The CyberArk CDE-CPC Recertification (CPC-CDE-RECERT)

CyberArk’s official DR CPM procedure for Privilege Cloud (shared services) describes two key actions in this flow:

During installation (Connector Management): When prompted to select the CPM mode, choose Passive .

After installation (configuration step): Stop the CyberArk Password Manager service and set its startup type to Manual .

These map directly to answers C and A .

For LDAP integration with CyberArk Privilege Cloud Standard, the correct statement is that only the Issuing CA certificate is required for certificate trust to your directory server. This setup simplifies the process of establishing a trusted connection between CyberArk and the LDAP server by necessitating only the certification of the issuing Certificate Authority (CA), rather than needing multiple certificates from different levels of the trust chain. This approach ensures that the SSL/TLS communication between CyberArk and the LDAP server is secured based on the trust of the issuing CA’s certificate.

For retrieving the LDAPS certificate when not using the CyberArk provided LDAPS certificate tool, the supported certificate format is .der . The DER (Distinguished Encoding Rules) format is a binary form of a certificate rather than the ASCII PEM format. This format is widely supported across various systems for securing LDAP connections by providing a mechanism for LDAP servers to authenticate themselves to users. This information can be verified by checking LDAP configuration guides and CyberArk ' s secure implementation documentation which outline supported certificate formats for LDAP integrations.

CyberArk’s official connector guidance (CyberArk Identity / Identity Administration—used with Privilege Cloud Shared Services for AD user authentication) says that for trusted domains in a single forest , you use this model when the domain controllers have a two-way, transitive trust relationship with the domain controller the connector is joined to.

It also clarifies that a single connector can be used for the entire domain tree or forest in that trusted-domain model, and authentication requests are handled according to AD trust relationships within the forest/tree.

https://docs.cyberark.com/identity/latest/en/content/coreservices/connector/userauthmultdomain.htm

In the Privilege Cloud Shared Services model , user access and MFA are driven through CyberArk Identity / Shared Services , and CyberArk publishes a dedicated list of “MFA options in Shared Services” for the user portal and supported challenges.

In CyberArk PAM Self-Hosted , MFA is typically achieved by enabling and integrating additional authentication methods such as RADIUS, SAML, PKI, LDAP, Windows, CyberArk , etc., depending on the organization’s design.

So, the accurate comparison is that Privilege Cloud (Shared Services) leverages CyberArk Identity , while PAM Self-Hosted relies on enabling/integrating the relevant authentication/MFA methods in the self-hosted environment → B .

After the successful scripted installation of the Privileged Session Manager (PSM), one of the post-installation tasks is to disable the screen saver for the PSM local users. This is done to ensure that the PSMConnect and PSMAdminConnect users, which are created during the installation process, do not have a screen saver activated that could interfere with the operation of the PSM.

When installing the first CyberArk Privilege Management (CPM) instance in the Privilege Cloud using the Connector Management Agent, the installation mode should be set to " Active " . This configuration sets the CPM to be actively involved in password management and task processing without being in a standby or passive mode. Here are the step-by-step details:

Download the Connector Management Agent : Obtain the installer from the CyberArk Marketplace or your installation kit.

Run the Installer : Start the setup and select the CPM component to install.

Choose Installation Mode : When prompted, select " Active " as the installation mode. This sets up the CPM as the primary node responsible for handling password management operations.

This setup ensures that the CPM is immediately active and capable of handling requests without waiting for manual intervention or failover.

For large implementations of CyberArk Privilege Cloud Connectors in AWS and Azure environments, each connector can handle between 31-60 concurrent RDP/SSH sessions. This capacity is specified in the CyberArk documentation concerning Privilege Cloud Connectors and their scalability options. It is designed to support a higher volume of concurrent sessions to meet the needs of larger enterprise environments, ensuring that multiple users can securely access resources without significant performance degradation.