. Introduction to the Blueprint Guiding Principles

The preferred integration is the REST API method for adding discovered accounts, which lets a third-party discovery application submit discovered-account data directly to the Account Feed for processing.

In CyberArk, enabling Object Level Access Control for a Safe is irreversible. It can be used to grant access at the individual-account level, but it cannot later be disabled for that Safe.

A Conjur Enterprise Auto-Failover cluster supports up to five Standby nodes.

A Privilege Cloud Connector Server requires a public-facing IP address for communication with the Privilege Cloud service and IP allowlisting. IIS Server 10, an IPv6 address, and domain membership are not universal Connector Server prerequisites.

PSM recordings are stored in Recording Safes in the CyberArk Vault. At nearly 100 GB per day, retaining every recording online for seven years would require roughly 255 TB before storage overhead. A short active recording-retention period combined with Secure Replicate offloads older recordings to archival storage, meeting the long-term retention requirement without sizing the active Vault for the entire seven-year recording volume.