API / Venafi Interview questions
What is the difference between CyberArk SSH Manager for Machines and manual SSH key rotation?
Manual SSH key rotation and SSH Manager for Machines aim at the same outcome — keys that don't sit static and unmanaged forever — but differ enormously in how they scale and what they actually catch.
| Manual rotation | SSH Manager for Machines |
| Relies on someone remembering which keys exist | Discovers keys via automated scanning, including unknown/orphaned ones |
| Rotation happens ad hoc, often only after an audit finding | Rotation runs on a defined, enforced schedule |
| No systematic view of trust relationships between hosts | Maps which key on which host can access which other hosts |
| Error-prone at scale (hundreds+ of servers) | Consistent regardless of fleet size |
The practical gap shows up at scale: manual rotation might work fine for a handful of servers a small team fully understands, but it reliably breaks down once an environment grows past what any one person can hold in their head — which is exactly the point at which orphaned and duplicate keys start accumulating unnoticed.
What can SSH Manager for Machines catch that manual rotation typically misses?
At what point does manual key rotation typically become unreliable?
More Related questions...
