# CyberArk is a privileged-session factory. Safe ACL, then Connect.

Source: https://ai.techclick.in/blog_cyberark_session_factory
Markdown: https://ai.techclick.in/blog_cyberark_session_factory.md
Publisher: Techclick Infosec Pvt Ltd

CyberArk is a privileged-session factory: Safe ACL, then Use or Retrieve, then PSM/PSMP, then CPM verify. Prove it in Accounts View and Monitoring.

Quick answer

   CyberArk Privilege Cloud is a  privileged-session factory . The Vault stores the secret. A  Safe  is the ACL. Official Access permissions decide the next stamp:  List accounts  lets the row appear,  Use accounts  lets the operator click  Connect  through PSM without seeing the password,  Retrieve accounts  lets them click  Show  /  Copy . PSM (RDP / HTML5 from the Portal) or  PSM for SSH  (native SSH client) brokers and records the session. CPM then  verifies  the Vault copy still matches the target — and only  reconciles  when those two truths drifted. A green Vault with a missing Safe member is not an outage.

   Say this out loud

   I do not start with a rebuild. I ask whether the user is a Safe member, whether they have Use or Retrieve, whether Connect or Show is the designed path, whether PSM or PSM for SSH is the broker, and whether Last Verified is recent. I do not Change a healthy secret because a session failed to start.

## 1. Why Vault up is not a session

 Every other briefing starts with “is the Vault up?” That is why night shift reboots a healthy Primary and still has a contractor who cannot see the Safe. The real object is the  privileged session . Vault health is only the factory floor being powered. The ticket is printed by Safe membership. The stamp is Use or Retrieve. The broker is PSM or PSM for SSH. CPM is the after-shift inspector, not the door.

 Official Privilege Cloud wording: users who have access to Safes are  Safe members . Each member gets a unique set of permissions on accounts in that Safe. Official Connect docs: you need  Use account  and  List account  in the Safe to connect to a target. Official retrieve docs:  Show  on the account menu displays the password for a limited time — that is a different permission and a different design.

   Hero · who talks to whom

   Notice: the operator never walks straight to the Windows box. Portal → Safe ACL → Use or Retrieve → optional PSM/PSMP broker.

#### What the ticket asked

 “CyberArk is down — Finance cannot RDP.” That sentence is a hypothesis. The factory may already be green and still refuse the member.

#### What you prove first

 Safe members on  Policies → Safes , then Use vs Retrieve, then Connect vs Show, then Last Verified. Night-shift field order lives in  the evidence desk .

   The lie every L1 repeats

   “The Vault is green, so we restart the connector and rotate the local admin.” A green Vault only means the store is up. If the user is missing from the Safe, or has List without Use, Connect will never appear. Rotating after that just gives you two problems.

## 2. Mental model — four factory stations

 Hold four parts. Interviews fail when people mix the store, the ACL, the broker, and the rotator.

#### 1. The store is the Vault

     Privilege Cloud holds the secret. Necessary. Never sufficient. A healthy Primary with a missing member still denies.

#### 2. The ACL is the Safe

     Official:  Policies → Safes . Members tab. Permissions are per member. List / Use / Retrieve are Access permissions — not “owner.”

#### 3. The broker is PSM or PSMP

      PSM  = Portal  Connect , RDP file or HTML5 remote, video + text in Monitoring.  PSM for SSH  = native SSH client, no Portal session window required.

#### 4. The inspector is CPM

      Verify  proves Vault and target still match.  Change  rotates both together.  Reconcile  uses a linked reconcile account when they drifted.

   Path · four stations on one floor

   Notice: the diamond is not “is CyberArk down?” It is “which station failed — ACL, retrieve/use, broker, or CPM?”

