CyberArk CyberArk Certifications SECRET-SEN Questions & Answers

• Question 31:

  If you rename an account or Safe, the Vault Conjur Synchronizer recreates these accounts and safes with their new name and deletes the old accounts or safes.

  What does this mean?

  A. Their permissions in Coniur must also be recreated to access them.

  B. Their permissions in Coniur remain the same.

  C. You can not rename an account or safe.

  D. The Vault-Conjur Synchronizer will recreate these accounts and safes with their exact same names.

  Correct Answer: A

  When an account or Safe is renamed in the Vault, the Vault Conjur Synchronizer will create new variables in Conjur with the new name and delete the old variables with the old name. This means that the permissions that were granted to the old variables in Conjur will not apply to the new variables, and they will need to be recreated using delegation policies. Otherwise, the users or hosts that had access to the old variables will not be able to access the new ones. References: Manage Accounts and Safes During Synchronization; Vault Synchronizer full policy guide

• Question 32:

  While installing the first CP in an environment, errors that occurred when the environment was created are displayed; however, the installation procedure continued and finished successfully.

  What should you do?

  A. Continue configuring the application to use the CP. No further action is needed since the successful installation makes the error message benign.

  B. Review the lag file 'CreateEnv.loq' and investigate any error messages it contains.

  C. Run setup.exe again and select 'Recreate Vault Environment'. Provide the details of a user with more privileges when prompted by the installer.

  D. Review the PV WA lags to determine which REST API call used during the installation failed.

  Correct Answer: B

  B. Review the log file `CreateEnv.log' and investigate any error messages it contains. This is the best option because the CreateEnv.log file records the steps and results of creating the CP environment in the Vault during the installation. The CP environment includes the safe, the provider user, the application user, and the application identity. If any errors occurred when creating the CP environment, they will be logged in this file and may indicate a problem with the Vault connection, the credential file, the permissions, or the configuration. Reviewing the log file can help to identify and resolve the root cause of the errors and ensure the CP environment is properly set up. Continuing configuring the application to use the CP without further action is not a good option because it may lead to unexpected or inconsistent behavior of the CP or the application. The errors that occurred when creating the CP environment may affect the security, availability, or integrity of the credentials or the application. Ignoring the errors may also make it harder to troubleshoot or fix them later. Running setup.exe again and selecting `Recreate Vault Environment' is not a good option because it may overwrite or delete the existing CP environment and cause more errors or conflicts. Recreating the Vault environment should only be done after reviewing the log file and understanding the cause of the errors. Moreover, recreating the Vault environment may require more privileges than creating it for the first time, as some objects may be already in use or locked. Reviewing the PVWA logs to determine which REST API call used during the installation failed is not a good option because it may not provide enough information or context to understand or resolve the errors. The PVWA logs may show the HTTP status codes or messages of the REST API calls, but they may not show the details or parameters of the calls or the responses. The PVWA logs may also contain other unrelated or irrelevant entries that may confuse or distract from the errors. The CreateEnv.log file is a more specific and reliable source of information for the errors that occurred when creating the CP environment.

• Question 33:

  What is the correct process to upgrade the CCP Web Service?

