Cdocker exec <ContainerName> evoke ca import – –no-restart <rootCA.cer>
Ddocker exec <ContainerName> ca import <rootCA.cer>
During the configuration of Conjur, what is a possible deployment scenario?
AThe Leader and Followers are deployed outside of a Kubernetes environment; Slandbys can run inside a Kubernetes environment.
BThe Conjur Leader cluster is deployed outside of a Kubernetes environment; Followers can run inside or outside the environment,
CThe Leader cluster is deployed outside a Kubernetes environment; Followers and Standbys can run inside or outside the environment.
DThe Conjur Leader cluster and Followers are deployed inside a Kubernetes environment.
Question 6
Access Policy Configuration
0
Question 7
Secrets Lifecycle and Management
Question 8
Secrets Lifecycle and Management
Question 9
Deployment and Architecture
Question 10
Monitoring and Auditing
Question 11
Deployment and Architecture
Question 12
Monitoring and Auditing
Question 13
Deployment and Architecture
Question 14
Access Policy Configuration
Question 15
Access Policy Configuration
Question 16
Access Policy Configuration
Question 17
Deployment and Architecture
Question 18
Deployment and Architecture
Question 19
Deployment and Architecture
Question 20
Deployment and Architecture
Question 21
Deployment and Architecture
Question 22
Deployment and Architecture
Question 23
Access Policy Configuration
Question 24
Deployment and Architecture
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ad
Want a break from the ads?
Become a Supporter and enjoy a completely ad-free experience, plus unlock Learn Mode, Exam Mode, AstroTutor AI, and more.
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
DRAG DROP -
Arrange the steps to configure authenticators in the correct the sequence.
DRAG DROP -
Match each scenario to the appropriate Secrets Manager solution.
When working with Summon, what is the purpose of the secrets.yml file?
AIt is where Summon outputs the secret value after retrieval.
BIt is where you define which secrets to retrieve.
CIt is where you store the Conjur URL and host API key.
DIt is the log file for Summon.
You are deploying Kubernetes resources/objects as Conjur identities.
In addition to Namespace and Deployment, from which options can you choose? (Choose two.)
AServiceAccount
BReplicasets
CSecrets
DTokenreviews
EStatefulSet
You are diagnosing this log entry:
From Conjur logs:
Given these errors, which problem is causing the breakdown?
AThe Jenkins certificate chain is not trusted by Conjur.
BThe Conjur certificate chain is not trusted by Jenkins.
CThe JWT sent by Jenkins does not match the Conjur host annotations.
DThe Jenkins certificate is malformed and will not be trusted by Conjur.
You are enabling synchronous replication on Conjur cluster.
What should you do?
AExecute this command on the Leader:docker exec <container-name> sh –c”evoke replication sync that*
BExecute this command on each Standby:docker exec <container-name> sh –c”evoke replication sync that*
CIn Conjur web UI, click the Tools icon in the top right corner of the main window.Choose Conjur Cluster and click “Enable synchronous replication” in the entry for Leader.
DIn Conjur web UI, click the Tools icon in the top right corner of the main window.Choose Conjur Cluster and click “Enable synchronous replication” in the entry for Standbys.
An application is having authentication issues when trying to securely retrieve credential’s from the Vault using the CCP webservices RESTAPI. CyberArk Support advised that further debugging should be enabled on the CCP server to output a trace file to review detailed logs to help isolate the problem.
What best describes how to enable debug for CCP?
AEdit web.config. change the “AIMWebServiceTrace” value, restart Windows Web Server (IIS)
BIn the PVWA, go to the Applications tab, select the Application in question, go to Options > Logging and choose Debug.
CFrom the command line, run appprvmgr.exe update_config logging=debug.
DEdit the basic_appprovider.conf, change the “AIMWebServiceTrace" value, and restart the provider.
When working with Credential Providers in a Privileged Cloud setting, what is a special consideration?
AIf there are installation issues, troubleshooting may need to involve the Privileged Cloud support team.
BCredential Providers are not supported in a Privileged Cloud setting.
CThe AWS Cloud account number must be defined in the file main_appprovider.conf. <platform>.<version> found in the AppProviderConf Safe.
DDebug logging for Credential Providers deployed in a Privileged Cloud setting can inadvertently exhaust available disk space.
While retrieving a secret through REST, the secret retrieval fails to find a matching secret. You know the secret onboarding process was completed, the secret is in the expected safe with the expected object name, and the CCP is able to provide secrets to other applications.
