Question bank
CyberArk Certified Defender - Privileged Access
40 CyberArk Certified Defender - Privileged Access questions with the correct answer and a written explanation, organised across 5 exam domains.
- 40 questions
- 5 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Credential Management
8 questions in this domain
- Question 1Single Choice
In the CyberArk secrets lifecycle, what is the formal integration of a discovered account into a Safe called?
- AOnboardingCorrect answer
- BDiscovery
- CRotation
- DDecommissioning
Why this is the answer
Discovery only identifies accounts. Onboarding is the formal integration that maps the account to a Safe for centralized control.
- Question 2Multiple Select
Which two statements accurately describe automated rotation by CyberArk CPM?
- APerformed by Central Policy Manager (CPM)Correct answer
- BReduces the window for attackers using stolen credentialsCorrect answer
- CRequires manual administration to avoid errors
- DHappens only after an account is decommissioned
Why this is the answer
CPM performs automated rotation, and periodic changes reduce the time a stolen credential remains useful. Manual rotation is not part of a mature CyberArk lifecycle.
- Question 3Interactive
Review the code snippet below. Which CyberArk component is the application contacting to obtain the credential?
- ACentral Credential Provider (CCP)Correct answer
- BCentral Policy Manager (CPM)
- CPrivileged Session Manager (PSM)
- DThe Vault database
Why this is the answer
The request targets the CCP web service. CCP acts as the gateway between the application and the Vault, while CPM rotates passwords and PSM isolates human sessions.
- Question 4Single Choice
Which lifecycle phase ensures the right entity accesses the right secret at the right time through strictly enforced policies?
- AAccess Control and RetrievalCorrect answer
- BOnboarding
- CAutomated Rotation
- DAudit and Monitoring
Why this is the answer
Access Control and Retrieval ensures that authorized users or applications request and use secrets under strictly enforced policies.
- Question 5Multiple Select
Which two methods can applications use to retrieve secrets from CyberArk AAM?
- AREST API via CCPCorrect answer
- BApplication SDKCorrect answer
- CCentral Policy Manager (CPM)
- DPrivileged Session Manager (PSM)
Why this is the answer
Applications fetch secrets mainly through the CCP REST API or the Application SDK. CPM is for rotation and PSM is for human session isolation.
- Question 6Interactive
An application uses the following code to retrieve a secret. What is the function of the service being called?
- AActs as a proxy/gateway between app and VaultCorrect answer
- BStores secrets as the single source of truth
- CIsolates human-to-machine remote sessions
- DRotates the password after each retrieval
Why this is the answer
The code calls the CCP, which is a proxy or gateway. The Vault is the storage source of truth, CPM rotates passwords, and PSM isolates human sessions.
- Question 7Single Choice
What is an Application ID (AppID) in CyberArk AAM?
- ALogical identifier for an applicationCorrect answer
- BA standard Vault user account
- CA physical server for secret storage
- DA temporary token for administrators
Why this is the answer
An AppID is a unique logical identifier assigned to an application to authorize requests to AAM. It is not a traditional Vault user account.
- Question 8Multiple Select
Select two true statements about non-human credential management with AAM.
- AMust be rotated and revoked like human credentialsCorrect answer
- BAAM supplies updated secrets after CPM rotationCorrect answer
- CAAM rotates passwords without CPM
- DEncrypted local configs are secure storage
Why this is the answer
Non-human credentials follow the same lifecycle as human credentials. CPM rotates passwords, and AAM provides the updated value to the application.
Integration & Architecture
6 questions in this domain
- Question 9Single Choice
During CyberArk account onboarding, what is the primary difference between Discovery and Onboarding?
- ADiscovery identifies accounts; Onboarding integrates them into a safe.Correct answer
- BDiscovery stores accounts; Onboarding rotates their passwords.
- CDiscovery maps accounts to platforms; Onboarding audits their usage.
- DDiscovery assigns AppIDs; Onboarding configures CCP.
Why this is the answer
Discovery is only the identification phase. Onboarding formally integrates the account into a safe for centralized control.
- Question 10Multiple Select
Which of the following are formal stages in the CyberArk secrets management lifecycle? Select all that apply.
- AOnboarding and DiscoveryCorrect answer
- BAutomated RotationCorrect answer
- CDecommissioning and DeletionCorrect answer
- DStoring secrets in encrypted local configuration files
Why this is the answer
The CyberArk lifecycle includes onboarding, rotation, access control, audit, and decommissioning. Local file encryption is not a lifecycle phase.
