The interview question that trips up 70% of PAM candidates
Senior interview: "A user needs to RDP into a production Windows server through CyberArk, but must never see the password. Which single permission do you grant?"
Wrong answers: "Retrieve Accounts", "Manage Safe", "all of them". Right answer: UseAccounts only. It lets PSM broker the session so the credential never lands on the user's machine. RetrieveAccounts would additionally expose the plaintext password — a much bigger blast radius. Confusing these two is the single most common reason a CyberArk safe fails its access review. Get this one distinction right and you're already ahead of most "PAM admins" three years into the job.
💡 The SBI bank-locker analogy
Think of the Vault as the SBI locker room. The building holds hundreds of individual lockers — each locker is a Safe. Your access depends on exactly what the manager wrote against your name. Some people can only read the locker register (List Accounts). Some can open the locker and look inside but take nothing (Retrieve). Some can use what's inside without ever touching it themselves — the bank's agent handles it for them (Use, via PSM). And only the locker manager can add or remove other keyholders (Manage Safe Members). The Master Policy is RBI's uniform rulebook that applies to every branch — but one branch can file an exception for a special-purpose locker. Same family, same building, separate keys. That separation is the whole game.
4 things you'll be tested on before we begin
UseAccounts = PSM-proxied connect, password never shown. RetrieveAccounts = view + copy the plaintext. So what: default to Use; grant Retrieve only for break-glass or programmatic needs.
In two groups on the same safe? You get the most permissive union of both. So what: one over-scoped group silently grants Retrieve to everyone in it.
accessWithoutConfirmation bypasses dual control even when the Master Policy enforces it. So what: a single over-grant nullifies your two-person rule — keep it to named break-glass only.
Object Level Access Control adds per-account permission checks inside one safe. Cannot be disabled once on. So what: use it for mixed-population safes without creating safe sprawl.
① Safe member permissions — the 21 flags and the 2 that matter most
A safe is just a container. What makes it secure is the permission set you grant each Safe Member. CyberArk PAM Self-Hosted exposes 21 discrete permission flags in the Gen2 REST API. You will not memorise all 21 for the job — but you must know which ones are dangerous. The two that decide everything are useAccounts and retrieveAccounts.
Ramesh Kumar, Senior PAM Architect at a large Mumbai NBFC, maps the BFS-OraDBAs AD group onto the Oracle safe with UseAccounts + ListAccounts + ViewAuditLog — and not RetrieveAccounts. DBAs connect to SYS through PSM all day, but nobody can copy the raw password out of PVWA. Retrieve goes to just two named senior DBAs for break-glass. That single design choice is what passed his quarterly access certification.
Here is the rule that scares auditors: when a user belongs to two AD groups that are both members of the same safe, CyberArk applies the cumulative (most permissive) permission. If Group-A grants Retrieve and Group-B denies it, the user gets Retrieve. One sloppy group nesting silently hands plaintext passwords to people who were never meant to have them.
curl -k -X POST \
https://10.20.40.50/PasswordVault/API/Safes/PROD-DB-ORA-DBA/Members \
-H 'Content-Type: application/json' \
-H "Authorization: ${SESSION_TOKEN}" \
-d '{ "memberName": "BFS-OraDBAs", "searchIn": "techclick.in",
"permissions": { "useAccounts": true, "listAccounts": true,
"retrieveAccounts": false, "manageSafeMembers": false,
"accessWithoutConfirmation": false, "viewAuditLog": true } }'
{ "memberName": "BFS-OraDBAs", "memberType": "Group",
"isPredefinedUser": false,
"permissions": { "useAccounts": true, "listAccounts": true,
"retrieveAccounts": false, "manageSafeMembers": false,
"accessWithoutConfirmation": false, "viewAuditLog": true } }
Before you scroll: a help-desk analyst is added to two AD groups on the domain-admin safe. Group-A = List only. Group-B = List + Retrieve. What can the analyst do?
Pause & Predict A DBA team connects to SYS through PSM all day but must never be able to copy the raw password out of PVWA. Of the 21 safe-member flags, which one do you grant for the connection — and which one do you deliberately withhold?
② The Master Policy — one engine, four rule areas, surgical exceptions
The Master Policy is CyberArk's single-pane policy engine. It sets the organisation-wide baseline across four rule areas, and you carve out deviations as exceptions per platform or per safe — without touching the global default. Know the four areas cold; they map directly to PAM-DEF exam questions.
Priya Menon, IT Security Manager, needs one Windows service account to rotate every 30 days for PCI-DSS — but the global rule is 90 days and she will not touch it. She creates a Platform-level exception on that account's platform, sets change frequency to 30 days, and every other platform keeps the 90-day baseline. One surgical override, zero blast radius.
