CyberArk CyberArk Certifications SECRET-SEN Questions & Answers

• Question 11:

  When attempting to retrieve a credential, you receive an error 401 ?Malformed Authorization Token.

  What is the cause of the issue?

  A. The token is not correctly encoded.

  B. The token you are trying to retrieve does not exist.

  C. The host does not have access to the credential with the current token.

  D. The credential has not been initialized.

  Correct Answer: A

  = The cause of the issue is that the token is not correctly encoded. A token is a string of characters that represents a credential or an authorization grant for accessing a resource. A token must be encoded according to a specific format and standard, such as Base64, JSON Web Token (JWT), or OAuth 2.0. If the token is malformed, meaning that it does not follow the expected format or standard, the server will reject the token and return an error 401 - Malformed Authorization Token. This error indicates that the token is invalid or expired, and the request is unauthorized. To resolve the issue, the token must be regenerated or refreshed using the correct encoding method and parameters12. References: = CyberArk Identity: Getting 401 unauthorized Error when using API calls with OAuth2 Client 2, Resolution 1 Troubleshoot CyberArk Vault Synchronizer 1, Error: Forbidden Logon Token is Empty - Cannot logon Unauthorized

• Question 12:

  After manually failing over to your disaster recovery site (Site B) for testing purposes, you need to failback to your primary site (Site A).

  Which step is required?

  A. Contact CyberArk for a new license file.

  B. Reconfigure the Vault Conjur Synchronizer to point to the new Conjur Leader.

  C. Generate a seed for the new Leader to be deployed in Site A.

  D. Trigger autofailover to promote the Standby in Site A to Leader.

  Correct Answer: C

  According to the CyberArk Sentry Secrets Manager documentation1, the steps to failback to the primary site after a manual failover to the disaster recovery site are as follows: On the DR site, stop the Conjur Leader node using the command docker stop . On the primary site, generate a seed for the new Leader node using the command evoke seed leader . This will create a file named .tar in the current directory. On the primary site, copy the Leader seed file to the new Leader server using the command scp .tar :.tar On the new Leader server, create a new container using the same name as the one you just stopped, and load the Leader seed file using the command docker run --name -d --restart=always -v /var/log/conjur:/var/log/conjur -v /opt/conjur/backup:/opt/conjur/backup -p "443:443" -p "5432:5432" -p "1999:1999" cyberark/conjur:latest seed fetch .tar On the new Leader server, configure the Conjur Leader node using the command evoke configure leader -h -p On the new Leader server, reconfigure the Vault Conjur Synchronizer to point to the new Conjur Leader using the command evoke vault sync set On the DR site, generate a seed for the new Standby node using the command evoke seed standby . This will create a file named .tar in the current directory. On the DR site, copy the Standby seed file to the new Standby server using the command scp .tar :.tar On the new Standby server, create a new container using the same name as the one you just stopped, and load the Standby seed file using the command docker run --name -d --restart=always -v /var/log/conjur:/var/log/ conjur -v /opt/conjur/backup:/opt/conjur/backup -p "443:443" -p "5432:5432" -p "1999:1999" cyberark/conjur:latest seed fetch .tar On the new Standby server, re-enroll the node to the cluster using the command evoke cluster enroll The other options are not correct, as they are either unnecessary or incorrect. Contacting CyberArk for a new license file is not required, as the license is valid for both sites. Reconfiguring the Vault Conjur Synchronizer to point to the new Conjur Leader is a step that should be done on the new Leader server, not on the DR site. Triggering autofailover to promote the Standby in Site A to Leader is not possible, as the Standby node is not aware of the manual failover and will not accept the promotion request.

• Question 13:

  During the configuration of Conjur, what is a possible deployment scenario?

  A. The Leader and Followers are deployed outside of a Kubernetes environment; Slandbys can run inside a Kubernetes environment.

  B. The Conjur Leader cluster is deployed outside of a Kubernetes environment; Followers can run inside or outside the environment.

  C. The Leader cluster is deployed outside a Kubernetes environment; Followers and Standbys can run inside or outside the environment.

