Your organization wants to limit access to the CyberArk Identity user portal to only corporate issued domain-joined laptops without the use of a VPN. How can you achieve this?

Question

Options

• AUse the Windows Device Trust agent with certificate-based authentication.
• BUse the Windows Cloud Agent and CyberArk Identity Connector with Integrated Windows Authentication
• CDefine a range of internal corporate IP addresses and use them to restrict access.
• DUse the CyberArk Conjur integration.

• A
  79% (37)
• B
  2% (1)
• C
  6% (3)
• D
  13% (6)

Explanation

Option A is correct because the Windows Device Trust agent verifies that a device is domain-joined by validating a machine certificate issued by your corporate CA - no VPN required, since the check happens at the identity layer before portal access is granted.

Why the distractors are wrong:

• B - Integrated Windows Authentication (IWA/Kerberos) requires the device to be on the corporate network or connected via VPN to reach a domain controller; it doesn't work for off-network, internet-only access.
• C - IP range restrictions only work while the user is on the corporate network or VPN; they explicitly contradict the "without VPN" requirement and can't verify device ownership.
• D - CyberArk Conjur is a secrets management platform for machine identities and credentials in DevOps pipelines - it has no role in controlling end-user portal access.

Memory tip: Think "Device Trust = certificate on the machine proves identity" - the key phrase in the question is domain-joined + no VPN, which points directly to a client certificate approach that works over the internet, which is exactly what the Device Trust agent provides.

No community discussion yet for this question.