  A. Run "sudo yum update aimprv" from the CLI.

  B. Double-click the Credential Provider installer executable and select upgrade.

  C. Double-click the AimWebService.msi and select upgrade.

  D. Uninstall and reinstall the CCP Web Service.

  Correct Answer: D

  The correct process to upgrade the CCP Web Service is D. Uninstall and reinstall the CCP Web Service. The CCP Web Service is a component of the CyberArk Central Credential Provider (CCP) that enables applications to retrieve secrets from the CyberArk Vault using REST API calls. To upgrade the CCP Web Service, you need to first uninstall the existing CCP Web Service from the Windows Server Manager or the Control Panel, and then reinstall the CCP Web Service using the latest installation package from the CyberArk website. The installation package contains both the Credential Provider and the CCP Web Service components, and you need to run the AimWebService.msi file to install the CCP Web Service. You also need to make sure that the CCP Web Service has the correct configuration and permissions, and that the CyberArk CRL (Certificate Revocation List) is open from the CCP server. The other options are not correct processes to upgrade the CCP Web Service. Running "sudo yum update aimprv" from the CLI is a command to update the Credential Provider on Linux, not the CCP Web Service on Windows. Double-clicking the Credential Provider installer executable and selecting upgrade is a process to upgrade the Credential Provider on Windows, not the CCP Web Service. Double-clicking the AimWebService.msi and selecting upgrade is not a valid option, as the CCP Web Service does not support an upgrade option, and you need to uninstall it first before reinstalling it. References: Upgrade the Central Credential Provider (CCP) - CyberArk, Section "Upgrade the Central Credential Provider (CCP)" Central Credential Provider web service configuration - CyberArk, Section "Central Credential Provider web service configuration"

• Question 34:

  While troubleshooting an issue with accounts not syncing to Conjur, you see this in the log file:

  

  What could be the issue?

  A. Connection timed out to the Vault.

  B. Safe permissions for the LOB user are incorrect.

  C. Connection timed out during loading policy through SDK.

  D. At first Vault Conjur Synchronizer start up, the number of LOBs is exceeded.

  Correct Answer: D

  This is the correct answer because the log file shows the error message "CEADBR009E Failed to load policy through SDK" and the exception message "The number of LOBs exceeds the limit". This indicates that the Vault Conjur Synchronizer service (Synchronizer) encountered a problem when trying to sync the secrets from the CyberArk Vault to the Conjur database using the Conjur SDK. The Conjur SDK is a library that allows the Synchronizer to interact with the Conjur REST API and perform operations on the Conjur resources, such as roles, policies, secrets, and audit records. The number of LOBs refers to the number of lines of business (LOBs) that are configured in the Synchronizer. A LOB is a logical grouping of secrets that belong to a specific business unit or function. Each LOB has its own configuration file that specifies the source safe, the target policy, and the mapping rules for the secrets. The Synchronizer can sync multiple LOBs concurrently using multiple threads. However, there is a limit on the number of threads that the Synchronizer can use, which depends on the hardware and software specifications of the Synchronizer machine. If the number of LOBs exceeds the number of threads, the Synchronizer will not be able to sync all the LOBs and will generate an error. This answer is based on the CyberArk Secrets Manager documentation and the CyberArk Secrets Manager training course.

• Question 35:

  Which API endpoint can be used to discover secrets inside of Conjur?

  A. Resources

  B. Roles

  C. Policies

  D. WhoAmi

  Correct Answer: A

  Conjur is a secrets management solution that securely stores and manages secrets and credentials used by applications, DevOps tools, and other systems. Conjur provides a REST API that enables users to perform various operations on Conjur objects, such as secrets, policies, roles, and resources. The API endpoint for each Conjur object is composed of the base URL of the Conjur server, followed by the object type and identifier. For example, the API endpoint for a secret named db-password in the dev/my-app policy is: https:///secrets/dev/my-app/db-password To discover secrets inside of Conjur, the API endpoint that can be used is Resources. Resources are Conjur objects that have permissions and annotations associated with them, such as secrets, hosts, groups, and layers. The Resources API endpoint allows users to list, search, and filter resources based on various criteria, such as kind, owner, policy, and annotation. For example, the following API request will return a list of all secrets owned by the user alice: https:///resources?kind=variableandowner=user:alice The Resources API endpoint can help users to discover secrets inside of Conjur by providing information such as the name, ID, policy, owner, and annotations of each secret. Users can also use the Resources API endpoint to check the permissions and audit records of each secret, and to retrieve the secret value if they have the read permission. References: Conjur API; Resources API; Secrets API

• Question 36:

  A customer has 100 .NET applications and wants to use Summon to invoke the application and inject secrets at run time.

  Which change to the NET application code might be necessary to enable this?

