Free CPC-SEN sample questions

Correct answer: Install a second CPM on an additional Connector in Passive mode (DR CPM) and manually switch over to it when the primary CPM is unavailable.

CyberArk documents an active-passive Disaster Recovery CPM: you install and configure a second CPM instance (selecting CPM mode Passive during installation through Connector Management or the Privilege Cloud installer) and, if the primary CPM is down, you manually switch over to the DR CPM. Only one CPM instance can be active at a time, so active-active CPMs managing the same accounts, or two running copies of the same CPM, are not supported, and the on-premises CPM is not failed over by CyberArk. For sessions, high availability comes from deploying multiple PSMs, typically behind a load balancer.

Correct answer: Link a Cisco enable password object to the Cisco user account as an additional (linked) account.

The Cisco router plugin documents that a Cisco user password 'without password management privileges' requires a link to an additional password object that enables the CPM to switch to Enable mode and change the password on the remote machine. The CiscoEnable password object provides this and is linked in the account's Details tab > Linked Accounts, where an enable password is an 'other' linked account defined at account level. There is no fixed 'EnablePrompt' platform parameter, because TPC prompt conditions are user-defined names in the Prompts file. The CiscoTerminal type also needs a linked object to switch to Enable mode. With TACACS, only reconciliation of local accounts is enabled, and Verify and Change are disabled by default.

Correct answers: The local recordings folder is only temporary storage; each recording is uploaded to the Vault when the PSM session ends.; Uploaded recordings are stored in Recording Safes that PSM creates according to the platform's `SessionRecorderSafe` setting (default `PSMRecordings`).

CyberArk documents that PSM recordings are saved temporarily in a local folder until the PSM session ends, when they are uploaded to the Vault. They are stored in Recording Safes that PSM creates automatically when the first recording is uploaded, named according to the platform's SessionRecorderSafe parameter (default PSMRecordings, or dynamic names such as PSM-{AccountSafeName}); retention is defined per recording Safe (SessionRecorderSafeRetention). No SFTP server, network share or Support-side configuration is needed to keep recordings off the PSM hosts.

CyberArk documents that PSM recordings are saved temporarily in a local folder until the PSM session ends, when they are uploaded to the Vault. They are stored in Recording Safes that PSM creates automatically when the first recording is uploaded, named according to the platform's SessionRecorderSafe parameter (default PSMRecordings, or dynamic names such as PSM-{AccountSafeName}); retention is defined per recording Safe (SessionRecorderSafeRetention). No SFTP server, network share or Support-side configuration is needed to keep recordings off the PSM hosts.

Correct answer: Set the platform's `ChangePasswordInResetMode` parameter (Additional Policy Settings) to `Yes`, so the CPM resets the passwords by using the reconcile account instead of performing a password change.

`ChangePasswordInResetMode` is a platform-level parameter in the Additional Policy Settings (default No). When it is set to Yes, the CPM performs password changes as reset operations using the associated reconciliation account instead of changing the password with the current one. CyberArk notes this is useful when a one-time password is used with a directory minimum password-age restriction or when the password policy prevents users from changing their own passwords (password plugins only). It is not a parameter of the Add Account API, whose body contains properties such as platformId, safeName, secret and secretManagement. Disabling automatic management would stop rotation altogether, and ImmediateInterval only sets the delay before a user-initiated management operation runs.

Correct answer: False

False. Privilege Cloud can integrate with a SIEM in two ways: the recommended Audit service SIEM integration (Setup space > Integrations > Export to SIEM), which does not use the Secure Tunnel, or syslog forwarding, for which the Secure Tunnel is deployed on premises so that the Privilege Cloud backend can send syslog messages to the SIEM servers (up to five). The Secure Tunnel is used for SIEM, LDAP (Standard) and legacy remote-access connections — CPM and PSM communicate with the Vault directly over TCP 1858. Since June 30, 2026 the Secure Tunnel is no longer supported for new deployments; organizations that require syslog must ask Technical Support to enable it.

