CyberArk SECRET-SEN Online Practice Questions and Exam Preparation

CyberArk SECRET-SEN Online Questions & Answers

• Question 1:

  A customer has 100 .NET applications and wants to use Summon to invoke the application and inject secrets at run time.

  Which change to the NET application code might be necessary to enable this?

  A. It must be changed to include the REST API calls necessary to retrieve the needed secrets from the CCP.
  B. It must be changed to access secrets from a configuration file or environment variable.
  C. No changes are needed as Summon brokers the connection between the application and the backend data source through impersonation.
  D. It must be changed to include the host API key necessary for Summon to retrieve the needed secrets from a Follower
  B. It must be changed to access secrets from a configuration file or environment variable.

  ---

  Explanation/Reference:

  Summon is a utility that allows applications to access secrets from a variety of trusted stores and export them as environment variables to a sub-process environment. Summon does not require any changes to the application code to retrieve secrets from the CyberArk Central Credential Provider (CCP), as it uses a provider plugin that handles the communication with the CCP. However, the application code must be able to access secrets from a configuration file or environment variable, as these are the methods that Summon uses to inject secrets into the application. Summon reads a secrets.yml file that defines the secrets that the application needs and maps them to environment variables. Then, Summon fetches the secrets from the CCP using the provider plugin and exports them as environment variables to the application sub-process. The application can then read the secrets from the environment variables as if they were hard-coded in the configuration file. References: Summon-inject secrets, .NET Application Password SDK

• Question 2:

  DRAG DROP

  Arrange the steps to configure authenticators in the correct the sequence.

  Select and Place:

  

  

  ---

  Explanation/Reference:

  Create an authenticator policy for each authenticator and then load the policy to Conjur.

  Add each authenticator to conjur.yml using this format: .

  Execute evoke configuration apply.

  Comprehensive Authenticators are plugins that enable Conjur to authenticate requests from different types of clients, such as Kubernetes, Azure, or LDAP. To configure authenticators, you need to follow these steps:

  Create an authenticator policy for each authenticator and then load the policy to Conjur. This step defines the authenticator as a resource in Conjur and grants permissions to the users or hosts that can use it. You can use the policy templates provided by Conjur for each authenticator type, or create your own custom policy. For more information, see Define Authenticator Policy. Add each authenticator to conjur.yml using this format: . This step enables the authenticator service on the Conjur server and specifies the service ID that identifies the authenticator instance. The service ID must match the one used in the policy. For more information, see Enable Authenticators.

  Execute evoke configuration apply. This step applies the changes made to the conjur.yml file and restarts the Conjur service. This is necessary for the authenticator configuration to take effect. For more information, see Apply Configuration Changes.

  References: The steps to configure authenticators are explained in detail in the Configure Authenticators section of the CyberArk Conjur Enterprise documentation. The image in the question is taken from the same source.

• Question 3:

  What is a possible Conjur node role change?

  A. A Standby may be promoted to a Leader.
  B. A Follower may be promoted to a Leader.
  C. A Standby may be promoted to a Follower.
  D. A Leader may be demoted to a Standby in the event of a failover.
  A. A Standby may be promoted to a Leader.

  ---

  Explanation/Reference:

  According to the CyberArk Sentry Secrets Manager documentation, Conjur is a secrets management solution that consists of a leader node and one or more follower nodes. The leader node is responsible for managing the secrets, policies,

  and audit records, while the follower nodes are read-only replicas that can serve secrets requests from applications. Additionally, Conjur supports a standby node, which is a special type of follower node that can be promoted to a leader node

  in case of a leader failure. A standby node is synchronized with the leader node and can take over its role in a disaster recovery scenario. A possible Conjur node role change is when a standby node is promoted to a leader node, either

  manually or automatically, using the auto-failover feature. A follower node cannot be promoted to a leader node, as it does not have the same data and functionality as the leader node. A standby node cannot be promoted to a follower node,

  as it already has the same capabilities as a follower node, plus the ability to become a leader node. A leader node cannot be demoted to a standby node in the event of a failover, as it would lose its data and functionality and would not be able

  to resume its role as a leader node.