The Master Policy is the technical how — it enforces rotation, recording and workflows. It is not the why: it captures no business justification, no ownership accountability, no certification schedule. A CISO who points to the Master Policy as "our PAM policy" will fail a SOX or ISO 27001 audit. You need both: a written governance document and the Master Policy as its implementation.
You're at a Bengaluru fintech. A user must RDP into a production Windows server through PSM and must never see the password. Which single safe-member permission do you grant?
Recreated for clarity📜 The exact screen you'll use — PVWA → Administration → Master Policy. Your console matches this layout.
| Rule | Status | Exceptions |
|---|---|---|
| Require dual control password access approval | Inactive | 2 |
| Enforce check-in/check-out exclusive access | Active | 0 |
| Enforce one-time password access | Active | 1 |
| Require users to specify reason for access | Active | 0 |
| Allow EPV transparent connections ("Click to connect") | Active | 0 |
On the Master Policy grid above, "Require dual control password access approval" shows status Inactive but an Exceptions count of 2. Two named Safes still require dual-control approval. How did that happen without flipping the global rule on?
③ Dual control, exclusive accounts & one-time passwords — two-person integrity
Dual control is the Master Policy rule that forces a privileged request to be approved by one or more safe owners before the password or session is released. It is OFF by default — you turn it on for your crown-jewel safes. Pair it with Exclusive Check-In/Check-Out (one user at a time) and One-Time Password (CPM rotates the password the instant it's checked back in) and a stolen credential becomes worthless seconds after use.
Aditya, lead engineer at a Hyderabad SaaS firm, wires CyberArk's approval workflow to ServiceNow. Now nobody touches the Linux root safe without (1) a valid CHG ticket in the right state and (2) a Level-1 then Level-2 approver sign-off. With two authorisation levels enabled, Level-1 must confirm before Level-2 is even notified — a true sequential, multi-person chain.
▶ Watch a dual-control checkout, step by step
Aditya needs root on a production Linux box. Dual control + ServiceNow ticket + OTP are enforced. Press Play.
root@prod-lnx-01, enters reason "P1 incident INC0049213" and links ServiceNow CHG0031882.Approved. Request enters the dual-control queue.requestsAuthorizationLevel1 = true. Only now is the Level-2 approver notified.A mid-sized e-commerce firm enabled dual control + ServiceNow on its Linux root safes — then printed the failsafe bypass code on a note by the PVWA workstation and shared it in a Slack channel. A post-incident review found it had been used 17 times with no change ticket and no approver record. The fix: regenerate the code, store it inside a separate safe that itself requires dual control, and alert via PTA on any bypass-code use. The lesson: a bypass that skips the whole workflow must be guarded harder than the workflow itself.
Dual control is enforced on the root safe via the Master Policy. But one service team also has accessWithoutConfirmation granted on that safe. When they request root, what happens?
Pause & Predict An attacker shoulder-surfs a DBA's root password during a legitimate one-time-password checkout, then walks away to reuse it ten minutes later. The safe has Exclusive Check-In/Check-Out and One-Time Password turned on. Why is the stolen password already worthless?
④ Least-privilege safe design — segregation, naming & AD mapping
Here is where most CyberArk deployments quietly rot. A safe boundary must line up with a job-function boundary. If your DBA team and your Windows server team share one safe, neither least privilege nor clean auditing is possible — and a single compromised help-desk account can reach credentials it has no business touching.
A global bank's quarterly certification found one Windows admin safe with 40 active members, every one holding RetrieveAccounts on domain-admin accounts — added "just in case", never cleaned up, no dual control, no OTP. In a Red Team test, an attacker who phished one help-desk account pulled a domain-admin password from PVWA in under two minutes and owned a domain controller. The remediation: strip Retrieve from 38 of 40 members and put dual control + OTP on the 2 break-glass accounts that kept it. Safe membership had been a one-way door with no attestation — that's the real bug.
The fix for the DBA-vs-Windows mess is structural: one safe per platform per environment, with each AD group mapped only onto its own safe. Names are capped at 28 characters and can't contain spaces, periods, asterisks or quotes — which is exactly why the field uses an abbreviated convention: [Env]-[Location]-[AssetType]-[Platform]-[AccountType].
