CyberArk SECRET-SEN Online Practice Questions and Exam Preparation

CyberArk SECRET-SEN Online Questions & Answers

• Question 51:

  A customer wants to minimize the Kubernetes application code developers must change to adopt Conjur for secrets access.

  Which solutions can meet this requirement? (Choose two.)

  A. CPM Push-to-File
  B. Secrets Provider
  C. authn-Azure
  D. Secretless
  E. Application Server Credential Provider
  B. Secrets Provider
  D. Secretless

  ---

  Explanation/Reference:

  Secrets Provider and Secretless are two solutions that can minimize the Kubernetes application code changes required to adopt Conjur for secrets access. Secrets Provider is a Kubernetes Job or Deployment that runs as an init container or application container alongside the application pod. It retrieves secrets from Conjur and writes them to one or more files in a shared, mounted volume. The application can then consume the secrets from the files without any code changes, as reading local files is a common and platform-agnostic method. Secretless is a sidecar proxy that runs as a separate container in the same pod as the application. It intercepts the application's requests to protected resources, such as databases or web services, and injects the secrets from Conjur into the requests. The application does not need to handle any secrets in its code, as Secretless handles the authentication and authorization for it. References: CyberArk Secrets Provider for Kubernetes, Secretless Broker

• Question 52:

  How many Windows and Linux servers are required for a minimal Conjur deployment that integrates with an existing CyberArk PAM Vault environment, supports high availability, and is redundant across two geographically disparate regions?

  A. 5 Linux servers, 2 Windows servers
  B. 9 Linux servers, 2 Windows servers
  C. 3 Linux servers, 1 Windows server
  D. 10 Linux servers, 2 Windows server
  B. 9 Linux servers, 2 Windows servers

  ---

  Explanation/Reference:

  This is the correct answer because a minimal Conjur deployment that integrates with an existing CyberArk PAM Vault environment, supports high availability, and is redundant across two geographically disparate regions requires the following servers: 2 Linux servers for the Conjur master cluster, one in each region. The master cluster consists of a leader and a standby node that can automatically failover in case of a leader failure. The leader node performs read/write operations on the Conjur database and policy engine, while the standby node replicates the leader data and can be promoted to leader if needed. The master cluster also hosts the Conjur UI and API endpoints. 4 Linux servers for the Conjur follower clusters, two in each region. The follower clusters consist of one or more follower nodes that perform read-only operations on the Conjur database and policy engine, such as authentication, authorization, and secret retrieval. The follower clusters are horizontally scalable and can be configured behind a load balancer to handle high volumes of requests from applications and clients. The follower clusters also host the Conjur Synchronizer service, which synchronizes secrets from the CyberArk PAM Vault to the Conjur database. 2 Linux servers for the Conjur seed fetcher service, one in each region. The seed fetcher service is a utility that runs on a separate server and periodically fetches the Conjur seed files from the master cluster and distributes them to the follower clusters. The seed files contain the configuration and encryption keys that are required to join a follower node to the Conjur cluster. The seed fetcher service ensures that the follower clusters are always updated with the latest seed files and can join the Conjur cluster without manual intervention. 2 Windows servers for the CyberArk Central Credential Provider (CCP), one in each region. The CCP is a component that provides secure and centralized credential management for applications and clients that need to access secrets from the CyberArk PAM Vault. The CCP exposes a web service interface that allows applications and clients to request credentials based on their identity and permissions. The CCP integrates with the Conjur Synchronizer service to retrieve the secrets from the Conjur database and cache them locally for faster access. Therefore, the total number of servers required for this deployment is 9 Linux servers and 2 Windows servers. This deployment architecture is based on the Conjur documentation1 and the Conjur training course2.

• Question 53:

  An application is having authentication issues when trying to securely retrieve credential's from the Vault using the CCP webservices RESTAPI. CyberArk Support advised that further debugging should be enabled on the CCP server to output a trace file to review detailed logs to help isolate the problem.

  What best describes how to enable debug for CCP?

  A. Edit web.config. change the "AIMWebServiceTrace" value, restart Windows Web Server (IIS)
  B. In the PVWA, go to the Applications tab, select the Application in question, go to Options > Logging and choose Debug.
  C. From the command line, run appprvmgr.exe update_config logging=debug.
  D. Edit the basic_appprovider.conf, change the "AIMWebServiceTrace" value, and restart the provider.
  A. Edit web.config. change the "AIMWebServiceTrace" value, restart Windows Web Server (IIS)

  ---

  Explanation/Reference:

