CyberArk Sentry Exam

Core Privileged Access Security (PAS) Components - answer-EPV + PSM +PTA Enterprise Password Vault (EPV) = - answer-Digital Vault + PVWA + CPM EPV - answer-Enterprise Password Vault Enterprise Password Vault - answer-A hardened and secured digital vault used to store privileged account information. CPM - answer-Central Policy Manager Central Policy Manager - answer-Performs password changes and SSH key rotations on devices based on the policies set by Vault Administrators. PVWA - answer-Password Vault Web Access Password Vault Web Access - answer-The web interface used by Administrators to perform administrative tasks and by end users to gain access to privileged account information. PSM - answer-Privileged Session Management Privileged Session Management - answer-Prevent cyber attacks by isolating desktops from sensitive target machines. Creates accountability and control over privileged session access with policies, workflows, and privileged single sign on. Delivers continuous monitoring and compliance with session recordings with zero footprint on target machines. CPM and PVWA Information Exchange - answer-Do not exchange policy information directly. Policy changes are saved to the Vault. Each component refreshes its local cache of policies via the VPN. PVWA/CPM Port - answer-TCP/443 Possible Reasons for Multiple CPMs - answer-Isolated network segments WAN link latency Scalability Eight Security Controls of CyberArk - answer-1. Isolate and harden the digital vault server 2. Use 2-factor authentication 3. Restrict access to component servers 4. Limit privileges and points of administration 5. Protect sensitive accounts and encryption keys 6. Use secure protocols 7. Monitor logs for irregularities 8. Create and periodically test a DR plan What types of attacks does isolating the digital vault server protect against? - answer-Pass-the-hash and golden ticket (leverage Kerberos protocol) Principles of Isolating and Hardening the Digital Vault Server - answer-1. Not be and never have been a member of a Windows domain 2. No third-party software 3. Network traffic is restricted to CyberArk protocols 4. Physical servers What types of attacks does two-factor authentication protect against? - answer-Key loggers or more advanced tools that are capable of harvesting plaintext passwords Principles of Restricting Access to Component Servers - answer-1. Consider installing each one on a dedicated physical server 2. Consider installing on workgroup rather than domain joined servers 3. Do not install non-CyberArk applications on the component servers 4. Limit the accounts that can access component servers and ensure that any domain accounts used to access CyberArk servers are unable to access domain controllers 5. Use network-based firewalls and IPsec to restrict, encrypt, and authenticate inbound administrative traffic 6. Use the PSM and the local admin account to access component servers 7. Deploy application whitelisting and limit execution to authorized applications Why do you limit the number of privileged accounts and the extent of their privileges? - answer-Reduces the overall privileged account attack surface. Principles of Limiting Privileges and Points of Administration - answer-1. Reduce privileges of CyberArk admin accounts 2. Eliminate unnecessary CyberArk admin accounts 3. CyberArk admins should not have access to all credentials 4. Require privilege elevation (Dual Control/Ticketing Integration) 5. Use the PSM to isolate and monitor CyberArk administration 6. Require 2-factor authentication for all avenues of admin access CyberArk Internal Admin Accounts - answer-Administrator account Master user account Vault Encryption Keys - answer-Operator Key Master Key Operator Key - answer-Vault encryption key used for runtime encryption tasks Master Key - answer-Vault encryption key used for recovery operations Principles of Protecting Sensitive Accounts and Encryption Keys - answer-1. Use the Microsoft Windows Password Reset Disk utility prior to installing the vault, and store the Local Admin account password in a physical safe on a USB drive 2. Store the Master Password separately from the Master Key and each should be assigned to different entities within an organization 3. Store the Master Key and Password in a physical safe 4. Do not store the Operator Key on the same media as the data (use an HSM) Principles of Using Secure Protocols - answer-1. HTTPs for the PVWA 2. LDAPs for Vault-LDAP integration and CPM Windows scans 3. RDP/TLS for connections to the PSM and from PSM to target machines 4. SSH (instead of telnet) for password management Principles for Monitoring Logs for Irregularities - answer-1. Aggregate CyberArk logs within your SIEM 2. Monitor and alert upon excessive authentication failures, logins to the Vault server OS, and logins as Admin or Master 3. Consider implementing PTA Is it ok to join the Digital Vault to an Active Directory Domain? - answer-No. It can lead to the following: pass-the-hash