One more design trap worth naming: map AD groups as safe members, and make Vault users LDAP-authenticated. At Technocraft, an exited junior admin pulled the Azure root password three hours after his AD account was disabled — because his local Vault account still worked. LDAP-backed users would have lost access the instant AD disabled him. Keep exactly one local break-glass user for the day AD itself is down.
curl -k -s \
https://10.20.40.50/PasswordVault/API/Safes/PROD-WIN-DOM-ADM/Members \
-H "Authorization: ${SESSION_TOKEN}" | \
jq '.value[] | select(.permissions.retrieveAccounts == true)
| {member: .memberName, type: .memberType}'
{ "member": "BFS-WinBreakGlass", "type": "Group" }
{ "member": "ramesh.kumar", "type": "User" }
# Only 2 entities hold Retrieve — exactly what least-privilege expects.
# 40 entries here would be your audit finding.
You're designing safes for a Pune NBFC. The Oracle DBA team and the Windows server team currently share one safe. What's the cleanest least-privilege fix?
Recreated for clarity🔐 The exact screen you'll use — PVWA → Safes → Add Safe. Your console matches this layout.
Pause & Predict A colleague creates a safe called Rajesh-Personal, adds three teammates, and leaves the Assign a CPM field blank. Name the two least-privilege design failures baked into that one dialog.
PROD-Linux-DBA). (2) No CPM assigned means no automatic rotation — the #1 audit miss; passwords in that safe will never change unless someone notices. Fix the name and assign PasswordManager.🤖 Ask the AI Tutor
Tap any question — instant context-aware answer.
Deeper questions → chat.techclick.in.
The 5 findings that fail a CyberArk safe audit
Whole teams with Retrieve on domain-admin. Strip to named break-glass; default everyone to UseAccounts.
A junior DBA who can add their own account with full rights, or remove the Auditors group. Restrict to PAM admins / safe owners only.
Silently nullifies dual control. Reduce to a small, named, PTA-monitored set.
Leavers keep Vault access after AD disable. Migrate users to LDAP authentication; keep one local break-glass user.
DBA and Windows teams in one safe = no SoD. Split by platform per environment; use OLAC only for genuinely mixed safes.
CVE-2024-54840 (CVSS 6.1, Host Header injection) affects PVWA in PAM Self-Hosted before 14.4. Since every safe-management and dual-control workflow flows through PVWA, upgrade to 14.4+ and align your patch cadence to the CISA KEV list. Open-source tools like HuntCyberArk can scan for permission sprawl and known CVEs as part of your quarterly attestation.
📝 Check your understanding — 10 questions, 70% to pass
Q1–Q2 above already count. Below are Q3 to Q10. One correct answer each; read the reasoning even when you're right.
What is the maximum number of characters allowed in a CyberArk Safe name?
A platform's Master Policy exception enforces dual control, but the on-call senior admin at a Mumbai bank needs break-glass access without waiting for approval. How do you configure this at the safe-member level?
You want production root credentials to be single-use — the password must change every time someone checks it out. Which two Master Policy rules must you enable together?
A security audit at an NBFC finds a junior DBA has Manage Safe Members on a production Oracle safe. What is the precise attack surface this creates?
A user at a Chennai enterprise is in two AD groups, both members of the same safe. Group-A has RetrieveAccounts = true; Group-B has RetrieveAccounts = false. What effective permission does the user have?
A global rule sets password rotation every 90 days. One Windows service account must rotate every 30 days for PCI-DSS, without changing the global rule. How do you achieve this?
One architect at a 3,000-server NBFC proposes one safe per server (500+ safes); another proposes one safe per team/platform (a handful). Evaluate and recommend.
Your CISO asks whether the CyberArk Master Policy can replace a separate written PAM governance document. Evaluate the claim.
Self-explain (say it out loud): in one sentence, why is UseAccounts safer than RetrieveAccounts, and when would you still grant Retrieve?
Teach a friend: "A CyberArk Safe is the wall, the permission is the door, and the Master Policy decides if you also need a second person to open it."
Spaced recall: set a 3-day reminder to re-run the jq Retrieve-audit query mentally against any safe — if you can list the 6 dangerous permissions from memory, it stuck.
Next up — CyberArk CPM: Automatic Credential Rotation
Now your safes know WHO can do WHAT. Next: the Central Policy Manager — how CyberArk changes, verifies and reconciles passwords automatically, why reconcile accounts exist, and what breaks rotation in production.
Sources cited inline
- CyberArk PAM Self-Hosted 14.0 — Add and manage Safes and Safe members
- CyberArk Privilege Cloud — Assign Safe member permissions
- CyberArk — Understand the Master Policy Framework
- CyberArk Community — Safe Naming Convention Best Practices
- CVE-2024-54840 — CyberArk PVWA Host Header Injection
- psPAS — Add-PASSafeMember (21 permission flags reference)
- HuntCyberArk — CyberArk security audit tool