CyberArk CyberArk Certifications SECRET-SEN Questions & Answers

• Question 51:

  DRAG DROP

  Arrange the steps of a Conjur authentication flow in the correct sequence.

  Select and Place:

  

  Correct Answer:

  

  References:

  CyberArk Sentry Secrets Manager

  documentation: https://docs.cyberark.com/Portal/Content/Resources/_TopNav/cc_ Portal.htm

  CyberArk Sentry Secrets Manager course

  materials: https://training.cyberark.com/learn

  CyberArk whitepapers and technical

  resources: https://www.cyberark.com/resources/home/cyberark-secrets-manager

  The authentication flow begins with the requester presenting their credentials to Conjur. This can be in the form of a username and password, an API key, or another supported method.

  Conjur verifies the presented credentials against its internal database. If the credentials are valid, Conjur generates and returns a short-lived access token to the requester.

  The requester includes the access token with every subsequent request to access Conjur resources. This allows Conjur to identify the requester and authorize their access to specific secrets and functionalities based on configured policies.

  Finally, each request is evaluated against the Conjur RBAC (Role-Based Access Control) rules defined in its policy. These rules determine which users and roles have access to specific resources and what actions they can perform. Only

  requests that comply with these rules are granted access.

• Question 52:

  DRAG DROP

  You are upgrading an HA Conjur cluster consisting of 1x Leader, 2x Standbys and 1x Follower. You stopped replication on the Standbys and Followers and took a backup of the Leader.

  Arrange the steps to accomplish this in the correct sequence.

  Select and Place:

  

  Correct Answer:

  

  To upgrade an HA Conjur cluster, you need to follow these steps: Stop and rename the Conjur Leader container and then start the new Leader. This step ensures that you have a backup of the old Leader container in case something goes wrong with the upgrade. You also need to specify the hostname and master-altnames parameters when starting the new Leader container to match the load balancer and the cluster nodes. Restore the Leader from backup. This step restores the data and configuration from the old Leader to the new Leader. You need to use the evoke restore command with the backup file name and the account name as arguments. Redeploy to the Standbys. This step upgrades the Standbys to the same version as the Leader. You need to stop and rename the old Standby containers and then start the new Standby containers with the evoke configure standby command. You also need to specify the hostname of the Leader and the Standby as arguments. Enroll the Leader and Standbys into the auto-failover cluster. This step enables the auto-failover feature for the cluster, which allows the Standbys to automatically take over the role of the Leader in case of a failure. You need to use the evoke cluster enroll command on the Leader and the evoke cluster join command on the Standbys. You also need to provide the hostname and password of the Leader as arguments. References: You can find more information about the upgrade process in the following resources: Upgrade Conjur Configure the Conjur cluster Conjur architecture and deployment reference Breathe Easy with a Self-Healing Conjur Cluster

• Question 53:

  DRAG DROP

  Match the correct network port to its function in Conjur.

  Select and Place:

  

  Correct Answer:

  

  Based on the image you sent, the correct network port to its function in Conjur are:

  22: required for SSH access

  443: TLS endpoint for Conjur UI and API

  444: HTTP health endpoint: simplifies load balancer setup

  1999: audit events are streamed from the Follower to the Leader (using syslog-ng)

  5432: required for data replication from the Leader to Standbys and Followers (PostgreSQL)

  These are the standard ports and protocols used by the Conjur components to communicate with each other and with external clients. The ports can be customized according to the network and security requirements of the organization.

  These ports are documented in the CyberArk Secrets Manager documentation1 and the CyberArk Secrets Manager training course2.

• Question 54:

  DRAG DROP

  You are configuring the Conjur Cluster with 3rd-party certificates.

  Arrange the steps to accomplish this in the correct sequence.

  Select and Place:

  

  Correct Answer:

  

  The correct sequence of steps to configure the Conjur Cluster with 3rd-party certificates is as follows: Import 3rd-party certificates to the Leader using the command: docker exec mycontainer evoke ca import --force --root --chain 1 Configure the Leader using the command: docker exec mycontainer evoke configure master --accept-eula --hostname --admin-password 1 Verify the Conjur Leader configuration using the command: docker exec mycontainer evoke role Configure the Standbys using the command: docker exec mycontainer evoke configure standby --master-address --master-fingerprint 1 References: Certificate requirements

• Question 55:

  DRAG DROP

  Match each scenario to the appropriate Secrets Manager solution.

  Select and Place:

  

  Correct Answer:

  

  The appropriate Secrets Manager solution for each scenario is as follows: token based retrieval of secrets, such as OIDC or JWT: Conjur workloads requiring the fastest secrets delivery performance possible: ASCP agentless workload authentication that relies on OS User: CCP These solutions are described in the Secrets Management Tools page of the CyberArk website

• Question 56:

  DRAG DROP

  Findings were obtained after cataloging pending Secrets Manager use cases.

  Arrange the findings in the correct order for prioritization.

