Explanation
SAFE Authorizations may be granted to Vault Users, Vault Groups, LDAP Users, and LDAP Groups. These are the four types of users that can be defined in the Vault and assigned permissions to access Safes and manage passwords. Vault Users and Vault Groups are created and managed within the Vault, while LDAP Users and LDAP Groups are imported from an external directory service such as Active Directory.
References:
* Defender PAM Course, Module 4: Managing Safes, Lesson 4.2: Safe Authorizations, slide 4
* Defender PAM Sample Items Study Guide, Question 39, page 15
* CyberArk Privileged Access Security Documentation, Vault Administration Guide, Chapter 4:
Managing Safes, Section: Safe Authorizations, page 4-12

Explanation
To change debugging levels on the vault without having to restart the vault, you can use the following utilities:
* PAR Agent: This is a utility that runs on the vault server and allows you to change the debug level of the vault by editing the PARAgent.ini file. You can set the EnableTrace parameter to yes and specify the debug level in the DebugLevel parameter. The changes will take effect immediately without restarting the vault. The log file is located in the PARAgent.log file1.
* PrivateArk Server Central Administration: This is a graphical user interface that runs on the vault server and allows you to change the debug level of the vault by selecting the vault server and clicking the Debug button. You can choose the debug level from a list of predefined options or enter a custom value. The changes will take effect immediately without restarting the vault. The log files are located in the Trace.dX files, where X is a number from 0 to 42.
You cannot use the following utilities to change debugging levels on the vault without having to restart the vault:
* Edit DBParm.ini in a text editor: This is a configuration file that stores the vault parameters, such as the database name, port, and password. Editing this file does not affect the debug level of the vault, and requires restarting the vault for the changes to take effect3.
* Setup.exe: This is an installation program that runs on the vault server and allows you to install, upgrade, or uninstall the vault. It does not allow you to change the debug level of the vault, and requires restarting the vault for any changes to take effect4. References:
* 1: Configure Debug Levels, Vault section, PARAgent subsection
* 2: Configure Debug Levels, Vault section, PrivateArk Server Central Administration subsection
* 3: CyberArk Privileged Access Security Implementation Guide, Chapter 2: Installing the Vault, Section:
Configuring the Vault, Subsection: DBParm.ini
* 4: CyberArk Privileged Access Security Implementation Guide, Chapter 2: Installing the Vault, Section:
Installing the Vault

Explanation
The Master Policy in CyberArk defines the behavior of one-time passwords and exclusive accessExclusive access ensures that only one user can check out an account at any given time, effectively locking the account during its use to prevent simultaneous access1. On the other hand, one-time password functionality is designed to change the account's password after it is used, based on a timer set by the MinValidityPeriod parameter in the policy file. This means that once the password is checked out and the timer expires, the Central Policy Manager (CPM) will change the password2. These settings are often used together to maintain accountability and security for the usage of shared privileged accounts. References:
* CyberArk Docs: One-time passwords and exclusive accounts1
* CyberArk Knowledge Article: CPM: What is the difference between "One Time" and "Exclusive" passwords?2

Explanation
A Logon Account cannot be specified in the Master Policy. The Master Policy is a set of rules that define the security and compliance policy of privileged accounts in the organization, such as access workflows, password management, session monitoring, and auditing1. The Master Policy does not include any technical settings that determine how the system manages accounts on various platforms1. A Logon Account is a technical setting that defines the account that the CPM uses to log on to a target system and perform password management tasks, such as changing, verifying, or reconciling passwords2. A Logon Account can be specified in the Platform Management settings, which are configured by the IT administrator for each platform2. The Platform Management settings are independent of the Master Policy and can be customized according to the organization's environment and security policies1. References:
* The Master Policy
* [Platform Management]