  References:

  1: Conjur Architecture

  2: Deploying Conjur on AWS

  3: Auto-failover

• Question 4:

  An application owner reports that their application is suddenly receiving an incorrect password. CPM logs show the password was recently changed, but the value currently being retrieved by the application is a different value. The Vault Conjur Synchronizer service is running.

  What is the most likely cause of this issue?

  A. The Vault Conjur Synchronizer is not configured with the DR Vault IP address and there has been a failover event.
  B. Dual Accounts are in use, but after the CPM changed the password for the Inactive account, it accidentally updated the password for the Active account instead.
  C. The CPM is writing password changes to the Primary Vault while the Vault Conjur Synchronizer is configured to replicate from the DR Vault.
  D. The application has been configured to retrieve the wrong password.
  C. The CPM is writing password changes to the Primary Vault while the Vault Conjur Synchronizer is configured to replicate from the DR Vault.

  ---

  Explanation/Reference:

  This is the most likely cause of this issue because it creates a discrepancy between the passwords stored in the Primary Vault and the DR Vault, which affects the Vault Conjur Synchronizer service (Synchronizer) and the application. The

  Synchronizer is a service that synchronizes secrets from the CyberArk Vault to the Conjur database. The application is a client that retrieves secrets from the Conjur database using the Conjur REST API. The CPM is a component that

  manages the lifecycle of the passwords stored in the CyberArk Vault, such as changing, verifying, and reconciling them. If the CPM is writing password changes to the Primary Vault while the Synchronizer is configured to replicate from the

  DR Vault, the following scenario may occur:

  The CPM changes the password for an account in the Primary Vault and updates the password value in the Vault database.

  The Synchronizer does not detect the password change in the DR Vault, as the DR Vault database has not been updated yet with the new password value. The Synchronizer does not sync the new password value to the Conjur database, as

  it assumes that the password value in the DR Vault database is the latest and correct one.

  The application requests the password value from the Conjur database and receives the old password value, which is different from the new password value in the Primary Vault database.

  The application tries to use the old password value to access the target platform or device and fails, as the target platform or device expects the new password value. This answer is based on the CyberArk Secrets Manager documentation1

  and the CyberArk Secrets Manager training course2.

• Question 5:

  Which statement is true for the Conjur Command Line Interface (CLI)?

  A. It is supported on Windows, Red Hat Enterprise Linux, and macOS.
  B. It can only be run from the Conjur Leader node.
  C. It is required for working with the Conjur REST API.
  D. It does not implement the Conjur REST API for managing Conjur resources.
  A. It is supported on Windows, Red Hat Enterprise Linux, and macOS.

  ---

  Explanation/Reference:

  This is the correct answer because the Conjur CLI is a tool that allows users to interact with the Conjur REST API from the command line. The Conjur CLI can be run on Windows, Red Hat Enterprise Linux, and macOS operating systems, as well as in Docker containers. The Conjur CLI can be installed using various methods, such as downloading the executable file, using a package manager, or pulling the Docker image. The Conjur CLI supports Conjur Enterprise 12.9 or later versions. This answer is based on the CyberArk Secrets Manager documentation1 and the CyberArk Secrets Manager training course2. The other options are not true statements for the Conjur CLI. The Conjur CLI can be run from any machine that has network access to the Conjur server, not only from the Conjur Leader node. The Conjur Leader node is the node that performs read/write operations on the Conjur database and policy engine, and hosts the Conjur UI and API endpoints. The Conjur CLI is not required for working with the Conjur REST API, as users can also use other tools, such as curl, Postman, or web browsers, to send HTTP requests to the Conjur REST API. The Conjur CLI does implement the Conjur REST API for managing Conjur resources, such as roles, policies, secrets, and audit records. The Conjur CLI provides a set of commands that correspond to the Conjur REST API endpoints and allow users to perform various operations on the Conjur resources.