  Select and Place:

  

  Correct Answer:

  

  The correct order for prioritization of the findings is as follows: A new vulnerability scanner project is nearing completion and is expected to go into production soon. This scanner is owned by the Security Team that owns CyberArk. This finding should be prioritized first because it has the highest urgency, feasibility, and alignment with the Security Team's goals. The vulnerability scanner is a critical security tool that needs to protect its credentials from unauthorized access. The Security Team can leverage their own expertise and authority to implement the Secrets Manager solution for this project without much delay or dependency. A large, high performance application under PCI DSS regulation will require many CPs. This will require a license purchase. The procurement process can take 6-12 months. The development team is eager to work with Security on this project. This finding should be prioritized second because it has a high impact, compliance requirement, and stakeholder support. The application handles sensitive payment card data that needs to be secured by the Secrets Manager solution. The development team is willing to collaborate with the Security Team on this project and can help with the technical aspects of the implementation. However, this finding also has a high cost and a long lead time due to the license purchase and the procurement process. A small, internally developed application under HIPPA regulation needs updates to the application code to retrieve secrets from a Secrets Manager solution. The development team stated they cannot accommodate this work before next quarter. This finding should be prioritized third because it has a moderate impact, compliance requirement, and feasibility. The application handles protected health information that needs to be secured by the Secrets Manager solution. The development team is aware of the need to update the application code to integrate with the Secrets Manager solution, but they have other priorities and constraints that prevent them from doing so in the near term.

  Here's the reasoning behind this order:

  1.

  New vulnerability scanner project:

  This project directly impacts CyberArk's Security Team, making it a high priority due to potential internal security concerns. Additionally, its near-completion state suggests a quicker implementation timeframe.

  2.

  Large application under PCI DSS:

  While this application requires significant resources and time investment due to license purchase and development, its high performance and PCI DSS regulation compliance mandate prioritization. Delaying this project could potentially lead to

  security vulnerabilities and compliance issues.

  3.

  Small application under HIPAA:

  Although HIPAA regulation necessitates compliance, the application's size and development team's delay request suggest a lower priority compared to the previous two projects. However, it should still be addressed within the next quarter as

  mandated by the development team.

• Question 57:

  DRAG DROP

  You are installing a Credential Provider on a Linux host. Arrange the installation steps in the correct sequence.

  Select and Place:

  

  Correct Answer:

  

  The correct sequence of installation steps for a Credential Provider on a Linux host is as follows:

  Download the correct install package to a directory on the Linux host and decompress1.

  Copy the aimparms.sample file to /var/tmp/aimparms. Create a Credential File with an account with sufficient permissions to install. Modify the Vault.ini file to point to the correct vault2.

  Install the correct Credential Provider package for the distribution of Linux using the command: rpm -ivh CARKaim-..rpm2. Check that the aimprv service is running using the command: service aimprv

  status2.

  References: 1: Download the Credential Provider 2: Install Credential Provider on Linux / AIX

• Question 58:

  DRAG DROP

  Arrange the steps to configure authenticators in the correct the sequence.

  Select and Place:

  

  Correct Answer:

  

  Create an authenticator policy for each authenticator and then load the policy to Conjur.

  Add each authenticator to conjur.yml using this format: .

  Execute evoke configuration apply.

  Comprehensive Authenticators are plugins that enable Conjur to authenticate requests from different types of clients, such as Kubernetes, Azure, or LDAP. To configure authenticators, you need to follow these steps:

  Create an authenticator policy for each authenticator and then load the policy to Conjur. This step defines the authenticator as a resource in Conjur and grants permissions to the users or hosts that can use it. You can use the policy templates

  provided by Conjur for each authenticator type, or create your own custom policy. For more information, see Define Authenticator Policy. Add each authenticator to conjur.yml using this format: . This step

  enables the authenticator service on the Conjur server and specifies the service ID that identifies the authenticator instance. The service ID must match the one used in the policy. For more information, see Enable Authenticators.

  Execute evoke configuration apply. This step applies the changes made to the conjur.yml file and restarts the Conjur service. This is necessary for the authenticator configuration to take effect. For more information, see Apply Configuration

  Changes.

  References: The steps to configure authenticators are explained in detail in the Configure Authenticators section of the CyberArk Conjur Enterprise documentation. The image in the question is taken from the same source.

• Question 59:

  DRAG DROP

  You want to allow retrieval of a secret with the CCP. The safe and the required secrets already exist.

  Assuming the CCP is installed, arrange the steps in the correct sequence.

  Select and Place:

  

  Correct Answer:

  

  The correct order of the steps is: Define the Application with the desired authentication details Add the Application ID and Application Provider ID to the safe with appropriate permissions Configure application to call the appropriate REST API to retrieve the secret and test To allow an application to retrieve a secret with the CCP, the following steps are required: Define the Application with the desired authentication details: This step involves creating an Application object in the Vault with a unique Application ID and an Application Provider ID. The Application Provider ID is used to identify the CCP instance that will serve the request. The Application object also defines the authentication method and parameters that the application will use to connect to the CCP, such as certificate, password, or AppRole. Add the Application ID and Application Provider ID to the safe with appropriate permissions: This step involves granting the Application object the necessary permissions to access the safe and the secret that it needs. The Application ID and the Application Provider ID are added as members of the safe with at least List and Retrieve permissions. The secret name or ID can also be specified as a restriction to limit the access to a specific secret within the safe. Configure application to call the appropriate REST API to retrieve the secret and test: This step involves configuring the application to send a REST API request to the CCP endpoint with the required parameters, such as the Application ID, the Application Provider ID, the safe name, and the secret name or ID. The application should also provide the authentication credentials or token that match the method defined in the Application object. The application should receive a JSON response from the CCP with the secret value and other metadata. The application should test the connection and the secret retrieval before deploying to production. References: CyberArk Secrets Manager Sentry - Secrets Manager - Sample Items and Study Guide Sentry - Secrets Secrets Management Essentials for Developers

• Question 60:

  DRAG DROP

  Match each use case to the appropriate Secrets Manager Solution.

  Select and Place:

  

  Correct Answer: