Which components can connect to a satellite Vault in a distributed Vault architecture?

In a CyberArk Distributed Vaults architecture, Satellite Vaults are primarily designed to provide high availability and load balancing for credential retrieval and session management. Therefore, the Password Vault Web Access (PVWA) and Privileged Session Manager (PSM) can connect directly to Satellite Vaults to service user requests. The Central Policy Manager (CPM) requires read/write access to the database to manage and rotate credentials, so it must connect directly to the Primary Vault, not a Satellite Vault.

A. CPM requires read/write access and must connect to the Primary Vault. EPM and PTA do not connect to Satellite Vaults for standard PAM operations.

C. CPM cannot connect to a Satellite Vault because it requires read/write access to the Vault database to perform password changes.

D. CPM cannot connect to a Satellite Vault; it must connect to the Primary Vault for credential management tasks.

1. CyberArk Official Documentation: PAM Self-Hosted -> Architecture -> Distributed Vaults -> Components connecting to Distributed Vaults.

2. CyberArk Official Documentation: PAM Self-Hosted -> Installation -> Installing Distributed Vaults -> Distributed Vaults Architecture.