- Question 11Interactive
Examine the following sample request. Which CyberArk component is being called to retrieve the secret?
- ACentral Credential Provider (CCP)Correct answer
- BCentral Policy Manager (CPM)
- CPrivileged Session Manager (PSM)
- DPrivateArk Client
Why this is the answer
The CCP is the web service gateway for REST API credential retrieval; the Vault remains the backend source of truth.
- Question 12Single Choice
Which identifier is the fundamental security principal for authorizing an application to retrieve secrets in CyberArk AAM?
- AVault username
- BAppIDCorrect answer
- CSafe name
- DCPM policy
Why this is the answer
The AppID is the logical, unique identifier used to authorize an application in AAM. It is not a traditional Vault user.
- Question 13Multiple Select
Which of the following are correct statements about the CyberArk Central Credential Provider (CCP)? Choose all that apply.
- AIt acts as a proxy or gateway between applications and the Vault.Correct answer
- BIt stores the actual secrets in a local database.
- CIt accepts HTTPS requests from applications.Correct answer
- DThe Vault remains the single source of truth for secrets.Correct answer
Why this is the answer
The CCP is a secure web service gateway; it does not store secrets. The Vault is always the authoritative repository.
- Question 14Interactive
The provided code snippet shows a native application retrieving a secret from the Vault. Which CyberArk integration method is being used?
- AREST API via CCP
- BApplication SDKCorrect answer
- CCPM password rotation
- DPSM session recording
Why this is the answer
The code calls a CyberArk library directly from the application, which is the Application SDK integration method.
Privileged Account Security
12 questions in this domain
- Question 15Single Choice
In the CyberArk Vault lifecycle, what is the primary role of the discovery phase?
- AFormally integrates accounts into a safe
- BIdentifies accounts and secrets in infrastructureCorrect answer
- CAutomatically rotates credentials
- DDeletes inactive accounts from the Vault
Why this is the answer
Discovery is only the identification phase. Onboarding is the formal integration into a safe that enables centralized management and control.
- Question 16Multiple Select
Which statements accurately describe automated credential rotation in CyberArk?
- AIt reduces the window of opportunity for attackers using stolen credentialsCorrect answer
- BIt relies on manual password changes by administrators
- CIt ensures leaked secrets remain useful only for a limited timeCorrect answer
- DIt is performed by the Central Policy Manager (CPM)Correct answer
Why this is the answer
Automated rotation by CPM limits credential lifetime and reduces attacker opportunity. Manual changes are not part of a mature CyberArk lifecycle.
- Question 17Interactive
The code block contains two assignment statements. Which pair of AAM security concepts do they represent?
- AAppID and Access Control List (ACL)Correct answer
- BVault user and password
- CSafe and platform
- DCPM and PVWA
Why this is the answer
An AppID is the application identity, while an ACL defines which AppID can access a specific secret. Both are distinct parts of the authorization workflow.
- Question 18Single Choice
In the CyberArk architecture, where are all secrets ultimately stored?
- ACentral Credential Provider
- BApplication SDK
- CThe VaultCorrect answer
- DPVWA
Why this is the answer
The Vault is the central repository and single source of truth, while CCP, SDK, and PVWA are interfaces or gateways.
- Question 19Multiple Select
Which statements about an Application ID (AppID) are true?
- AIt is a logical identifier for an application or serviceCorrect answer
- BIt is a traditional Vault user with a password
- CIt authorizes an application's request to the AAM providerCorrect answer
- DIt is the same as a PSM session
Why this is the answer
An AppID is a logical identity for applications, not a standard user account. It is the principal used to authorize secret requests to AAM.
- Question 20Interactive
The curl command in the code block sends a secret request to an endpoint. Which component is receiving that request?
- ACentral Credential Provider (CCP)Correct answer
- BCentral Policy Manager (CPM)
- CPrivileged Session Manager (PSM)
- DVault
Why this is the answer
The CCP is the web service gateway that receives HTTPS secret requests and abstracts Vault complexity for applications.
- Question 21Single Choice
Why are audit records generated for secret retrieval and lifecycle transitions?
- ATo rotate passwords automatically
- BTo support compliance and incident responseCorrect answer
- CTo replace the need for Access Control Lists
- DTo discover new privileged accounts
Why this is the answer
Audit records provide telemetry for compliance and incident response. They do not rotate, replace ACLs, or perform discovery.
