CyberArk CyberArk Certifications SECRET-SEN Questions & Answers

• Question 21:

  Which statement is correct about this message?

  Message: "[number-of-deleted-rows] rows has successfully deleted "CEADBR009D Finished vacuum"?

  A. It notes the number of records deleted from the database and does not require any action.

  B. The user specified for Conjur does not have the appropriate permissions to retrieve the audit database (audit .db).

  C. When audit retention was performed, the query on the Ul audit database (audit.db) generated an error.

  D. The Vault Conjur Synchronizer successfully deleted the password objects that were marked for deletion in the PVWA.

  Correct Answer: A

  This is the correct answer because the message indicates that the audit retention process has successfully completed and deleted the specified number of rows from the audit database (audit.db). The audit retention process is a scheduled task that runs periodically to delete old audit records from the audit database based on the retention period configured in the Conjur UI. The audit retention process also performs a vacuum operation to reclaim the disk space and optimize the database performance. The message does not require any action from the user, as it is a normal and expected outcome of the audit retention process. This answer is based on the CyberArk Secrets Manager documentation1 and the CyberArk Secrets Manager training course2. The other options are not correct statements about the message. The message does not imply that the user specified for Conjur does not have the appropriate permissions to retrieve the audit database, as the message is not an error or a warning, but a confirmation of the audit retention process. The user specified for Conjur is the user that is used to connect to the Conjur server and perform operations on the Conjur resources, such as roles, policies, secrets, and audit records. The user specified for Conjur needs to have the appropriate permissions to access the audit database, but the message does not indicate any problem with the user permissions. The message does not imply that when audit retention was performed, the query on the UI audit database generated an error, as the message is not an error or a warning, but a confirmation of the audit retention process. The query on the UI audit database is the query that is used to display the audit records in the Conjur UI. The query on the UI audit database is not related to the audit retention process, which is a background task that runs on the Conjur server and deletes the old audit records from the audit database. The message does not indicate any problem with the query on the UI audit database. The message does not imply that the Vault Conjur Synchronizer successfully deleted the password objects that were marked for deletion in the PVWA, as the message is not related to the Vault Conjur Synchronizer or the password objects. The Vault Conjur Synchronizer is a service that synchronizes secrets from the CyberArk Vault to the Conjur database. The password objects are the accounts in the CyberArk Vault that store the credentials for various platforms and devices. The message is related to the audit retention process, which deletes the old audit records from the audit database. The message does not indicate any problem or action with the Vault Conjur Synchronizer or the password objects.

• Question 22:

  What is the most maintenance-free way to ensure a Conjur host's access reflects any changes made to accounts in a safe in the CyberArk vault?

  A. Write an automation script to update and load the host's policy using PATCH/update.

  B. Use yami anchor [and] and wildcard (*) syntax to maintain its list of permission grants.

  C. Grant the consumers group/role created by the Synchronizer for the Safe to the host.

  D. Use PVWA to add the Conjur host ID as a member of the Safe.

  Correct Answer: C

  The most maintenance-free way to ensure a Conjur host's access reflects any changes made to accounts in a safe in the CyberArk vault is to grant the consumers group/role created by the Synchronizer for the Safe to the host. This means

  that the host will inherit the read and execute permissions on all the secrets in the Safe from the consumers group/role, and will automatically get access to any new or updated secrets in the Safe without requiring any manual intervention or

  policy changes. The consumers group/role is created by the Vault Conjur Synchronizer, which is a service that synchronizes secrets between the CyberArk vault and Conjur. The Synchronizer creates a policy branch for each Safe in Conjur,

  and assigns the consumers group/role to have read and execute permissions on all the secrets in the Safe. The Synchronizer also creates a delegation policy for each Safe, which allows the Safe admins to grant permissions to other users,

  hosts, groups, or layers12.

  The other options are not the most maintenance-free ways to ensure a Conjur host's access reflects any changes made to accounts in a safe in the CyberArk vault. Writing an automation script to update and load the host's policy using

  PATCH/update may work, but it requires additional effort and maintenance to ensure the script is always running and up to date with the changes in the Safe. Using yami anchor [and] and wildcard (*) syntax to maintain its list of permission

  grants may simplify the policy writing, but it still requires manual editing and loading of the policy whenever a new secret is added or removed from the Safe. Using PVWA to add the Conjur host ID as a member of the Safe may not be

  possible or advisable, as the PVWA is designed for managing human users and not Conjur hosts, and it may not have the necessary integration or authorization to do so3.

  References:

  Vault Conjur Synchronizer 1, Synchronizer Policy Structure Grant permissions on secrets 2, Grant role permissions on all secrets in a Safe Privileged Access Manager - Self-Hosted 3, Privileged Web Access (PVWA)

• Question 23:

  When installing the CCP and configuring it for use behind a load balancer, which authentication methods may be affected? (Choose two.)