   Flow 1 · one ticket, four stations

       Privilege Cloud factory: Safe ACL, Use or Retrieve, PSM or PSMP, then CPM verify

- Vault up is power — not a printed session 1 Safe ACL Policies → Safes → Members 2 Use / Retrieve Connect vs Show / Copy 3 PSM / PSMP broker + record 4 CPM verify / change / recon Use accounts (official) Connect with account / Connect — PSM launch. Operator never sees the password. Pair with List. Retrieve accounts (official) Show / Copy on Accounts View. Limited display time. Not required for Connect. Do not grant “so PSM works.” Platform is the contract. Safe Assign to CPM is who runs it. PSM lives on the platform, not as a Safe checkbox. WinServerLocal (Windows local default) · Allow automatic password management · Last Verified on Overview · Monitoring recordings after the session starts Sources: Manage Safe members · Connect to a target device · Retrieve the account password · Manage and reconcile account passwords Read left → right. Station 2 is a fork, not a synonym. Use and Retrieve are two official Access permissions with two different buttons. Use accounts answers “may this person launch a brokered session?” Official: log on to a remote machine through PSM from the Accounts List ( Connect with account ) or from Account Details / Versions ( Connect ). The password stays hidden. Platforms can be configured so the value is never displayed and only transparent connection is allowed. Retrieve accounts answers “may this person see the secret?” Official: Show on the account menu, then reason (if Master Policy Require users to specify reason for access is Active), then Copy . The password is displayed for a limited time. That is checkout-style retrieve — not the PSM path. PSM answers “who sits between the human and the target?” Official Connect: from inside the network an RDP file is downloaded and becomes invalid once the session begins. Remote (no VPN) uses the Remote Connection toggle and HTML5. PSM for SSH answers the same question for Unix: a standard SSH client to the PSMP proxy, syntax User@targetuser#DomainAddress@targetmachine@proxyaddress . CPM answers “do the two copies still match?” Official: Overview → Last Verified → Verify. If they do not match, Overview → Compliance Status → Reconcile (needs a linked reconcile account). Change is a third button. It is not the first move after a dead Connect. ## 3. Decision flow — name the station Draw this before you open Privilege Cloud Portal. The first diamond is not “is CyberArk down?” It is “which factory station failed?” Flow 2 · name the station (official order) Decision tree: Vault, Safe member, Use versus Retrieve, dual control, PSM versus CPM Ticket: “CyberArk is down — cannot RDP” User listed on the Safe? NO YES Safe membership Policies → Safes → Members Has Use + List? NO Missing Use accounts Connect will not launch Request pending? Dual control — confirmer Last Verified ok? YES + Connect fail Do not Change — fix PSM / NLA Verify, then Reconcile Official facts students invert Connect needs Use + List — not Retrieve. Show needs Retrieve. Confirmers need Confirm requests (authorize account requests). Changing confirmer settings invalidates existing requests — delete and re-create them. Source: Set up dual control · Manage Safe members Read top → bottom. Amber = change-control (member, permission). Green = isolate the broker. Red = CPM only after Last Verified failed. #1 student trap — Retrieve so Connect works Operators keep asking for Show because they think the password is how PSM logs on. Official Connect does not require Retrieve. PSM injects the Vault secret. Granting Retrieve so “Connect appears” is how standing passwords leak onto laptops. If Connect is missing, check Use accounts and List accounts , then dual control, then the platform connection component — not Show. ## 4. How to choose Use, Retrieve, PSM, CPM You are not choosing a product. You are choosing which stamp the factory is allowed to write, and which broker carries the session. Choice Use when Do not use when Proof you were right List + Use only Production operators. Designed path is Portal Connect (PSM) or PSM for SSH. Password must stay hidden. You also need the human to paste a password into a tool that cannot go through PSM. That is a documented Retrieve exception. Member can see the account and Connect. Show is absent or fails. Recording appears in Monitoring. List + Retrieve Break-glass or a designed Show path. Master Policy reason rule is Active. Exclusive access if the account must lock while displayed. You grant it “so PSM works.” Official Connect does not need it. Show → reason → Copy. Activity log has the retrieve. Password display times out. Confirm requests Approver group on a Safe that is under dual control. Pair with List so they can open request details. You put it on the operator group. Operators request; confirmers confirm. Accounts → Request List moves off waiting. Operator can then Connect. Access Safe without confirmation A break-glass identity that must skip dual control. Named, monitored, tiny membership. You add it to the whole operator group to close a P2. That is silently turning dual control off. Only that member Connects without a request. Everyone else still requests. PSM (Portal Connect) Windows / RDP / apps that need video recording, live Monitor / Suspend / Terminate. The user is on a Unix jump with a native SSH client and you force them through an RDP file. RDP file or HTML5 session starts. Monitoring row exists. Recording Safe (default PSMRecordings after first session) has the file. PSM for SSH Unix / network devices from PuTTY, plink, SecureCRT, or automation. Admin has enabled PSMP. The account needs a logon account — official PSMP remote-command and SFTP paths do not support that. SSH to the proxy using official syntax. Text recording in the Vault. Session closes after a remote command if you used that flow. Verify First CPM move. You need to know whether Vault and target still match. You skip it and click Change because Connect failed. Overview → Last Verified updates. Compliance status follows. Change (CPM rotate) Password expired (Master Policy require-change-every-X-days), exclusive / one-time after use, approved dual-control timeframe ended, or you intend a rotate. Last Verified is recent and the failure is PSM / NLA / connector. CPM cycle completes. New Last Verified. Target accepts the new secret. Reconcile Verify failed. Two truths. Linked reconcile account exists (account-level Associate, or platform ReconcileAccountSafe / Folder / Name). No reconcile account and you enabled RCAutomaticReconcileWhenUnsynched . Official: retries error and can disable the account. Compliance Status updates after the next CPM cycle. Vault and target match again. Official Safe create wizard assigns a CPM on the Safe ( Assign to CPM ). It does not assign a PSM server as a Safe checkbox. PSM / PSMP are connection components on the platform (Administration → Platform Management / Configuration Options → Connection Components). Mixing those two is how students invent a menu that is not there. ## 5. Runbook Side A → B → C Goal: one lab Windows local admin in Safe Finance-Windows , platform WinServerLocal , operator group can Connect through PSM without seeing the password, CPM assigned, Last Verified and a Monitoring recording exist after the pilot. Lab values only. Safe Finance-Windows (≤ 28 characters, official limit). Account username finance_admin , address 192.0.2.18 , platform WinServerLocal (official default name for Windows local). Operator group LAB-Finance-Operators . Confirmer group LAB-Finance-Approvers . Nothing here is a live tenant. ### Side A — Policies → Safes (print the ACL) Primary source: Create and manage Safes for access control + Manage Safe members + Assign Safe member permissions . #### Create the Safe and assign CPM Policies → Safes → Create Safe . Wizard: Define properties → Select members → Set permissions. Safe name Finance-Windows . Assign to CPM = the lab CPM that will manage this Safe’s password policy. Description is optional. Advanced: save account versions for N days / save latest N versions. A Safe with no CPM never rotates.

