Which Vault authorization does a user need to have assigned to able to generate the "Entitlement Report" from the reports page in PVWA? (Choose two.)

Generating the "Entitlement Report" in PVWA requires two distinct Vault-level authorizations. First, to access the main "Reports" page, a user needs the View Audit authorization. Second, to specifically generate the "Entitlement Report" from that page, the user requires the Audit Users authorization.

Option (B) Audit Users is explicitly required per official documentation.

Option (D) View Entitlements, while not an official authorization name, serves as the most logical proxy for the required View Audit permission, which is not listed as an option. The report's purpose is to view entitlements, making this the best-fitting choice for the prerequisite viewing permission.

A. Manage Users: This is an excessive administrative authorization and is not the minimum permission required to generate audit reports.

C. Read Activity: This is not a standard, documented Vault-level authorization within the CyberArk PAM solution.

E. List Accounts: This is a Safe-level permission that allows viewing accounts within a specific Safe, not a Vault-level authorization for generating cross-Safe entitlement reports.

1. CyberArk Privileged Access Manager - Self-Hosted Documentation (v13.2)

"Generate reports in the PVWA".

Section: Reports page: "To view the Reports page

users require the View Audit user authorization in the Vault."

Section: Entitlements report: "Required authorizations: Audit users"

This documentation confirms the two required permissions are 'View Audit' and 'Audit Users'

supporting the selection of (B) and the interpretation of (D) as a proxy for 'View Audit'.

2. CyberArk Privileged Access Manager - Self-Hosted Documentation (v13.2)

"User and Group Authorizations".

Section: Vault authorizations: This section provides a comprehensive list of all standard Vault-level authorizations. The list includes 'Audit Users' and 'View Audit' but does not include 'View Entitlements' or 'Read Activity'

confirming they are not official authorization names. This supports the reasoning for excluding option (C).