CyberArk Updated CPC-CDE-RECERT Exam Questions and Answers by jonas

https://docs.cyberark.com/pam-self-hosted/latest/en/content/pas%20inst/install_psm_harden.htm#HardenInDomaindeployments

The correct description of the authentication differences between CyberArk Privilege Cloud and CyberArk PAM Self-Hosted is that CyberArk Privilege Cloud uses cloud-based methods, integrating with CyberArk Identity for Multi-Factor Authentication (MFA), and supports SAML and OIDC, while CyberArk PAM Self-Hosted relies on on-premises methods such as RADIUS and LDAP, but can adopt SAML or OIDC with additional setups. CyberArk Privilege Cloud is designed to leverage modern cloud-based authentication protocols to enhance security and ease of use, particularly in distributed and diverse IT environments. In contrast, CyberArk PAM Self-Hosted offers flexibility to use traditional on-premises authentication methods but also supports modern protocols if configured to do so.

CyberArk explicitly states that you must move PSM application users (PSMConnect/PSMAdminConnect) to domain users on Windows 2019/2022 when:

you are using RDS CAL per-user licensing, and

you want to extend PSM sessions beyond one hour.

PSM relies on Microsoft Remote Desktop Services capabilities on Windows, and CyberArk documentation/knowledge articles call out RDS CAL considerations for PSM deployments (including guidance on CAL type implications, especially with Windows Server 2019 licensing enforcement behavior).