CDE Practice Test

CDE practice test: what's covered

• Defender CDE
• Privileged Access Management

Free CDE sample questions

1. During a CyberArk PAS health check, you notice the Vault server has only TCP/1858 open inbound and NO other ports. A new admin insists "open 443 and 22 like every other server". What is the CORRECT response based on CyberArk hardening?

   • A. Open 443 so PVWA can talk to it
   • B. Keep ONLY TCP/1858 open — the Vault uses a proprietary protocol on 1858 and the hardened OS firewall is intentionally locked; PVWA/CPM/PSM all communicate over 1858, not HTTPS or SSH
   • C. Open 22 so administrators can SSH directly to the Vault
   • D. Open 389 LDAP so the Vault can authenticate users
   Show answer

   Correct: B. The Vault is a hardened Windows server with its own firewall ruleset — only TCP/1858 (proprietary CyberArk Vault protocol) is allowed inbound. SSH and RDP to the Vault are deliberately disabled; admins use the PrivateArk Client over 1858. Opening 443/22 breaks the security model.

2. Which CyberArk component is responsible for password Verify, Change and Reconcile operations against target systems?

   • A. PVWA (Password Vault Web Access)
   • B. CPM (Central Policy Manager)
   • C. PSM (Privileged Session Manager)
   • D. PrivateArk Client
   Show answer

   Correct: B. CPM owns the password lifecycle on targets — Verify, Change, Reconcile — using plug-ins per platform type. PVWA is the web UI / user-facing portal. PSM brokers sessions. PrivateArk is the thick client for Vault administration. Students often confuse "PVWA does the change" because they request it from PVWA — but PVWA only queues the task; CPM executes it.

3. Which TWO statements about the ENE (Event Notification Engine) are correct? (Choose 2)

   • A. ENE sends SMTP notifications based on Vault audit events (password changes, safe member changes, failed logins)
   • B. ENE is installed by default on every Vault and cannot be disabled
   • C. ENE pulls events from the Vault and emails configured recipients per notification template
   • D. ENE encrypts the Vault database at rest
   • E. ENE performs password rotation on targets
   Show answer

   Correct: A and C. ENE is the email notification component — it watches Vault audit events and emails them out (SMTP). It is OPTIONAL (not always installed), it does NOT encrypt the DB (the Vault itself does with its server key + recovery keys), and it does NOT rotate passwords (that is CPM).

4. A customer wants to deploy PVWA in DMZ for external administrator access. Which BEST describes the secure deployment?

   • A. Place PVWA in DMZ and let it talk DIRECTLY to LDAP, target systems and Vault — anything else is over-engineering
   • B. Deploy PVWA in DMZ — it terminates HTTPS from the user, then talks to the Vault over TCP/1858; it does NOT need direct access to target systems (CPM handles target access)
   • C. Place PVWA on the same server as the Vault to avoid network exposure
   • D. Skip PVWA in DMZ — use PrivateArk Client over the public internet
   Show answer

   Correct: B. PVWA is the only component intended to face users — it terminates HTTPS, authenticates, and proxies all data requests to the Vault on 1858. It does NOT need direct line-of-sight to target servers (DBs, network gear, hypervisors); CPM and PSM, deployed in the internal network, handle target connectivity. Co-locating PVWA on the Vault violates CyberArk hardening and is unsupported.

5. Which component allows administrators to manage the Vault itself (create Safes, manage users, configure ENE rules) using a Windows thick client over TCP/1858?

   • A. PVWA
   • B. PrivateArk Client
   • C. CPM
   • D. PSM
   Show answer

   Correct: B. PrivateArk Client is the Windows thick-client GUI for Vault administration — Safe creation, user management, server configuration, low-level Vault tasks. PVWA is the web UI but has fewer admin-grade capabilities. CPM and PSM are not admin clients at all.

Last updated: 2026-10-19

CDE practice test FAQ