  D. The Conjur Leader cluster and Followers are deployed inside a Kubernetes environment.

  Correct Answer: C

  Conjur is a secrets management solution that securely stores and manages secrets and credentials used by applications, DevOps tools, and other systems. Conjur can be deployed in different scenarios, depending on the needs and preferences of the organization. One of the possible deployment scenarios is to deploy the Leader cluster outside a Kubernetes environment, and the Followers and Standbys inside or outside the environment. The Leader cluster is the primary node that handles all write operations and coordinates the replication of data to the Follower and Standby nodes. The Leader cluster consists of one active Leader node and one or more Standby nodes that can be promoted to Leader in case of a failure. The Leader cluster can be deployed outside a Kubernetes environment, such as on a virtual machine or a physical server, using Docker or other installation methods. This can provide more control and flexibility over the configuration and management of the Leader cluster, as well as better performance and security. The Follower and Standby nodes are read-only replicas of the Leader node that can serve requests from clients and applications that need to retrieve secrets or perform other read- only operations. The Follower and Standby nodes can be deployed inside or outside a Kubernetes environment, depending on the use case and the availability requirements. For example, if the clients and applications are running inside a Kubernetes cluster, it may be convenient and efficient to deploy the Follower and Standby nodes inside the same cluster, using Helm charts or other methods. This can reduce the network latency and complexity, and leverage the Kubernetes features such as service discovery, load balancing, and health checks. Alternatively, if the clients and applications are running outside a Kubernetes cluster, or if there is a need to distribute the Follower and Standby nodes across different regions or availability zones, it may be preferable to deploy the Follower and Standby nodes outside the Kubernetes cluster, using Docker or other methods. This can provide more scalability and resiliency, and avoid the dependency on the Kubernetes cluster. References: Conjur Deployment Scenarios; Conjur Cluster Installation; Conjur Kubernetes Integration

• Question 14:

  You are deploying Kubernetes resources/objects as Conjur identities.

  In addition to Namespace and Deployment, from which options can you choose? (Choose two.)

  A. ServiceAccount

  B. Replica sets

  C. Secrets

  D. Tokenreviews

  E. StatefulSet

  Correct Answer: AE

  ServiceAccount and StatefulSet are two of the Kubernetes resources/objects that can be used as Conjur identities, in addition to Namespace and Deployment. Conjur identities are the entities that can authenticate with Conjur and retrieve secrets from it. Conjur supports authenticating Kubernetes resources/objects using the Conjur Kubernetes Authenticator, which is a sidecar or init container that runs alongside the application container and injects the Conjur access token into a shared volume. The application container can then use the access token to fetch secrets from Conjur. A ServiceAccount is a Kubernetes resource that represents an identity for processes that run in a pod. ServiceAccounts can be used to grant specific privileges and permissions to the pod, and to enable communication with the Kubernetes API server. A ServiceAccount can be used as a Conjur identity by annotating it with the Conjur authentication policy branch ID, and by creating a Conjur host entity that matches the ServiceAccount name and namespace. The Conjur Kubernetes Authenticator will then use the ServiceAccount token to authenticate the pod with Conjur and obtain the Conjur access token. A StatefulSet is a Kubernetes resource that manages the deployment and scaling of a set of pods, and provides guarantees about the ordering and uniqueness of these pods. StatefulSets are useful for applications that require stable and persistent identities, such as databases, message brokers, or distributed systems. A StatefulSet can be used as a Conjur identity by annotating it with the Conjur authentication policy branch ID, and by creating a Conjur host entity that matches the StatefulSet name and namespace. The Conjur Kubernetes Authenticator will then use the pod name and namespace to authenticate the pod with Conjur and obtain the Conjur access token. The other options are not valid Kubernetes resources/objects that can be used as Conjur identities. Replica sets are a lower-level resource that are usually managed by higher-level resources such as Deployments or StatefulSets, and do not have their own identity or annotations. Secrets are a Kubernetes resource that store sensitive information such as passwords, tokens, or keys, and are not meant to be used as identities. Tokenreviews are a Kubernetes resource that are used to verify the validity of a ServiceAccount token, and are not meant to be used as identities either. References: Securing Secrets in Kubernetes - CyberArk Developer, Section "Conjur Kubernetes Authentication: A Hands-On Demonstration" GitHub - cyberark/secrets-provider-for-k8s: Cyberark secrets provider ..., Section "Consuming Secrets from CyberArk Secrets Provider" Secure your Kubernetes-deployed applications with CyberArk Conjur, Section "How it works" Simplify and Improve Container Security Using New CyberArk Conjur ..., Section "CyberArk Conjur Enterprise" Keeping Secrets Secure on Kubernetes - CyberArk Developer, Section "The Solution"

• Question 15:

  You are enabling synchronous replication on Conjur cluster.