- #### Add the operator group as members Policies → Safes → select Finance-Windows → Members tab → Add Members . Official wizard: Select Safe members (search Privilege Cloud or LDAP, User or Group, ≥ 3 characters) → Next → Set Permissions. Maximum 64 members including predefined users. Add up to ten at a time.

- #### Set Access permissions — smallest set that matches the design Operators: List accounts + Use accounts . Add Retrieve accounts only if Show is designed. Confirmers are a different group with Confirm requests (authorize account requests) plus List. You can only grant permissions you yourself have. Membership expiration is Off by default — click Set if this is a contractor.

     https://lab.privilegecloud.cyberark.cloud — Policies › Safes › Finance-Windows › Members

     Training mock · not live

       Policies  ›  Safes  ›  Finance-Windows  ›  Members  ›  Add Members

### Add member to Safe

         Select members  Set Permissions

          Safe  Finance-Windows

          Member (LDAP group)  LAB-Finance-Operators

          Assign to CPM (Safe property)  CPM-LAB-01

          Membership expiration  Off

       Access permissions

            List accounts
            Use accounts
            Retrieve accounts
            Confirm requests (authorize account requests)
            Initiate CPM account management operations
            Access Safe without confirmation

        Back  Add member

       Lab values only. Operators get List + Use. Confirmers are LAB-Finance-Approvers with Confirm requests. Retrieve is off on purpose.

    Source:  Manage Safe members — Policies → Safes → Members → Add Members. Official Access: List / Use / Retrieve. Next click: Accounts View → Add account on platform  WinServerLocal .

### Side B — Accounts View + platform contract (print the ticket, choose the broker)

 Primary source:  Add individual accounts manually  +  Connect from the Privilege Cloud Portal  +  Configure automatic account management .

     https://lab.privilegecloud.cyberark.cloud — Accounts View › Add account

     Training mock · not live

       Accounts View  ›  Add account

### Add account

         System type  Platform  Safe  Define properties

          Select system type  Windows

          Assign to platform  WinServerLocal

          Store in Safe  Finance-Windows

          Address  192.0.2.18

          Username  finance_admin

          Password (initial)  ••••••••••••

          Allow automatic password management  On (default)

          Customize account name  Off — system format

       If you skip the initial password, official next step is a reconcile. Maximum password length 2300. Dummy lab only.