Correct answer: PSM Live Session Monitoring and Termination

The PSM's Live Session Monitoring feature is designed for this exact use case. It allows authorized users (like security analysts) to view active privileged sessions in real-time. This interface includes controls to take over or terminate the session immediately, providing the necessary oversight and intervention capabilities required by the organization.

Correct answer: The plugin supports Verify and Change through the AWS REST API, but Reconcile is not supported.

The AWS access keys plugin connects to AWS through the REST API, which is its only connection method. Its supported actions are Verify (connect to AWS) and Change (the IAM user must be allowed to change its own access key, globally or by group). Reconcile and Delete are not supported, so a reconcile account cannot recover an unsynchronized key. The required account parameters are Username (the IAM user), AWS Account ID, and AWS Access Key ID, and the access key secret is stored as the password.

Correct answer: The IdP's SAML response signing certificate is missing from, or does not match the certificate in, the Privilege Cloud SAML configuration.

When the IdP confirms a successful authentication but the assertion is rejected, and clock skew and the Audience value have been ruled out, the most likely cause is a trust problem. Privilege Cloud verifies the signature of the SAML response with the IdP's signing certificate (IdentityProviderCertificate, or the certificate in the IdP metadata provided for the configuration: "used to verify the authenticity of the responses"). If that certificate is missing, expired or different from the one the IdP signs with, the assertion is rejected even though the user authenticated at the IdP. In Privilege Cloud Standard this information is provided to Technical Support; in Shared Services it is part of the external IdP's inbound metadata in Identity Administration.

Correct answers: To encrypt and forward audit logs from the Vault to an external SIEM.; To facilitate LDAP integration between the customer's Active Directory and the Privilege Cloud.

In the Privilege Cloud Standard architecture, the Secure Tunnel client is an optional on-premises component that 'enables you to securely connect Privilege Cloud with your LDAP and SIEM servers' (and set up legacy offline/remote access). The Privilege Cloud backend uses it to reach the on-premises directory for LDAPS integration and to deliver Vault audit records to the customer's SIEM over syslog. CPM and PSM do not use the tunnel: they connect directly to the Vault backend on TCP 1858 (and 443 for REST), and session isolation and recording are PSM functions. In Shared Services, AD/LDAP integration is handled by the Identity Connector and SIEM by the Audit service, and Secure Tunnel is no longer supported for new deployments as of June 30, 2026.

In the Privilege Cloud Standard architecture, the Secure Tunnel client is an optional on-premises component that 'enables you to securely connect Privilege Cloud with your LDAP and SIEM servers' (and set up legacy offline/remote access). The Privilege Cloud backend uses it to reach the on-premises directory for LDAPS integration and to deliver Vault audit records to the customer's SIEM over syslog. CPM and PSM do not use the tunnel: they connect directly to the Vault backend on TCP 1858 (and 443 for REST), and session isolation and recording are PSM functions. In Shared Services, AD/LDAP integration is handled by the Identity Connector and SIEM by the Audit service, and Secure Tunnel is no longer supported for new deployments as of June 30, 2026.

Correct answer: Create two separate Safes, 'AWS-JIT' and 'Legacy-Persistent', and a dedicated platform for the AWS accounts with a Master Policy exception that activates 'Require dual control password access approval'. Grant 'AWS-Admins' 'Use accounts' on 'AWS-JIT' with team leads as confirmers ('Authorize account requests'), enforce the request timeframe on PSM sessions, and grant 'IT-Ops' standing 'Use accounts' on 'Legacy-Persistent'.

Safes are the access boundary and the Master Policy is applied per platform. Placing the AWS accounts in an 'AWS-JIT' Safe on a dedicated platform lets a Master Policy exception activate 'Require dual control password access approval' for them only: each request states the access timeframe, team leads who are Safe members with 'Authorize account requests' confirm it, and EnforceDualControlTimeframeOnPSMConnections ends PSM sessions when the approved timeframe expires. IT-Ops receive standing 'Use accounts' access in 'Legacy-Persistent', whose accounts use platforms without dual control. 'Record and save session activity' is active by default, so both teams' PSM sessions are recorded. Giving IT-Ops 'Retrieve accounts' would allow unrecorded direct use, and exceptions cannot be created for an Okta group.