According to the web search results, all of the Privileged Session Management (PSM) solutions support live monitoring of active sessions. PSM, PSM for Windows, and PSM for SSH enable authorized users to monitor active sessions from their workstation and take part in controlling these sessions. Users can also suspend or terminate active sessions based on their group assignment. By default, active session monitoring is enabled at system level for all authorized users, and can be disabled at platform level. Active session monitoring can also be disabled at system level, but when it is disabled, it cannot be enabled at platform level.  PSM can automatically suspend or terminate sessions when notified by PTA or a third party threat analytics tool 1 .  Authorized users monitor or terminate an active session using the same connection method (RDP file or HTML5 Gateway) as the end user

A connection component is a set of parameters that defines how PSM connects to a target system using a specific protocol or application. Different connection components are suitable for different types of systems or functions. The correct matches are as follows:

PSM-SSH: This connection component enables transparent connections to UNIX machines using the SSH protocol. It supports various UNIX flavors, such as Linux, Solaris, AIX, and HP-UX.

PSM-RDP: This connection component enables transparent connections to Windows machines using the RDP protocol. It supports various Windows versions, such as Windows Server, Windows 10, and Windows 7.

PSM-WinSCP: This connection component enables transparent connections to UNIX machines using the WinSCP application. It supports file transfer operations, such as upload, download, delete, and rename, between the local and remote machines.

PSM-SQLPlus: This connection component enables transparent connections to Oracle databases using the SQL*Plus application. It supports various Oracle versions, such as Oracle 12c, Oracle 11g, and Oracle 10g.

PSM-OS390: This connection component enables transparent connections to IBM mainframes using the OS/390 protocol. It supports various mainframe applications, such as TSO, CICS, and IMS.

References :  Connection Components , Connection Component Parameters

 Ad-Hoc Access (formerly Secure Connect) is a feature that allows users to connect to target devices that are not managed by CyberArk through the PSM. Users can specify the address, username, and password of the target device, and select a client to launch the connection. Ad-Hoc Access sessions benefit from the standard PSM features, such as session recording, detailed auditing, and real-time live session monitoring. However, Ad-Hoc Access does not allow users to connect from a terminal without logging in to the PVWA, as this would bypass the authentication and authorization mechanisms of CyberArk.  References :

Configure ad hoc connections

Ad Hoc Connections

Privileged Remote Access Management – PAM Remote Access

The server key and the public recovery key are required to be present in order to start the PrivateArk Server service. The server key opens the Vault, much like the key of a physical Vault. The public recovery key is part of the asymmetric recovery key that enables the Master User to log on to the Vault in case of a disaster. The server key and the public recovery key are usually stored on a removable media, such as a disk or CD, so that they can be safely secured in a physical safe. The recovery private key and the safe key are not needed to start the PrivateArk Server service. The recovery private key is only used for recovery purposes and the safe key is only used to access a specific safe that is defined with an external key.  References:   Server keys ,  Server Components

The Replicate component can be used to create a tape backup of the Vault. The Replicate component is a utility that exports the encrypted contents of the Safes and the Vault metadata to a computer outside the Vault environment. A global backup system can then access the replicated files and copy them to a tape or any other backup media.  The Replicate component is part of the CyberArk Backup Process, which provides a secure and easy method of backing up and restoring the Vault data 1 2 . The other components are not related to the tape backup of the Vault.  Disaster Recovery is a feature that enables the Vault to recover from a catastrophic failure by using a standby Vault server 3 .  Distributed Vaults is a feature that enables the Vault to synchronize data with other Vaults in different locations 4 . High Availability is a feature that enables the Vault to maintain continuous operation by using a primary and a secondary Vault server.  References :

Use the CyberArk Backup Process - CyberArk , section “Use the CyberArk Backup Process”

Install the Vault Backup Utility - CyberArk , section “Backup utilities”

Disaster Recovery - CyberArk , section “Disaster Recovery”

Distributed Vaults - CyberArk , section “Distributed Vaults”

[High Availability - CyberArk], section “High Availability”

Vault keys should be rotated when there is a significant event that could potentially compromise the security of the keys, such as when migrating to a new data center. This is because the keys may be exposed to new environments and systems, and rotating them ensures that any potential exposure does not result in a security breach.  Additionally, periodic rotation of encryption keys is recommended to maintain the integrity of the encryption and to adhere to best practices for security 1 .  References :

CyberArk Docs: Credentials Rotation Policy 2

HashiCorp Developer: Key Rotation

Add Accounts -- > Safe

Initiate CPM account management operations - > Safe

Add/Update Users - > Vault

Add Safes - > Vault

Comprehensive Explanation :

Add Accounts : This permission is associated with the ability to add new accounts to the CyberArk Vault. It is typically found in the Vault’s administrative settings where account management is handled.