attack, golden ticket attack, malicious or accidental changes in domain GPO, attacks through open firewall ports, increased operational risk due to enablement of unnecessary services. Why does CyberArk prohibit the installation of anti-virus and other agents on the Digital Vault? - answer-Vulnerability due to opened firewall ports. Why should you store the Operator Key on the HSM? - answer-If the Server Key is stored on the local file system of the Digital Vault, it puts the system at risk. If an attacker were to gain access to the operating system, Server Key, and encrypted data, it would be possible for the attacker to reverse engineer the encryption process and gain access to Digital Vault data. CyberArk Proprietary Protocol or VPN Port - answer-TCP1858 What percentage of encryption processes occur on the client side? - answer-95% Supported Authentication Methods - answer-CyberArk (Vault auth) LDAP RADIUS Windows PKI Auth RSA SecurID Amazon Cognito SAML Google Auth Oracle SSO Supported Encryption Methods - answer-AES-256/AES0128 RSA-2048/RSA-1024 3DES SHA-256 Installation Package Consists of: - answer-Two copies of Operator CD Two copies of the Master CD License Agreement Operator CD contains: - answer-Server Key Recovery Public Key Master CD contains: - answer-Recovery Private Key Which CD is needed for Vault installation? - answer-Operator CD When is the Master CD used? - answer-Emergency situations These items need to be copied to the Vault Server before hardening: - answer-CyberArk Server and Client Installation software Operator CD CyberArk License File Digital Certificates installed for LDAP integration Vault Installation Pre-Requisites - answer-Remove unnecessary network components Eliminate DNS entries Disable WINS Distributes Vaults Internal Communication Platform - answer-RabbitMQ CyberArk Vault Services - answer-CyberArk Event Notification Engine CyberArk Hardened Windows Firewall CyberArk Logic Container PrivateArk Database PrivateArk Remote Control Agent PrivateArk Server Vault Main Configuration Files Folder Location - answer-PrivateArkServerConf Vault Configuration Files - Vault Log Files Folder Location - answer-PrivateArkServerLogs Default Vault Safes - answer-Notification Engine, System, Vault Internal Vault Configuration Files Safe - answer-System Safe (includes the ) When do you install HSM software? - answer-BEFORE installing CyberArk What are the steps for integrating the HSM once the Vault is installed? - answer-1. Open FW port to HSM in 2. Configure HSM in 3. Enroll the Vault in the HSM server 4. Encrypt PIN code for HSM connectivity 5. Load existing Server Key to HSM 6. Point to Server Key on HSM 7. Restart the Vault 8. Generate a new server key on HSM - Insert Master CD - Run ChangeServerKeys 9. Point to the NEW key in HSM 10. Restart the Vault True or False: All encryption is processed by the Digital Vault Server? - answer-False - 95% of encryption happens on the client side True or False: The Windows firewall on the Digital Vault server is managed by the Vault, therefore all firewall rules must be defined in the main configuration file, . - answer-True True or False: The ITAL is the Vault's primary log file. It can be found in the PrivateArkServer directory. - answer-False - It can be found in the PrivateArkServerLogs folder. True or False: CyberArk does not support MAC or DAC, only RBAC. - answer-False - It supports all three. RBAC = granular entitlements DAC = enabling creation of custom roles MAC = Limit where and when users and components can authenticate to the vault. Installation Order - answer-Vault PVWA CPM PSM PSMP Vault Backup & Disaster Recovery PVWA Installation Log Files - answer-PVWAI PVWAInstallE PVWA Installation Log Files Location - answer-C:UsersAdministratorAppDataLocalTemp PVWA Safes - answer-PVWAConfig PVWAProvateUserPrefs PVWAPublicData PVWAReports PVWATaskDefinitions PVWATicketingSystem PVWAUserPrefs PVWAConfig Safe - answer-Contains all the configuration settings for the Password Vault Web Access PVWAPrivateUserPrefs Safe - answer-Contains the user preference settings for the Password Vault Web Access interface Which PVWA safes should not be accessed directly? - answer-PVWAConfig & PVWAPrivateUserPrefs PVWAReports Safe - answer-Used for internal processes related to generating reports Where is the P file located, and what does it contain? - answer-It is located in the PVWAConfig safe, and it contains the "UI & Workflow" settings for all platforms. PVWA Vault Users and Groups - answer-PVWAppUser PVWAGWUser PVWAppUser - answer-Used by the PVWA for internal processing PVWAGWUser - answer-Impersonates the logged-in user to the Vault Three Phases of PVWA Hardening - answer-1. Executing the InstallationAutomation PowerShell script 2. Applying a CyberArk provided Group Policy Object to the component server 3. Manual procedures PVWA Component Server Network Protocols - answer-Client for Microsoft Network File and Printer Sharing for Microsoft Network Internet Protocol Version 4 (TCP/IPv4)