• Question 6:

  What is a main advantage of using dual accounts in password management?

  A. Since passwords are cached for both rotation accounts, it ensures the password for an application will not be changed, reducing the amount of blackout dates when a password expires.
  B. It ensures passwords are rotated every 90 days, which respects the expected downtime for a system, database, or application
  C. It ensures no delays are incurred when the application needs credentials because a password that is currently used by an application will never be changed
  D. Since there are two active accounts, it doubles the probability that a system, database, or application will successfully authenticate.
  C. It ensures no delays are incurred when the application needs credentials because a password that is currently used by an application will never be changed

  ---

  Explanation/Reference:

  Dual accounts is a password management method that uses two accounts with identical privileges to access a system, database, or application. One account is active and the other is inactive at any given time. The active account remains untouched during password rotation, while the inactive account has its password changed after a grace period. This way, the application can always use the active account without experiencing any delays or errors due to password expiration or change. The advantage of using dual accounts is that it ensures business continuity and seamless access to the target resource, especially for high load and critical applications. References: Manage Dual Accounts, Configure dual accounts

• Question 7:

  What is the correct command to import the root CA certificate into Conjur?

  A. docker exec evoke ca import --no-restart --root;
  B. docker exec evoke import --no-restart --root;
  C. docker exec evoke ca import --no-restart;
  D. docker exec ca import
  C. docker exec evoke ca import --no-restart;

  ---

  Explanation/Reference:

  C. docker exec evoke ca import --no-restart

  This is the correct command to import the root CA certificate into Conjur. The evoke ca import command is used to import a certificate authority (CA) certificate into the Conjur appliance. The certificate can be either a root CA or an

  intermediate CA. The --no-restart option prevents the Conjur appliance from restarting after importing the certificate. The parameter specifies the path and name of the root CA certificate file to be imported. This command will

  add the root CA certificate to the trusted CA store of the Conjur appliance, which is used to validate the certificates of the clients and servers that communicate with Conjur. This command is documented in the Conjur documentation and the

  Conjur training course.

  The other options are not correct commands to import the root CA certificate into Conjur. The evoke import command does not exist.

  The --root option is not a valid option for the evoke ca import command. The ca import command is not a valid docker exec command.

• Question 8:

  You have a PowerShell script that is being used on 1000 workstations. It requires a Windows Domain credential that is currently hard coded in the script.

  What is the simplest solution to remove that credential from the Script?

  A. Modify the script to use the CLI SDK to fetch the secret at runtime using Credential Providers installed on each workstation.
  B. Modify the script to make a SOAP call to retrieve the secret from the Central Credential Provider.
  C. Modify the script to run on WebSphere using the Application Server Credential Provider to retrieve the secret.
  D. Use Conjur Summon to invoke the script and inject the secret at run time.
  D. Use Conjur Summon to invoke the script and inject the secret at run time.

  ---

  Explanation/Reference:

  Conjur Summon is an open source utility that can fetch secrets from Conjur and export them as environment variables to a sub-process environment. This way, the secrets are not exposed or stored in the script, but are only available at run time. To use Conjur Summon, you need to install the summon-conjur provider on each workstation, define the secrets in a secrets.yml file, and wrap the PowerShell script in summon. For example, if the secret ID is win/domain/cred, the

  secrets.yml file would look like this:

  DOMAIN_CRED: !var win/domain/cred

  And the summon command would look like this:

  summon --provider summon-conjur powershell script.ps1 This will inject the secret value of win/domain/cred as an environment variable named DOMAIN_CRED to the PowerShell script. The script can then access the secret using the

  $env:DOMAIN_CRED syntax.

  References: Summon-inject secrets, cyberark/summon-conjur

• Question 9:

  A customer wants to ensure applications can retrieve secrets from Conjur in three different data centers if the Conjur Leader becomes unavailable. Conjur Followers are already deployed in each of these data centers.