  The best way to enable debug for CCP is to edit the web.config file in the AIMWebService folder and change the value of the AIMWebServiceTrace parameter to 4, which is the verbose level. This will generate detailed logs in the AIMWSTrace.log file in the logs folder. The logs folder may need to be created manually and given the appropriate permissions for the IIS_IUSRS group. After changing the web.config file, the Windows Web Server (IIS) service needs to be restarted to apply the changes. This method is recommended by CyberArk Support and documented in the CyberArk Knowledge Base1. Editing the basic_appprovider.conf file and changing the AIMWebServiceTrace value is not a valid option, as this parameter does not exist in this file. The basic_appprovider.conf file is used to configure the basic provider settings, such as the AppProviderVaultParmsFile, the AppProviderPort, and the AppProviderCacheMode. The AIMWebServiceTrace parameter is only found in the web.config file of the AIMWebService. In the PVWA, going to the Applications tab, selecting the Application in question, and going to Options > Logging and choosing Debug is not a valid option, as this will only enable debug for the Application Identity Manager (AIM) component, not the CCP component. The AIM component is used to manage the application identities and their access to the Vault. The CCP component is used to provide secure retrieval of credentials from the Vault using web services. Enabling debug for AIM will generate logs in the APPconsole.log, APPtrace.log, and APPaudit.log files in the ApplicationPasswordProvider\Logs folder, but these logs will not help to troubleshoot the CCP authentication issues. From the command line, running appprvmgr.exe update_config logging=debug is not a valid option, as this will only enable debug for the Application Provider Manager (APM) component, not the CCP component. The APM component is used to manage the configuration and operation of the providers, such as the basic provider, the LDAP provider, and the ENE provider. Running appprvmgr.exe update_config logging=debug will generate logs in the appprvmgr.log file in the ApplicationPasswordProvider\Logs folder, but these logs will not help to troubleshoot the CCP authentication issues. References: Enable Debugging and Gather Logs - Central Credential Provider1

• Question 54:

  DRAG DROP

  Match each use case to the appropriate Secrets Manager Solution.

  Select and Place:

  

  

  ---

  Explanation/Reference:

  

• Question 55:

  You modified a Conjur host policy to change its annotations for authentication.

  How should you load the policy to make those changes?

  A. Use the default "append" method (e.g. conjur policy load ).
  B. Use the "replace" method (e.g. conjur policy load ?璻eplace;;).
  C. Use the "delete" method (e.g. conjur policy load ?璬elete;;).
  D. Use the "update" method (e.g. conjur policy load ?璾pdate;;).
  B. Use the "replace" method (e.g. conjur policy load ?璻eplace;;).

  ---

  Explanation/Reference:

  = According to the CyberArk Sentry Secrets Manager documentation, the replace method is used to overwrite an existing policy branch with a new policy file. This method is suitable for making changes to the existing resources, such as modifying their annotations, permissions, or attributes. The replace method preserves the existing data and secrets associated with the resources, but removes any resources that are not defined in the new policy file. Therefore, to change the annotations for authentication of a Conjur host, the replace method is the best option. The append method is used to add new resources or data to an existing policy branch, without affecting the existing resources. This method is suitable for creating new hosts, groups, variables, or secrets, but not for modifying the existing ones. The append method will ignore any changes to the existing resources, such as annotations, and will only load the new resources or data. The delete method is used to remove resources or data from an existing policy branch, without affecting the other resources. This method is suitable for deleting hosts, groups, variables, or secrets, but not for modifying them. The delete method will remove any resources or data that are defined in the policy file, and will ignore any resources or data that are not defined in the policy file. The update method is used to modify the data or secrets associated with existing resources, without affecting the resources themselves. This method is suitable for changing the values of variables or secrets, but not for changing the annotations, permissions, or attributes of the resources. The update method will only load the data or secrets that are defined in the policy file, and will ignore any resources or data that are not defined in the policy file. References: = Annotation reference | CyberArk Docs; Policy load modes | CyberArk Docs; Policy - docs.cyberark.com

• Question 56:

  DRAG DROP

  You are upgrading an HA Conjur cluster consisting of 1x Leader, 2x Standbys and 1x Follower. You stopped replication on the Standbys and Followers and took a backup of the Leader.

  Arrange the steps to accomplish this in the correct sequence.

  Select and Place:

  

  

  ---

  Explanation/Reference:

  To upgrade an HA Conjur cluster, you need to follow these steps: Stop and rename the Conjur Leader container and then start the new Leader. This step ensures that you have a backup of the old Leader container in case something goes wrong with the upgrade. You also need to specify the hostname and master-altnames parameters when starting the new Leader container to match the load balancer and the cluster nodes. Restore the Leader from backup. This step restores the data and configuration from the old Leader to the new Leader. You need to use the evoke restore command with the backup file name and the account name as arguments. Redeploy to the Standbys. This step upgrades the Standbys to the same version as the Leader. You need to stop and rename the old Standby containers and then start the new Standby containers with the evoke configure standby command. You also need to specify the hostname of the Leader and the Standby as arguments. Enroll the Leader and Standbys into the auto-failover cluster. This step enables the auto-failover feature for the cluster, which allows the Standbys to automatically take over the role of the Leader in case of a failure. You need to use the evoke cluster enroll command on the Leader and the evoke cluster join command on the Standbys. You also need to provide the hostname and password of the Leader as arguments. References: You can find more information about the upgrade process in the following resources: Upgrade Conjur Configure the Conjur cluster Conjur architecture and deployment reference Breathe Easy with a Self-Healing Conjur Cluster

• Question 57:

  A customer requires high availability in its AWS cloud infrastructure.