         Cancel
         Add account

    Source:  Add individual accounts manually — system type, Assign to platform, Store in Safe, Address, Username, Password, Allow automatic password management. Next: associate PSM-RDP on the platform, then pilot Connect.

- #### Add the account on WinServerLocal Accounts View → Add account . Official order: Select system type → Assign to platform → Store in Safe (only Safes you can add to, and Safes defined for that platform) → Define properties. Address 192.0.2.18 , Username finance_admin , enter an initial password. Leave Allow automatic password management On so CPM can rotate, verify, and reconcile. Deactivating that toggle blocks all CPM management.

- #### Confirm the platform broker and CPM contract Administration → Platform Management on WinServerLocal . Associate connection component PSM-RDP for Portal Connect. For Unix siblings you would associate PSMP-SSH . Automatic account management: Password Change (interval + HeadStartInterval ), Password Verification ( VFPerformPeriodicVerification / VFVerificationPeriod ), Password Reconciliation (link ReconcileAccountSafe / ReconcileAccountFolder / ReconcileAccountName , or a dynamic rule). Enable RCAutomaticReconcileWhenUnsynched only when a reconcile account exists. Limit blast radius with AllowedSafes if you use reconcile.

- #### Decide dual control in Master Policy — do not invent a Safe toggle Policies → Master Policy → Require dual control password access approval . Official default is Inactive. To scope it: Rule Preview → Add Exception → pick platform WinServerLocal → set the rule Active → Finish. Confirmers must be Safe members with Authorize account requests (same permission as Confirm requests). Do not enable Only direct manager can approve together with multi-level or more than one confirmer — official: requests will never complete. Changing confirmer settings invalidates existing requests; delete and re-create them.

- #### Pilot Connect — or Request Connection Accounts View → locate finance_admin → Connect . If dual control is Active, the button is Request Connection : Reason, Request Timeframe, Multiple access is required, then OK. Review from Accounts → Request List . After confirmation, Connect downloads an RDP file (in-network) or use Remote Connection for HTML5. The RDP file becomes invalid when the session begins — that is official, not a bug.

  Official PSM for SSH syntax — dummy lab, not a customer proxy
 ssh ops@lab.example@finance_admin#example.lab@192.0.2.18@psmp.lab.example
# User @ targetuser # DomainAddress @ targetmachine @ proxyaddress
# Prompt: Privilege Cloud password, then optional reason if Master Policy requires it

 Parameters are separated by  @ . Optional pieces use  # . Default SSH port is 22. Official: the username may contain one  @ ; additional  @  characters are not supported. Remote command execution closes the session after the command — and is not supported when the account requires a logon account.

### Side C — prove Last Verified and the recording

 Primary source:  Manage and reconcile account passwords  +  Monitor sessions .

- #### Pilot user can list the account A user in LAB-Finance-Operators opens Accounts View and sees finance_admin . If the row is missing, you are still on Side A membership / List — not CPM and not PSM.

- #### Connect (or Show) matches the permission you granted Operators with Use: Connect succeeds, Show is not the path. If you designed Retrieve instead: account menu → Show → reason → Copy . Exclusive accounts lock from display until Release or until automatic rotation after MinValidityPeriod .

- #### Read Overview — Last Verified is a field, not a feeling Accounts View → the account → Overview . Last Verified shows when CPM last proved the two copies match, and when the next automatic verify is due. Click Verify only if you have Initiate CPM account management operations — that marks the account for the next CPM cycle; it is not instant magic.

- #### Open Monitoring only after a session existed Monitoring appears after at least one recording or session exists. Official: session monitoring requires a PSM connector — SIA-only estates do not get this menu. Play Video is an embedded HTML5 player. Active Sessions: Monitor / Suspend / Resume / Terminate if you are in Auditors (or the terminate group) or have the granular Safe permissions on the account Safe and the recording Safe.

     https://lab.privilegecloud.cyberark.cloud — Accounts View › finance_admin › Overview

     Training mock · not live

       Accounts View → finance_admin → Overview

### Account overview

         Overview  Details  Versions  Activity

          Safe  Finance-Windows

          Platform  WinServerLocal

          Last Verified  16 Aug 2026 02:05 UTC · next auto 26h

          Compliance Status   Compliant

          Allow automatic password management  On

          Reconcile account  Finance-Reconcile / win_reconcile

         Verify
         Change
         Reconcile
         Connect

       Last Verified recent + Connect fail = do not press Change. Compliance Status is where Reconcile lives after a failed verify.