  What should you do?

  A. Execute this command on the Leader: docker exec sh -c" evoke replication sync that

  B. Execute this command on each Standby: docker exec sh -c" evoke replication sync that

  C. In Conjur web UI, click the Tools icon in the top right corner of the main window. Choose Conjur Cluster and click "Enable synchronous replication" in the entry for Leader.

  D. In Conjur web UI, click the Tools icon in the top right corner of the main window. Choose Conjur Cluster and click "Enable synchronous replication" in the entry for Standbys.

  Correct Answer: A

  enable synchronous replication on a Conjur cluster, you need to run the command evoke replication sync that on the Leader node of the cluster. This command will configure the Leader to wait for confirmation from all Standbys before committing any transaction to the database. This ensures that the data is consistent across all nodes and prevents data loss in case of a failover. However, this also increases the latency and reduces the throughput of the cluster, so it should be used with caution and only when required by the business or compliance needs. References: Conjur Cluster Replication Sentry - Secrets Manager - Sample Items and Study Guide

• Question 16:

  When an application is retrieving a credential from Conjur, the application authenticates to Follower A. Follower B receives the next request to retrieve the credential.

  What happens next?

  A. The Coniur Token is stateless and Follower B is able to validate the Token and satisfy the request.

  B. The Coniur Token is stateful and Follower B is unable to validate the Token promptinq the application to re-authenticate.

  C. The Coryur Token is stateless and Follower B redirects the request to Follower A to satisfy the request.

  D. The Coniur Token is stateful and Follower B redirects the request to Follower A to satisfy the request.

  Correct Answer: A

  This is the correct answer because the Conjur Token is a JSON Web Token (JWT) that is signed by the Conjur master and contains the identity and permissions of the application. The Conjur Token is stateless, meaning that it does not depend on any stored session or transaction information on the server side. Therefore, any Conjur follower can validate the Token by verifying the signature and the expiration time, and satisfy the request by retrieving the credential from the local database. This allows the Conjur followers to be horizontally scalable and load balanced, and to provide high availability and performance for the applications. This answer is based on the Conjur documentation1 and the Conjur training course2.

• Question 17:

  When working with Summon, what is the purpose of the secrets.yml file?

  A. It is where Summon outputs the secret value after retrieval.

  B. It is where you define which secrets to retrieve.

  C. It is where you store the Conjur URL and host API key.

  D. It is the log file for Summon.

  Correct Answer: B

  = Summon is a command-line tool that provides on-demand secrets access for common DevOps tools. It reads a file in secrets.yml format and injects secrets as environment variables into any process. The secrets.yml file is where you define which secrets to retrieve from a trusted store, such as CyberArk Secrets Manager. The secrets.yml file specifies the name and location of each secret, as well as the environment variable to assign it to. For example, a secrets.yml file could look like this: DB_USERNAME: !var dev/my-app/db-username DB_PASSWORD: !var dev/my-app/db- password This means that Summon will fetch the values of dev/my-app/db-username and dev/my- app/db-password from the trusted store, and assign them to the environment variables DB_USERNAME and DB_PASSWORD, respectively. Then, Summon will run the specified process with these environment variables set, and remove them once the process exits. This way, Summon enables secure and convenient access to secrets without exposing them in plain text or storing them in files. References: Summon by cyberark - GitHub Pages; Using Summon to Manage Secrets as You Move From Dev to Prod

• Question 18:

  Followers are replications of the Leader configured for which purpose?

  A. synchronous replication to ensure that there is always an up-to-date database

  B. asynchronous replication from the Leader which allows secret reads at scale

  C. asynchronous replication from the Leader with read/write operations capability

  D. synchronous replication to ensure high availability

  Correct Answer: B

  Followers are read-only replicas of the Leader that perform asynchronous replication from the Leader. This means that they receive updates from the Leader periodically, but not in real time. Followers are designed to handle all types of read requests from workloads and applications, such as authentication, permission checks, and secret fetches. Followers can scale horizontally to support a large number of concurrent requests and reduce the load on the Leader. Followers also provide high availability and disaster recovery by serving as backup nodes in case of Leader failure or network partition. References: Set up Follower, Deploy the Conjur Follower, Follower architecture

• Question 19:

  When working with Credential Providers in a Privileged Cloud setting, what is a special consideration?