  What is the minimally viable Conjur deployment architecture to achieve this?

  A. one Follower in each AZ. load balancer for the region
  B. two Followers in each region, load balanced for the region
  C. two Followers in each AZ. load balanced for the region
  D. two Followers in each region, load balanced across all regions
  A. one Follower in each AZ. load balancer for the region

  ---

  Explanation/Reference:

  According to the CyberArk Sentry Secrets Manager documentation, Conjur is a secrets management solution that consists of a leader node and one or more follower nodes. The leader node is responsible for managing the secrets, policies,

  and audit records, while the follower nodes are read-only replicas that can serve secrets requests from applications. To achieve high availability in AWS cloud infrastructure, the minimally viable Conjur deployment architecture is to have one

  follower in each availability zone (AZ) and a load balancer for the region. This way, if one AZ fails, the applications can still access secrets from another AZ through the load balancer. Having two followers in each region, load balanced for the

  region, is not enough to ensure high availability, as a regional outage can affect both followers. Having two followers in each AZ, load balanced for the region, is more than necessary, as one follower per AZ can handle the secrets requests.

  Having two followers in each region, load balanced across all regions, is not feasible, as Conjur does not support cross-region replication.

  References: 1: Conjur Architecture 2: Deploying Conjur on AWS

• Question 58:

  When working with Summon, what is the purpose of the secrets.yml file?

  A. It is where Summon outputs the secret value after retrieval.
  B. It is where you define which secrets to retrieve.
  C. It is where you store the Conjur URL and host API key.
  D. It is the log file for Summon.
  B. It is where you define which secrets to retrieve.

  ---

  Explanation/Reference:

  = Summon is a command-line tool that provides on-demand secrets access for common DevOps tools. It reads a file in secrets.yml format and injects secrets as environment variables into any process. The secrets.yml file is where you define which secrets to retrieve from a trusted store, such as CyberArk Secrets Manager. The secrets.yml file specifies the name and location of each secret, as well as the environment variable to assign it to. For example, a secrets.yml file could look like this: DB_USERNAME: !var dev/my-app/db-username DB_PASSWORD: !var dev/my-app/db- password This means that Summon will fetch the values of dev/my-app/db-username and dev/my- app/db-password from the trusted store, and assign them to the environment variables DB_USERNAME and DB_PASSWORD, respectively. Then, Summon will run the specified process with these environment variables set, and remove them once the process exits. This way, Summon enables secure and convenient access to secrets without exposing them in plain text or storing them in files. References: Summon by cyberark - GitHub Pages; Using Summon to Manage Secrets as You Move From Dev to Prod

• Question 59:

  When attempting to configure a Follower, you receive the error:

  

  Which port is the problem?

  A. 5432
  B. 1999
  C. 443
  D. 1858
  A. 5432

  ---

  Explanation/Reference:

  The error message "psql: server closed the connection unexpectedly" means that the server terminated abnormally before or while processing the request. This is likely due to the Leader Load Balancer not being available on the port and replication cannot be established. The port that is the problem is 5432, which is the default port for PostgreSQL database connections. The Follower needs to connect to the Leader Load Balancer on this port to receive the replication data from the Leader. If the port is blocked or unreachable, the Follower will fail to sync with the Leader and display the error message. References: [Set up Follower], [Troubleshoot Follower]

• Question 60:

  DRAG DROP

  You want to allow retrieval of a secret with the CCP. The safe and the required secrets already exist.

  Assuming the CCP is installed, arrange the steps in the correct sequence.

  Select and Place:

  

  

  ---

  Explanation/Reference:

  The correct order of the steps is: Define the Application with the desired authentication details Add the Application ID and Application Provider ID to the safe with appropriate permissions Configure application to call the appropriate REST API to retrieve the secret and test To allow an application to retrieve a secret with the CCP, the following steps are required: Define the Application with the desired authentication details: This step involves creating an Application object in the Vault with a unique Application ID and an Application Provider ID. The Application Provider ID is used to identify the CCP instance that will serve the request. The Application object also defines the authentication method and parameters that the application will use to connect to the CCP, such as certificate, password, or AppRole. Add the Application ID and Application Provider ID to the safe with appropriate permissions: This step involves granting the Application object the necessary permissions to access the safe and the secret that it needs. The Application ID and the Application Provider ID are added as members of the safe with at least List and Retrieve permissions. The secret name or ID can also be specified as a restriction to limit the access to a specific secret within the safe. Configure application to call the appropriate REST API to retrieve the secret and test: This step involves configuring the application to send a REST API request to the CCP endpoint with the required parameters, such as the Application ID, the Application Provider ID, the safe name, and the secret name or ID. The application should also provide the authentication credentials or token that match the method defined in the Application object. The application should receive a JSON response from the CCP with the secret value and other metadata. The application should test the connection and the secret retrieval before deploying to production. References: CyberArk Secrets Manager Sentry - Secrets Manager - Sample Items and Study Guide Sentry - Secrets Secrets Management Essentials for Developers