CPC-CDE-RECERT Exam Dumps - CyberArk CDE-CPC Recertification

CyberArk documents that the HTML5 gateway tunnels the session using a secure WebSocket over port 443, enabling users to access PSM sessions from a web browser (instead of requiring an RDP client connection from the endpoint).

In Privilege Cloud remote access for employees, CyberArk describes using Remote Access and HTML5 to enable secure remote access sessions through PSM “from any web browser,” eliminating the need for VPN clients.

Given the provided answer choices, A is the only option that matches the documented “tunneling” role of the HTML5 Gateway (even though the most precise phrasing in CyberArk docs is “tunnels the session between the end user and the PSM machine”).

Why the other options are incorrect:

B: Authentication is handled by Privilege Cloud/IdP mechanisms; the HTML5 gateway’s documented role is session tunneling, not being the primary authenticator.

C: CyberArk explicitly positions HTML5 remote access as eliminating the need for VPN clients (not providing VPN).

D: This is marketing language not reflected as the HTML5 gateway’s documented purpose.

CyberArk’s Privilege Cloud documentation for SIEM integration (Syslog) states that to connect to SIEM in Privilege Cloud, you must first deploy the Secure Tunnel.

That means the Secure Tunnel is the required component that enables the communication path for sending Privilege Cloud audit logs via Syslog (TCP/TLS) to your SIEM.

Why the other options are not correct for this Privilege Cloud Syslog requirement:

A (CyberArk Syslog Writer) is typically referenced in CyberArk Identity / ISP logging contexts, not as the required Privilege Cloud SIEM transport component. (Privilege Cloud SIEM doc calls out Secure Tunnel explicitly.)

C (Privilege Cloud Connector) is not what the SIEM/Syslog doc identifies as the required prerequisite; it specifically calls out Secure Tunnel.

D (CyberArk Identity Connector) is used to integrate directory services (AD/LDAP) with CyberArk Identity/Identity Administration, not as the Privilege Cloud Syslog transport prerequisite.

In the Privilege Cloud Shared Services model, user access and MFA are driven through CyberArk Identity / Shared Services, and CyberArk publishes a dedicated list of “MFA options in Shared Services” for the user portal and supported challenges.

In CyberArk PAM Self-Hosted, MFA is typically achieved by enabling and integrating additional authentication methods such as RADIUS, SAML, PKI, LDAP, Windows, CyberArk, etc., depending on the organization’s design.

So, the accurate comparison is that Privilege Cloud (Shared Services) leverages CyberArk Identity, while PAM Self-Hosted relies on enabling/integrating the relevant authentication/MFA methods in the self-hosted environment → B.

https://docs.cyberark.com/privilege-cloud-standard/latest/en/content/privilege%20cloud/privcloud-app-users.htm

To retrieve the previous password for an account that had its password changed by the CPM, you should look under the Versions tab within the account's overview page. This tab maintains a history of password changes, including previous passwords, along with other historical data points that allow for tracking changes over time. This feature is critical for auditing and rollback purposes in environments where knowing past credentials is necessary for troubleshooting or compliance.

CyberArk’s hardening instructions for SUSE (manual hardening) explicitly require:

Updating the SSH daemon configuration in /etc/ssh/sshd_config (for example, removing SFTP subsystem definitions and setting multiple hardening-related attributes such as disabling forwarding features).

Ensuring the credential file for the PSM for SSH gateway user (psmpgwuser.cred) has the required permissions 640 (default path shown as /etc/opt/CARKpsmp/Vault/psmpgwuser.cred).

Those map directly to A and C.

To configure a platform to work with load-balanced Privileged Session Managers (PSMs), you should:

Create a new PSM definition that targets the load balancer IP address and assign it to the platform (Option B). This approach involves configuring the platform settings to direct session traffic through a load balancer that distributes the load across multiple PSM servers. This is effective in environments where high availability and fault tolerance are priorities.

In the Privilege Cloud LDAP integration workflow, CyberArk lists the default maps (built-in directory maps) as:

Vault Admins

Safe managers

Auditors

Users

Since the question asks for the default roles in addition to Vault Admins and Auditors, the remaining two default map roles are Safe managers and Users, which correspond to A and D.