  A. Allowed Machines authentication

  B. [Client Certificate authentication

  C. OS User

  D. Path

  E. Hash

  Correct Answer: AB

  The CCP (Central Credential Provider) is a tool that enables applications to securely retrieve credentials from CyberArk Secrets Manager without hard-coding or storing them in files. The CCP can be installed on a single server or on multiple servers behind a load balancer for high availability and scalability. The load balancer is a device or service that distributes the network traffic among the CCP servers based on predefined rules and criteria. The CCP supports multiple methods to authenticate applications, such as Allowed Machines, Client Certificate, OS User, Path, and Hash. These methods are based on registering information in the Vault with the unique application ID. For more information about the supported authentication methods, see Application authentication methods1. When installing the CCP and configuring it for use behind a load balancer, some authentication methods may be affected by the load balancer's behavior and settings. Specifically, the following authentication methods may be affected: Allowed Machines authentication: This method authenticates applications based on their IP address or hostname. If the load balancer replaces the source IP or hostname of the routed packets with its own IP or hostname, the CCP will not be able to authenticate the application that initiated the credential request. To enable the CCP to resolve the IP or hostname of the application, the load balancer needs to be configured as a transparent proxy or to attach the X-Forwarded-For header to the routed packets. For more information, see Load balance the Central Credential Provider2. Client Certificate authentication: This method authenticates applications based on their client certificate that is signed by a trusted certificate authority (CA). The client certificate is used to establish a secure and trusted connection between the application and the CCP. If the load balancer terminates the SSL connection before proxying the traffic to the CCP, the CCP will not be able to verify the client certificate of the application. To enable the CCP to validate the client certificate, the load balancer needs to be configured as a pass-through proxy or to forward the client certificate to the CCP. For more information, see Load balance the Central Credential Provider2. The other authentication methods are not affected by the load balancer, as they do not rely on the IP, hostname, or certificate of the application. For example, the OS User method authenticates applications based on their Windows domain user, the Path method authenticates applications based on their URL path, and the Hash method authenticates applications based on a hash value that is generated from the application ID and a shared secret. These methods do not require any special configuration on the load balancer or the CCP.

• Question 24:

  Which statement is true for the Conjur Command Line Interface (CLI)?

  A. It is supported on Windows, Red Hat Enterprise Linux, and macOS.

  B. It can only be run from the Conjur Leader node.

  C. It is required for working with the Conjur REST API.

  D. It does not implement the Conjur REST API for managing Conjur resources.

  Correct Answer: A

  This is the correct answer because the Conjur CLI is a tool that allows users to interact with the Conjur REST API from the command line. The Conjur CLI can be run on Windows, Red Hat Enterprise Linux, and macOS operating systems, as well as in Docker containers. The Conjur CLI can be installed using various methods, such as downloading the executable file, using a package manager, or pulling the Docker image. The Conjur CLI supports Conjur Enterprise 12.9 or later versions. This answer is based on the CyberArk Secrets Manager documentation1 and the CyberArk Secrets Manager training course2. The other options are not true statements for the Conjur CLI. The Conjur CLI can be run from any machine that has network access to the Conjur server, not only from the Conjur Leader node. The Conjur Leader node is the node that performs read/write operations on the Conjur database and policy engine, and hosts the Conjur UI and API endpoints. The Conjur CLI is not required for working with the Conjur REST API, as users can also use other tools, such as curl, Postman, or web browsers, to send HTTP requests to the Conjur REST API. The Conjur CLI does implement the Conjur REST API for managing Conjur resources, such as roles, policies, secrets, and audit records. The Conjur CLI provides a set of commands that correspond to the Conjur REST API endpoints and allow users to perform various operations on the Conjur resources.

• Question 25:

  When using the Seed Fetcher to deploy Kubernetes Followers, an error occurs in the Seed Fetcher container. You check the logs and discover that although the Seed Fetcher was able to authenticate, it shows a 500 error in the log and does not successfully retrieve a seed file. What is the cause?

  A. The certificate based on the Follower DNS name is not present on the Leader.

  B. The host you configured does not have access to see the certificates.

  C. The synchronizer service crashed and needs to be restarted.

  D. The Leader does not have the authenticator webservice enabled.

  Correct Answer: A

  The cause of the issue is A. The certificate based on the Follower DNS name is not present on the Leader. This means that the Leader does not have a certificate file that matches the Follower DNS name used in the seed request, and therefore cannot generate a valid seed file for the Follower. This results in a 500 error in the Seed Fetcher container log. To resolve the issue, you need to import a certificate with the Follower DNS name as the subject alt name on the Leader, and create a copy of the certificate file with a name that matches the Follower DNS name used in the seed request1.