- Question 22Multiple Select
Which methods can applications use to retrieve secrets from the CyberArk Vault?
- AREST API through the Central Credential Provider (CCP)Correct answer
- BApplication SDKCorrect answer
- CManual copy by an administrator
- DCommand-line interfaces through AAMCorrect answer
Why this is the answer
Apps can retrieve secrets using the CCP REST API, SDKs, or command-line interfaces. Manual copying does not meet secure retrieval requirements.
- Question 23Interactive
The code block checks if an identity is in a list of allowed identities. What additional permission structure must be validated before the secret is released?
- AAccess Control List (ACL)Correct answer
- BPlatform policy
- CDiscovery process
- DCredential Injection
Why this is the answer
Identity and authorization are distinct: the ACL defines which AppID is permitted to access a specific secret.
- Question 24Single Choice
Which CyberArk component is responsible for rotating passwords in the Vault?
- ACentral Policy Manager (CPM)Correct answer
- BCentral Credential Provider (CCP)
- CApplication Identity Manager (AIM)
- DPVWA
Why this is the answer
The CPM rotates credentials in the Vault. AAM/CCP provides the updated value to applications at runtime.
- Question 25Multiple Select
Which practices are part of the secrets management lifecycle for non-human credentials?
- AAutomated rotationCorrect answer
- BComplexity enforcementCorrect answer
- CImmediate revocation upon service decommissioningCorrect answer
- DNo audit records because no human is involved
Why this is the answer
Non-human credentials require the same lifecycle as human ones, including rotation, complexity, revocation, and auditing.
- Question 26Interactive
The code block shows a configuration file containing a database password. Why does this violate CyberArk secure storage requirements?
- AThe secret is stored locally instead of being dynamically retrieved from the VaultCorrect answer
- BThe code cannot be compiled by CyberArk
- CThe configuration file is outside the DMZ
- DIt uses PSM instead of AAM
Why this is the answer
True secure storage requires centralized vaulting and dynamic retrieval; local files, even encrypted, remain a risk. The Vault should inject the secret at runtime.
Privileged Session Management
8 questions in this domain
- Question 27Single Choice
In the CyberArk secrets lifecycle, which term describes the formal integration of a discovered account into a safe for centralized control?
- ADiscovery
- BOnboardingCorrect answer
- CAutomated Rotation
- DDecommissioning
Why this is the answer
Discovery only identifies accounts. Onboarding is the formal integration into a safe, where centralized management begins.
- Question 28Multiple Select
Which statements about automated credential rotation are correct in a mature CyberArk implementation? (Select all that apply.)
- AIt is executed by the CyberArk CPMCorrect answer
- BIt reduces the attack window for stolen credentialsCorrect answer
- CManual password changes are preferred in a mature lifecycle
- DIt makes leaked secrets time-boundCorrect answer
Why this is the answer
The CPM automates periodic rotation, reducing the value of stolen credentials and limiting the attack window. Manual changes are a trap.
- Question 29Interactive
Consider the request shown in the code block. Which CyberArk component directly receives this secret retrieval call?
- ACentral Credential Provider (CCP)Correct answer
- BCentral Policy Manager (CPM)
- CCyberArk Vault
- DPVWA
Why this is the answer
The request is an HTTPS call to the AIMWebService API. The CCP acts as the gateway for application secret retrieval; the Vault remains the storage source.
- Question 30Single Choice
In the CyberArk Application Access Manager context, what is an Application ID (AppID) primarily used for?
- AA unique identifier assigned to an application or serviceCorrect answer
- BA standard Vault user with an interactive password
- CA temporary password generated by the CPM
- DAn encryption key stored on the application server
Why this is the answer
An AppID is a logical identifier used to authorize an application's requests to the AAM provider, not a standard user account.
- Question 31Multiple Select
Which statements correctly distinguish an AppID used by CyberArk AAM from a standard Vault user account? (Select all that apply.)
- AAn AppID is a logical identifier for an applicationCorrect answer
- BAn AppID authorizes requests to the AAM providerCorrect answer
- CAn AppID is a traditional user account
- DACLs define which AppID can access secretsCorrect answer
Why this is the answer
An AppID is not a traditional Vault user with a password. It is a logical identity authorized through AppID and ACLs.
