PAM-CDE-RECERT: CyberArk Certified Delivery Engineer (CDE) Re-certification Exam

A complete Privileged Accounts Inventory report requires List Accounts to enumerate the accounts in the safe and View Safe Members to include the safe-membership information associated with that inventory.

CyberArk’s Master Policy defines the global requirement to change passwords every specified number of days. A 90-day rotation rule is therefore configured in the Master Policy; platform configuration can provide platform-specific settings or exceptions.

A PVWA user must have List Accounts to view the available accounts and Use Accounts to initiate a connection through PSM. A PSM connection does not require Retrieve Accounts, because the user does not need to reveal or retrieve the credential value.

Windows Discovery only needs to enumerate Active Directory objects within the organizational units in scope. Read permission provides that access without granting the ability to modify directory objects or broad administrative privileges.

CyberArk PTA detects suspected credential theft when a user connects to a machine or cloud service without first retrieving the required credentials from the Vault. This detection requires log data from a SIEM, Unix, AWS, or Azure source and Vault data; it does not require a Network Sensor, PSM logs, CPM logs, or EPM.