• Question 26:

  In a 3-node auto-failover cluster, the Leader has been brought down for patching that lasts longer than the configured TTL. A Standby has been promoted.

  Which steps are required to repair the cluster when the old Leader is brought back online?

  A. On the new Leader, generate a Standby seed for the old Leader node and add it to the cluster member list. Rebuild the old Leader as a new Standby and then re-enroll the node to the cluster.

  B. Generate a Standby seed for the newly promoted Leader. Stop and remove the container on the new Leader, then rebuild it as a new Standby. Re-enroll the Standby to the cluster and re-base replication of the 3rd Standby back to the old Leader.

  C. Generate standby seeds for the newly-promoted Leader and the 3rd Standby Stop and remove the containers and then rebuild them as new Standbys. On both new Standbys, re-enroll the node to the cluster.

  D. On the new Leader, generate a Standby seed for the old Leader node and re-upload the auto-failover policy in "replace" mode. Rebuild the old Leader as a new Standby, then re-enroll the node to the cluster.

  Correct Answer: A

  The correct answer is A. On the new Leader, generate a Standby seed for the old Leader node and add it to the cluster member list. Rebuild the old Leader as a new Standby and then re-enroll the node to the cluster. This is the recommended way to repair the cluster health after an auto-failover event, according to the CyberArk Sentry Secrets Manager documentation1. This method reuses the original Leader as a new Standby, without affecting the new Leader or the other Standby. The steps are as follows: On the new Leader, generate a Standby seed for the old Leader node using the command evoke seed standby . This will create a file named .tar in the current directory. On the new Leader, add the old Leader node to the cluster member list using the command evoke cluster add . On the old Leader server, stop and remove the container using the commands docker stop and docker rm . On the old Leader server, copy the Standby seed file from the new Leader using the command scp :.tar . On the old Leader server, create a new container using the same name as the one you just destroyed, and load the Standby seed file using the command docker run --name -d --restart=always -v /var/log/conjur:/var/log/conjur -v /opt/conjur/backup:/opt/conjur/backup -p "443:443" -p "5432:5432" -p "1999:1999" cyberark/conjur:latest seed fetch .tar On the old Leader server, re-enroll the node to the cluster using the command evoke cluster enroll The other options are not correct, as they either involve unnecessary or harmful steps, such as rebuilding the new Leader or the other Standby, or re-uploading the auto-failover policy in replace mode, which may cause data loss or inconsistency.

• Question 27:

  An application owner reports that their application is suddenly receiving an incorrect password. CPM logs show the password was recently changed, but the value currently being retrieved by the application is a different value. The Vault Conjur Synchronizer service is running.

  What is the most likely cause of this issue?

  A. The Vault Conjur Synchronizer is not configured with the DR Vault IP address and there has been a failover event.

  B. Dual Accounts are in use, but after the CPM changed the password for the Inactive account, it accidentally updated the password for the Active account instead.

  C. The CPM is writing password changes to the Primary Vault while the Vault Conjur Synchronizer is configured to replicate from the DR Vault.

  D. The application has been configured to retrieve the wrong password.

  Correct Answer: C

  This is the most likely cause of this issue because it creates a discrepancy between the passwords stored in the Primary Vault and the DR Vault, which affects the Vault Conjur Synchronizer service (Synchronizer) and the application. The

  Synchronizer is a service that synchronizes secrets from the CyberArk Vault to the Conjur database. The application is a client that retrieves secrets from the Conjur database using the Conjur REST API. The CPM is a component that

  manages the lifecycle of the passwords stored in the CyberArk Vault, such as changing, verifying, and reconciling them. If the CPM is writing password changes to the Primary Vault while the Synchronizer is configured to replicate from the

  DR Vault, the following scenario may occur:

  The CPM changes the password for an account in the Primary Vault and updates the password value in the Vault database.

  The Synchronizer does not detect the password change in the DR Vault, as the DR Vault database has not been updated yet with the new password value. The Synchronizer does not sync the new password value to the Conjur database, as

  it assumes that the password value in the DR Vault database is the latest and correct one.

  The application requests the password value from the Conjur database and receives the old password value, which is different from the new password value in the Primary Vault database.

  The application tries to use the old password value to access the target platform or device and fails, as the target platform or device expects the new password value. This answer is based on the CyberArk Secrets Manager documentation1

  and the CyberArk Secrets Manager training course2.

• Question 28:

  Refer to the exhibit.

  

  How can you confirm that the Follower has a current copy of the database?