  How should you architect the solution to support this requirement?

  A. No changes are required.
  B. Deploy a Standby in each data center that can be promoted to the role of Leader.
  C. Extend the auto failover cluster to include Standby?in each data center and allow for automatic recovery should the Leader become unavailable.
  D. Deploy a CP provider on the Follower server to provide offline caching capabilities for the Follower.
  C. Extend the auto failover cluster to include Standby?in each data center and allow for automatic recovery should the Leader become unavailable.

  ---

  Explanation/Reference:

  Conjur Followers are read-only replicas of the Leader that can serve client requests for authentication, authorization, and secret retrieval. However, Followers cannot perform write operations, such as creating or updating secrets, policies, or roles. If the Leader becomes unavailable, the Followers will not be able to sync with the latest data and will eventually become stale. To ensure high availability and data consistency, the customer should extend the auto-failover cluster to include Standbys in each data center. Standbys are also replicas of the Leader, but they can participate in replication and promotion. One Standby is configured for synchronous replication, which means it receives the same updates as the Leader at the same time. The other Standbys are configured for asynchronous replication, which means they receive updates from the Leader periodically, but not in real time. In case of Leader failure, the synchronous Standby can be automatically promoted to become the new Leader, and one of the asynchronous Standbys can become the new synchronous Standby. This way, the customer can ensure that there is always an up-to-date Leader that can serve write requests and sync with the Followers in different data centers. References: Set up Follower, Set up auto-failover cluster, Conjur architecture and deployment reference

• Question 10:

  DRAG DROP

  Findings were obtained after cataloging pending Secrets Manager use cases.

  Arrange the findings in the correct order for prioritization.

  Select and Place:

  

  

  ---

  Explanation/Reference:

  The correct order for prioritization of the findings is as follows: A new vulnerability scanner project is nearing completion and is expected to go into production soon. This scanner is owned by the Security Team that owns CyberArk. This finding should be prioritized first because it has the highest urgency, feasibility, and alignment with the Security Team's goals. The vulnerability scanner is a critical security tool that needs to protect its credentials from unauthorized access. The Security Team can leverage their own expertise and authority to implement the Secrets Manager solution for this project without much delay or dependency. A large, high performance application under PCI DSS regulation will require many CPs. This will require a license purchase. The procurement process can take 6-12 months. The development team is eager to work with Security on this project. This finding should be prioritized second because it has a high impact, compliance requirement, and stakeholder support. The application handles sensitive payment card data that needs to be secured by the Secrets Manager solution. The development team is willing to collaborate with the Security Team on this project and can help with the technical aspects of the implementation. However, this finding also has a high cost and a long lead time due to the license purchase and the procurement process. A small, internally developed application under HIPPA regulation needs updates to the application code to retrieve secrets from a Secrets Manager solution. The development team stated they cannot accommodate this work before next quarter. This finding should be prioritized third because it has a moderate impact, compliance requirement, and feasibility. The application handles protected health information that needs to be secured by the Secrets Manager solution. The development team is aware of the need to update the application code to integrate with the Secrets Manager solution, but they have other priorities and constraints that prevent them from doing so in the near term.

  Here's the reasoning behind this order:

  1. New vulnerability scanner project:

  This project directly impacts CyberArk's Security Team, making it a high priority due to potential internal security concerns. Additionally, its near-completion state suggests a quicker implementation timeframe.

  2. Large application under PCI DSS:

  While this application requires significant resources and time investment due to license purchase and development, its high performance and PCI DSS regulation compliance mandate prioritization. Delaying this project could potentially lead to security vulnerabilities and compliance issues.

  3. Small application under HIPAA:

  Although HIPAA regulation necessitates compliance, the application's size and development team's delay request suggest a lower priority compared to the previous two projects. However, it should still be addressed within the next quarter as mandated by the development team.