Exam PAM-SEN topic 1 question 62 discussion

LDAP & RADIUS The question is about enabling 2FA on PVWA and PrivateArk There's no SAML in PrivateArk Client And there's no "CyberArk" in PrivateArk Client either.

A https://docs.cyberark.com/pam-self-hosted/Latest/en/Content/PAS%20INST/Authenticating-to-the-Privileged-Account-Security-Solution.htm#Secondaryauthentication adding LDAP or RADIUS for a second factor

Authentication Methods in PrivateArk: - PrivateArk authentication -NT PrivateArk authentication - PKi - Radius - LDAP Thus no SAML or CyberArk Authentication Ans: A

I absolutely despise this question and deliberated on it for a really long time, as the combinations are really weird and it’s not really possible to enforce real 2FA for both the PVWA and the PAClient with any of them however the combination of SAML and RADIUS will allow real 2FA at the PVWA but will still prompt for username password and token at the PAClient although it’s technically just authenticating via the RADIUS server and not a separate LDAP query via the vault (I don’t think). I also can’t find any proper references to confirm this one way or the other. So if I had to guess I would suggest D. as being the closest to real 2FA for both PVWA and PAClient (I hope that's right). https://docs.cyberark.com/PAS/Latest/en/Content/PAS%20INST/Authenticating-to-the-Privileged-Account-Security-Solution.htm#:~:text=CyberArk%20support%20representative.-,Secondary%20authentication,-Secondary%20authentication%20strengthens

SAML & RADIUS There are two groups of authentications: Primary Auth Type - IIS (SFE and PVWA)-> Windows, Oracle SSO, PKI (Client Certificate) RSA, SAML Secondary Auth Type - Vault-> CyberArk, LDAP, Radius https://cyberark-customers.force.com/s/article/Two-Factor-Authentication-2FA-on-Web-component-Possible-Combination