- Question 32Interactive
The code block shows a lightweight script used in a DevOps pipeline to fetch a secret. Which CyberArk retrieval method is being used?
- AREST APICorrect answer
- BApplication SDK
- CCentral Policy Manager
- DPrivileged Session Manager
Why this is the answer
The REST API is ideal for lightweight scripts and web-based DevOps pipelines. The SDK is better for high-performance native integration.
- Question 33Single Choice
Which CyberArk component acts as a proxy or gateway for application secret requests and is not the storage location?
- ACentral Credential Provider (CCP)Correct answer
- BCentral Policy Manager (CPM)
- CCyberArk Vault
- DPrivileged Session Manager
Why this is the answer
The CCP is a web service proxy or gateway. The Vault remains the single source of truth for all secrets.
- Question 34Multiple Select
Which statements about the relationship between PSM and AAM are true? (Select all that apply.)
- APSM isolates human-to-machine sessionsCorrect answer
- BAAM handles machine-to-machine secret retrievalCorrect answer
- CAAM removes the need for hardcoded passwordsCorrect answer
- DPSM is the same as CCP
Why this is the answer
PSM is for human-to-machine session isolation. AAM is for machine-to-machine secret retrieval and eliminates hardcoded passwords.
Privileged Threat Analytics
6 questions in this domain
- Question 35Single Choice
In the CyberArk Vault implementation, which phase is defined as the formal integration of a discovered account into a Safe for centralized control?
- AOnboardingCorrect answer
- BDiscovery
- CAutomated Rotation
- DAudit and Monitoring
Why this is the answer
Discovery only identifies an account. Onboarding is the formal integration of that account into a Safe, enabling centralized control and credential lifecycle management.
- Question 36Multiple Select
Which two or more statements accurately describe CyberArk's Secrets Management Lifecycle for application credentials?
- ACredential rotation is performed by the Central Policy Manager (CPM) in the Vault.Correct answer
- BEvery credential in the environment, including service accounts, must be rotated to maintain security posture.Correct answer
- CThe Vault acts as a centralized, single source of truth for secrets management.Correct answer
- DEncrypting a local configuration file is considered equivalent to secure storage in CyberArk.
Why this is the answer
CPM performs credential rotation, all credentials require rotation, and the Vault is the centralized source of truth. Local encrypted files do not replace centralized vaulting and dynamic retrieval.
- Question 37Interactive
Analyze the following code block. Which CyberArk component receives this HTTPS request directly from the application?
- ACentral Credential Provider (CCP)Correct answer
- BVault
- CCentral Policy Manager (CPM)
- DPrivileged Session Manager (PSM)
Why this is the answer
The CCP is a web service component that acts as a secure, scalable gateway between applications and the Vault. The Vault stores secrets, CPM rotates them, and PSM isolates human sessions.
- Question 38Single Choice
In CyberArk AAM, what is the unique logical identifier that authorizes an application to request secrets from the provider?
- AApplication ID (AppID)Correct answer
- BVault User
- CSafe
- DCredential File
Why this is the answer
The AppID is a logical identifier for an application, not a traditional Vault user. It is the security principal used to authorize an application's request to the AAM provider.
- Question 39Multiple Select
According to the CyberArk AAM model, which statements about application credential management are correct?
- AAIM/AAM allows applications to retrieve secrets from the Vault at runtime, avoiding hardcoded credentials.Correct answer
- BAAM requires a distributed configuration file on each application server to fetch the secret.
- CThe Central Credential Provider can be used as a web service gateway for secret retrieval.Correct answer
- DThe CPM performs password rotation in the Vault before AAM provides the updated secret to the application.Correct answer
Why this is the answer
AIM/AAM enables runtime secret retrieval via SDK, API, or CLI, eliminating hardcoded passwords. CCP is the web service gateway, and CPM rotates credentials in the Vault; local config files are not required.
- Question 40Interactive
The code block below uses a CyberArk library inside a Java application. Which credential retrieval integration method does it demonstrate?
- AApplication SDKCorrect answer
- BREST API
- CCommand-line interface
- DDirect Vault protocol
Why this is the answer
The code uses a native SDK library for secret retrieval. SDKs provide deep integration for applications, while REST APIs are used for web services and lightweight scripts.
Frequently asked questions
Everything about the CyberArk Certified Defender - Privileged Access question bank and how to use it.