  A. Compare the pgcurrentxlog_locationlocation from the Leader to the Follower you need to validate against.

  B. Count the number of components in pgstartreplication and compare this to the total number of Followers in the deployment.

  C. Validate that the Follower container ID matches the node in the info endpoint on the Leader.

  D. Retrieve the credential from a test application on the Leader cluster; then retrieve against the Follower and compare if they are accurate.

  Correct Answer: A

  The exhibit shows a JSON object that contains the replication status of a database in a Secrets Manager cluster. Secrets Manager is a secrets management solution that securely stores and manages secrets and credentials used by applications, DevOps tools, and other systems. Secrets Manager can be deployed in a cluster mode, which consists of a Leader node and one or more Follower nodes. The Leader node is the primary node that handles all write operations and coordinates the replication of data to the Follower nodes. The Follower nodes are read-only nodes that replicate data from the Leader node and serve requests from clients and applications that need to retrieve secrets or perform other read-only operations. To confirm that the Follower has a current copy of the database, you can compare the pgcurrentxlog_locationlocation from the Leader to the Follower you need to validate against. The pgcurrentxlog_locationlocation is a property that indicates the current position of the write-ahead log (WAL) in the database. The WAL is a mechanism that records all changes made to the database in a sequential log file, before they are applied to the actual data files. The WAL ensures the durability and consistency of the database in case of a crash or a power failure. The WAL also enables the replication of data from the Leader node to the Follower nodes, by streaming the WAL records to the Follower nodes and applying them to their local databases. By comparing the pgcurrentxlog_locationlocation from the Leader to the Follower, you can determine how far behind the Follower is from the Leader in terms of the WAL records. If the pgcurrentxlog_locationlocation values are identical or very close, it means that the Follower has a current copy of the database, and that the replication is working properly. If the pgcurrentxlog_locationlocation values are different or far apart, it means that the Follower has an outdated copy of the database, and that there is a replication lag or a replication failure. In that case, you may need to troubleshoot the replication issue and resolve it as soon as possible. References: Secrets Manager Cluster Installation; Secrets Manager Cluster Configuration; Write-Ahead Logging - PostgreSQL Documentation

• Question 29:

  A customer wants to minimize the Kubernetes application code developers must change to adopt Conjur for secrets access.

  Which solutions can meet this requirement? (Choose two.)

  A. CPM Push-to-File

  B. Secrets Provider

  C. authn-Azure

  D. Secretless

  E. Application Server Credential Provider

  Correct Answer: BD

  Secrets Provider and Secretless are two solutions that can minimize the Kubernetes application code changes required to adopt Conjur for secrets access. Secrets Provider is a Kubernetes Job or Deployment that runs as an init container or application container alongside the application pod. It retrieves secrets from Conjur and writes them to one or more files in a shared, mounted volume. The application can then consume the secrets from the files without any code changes, as reading local files is a common and platform-agnostic method. Secretless is a sidecar proxy that runs as a separate container in the same pod as the application. It intercepts the application's requests to protected resources, such as databases or web services, and injects the secrets from Conjur into the requests. The application does not need to handle any secrets in its code, as Secretless handles the authentication and authorization for it. References: CyberArk Secrets Provider for Kubernetes, Secretless Broker

• Question 30:

  When attempting to retrieve a credential managed by the Synchronizer, you receive this error:

  

  What is the cause of the issue?

  A. The Conjur Leader has lost upstream connectivity to the Vault Conjur Synchronizer.

  B. The host does not have access to the credential.

  C. The path to the credential was not properly encoded.

  D. The Vault Conjur Synchronizer has crashed and needs to be restarted.

  Correct Answer: B

  The cause of the issue is that the host does not have access to the credential. This can happen if the host does not have the correct permissions or if the credential is not properly configured in the Vault Conjur Synchronizer. The Vault Conjur Synchronizer is a tool that enables the integration between CyberArk Vault and Conjur Secrets Manager Enterprise. The Synchronizer synchronizes secrets that are stored and managed in the CyberArk Vault with Conjur Enterprise, and allows them to be used via Conjur clients, APIs, and SDKs. The Synchronizer creates and updates Conjur policies and variables based on the Vault accounts and safes, and assigns permissions to Conjur hosts based on the Vault allowed machines. To fix this issue, the host needs to have the permission to access the credential in Conjur. This can be done by adding the host to the allowed machines list of the Vault account that corresponds to the credential, and synchronizing the changes with Conjur. Alternatively, the host can be granted the permission to access the credential in Conjur by modifying the Conjur policy that corresponds to the Vault safe that contains the credential, and loading the policy to Conjur. However, this may cause conflicts or inconsistencies with the Synchronizer, and is not recommended. For more information, see the CyberArk Vault Synchronizer docs1 and the Synchronizer Troubleshooting guide2.