Explanation
* A. Store the CD in a physical safe and mount the CD every time Vault maintenance is performed.
This option ensures that the CD is kept in a secure location when not in use, and that the keys are available when needed. This is the default option suggested by CyberArk1.
* B. Copy the entire contents of the CD to the system Safe on the Vault. This option allows the Vault to access the keys from the system Safe, which is a special Safe that stores the Vault configuration files and keys. The system Safe is encrypted and protected by the Vault, and can only be accessed by authorized users2.
* D. Store the server key in a Hardware Security Module (HSM) and copy the rest the keys from the CD to a folder on the Vault Server and secure it with NTFS permissions. This option provides an additional layer of security for the server key, which is the most critical key for the Vault. An HSM is a physical device that stores and manages cryptographic keys in a tamper-resistant and isolated environment. The Vault can integrate with an HSM to store and retrieve the server key3. The rest of the keys can be stored in a folder on the Vault Server and secured with NTFS permissions, which restrict access to authorized users and groups.
The following option is not secure and should be avoided:
* C. Copy the entire contents of the CD to a folder on the Vault Server and secure it with NTFS permissions. This option exposes the keys to potential risks, such as unauthorized access, data corruption, or deletion. NTFS permissions are not sufficient to protect the keys from malicious or accidental actions. Moreover, this option does not comply with the CyberArk best practices, which recommend to store the keys on a removable media or an HSM

Explanation
According to the web search results, when a DR Vault Server becomes an active vault, it will not automatically revert back to DR mode once the Primary Vault comes back online. The Vault administrator must manually set the DR Vault to DR mode by setting "FailoverMode=no" in the padr.ini file1. This file is located in the /opt/CARKaim/conf directory on the DR Vault machine2. The Vault administrator must also stop the replication process on the DR Vault and restart the PrivateArk Server service1. This procedure is known as a DR failback, which restores the original roles of the Primary Vault and the DR Vault after a failover1. The AllowFailback setting in the padr.ini file does not affect the DR failback process, as it only determines whether the DR Vault can be used as a backup for another DR Vault in a cascading DR scenario3.
The dbparm.ini file is not relevant for the DR failback process, as it contains the database parameters for the Vault server. References:
* Initiate a DR failback to the Production Vault - CyberArk
* Install the Disaster Recovery application - CyberArk
* Cascading DR - CyberArk
* [dbparm.ini file - CyberArk]

Explanation
To update the Vault level audit permissions for all auditors, you would use the Private Ark Client.
Specifically, you would navigate to the Tools menu, select Administrative Tools, then Users and Groups.
Within the Users and Groups section, you would select the Auditors group and go to the Authorizations tab.
Here, you can manage and update the permissions for the Auditor group, including the Audit Users Vault permission. This ensures that all members of the Auditors group have the necessary permissions to perform their audit functions within the Vault1.
References:
* CyberArk's official documentation on predefined users and groups, which includes information on the Auditor user and the permissions associated with this role1.
* Information on the administrative tools available in the Private Ark Client, which are used for managing users and groups, including auditors2.