CyberArk SECRET-SEN Exam Questions & Answers

Correct Answer: A

According to the CyberArk Sentry Secrets Manager documentation, Conjur is a secrets management solution that consists of a leader node and one or more follower nodes. The leader node is responsible for managing the secrets, policies,

and audit records, while the follower nodes are read-only replicas that can serve secrets requests from applications. Additionally, Conjur supports a standby node, which is a special type of follower node that can be promoted to a leader node

in case of a leader failure. A standby node is synchronized with the leader node and can take over its role in a disaster recovery scenario. A possible Conjur node role change is when a standby node is promoted to a leader node, either

manually or automatically, using the auto-failover feature. A follower node cannot be promoted to a leader node, as it does not have the same data and functionality as the leader node. A standby node cannot be promoted to a follower node,

as it already has the same capabilities as a follower node, plus the ability to become a leader node. A leader node cannot be demoted to a standby node in the event of a failover, as it would lose its data and functionality and would not be able

to resume its role as a leader node.

References:

1: Conjur Architecture

2: Deploying Conjur on AWS

3: Auto-failover

Correct Answer: C

C. docker exec evoke ca import --no-restart

This is the correct command to import the root CA certificate into Conjur. The evoke ca import command is used to import a certificate authority (CA) certificate into the Conjur appliance. The certificate can be either a root CA or an

intermediate CA. The --no-restart option prevents the Conjur appliance from restarting after importing the certificate. The parameter specifies the path and name of the root CA certificate file to be imported. This command will

add the root CA certificate to the trusted CA store of the Conjur appliance, which is used to validate the certificates of the clients and servers that communicate with Conjur. This command is documented in the Conjur documentation and the

Conjur training course.

The other options are not correct commands to import the root CA certificate into Conjur. The evoke import command does not exist.

The --root option is not a valid option for the evoke ca import command. The ca import command is not a valid docker exec command.

Correct Answer:

The appropriate Secrets Manager solution for each scenario is as follows: token based retrieval of secrets, such as OIDC or JWT: Conjur workloads requiring the fastest secrets delivery performance possible: ASCP agentless workload authentication that relies on OS User: CCP These solutions are described in the Secrets Management Tools page of the CyberArk website