    Click next:  Monitoring → Recordings, filter User = ops@lab.example and Target Address = 192.0.2.18. A missing recording after a failed Connect means the session never started. Source: Manage and reconcile account passwords + Monitor sessions.

   Proof · Accounts View + Monitoring

   Notice: juniors stare at the Vault widget. Seniors stare at Safe members, Use vs Retrieve, Last Verified, and whether a recording exists.

  Dummy lab · teaching dump of the finished ticket — not a Vault CLI
 safe=Finance-Windows members=LAB-Finance-Operators
  perms=List+Use retrieve=off confirmers=LAB-Finance-Approvers
account=finance_admin address=192.0.2.18 platform=WinServerLocal
  auto-manage=on last-verified=2026-08-16T02:05Z next=26h
  compliance=Compliant reconcile=linked
session=psm-2048 user=ops@lab.example state=ended
  recording=PSMRecordings play=html5

   Green success on this runbook

   Pilot is a member with List + Use. Connect (or approved Request Connection) starts a PSM session. Show is not required. Overview  Last Verified  is recent and Compliance is not drifting.  Monitoring  has a recording for that user and target. That is working. A green Vault widget with no member and no recording is not.

## 6. Runtime — request, broker, rotate

 After go-live the human path is: authenticate to Privilege Cloud → Accounts View → (optional dual-control request) → Connect or Show → target. CPM is not on that path. CPM walks the same account later, on the platform schedule.

   Flow 3 · runtime after go-live

       Runtime: request or Connect through PSM or PSMP, then CPM verify on a later cycle