What is the most likely cause for this issue?
AThe application ID or Application Provider does not have the correct permissions on the safe.
BThe client certificate fingerprint is not trusted.
CThe service account running the application does not have the correct permissions on the safe.
DThe OS user does not have the correct permissions on the safe
You are setting up a Kubernetes integration with Conjur. With performance as the key deciding factor, namespace and serviceaccount will be used as identity characteristics.
Which authentication method should you choose?
AJWT-based authentication
BCertificate-based authentication
CAPI key authentication
DOpenID Connect (O|DC) authentication
When attempting to retrieve a credential, you receive an error 401 – Malformed Authorization Token.
What is the cause of the issue?
AThe token is not correctly encoded.
BThe token you are trying to retrieve does not exist.
CThe host does not have access to the credential with the current token.
DThe credential has not been initialized.
A customer requires high availability in its AWS cloud infrastructure.
What is the minimally viable Conjur deployment architecture to achieve this?
Aone Follower in each AZ, load balancer for the region
Btwo Followers in each region, load balanced for the region
Ctwo Followers in each AZ, load balanced for the region
Dtwo Followers in each region, load balanced across all regions
While installing the first CP in an environment, errors that occurred when the environment was created are displayed; however, the installation procedure continued and finished successfully.
What should you do?
AContinue configuring the application to use the CP. No further action is needed since the successful installation makes the error message benign.
BReview the lag file ‘CreateEnv.log’ and investigate any error messages it contains.
CRun setup.exe again and select ‘Recreate Vault Environment’. Provide the details of a user with more privileges when prompted by the installer.
DReview the PVWA lags to determine which REST API call used during the installation failed.
What is the correct process to upgrade the CCP Web Service?
ARun “sudo yum update aimprv” from the CLI.
BDouble-click the Credential Provider installer executable and select upgrade.
CDouble-click the AimWebService.msi and select upgrade.
DUninstall and reinstall the CCP Web Service.
In a 3-node auto-failover cluster, the Leader has been brought down for patching that lasts longer than the configured TTL. A Standby has been promoted.
Which steps are required to repair the cluster when the old Leader is brought back online?
AOn the new Leader, generate a Standby seed for the old Leader node and add it to the cluster member list.Rebuild the old Leader as a new Standby and then re-enroll the node to the cluster.
BGenerate a Standby seed for the newly promoted Leader.Stop and remove the container on the new Leader, then rebuild it as a new Standby.Re-enroll the Standby to the cluster and re-base replication of the 3rd Standby back to the old Leader.
CGenerate standby seeds for the newly-promoted Leader and the 3rd StandbyStop and remove the containers and then rebuild them as new Standbys.On both new Standbys, re-enroll the node to the cluster.
DOn the new Leader, generate a Standby seed for the old Leader node and re-upload the auto-failover policy in “replace” mode.Rebuild the old Leader as a new Standby, then re-enroll the node to the cluster.
When using the Seed Fetcher to deploy Kubernetes Followers, an error occurs in the Seed Fetcher container. You check the logs and discover that although the Seed Fetcher was able to authenticate, it shows a 500 error in the log and does not successfully retrieve a seed file. What is the cause?
AThe certificate based on the Follower DNS name is not present on the Leader.
BThe host you configured does not have access to see the certificates.
CThe synchronizer service crashed and needs to be restarted.
DThe Leader does not have the authenticator webservice enabled.
You start up a Follower and try to connect to it with a REST call using the server certificate, but you get an SSL connection refused error.
What could be the problem and how should you fix it?
AThe certificate does not contain the Follower hostname as a Subject Alternative Name (SAN). Generate a new certificate for the Follower.
BOne of the PostgreSQL ports (5432. 1999) is blocked by the firewall Open those ports.
CPort 443 is blocked; open that port.
DThe certificate is unnecessary. Use the command option to suppress SSL certificate checking.
When loading policy, you receive a 422 Response from Conjur with a message.
What could cause this issue?
Amalformed Policy file
Bincorrect Leader URL
Cmisconfigured Load Balancer health check
Dincorrect Vault Conjur Synchronizer URL
After manually failing over to your disaster recovery site (Site B) for testing purposes, you need to failback to your primary site (Site A).
Which step is required?
AContact CyberArk for a new license file.
BReconfigure the Vault Conjur Synchronizer to point to the new Conjur Leader.
CGenerate a seed for the new Leader to be deployed in Site A.
DTrigger autofailover to promote the Standby in Site A to Leader.