  A. It must be changed to include the REST API calls necessary to retrieve the needed secrets from the CCP.

  B. It must be changed to access secrets from a configuration file or environment variable.

  C. No changes are needed as Summon brokers the connection between the application and the backend data source through impersonation.

  D. It must be changed to include the host API key necessary for Summon to retrieve the needed secrets from a Follower

  Correct Answer: B

  Summon is a utility that allows applications to access secrets from a variety of trusted stores and export them as environment variables to a sub-process environment. Summon does not require any changes to the application code to retrieve secrets from the CyberArk Central Credential Provider (CCP), as it uses a provider plugin that handles the communication with the CCP. However, the application code must be able to access secrets from a configuration file or environment variable, as these are the methods that Summon uses to inject secrets into the application. Summon reads a secrets.yml file that defines the secrets that the application needs and maps them to environment variables. Then, Summon fetches the secrets from the CCP using the provider plugin and exports them as environment variables to the application sub-process. The application can then read the secrets from the environment variables as if they were hard-coded in the configuration file. References: Summon-inject secrets, .NET Application Password SDK

• Question 37:

  What is a possible Conjur node role change?

  A. A Standby may be promoted to a Leader.

  B. A Follower may be promoted to a Leader.

  C. A Standby may be promoted to a Follower.

  D. A Leader may be demoted to a Standby in the event of a failover.

  Correct Answer: A

  According to the CyberArk Sentry Secrets Manager documentation, Conjur is a secrets management solution that consists of a leader node and one or more follower nodes. The leader node is responsible for managing the secrets, policies,

  and audit records, while the follower nodes are read-only replicas that can serve secrets requests from applications. Additionally, Conjur supports a standby node, which is a special type of follower node that can be promoted to a leader node

  in case of a leader failure. A standby node is synchronized with the leader node and can take over its role in a disaster recovery scenario. A possible Conjur node role change is when a standby node is promoted to a leader node, either

  manually or automatically, using the auto-failover feature. A follower node cannot be promoted to a leader node, as it does not have the same data and functionality as the leader node. A standby node cannot be promoted to a follower node,

  as it already has the same capabilities as a follower node, plus the ability to become a leader node. A leader node cannot be demoted to a standby node in the event of a failover, as it would lose its data and functionality and would not be able

  to resume its role as a leader node.

  References:

  1: Conjur Architecture

  2: Deploying Conjur on AWS

  3: Auto-failover

• Question 38:

  A customer wants to ensure applications can retrieve secrets from Conjur in three different data centers if the Conjur Leader becomes unavailable. Conjur Followers are already deployed in each of these data centers.

  How should you architect the solution to support this requirement?

  A. No changes are required.

  B. Deploy a Standby in each data center that can be promoted to the role of Leader.

  C. Extend the auto failover cluster to include Standby?in each data center and allow for automatic recovery should the Leader become unavailable.

  D. Deploy a CP provider on the Follower server to provide offline caching capabilities for the Follower.

  Correct Answer: C

  Conjur Followers are read-only replicas of the Leader that can serve client requests for authentication, authorization, and secret retrieval. However, Followers cannot perform write operations, such as creating or updating secrets, policies, or roles. If the Leader becomes unavailable, the Followers will not be able to sync with the latest data and will eventually become stale. To ensure high availability and data consistency, the customer should extend the auto-failover cluster to include Standbys in each data center. Standbys are also replicas of the Leader, but they can participate in replication and promotion. One Standby is configured for synchronous replication, which means it receives the same updates as the Leader at the same time. The other Standbys are configured for asynchronous replication, which means they receive updates from the Leader periodically, but not in real time. In case of Leader failure, the synchronous Standby can be automatically promoted to become the new Leader, and one of the asynchronous Standbys can become the new synchronous Standby. This way, the customer can ensure that there is always an up-to-date Leader that can serve write requests and sync with the Followers in different data centers. References: Set up Follower, Set up auto-failover cluster, Conjur architecture and deployment reference

• Question 39:

  In the event of a failover of the Vault server from the primary to the DR, which configuration option ensures that a CP will continue being able to refresh its cache?