- Two clocks: the human session, then the CPM cycle Accounts View row visible? Dual control? Connect / Show Use vs Retrieve PSM / PSMP inject + record Target session then Monitoring row Later — CPM cycle (not the Connect path) Verify on schedule → if unsynced, Reconcile · Change on expiry / exclusive release / dual-control timeframe end Official rotate triggers (not “someone could not RDP”) Master Policy require-change-every-X-days · exclusive / one-time after use · approved request timeframe ended · operator Change · account group sibling HeadStartInterval starts change before expiry so a failed plugin does not violate policy. Source: Configure automatic account management Read the top row as the human session. The blue bar is a different clock. Do not merge them because the ticket is loud. ### Scenario 1 — Safe exists, user is not a member A new Windows admin lives in Finance-Windows . CPM is assigned. Platform is WinServerLocal . The contractor is not in LAB-Finance-Operators . Vault is up. Accounts View is empty for that user. Official first move: Policies → Safes → Members → Add Members . Restarting a connector will not add a member. This is change-control. Trap Granting Vault Admins to “just let them in” bypasses the factory. Safe membership is the ACL. Quote the Members tab, not the health widget. Field-by-field proof is on the evidence desk . ### Scenario 2 — Member listed, Connect missing The group is on the Safe. The account row is visible (List works). Connect does not launch. Official Connect requires Use account and List account . If they only have Retrieve, they can Show and still cannot broker. Edit the member: More options → Manage Permissions → check Use accounts . You can only assign permissions you have. ### Scenario 3 — Request Connection sits waiting Master Policy exception set Require dual control password access approval Active on WinServerLocal . Status is a waiting request. That is a people queue. Confirmers need Confirm requests (authorize account requests) and List to see request details. Official request death: timeframe passed, single-access already used, Safe request retention expired, Safe or password deleted, or confirmer settings changed. Changing confirmer settings makes all existing requests obsolete — delete and re-create. Do not silently set the Master Policy rule back to Inactive to close a P2. ### Scenario 4 — Connect failed, Last Verified is recent User cannot RDP through PSM. Overview shows Last Verified a few hours ago, Compliance = Compliant. Recording is missing because the session never started. Official next move is the broker: PSM connection component, target NLA, HTML5 popup blocker, in-network RDP file vs Remote Connection toggle — not Change. Change after a healthy verify desynchronizes a working secret and manufactures a reconcile ticket. Trap “Works in native mstsc, fails in Connect” is almost always platform connector / logon account / NLA — not a bad Vault password. PSM for SSH has the same shape: wrong @ / # syntax, extra @ in the username, or a logon-account account on a flow that officially does not support one. ### Scenario 5 — Last Verified failed, two truths Official: if the password on the target is no longer synchronized with Privilege Cloud, users cannot access the target when connecting through the Portal. First click is still Verify if you are not sure. Then Reconcile on Compliance Status. Reconcile replaces the unsynchronized password in the Vault and on the remote device with a new platform-generated password. It uses the linked reconcile account (Associate on the account, or the platform-level names). If Change already wrote the Vault and the target plugin failed, do not Change again — Reconcile is the designed recovery. Isolate vs change-control Chasing an approver is isolate (people). Adding a confirmer group or flipping Master Policy is change-control. Clicking Reconcile without a linked reconcile account is how official IgnoreReconcileOnMissingAccount skips and disables. Read the platform before you enable auto-reconcile. ### Scenario 6 — Exclusive, one-time, and the dual-control clock Official automatic Change is not only “every X days.” Exclusive check-in/check-out changes on Release (or after MinValidityPeriod if they forget). One-time access changes after use. An approved dual-control timeframe can trigger Change when the window ends ( PasswordLevelRequestTimeframe , overrides MinValidityPeriod , not for group platforms). You can enforce that timeframe on the live PSM session: Administration → Configuration Options → Privileged Session Management → General Settings → Session Settings → EnforceDualControlTimeframeOnPSMConnections = Yes . The session dies at timeframe end or MaxSessionDuration , whichever is sooner. That is the factory shutting the ticket on purpose — not a PSM crash. ## 7. Traps + Accounts View proof Symptom Looks like Actually First move Vault widget green, Accounts View empty Outage / connector Not a Safe member, or no List Policies → Safes → Members Row visible, Connect missing Need Retrieve / Show Missing Use accounts Manage Permissions → Use + List Request Connection waiting Vault hung Dual control people queue Confirm requests on the confirmer group Connect fail, Last Verified recent Bad password — Change it PSM / NLA / HTML5 / RDP file Do not Change. Fix the broker. Works in mstsc, fails in Connect App-ID of PAM is broken Platform connection component / logon account WinServerLocal + PSM-RDP association Verify failed, Change already clicked Click Change again Two truths Reconcile with a linked reconcile account Reconcile retries, account disabled CPM is down No reconcile account Associate ReconcileAccount* before auto-reconcile Monitoring menu missing Permission bug No session yet, or SIA-only (no PSM connector) Official: menu hides until a recording exists; PSM required Recording = none after fail Recorder Safe full Session never started Same as Connect-fail row — not a rotate PSMP auth loop / extra @ Proxy is down Syntax: one @ in username max; @ and # separators Official User@targetuser#domain@target@proxy Existing requests all died Vault replication Confirmer settings changed Official: delete and re-create requests Direct-manager dual control never completes LDAP broken Combined with multi-level or >1 confirmer Official: those combinations never confirm Proof checklist — Finance-Windows actually prints sessions Policies → Safes → Finance-Windows → Members lists LAB-Finance-Operators with List + Use. Confirmers listed separately with Confirm requests.

- Account is in that Safe, platform WinServerLocal , Allow automatic password management On, Safe Assign to CPM is set.

- Pilot sees the row in Accounts View. Connect is the designed button (or Show, if you granted Retrieve on purpose).

- If dual control is Active: Request List shows an approved request, not a forever-waiting one.

- Overview Last Verified is recent. Compliance is not silently failed. Reconcile account is linked if you rely on auto-reconcile.

- Monitoring has a recording (or an Active Session you can Monitor) for that user and target. Default recording Safe after first PSM session is PSMRecordings .

- The same operator can complete the same Connect you used as the test. Night-shift field names: evidence desk .

   Interview close you can steal

   CyberArk is a privileged-session factory. The Vault stores the secret. The Safe is the ACL. Use accounts launches Connect through PSM without showing the password; Retrieve accounts is Show and Copy. PSM or PSM for SSH brokers and records. CPM verifies the two copies, and only reconciles when they drifted. I prove it on Members, Overview Last Verified, and Monitoring — not on a green Vault widget. I do not Change after a PSM fail when Last Verified is ok.

 Related:  The evidence desk — first tool + proof field  ·  PSM & PSMP deep dive  ·  PAM foundations  ·  CyberArk hub

## Knowledge check

   Six judgment questions. Map each miss back to the section named in the reason.

       Q1
       Vault widget is green. A new contractor cannot see  Finance-Windows  in Accounts View. What do you check first?