Initiate CPM account management operations : This permission allows users to initiate operations related to the Central Policy Manager (CPM) for account management within a Safe. It is found in the Safe’s permissions settings.

Add/Update Users : This permission enables the addition or updating of user information in the Vault. It is found in the Vault’s user management settings.

Add Safes : This permission is related to the creation of new Safes in the Vault. It is found in the Vault’s administrative settings where Safe management is conducted.

References :

The permissions and their locations can be referenced in the CyberArk Defender PAM course materials and official documentation, which provide detailed information on the management of permissions within the CyberArk solution.

 A linked account is an account that is associated with another account to enable the password management process. A linked account can be used for various purposes, such as logging on to a target system, changing the password of another account, or enabling privileged commands. A linked account can be defined either on the platform level or on the account level, depending on the type and scope of the linked account.  The types of linked accounts that are supported by CyberArk are 1 :

Logon account: An account that contains the password required to log on to a remote machine in order to perform a task using the regular account. A common use case for using a logon account is managing root accounts on a Unix system. The best practice for Unix systems is to disallow the root user from logging in using SSH. However, SSH is what the CPM uses to sign in to a system to manage the password. To manage the root password without violating this practice, the CPM establishes the session with a non-root account and then SUs to root (the target account). This is done using a linked account called a logon account.

Reconcile account: An account that contains the password used in reconciliation processes. Reconciliation is a process that restores the password of a privileged account to the value that is stored in the Vault, in case it is changed or out of sync. A reconcile account is a privileged account that has the permission to reset the password of another account on the target system. By associating a reconcile account with the target account, the CPM can use the reconcile account to restore the password of the target account, in case it is changed or out of sync.

Other additional accounts: Additional accounts can be used in various cases. For example:

Enable password: when managing network devices that require an enable password to access privileged mode.

Jump account: when using a custom plugin in a complex work flow that requires to first log on to a jump server.

The other options are not the purpose of a linked account, because:

A. To ensure that a particular collection of accounts all have the same password. This is not the purpose of a linked account, but of a group account. A group account is an account that is associated with multiple target systems that share the same credentials.  A group account allows the CPM to manage the password of multiple systems with a single password object in the Vault 2 .

B. To ensure a particular set of accounts all change at the same time. This is not the purpose of a linked account, but of a password change schedule. A password change schedule is a feature that allows the administrator to define a time frame for changing the passwords of a set of accounts.  A password change schedule can be configured either in the Master Policy or in the Platform settings 3 .

C. To connect the CPNI to a target system. This is not the purpose of a linked account, but of a service account. A service account is an account that is used by a service or an application to connect to a target system.  A service account can be managed by the Central Credential Provider (CCP), which is a component that provides applications and services with the credentials they need to access target systems 4 .

References :

1 :  Linked Accounts

2 : Group Accounts

3 : Password Change Schedule

4 : Service Accounts

 During the Windows discovery process in CyberArk Defender PAM, accounts that can be selected for use include an account that is already stored in the Vault and an account that is specified by the user. The discovery process scans predefined machines for new and modified accounts and their dependencies.  After the scan, accounts that should be onboarded into the Vault for secure and automatic management are identified 1 2 .  References : The information provided is based on general knowledge of CyberArk PAM best practices and the account discovery process as outlined in CyberArk’s official documentation 1

 To ensure that certain accounts do not have their passwords updated during business hours, you can configure the password change parameters within the platform settings to specify the permitted time frame for updates.  This involves setting the  FromHour  and  ToHour  parameters to define a win dow outside of business hours during which the CyberArk Central Policy Manager (CPM) will perform automatic password changes 1 . By doing so, you can control when password changes occur and ensure compliance with the specified requirement.

References :

CyberArk Community: Discussion on configuring automatic password change parameters