What authentication methods can be implemented to enforce Two-Factor Authentication (2FA) for users authenticating to CyberArk using both the PVWA…

To enforce Two-Factor Authentication (2FA) across both the Password Vault Web Access (PVWA) and the PrivateArk Client, RADIUS must be utilized. The PrivateArk Client natively supports CyberArk, LDAP, RADIUS, and PKI authentication, but it does not support SAML (which is strictly web-based). Because LDAP and CyberArk authentication are single-factor by default, RADIUS is the required method to enforce 2FA for both interfaces simultaneously.

B: CyberArk authentication is a local, single-factor method and does not natively enforce 2FA.

C: SAML is not supported by the PrivateArk Client, and CyberArk authentication is single-factor.

D: SAML is strictly web-based and unsupported by the PrivateArk Client, making it impossible to use for both interfaces.

1. CyberArk Privileged Access Manager Administration Guide, "Authentication Methods" and "PrivateArk Client Authentication" sections.

2. CyberArk Official Documentation, "Configure RADIUS Authentication" (Version 12.x/13.x).