           Reboot the Privilege Cloud connector and rotate finance_admin
           Policies → Safes → Finance-Windows → Members (and List accounts)
           Disable Allow automatic password management so CPM stops interfering
           Set Require dual control password access approval to Inactive

       Correct:  b . A healthy Vault still denies a missing Safe member. That is change-control, not an outage. Re-read Why Vault up is not a session and Scenario 1.

       Q2
       Official difference between Use accounts and Retrieve accounts?

           Use launches Connect through PSM without viewing the password; Retrieve is Show / Copy on Accounts View
           They are the same Access permission — CyberArk renamed the checkbox
           Use is only for CPM Change; Retrieve is only for Monitoring playback
           Retrieve is required for Connect; Use only applies to PSM for SSH

       Correct:  a . Official Connect needs Use + List, not Retrieve. Granting Retrieve “so PSM works” leaks standing passwords. Re-read Mental model and How to choose.

       Q3
       Portal Connect fails. Overview shows Last Verified a few hours ago and Compliance = Compliant. Next action?

           Immediate Change so the user can retry with a fresh secret
           Rebuild the Primary Vault — recordings would exist if the factory were healthy
           Fix the PSM broker (connector, NLA, HTML5 / RDP file); do not Change a verified secret
           Add the user to Vault Admins and Access Safe without confirmation

       Correct:  c . Last Verified recent means the two copies match. A missing recording means the session never started. Change here manufactures drift. Re-read Scenario 4 and Side C.

       Q4
       The user is a Safe member with Use + List. The button is Request Connection and the request sits waiting. What is this?

           A Vault outage — fail over and ignore Master Policy
           A dual-control people queue: confirmers need Confirm requests (authorize account requests)
           A CPM plugin crash — click Reconcile
           AllowedSafes on the platform blocking the account row

       Correct:  b . Official dual control: request → authorized Safe owner confirms → user Connects. Do not silently set the Master Policy rule Inactive. Re-read Scenario 3 and Side B step 3.

       Q5
       Last Verified failed. The Vault secret and the target password have drifted. Designed recovery?

           Click Change again so CPM overwrites the target with the current Vault value
           Reconcile, using a linked reconcile account (Associate or platform ReconcileAccountSafe / Folder / Name)
           Delete the account and onboard it without an initial password
           Turn off Allow automatic password management and paste a password into AD

       Correct:  b . Official Reconcile generates a new password into both the Vault and the target via the reconcile account. Change-again on two truths makes it worse. Re-read How to choose and Scenario 5.

       Q6
       What proves Finance-Windows actually printed a working privileged session?

           The Vault health widget is green and replication is ok
           Allow automatic password management is checked on the account
           Pilot is a member with Use, Connect started, Last Verified is recent, and Monitoring has a recording for that user and target
           The operator was added to Auditors so the Monitoring menu appears

       Correct:  c . Members + Use + Connect + Last Verified + a recording is the finished ticket. A green widget is station 1. Auditors is who can watch, not proof the session formed. Re-read Side C and the proof checklist.

       Check answers
       Reset

## Sources

- Create and manage Safes for access control — Policies → Safes → Create Safe; Assign to CPM; name ≤ 28 characters

- Manage Safe members — Members tab, Add Members wizard, 64-member cap

- Assign Safe member permissions — List / Use / Retrieve, Confirm requests, Initiate CPM operations

- Add individual accounts manually — Accounts View → Add account; platform; Safe; Allow automatic password management

- Connect to a target device — Use + List required

- Connect from the Privilege Cloud Portal — Connect / Request Connection; RDP file; HTML5 Remote Connection

- Retrieve (display) the account password — Show → reason → Copy

- Manage and reconcile account passwords — Last Verified, Verify, Reconcile, Change

- Configure automatic account management — change / verify / reconcile parameters, AllowedSafes, logon accounts

- Monitor sessions — Monitoring menu, Play Video, Active Sessions, PSM connector required

- Set up dual control for connecting to a target device — Master Policy exception, confirmer permission, request lifecycle

- Connect to Unix machines (using PSM for SSH) — official command syntax

 Related:  CyberArk evidence desk  ·  PSM & PSMP session management  ·  PAM foundations  ·  Privilege Cloud implementation  ·  CyberArk practice hub

---
Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees.
Browse all lessons: https://ai.techclick.in/blogs
AI index: https://ai.techclick.in/llms.txt