  A. Add the DR Vault IP address to the "Address" parameter in the file main_appprovider.conf. . found in the AppProviderConf safe.

  B. Add the IP address of the DR vault to the "Address" parameter in the file Vault.ini.file on the machine on which the CP is installed.

  C. In the Password Vault Web Access UI, add the IP address of the DR Vault in the Disaster Recovery section under Applications > Options.

  D. In the Conjur UI, add the IP address of the DR Vault in the Disaster Recovery section under Cluster Config > Credential Provider > Options.

  Correct Answer: B

  This is the correct answer because the Vault.ini file on the CP machine contains the configuration settings for the CP to connect to the Vault server. The Address parameter specifies the IP address or hostname of the Vault server that the CP will use to communicate with the Vault. In the event of a failover of the Vault server from the primary to the DR, the CP needs to update the Address parameter with the IP address of the DR Vault server in order to continue being able to refresh its cache. The cache is a local storage of credentials that the CP retrieves from the Vault and provides to the applications. The cache is refreshed periodically based on the RefreshInterval parameter in the Vault.ini file. This answer is based on the CyberArk Secrets Manager documentation1 and the CyberArk Secrets Manager training course2. The other options are not correct because they do not ensure that the CP will continue being able to refresh its cache in the event of a failover of the Vault server from the primary to the DR. Adding the DR Vault IP address to the Address parameter in the main_appprovider.conf.. file in the AppProviderConf safe is not a valid option, as this file does not contain the Address parameter. The main_appprovider.conf file contains the configuration settings for the basic provider, such as the AppProviderVaultParmsFile, the AppProviderPort, and the AppProviderCacheMode. The Address parameter is only found in the Vault.ini file on the CP machine. In the Password Vault Web Access (PVWA) UI, adding the IP address of the DR Vault in the Disaster Recovery section under Applications > Options is not a valid option, as this section does not exist in the PVWA UI. The PVWA UI does not have a Disaster Recovery section under Applications > Options. The PVWA UI has a Disaster Recovery section under Administration > Options, but this section is used to configure the DR Vault settings, such as the DR Vault IP address, the DR Vault user, and the DR Vault password. These settings are not related to the CP configuration or cache refresh. In the Conjur UI, adding the IP address of the DR Vault in the Disaster Recovery section under Cluster Config > Credential Provider > Options is not a valid option, as this section does not exist in the Conjur UI. The Conjur UI does not have a Cluster Config, Credential Provider, or Options section. The Conjur UI has a Cluster Config section under Settings, but this section is used to configure the Conjur cluster settings, such as the master IP address, the follower IP address, and the seed fetcher IP address. These settings are not related to the CP configuration or cache refresh.

• Question 40:

  A customer requires high availability in its AWS cloud infrastructure.

  What is the minimally viable Conjur deployment architecture to achieve this?

  A. one Follower in each AZ. load balancer for the region

  B. two Followers in each region, load balanced for the region

  C. two Followers in each AZ. load balanced for the region

  D. two Followers in each region, load balanced across all regions

  Correct Answer: A

  According to the CyberArk Sentry Secrets Manager documentation, Conjur is a secrets management solution that consists of a leader node and one or more follower nodes. The leader node is responsible for managing the secrets, policies,

  and audit records, while the follower nodes are read-only replicas that can serve secrets requests from applications. To achieve high availability in AWS cloud infrastructure, the minimally viable Conjur deployment architecture is to have one

  follower in each availability zone (AZ) and a load balancer for the region. This way, if one AZ fails, the applications can still access secrets from another AZ through the load balancer. Having two followers in each region, load balanced for the

  region, is not enough to ensure high availability, as a regional outage can affect both followers. Having two followers in each AZ, load balanced for the region, is more than necessary, as one follower per AZ can handle the secrets requests.

  Having two followers in each region, load balanced across all regions, is not feasible, as Conjur does not support cross-region replication.

  References: 1: Conjur Architecture 2: Deploying Conjur on AWS