  A. If there are installation issues, troubleshooting may need to involve the Privileged Cloud support team.

  B. Credential Providers are not supported in a Privileged Cloud setting.

  C. The AWS Cloud account number must be defined in the file main appprovider.conf.. found in the AppProviderConf Safe.

  D. Debug logging for Credential Providers deployed in a Privileged Cloud setting can inadvertently exhaust available disk space.

  Correct Answer: A

  Credential Providers are tools that enable applications to securely retrieve credentials from CyberArk Secrets Manager without hard-coding or storing them in files. Credential Providers can be installed on application servers or on a central server that acts as a proxy for multiple applications. Credential Providers can integrate with Privileged Cloud, which is a cloud-based solution that provides privileged access management as a service. Privileged Cloud integrates with Secrets Manager Credential Providers to manage application credentials as privileged accounts within Privileged Cloud. When working with Credential Providers in a Privileged Cloud setting, a special consideration is that if there are installation issues, troubleshooting may need to involve the Privileged Cloud support team. This is because the installation of Credential Providers in a Privileged Cloud setting requires some additional steps and configurations that are performed by the Privileged Cloud support team. For example, the Privileged Cloud support team needs to configure the connection between Privileged Cloud and Credential Providers, and provide the necessary certificates and keys for secure communication. Therefore, if there are any problems or errors during the installation process, the Privileged Cloud support team may need to assist with the troubleshooting and resolution. The other options are not correct. Credential Providers are supported in a Privileged Cloud setting, as described in the Secrets Manager Credential Providers integration documentation1. The AWS Cloud account number does not need to be defined in the file main appprovider.conf.. found in the AppProviderConf Safe. This file is used to configure the Credential Provider settings, such as the Privileged Cloud URL, the application ID, and the SSL options. The AWS Cloud account number is not relevant for this file. Debug logging for Credential Providers deployed in a Privileged Cloud setting can be enabled or disabled by the Privileged Cloud support team, as described in the Credential Provider installation documentation2. Debug logging can help with troubleshooting and diagnostics, but it does not necessarily exhaust available disk space, as the log files can be rotated and archived. References: Secrets Manager Credential Providers integration; Credential Provider installation

• Question 20:

  You modified a Conjur host policy to change its annotations for authentication.

  How should you load the policy to make those changes?

  A. Use the default "append" method (e.g. conjur policy load ).

  B. Use the "replace" method (e.g. conjur policy load ?璻eplace<;branc>;<;policy-fil>;).

  C. Use the "delete" method (e.g. conjur policy load ?璬elete<;branc>;<;policy-fil>;).

  D. Use the "update" method (e.g. conjur policy load ?璾pdate<;branc>;<;policy-fil>;).

  Correct Answer: B

  = According to the CyberArk Sentry Secrets Manager documentation, the replace method is used to overwrite an existing policy branch with a new policy file. This method is suitable for making changes to the existing resources, such as modifying their annotations, permissions, or attributes. The replace method preserves the existing data and secrets associated with the resources, but removes any resources that are not defined in the new policy file. Therefore, to change the annotations for authentication of a Conjur host, the replace method is the best option. The append method is used to add new resources or data to an existing policy branch, without affecting the existing resources. This method is suitable for creating new hosts, groups, variables, or secrets, but not for modifying the existing ones. The append method will ignore any changes to the existing resources, such as annotations, and will only load the new resources or data. The delete method is used to remove resources or data from an existing policy branch, without affecting the other resources. This method is suitable for deleting hosts, groups, variables, or secrets, but not for modifying them. The delete method will remove any resources or data that are defined in the policy file, and will ignore any resources or data that are not defined in the policy file. The update method is used to modify the data or secrets associated with existing resources, without affecting the resources themselves. This method is suitable for changing the values of variables or secrets, but not for changing the annotations, permissions, or attributes of the resources. The update method will only load the data or secrets that are defined in the policy file, and will ignore any resources or data that are not defined in the policy file. References: = Annotation reference | CyberArk Docs; Policy load modes | CyberArk Docs; Policy - docs.cyberark.com