CyberArk Defender - PAM Questions and Answers
What is the purpose of the HeadStartlnterval setting m a platform?
Where can a user with the appropriate permissions generate a report? (Choose two.)
The System safe allows access to the Vault configuration files.
Which combination of Safe member permissions will allow end users to log in to a remote machine transparently but NOT show or copy the password?
Where can reconcile and/or logon accounts be linked to an account? (Choose two.)
What is the chief benefit of PSM?
What is the purpose of a linked account?
When a DR Vault Server becomes an active vault, it will automatically revert back to DR mode once the Primary Vault comes back online.
The primary purpose of exclusive accounts is to ensure non-repudiation (Individual accountability).
Within the Vault each password is encrypted by:
A Reconcile Account can be specified in the Master Policy.
Which values are acceptable in the address field of an Account?
When Dual Control is enabled a user must first submit a request in the Password Vault Web Access (PVWA) and receive approval before being able to launch a secure connection via PSM for Windows (previously known as RDP Proxy).
For Digital Vault Cluster in a high availability configuration, how does the cluster determine if a node is down?
Which type of automatic remediation can be performed by the PTA in case of a suspected credential theft security event?
Which report provides a list of account stored in the vault.
The vault supports Role Based Access Control.
When are external vault users and groups synchronized by default?
You are configuring CyberArk to use HTML5 gateways exclusively for PSM connections.
In the PVWA, where do you set DefaultConnectionMethod to HTML5?
Which command generates a full backup of the Vault?
Match the log file name with the CyberArk Component that generates the log.
To use PSM connections while in the PVWA, what are the minimum safe permissions a user or group will need?
What is the easiest way to duplicate an existing platform?
Which dependent accounts does the CPM support out-of-the-box? (Choose three.)
What is the primary purpose of One Time Passwords?
Match each automatic remediation to the correct PTA security event.
Which parameters can be used to harden the Credential Files (CredFiles) while using CreateCredFile Utility? (Choose three.)
In a default CyberArk installation, which group must a user be a member of to view the “reports” page in PVWA?
Which command configures email alerts within PTA if settings need to be changed post install?
As long as you are a member of the Vault Admins group, you can grant any permission on any safe that you have access to.
A password compliance audit found:
1) One-time password access of 20 domain accounts that are members of Domain Admins group in Active Directory are not being enforced.
2) All the sessions of connecting to domain controllers are not being recorded by CyberArk PSM.
What should you do to address these findings?
In the Private Ark client under the Tools menu > Administrative Tools > Users and Groups, which option do you use to update users’ Vault group memberships?
If the AccountUploader Utility is used to create accounts with SSH keys, which parameter do you use to set the full or relative path of the SSH private key file that will be attached to the account?
For an account attached to a platform that requires Dual Control based on a Master Policy exception, how would you configure a group of users to access a password without approval.
When the CPM connects to a database, which interface is most commonly used?
Which permissions are needed for the Active Directory user required by the Windows Discovery process?
What do you need on the Vault to support LDAP over SSL?
You need to enable the PSM for all platforms.
Where do you perform this task?
Which Master Policy Setting must be active in order to have an account checked-out by one user for a pre-determined amount of time?
CyberArk recommends implementing object level access control on all Safes.
Which of the following Privileged Session Management (PSM) solutions support live monitoring of active sessions?
In your organization the “click to connect” button is not active by default.
How can this feature be activated?
Which item is an option for PSM recording customization?
In PVWA, you are attempting to play a recording made of a session by user jsmith, but there is no option to “Fast Forward” within the video. It plays and only allows you to skip between commands instead. You are also unable to download the video.
What could be the cause?
Due to corporate storage constraints, you have been asked to disable session monitoring and recording for 500 testing accounts used for your lab environment.
How do you accomplish this?
You created a new safe and need to ensure the user group cannot see the password, but can connect through the PSM.
Which safe permissions must you grant to the group? (Choose two.)
All of your Unix root passwords are stored in the safe UnixRoot. Dual control is enabled for some of the accounts in that safe. The members of the AD group UnixAdmins need to be able to use the show, copy, and connect buttons on those passwords at any time without confirmation. The members of the AD group Operations Staff need to be able to use the show, copy and connect buttons on those passwords on an emergency basis, but only with the approval of a member of Operations Managers never need to be able to use the show, copy or connect buttons themselves.
Which safe permission do you need to grant Operations Staff? Check all that apply.
VAULT authorizations may be granted to_____.
Which service should NOT be running on the DR Vault when the primary Production Vault is up?
Which utilities could you use to change debugging levels on the vault without having to restart the vault. Select all that apply.
Which methods can you use to add a user directly to the Vault Admin Group? (Choose three.)
A user is receiving the error message “ITATS006E Station is suspended for User jsmith” when attempting to sign into the Password Vault Web Access (PVWA). Which utility would a Vault administrator use to correct this problem?
You want to give a newly-created group rights to review security events under the Security pane. You also want to be able to update the status of these events.
Where must you update the group to allow this?
A recently-hired colleague onboarded five new Local Accounts that are used for five standalone Windows Servers. After attempting to connect to the servers from PVWA, the colleague noticed that the "Connect" button was greyed out for all five new accounts.
What can you do to help your colleague resolve this issue? (Choose two.)
To change the safe where recordings are kept for a specific platform, which setting must you update in the platform configuration?
Your organization requires all passwords be rotated every 90 days.
Where can you set this regulatory requirement?
Which option in the Private Ark client is used to update users’ Vault group memberships?
tsparm.ini is the main configuration file for the Vault.
Which Vault authorization does a user need to have assigned to able to generate the "Entitlement Report" from the reports page in PVWA? (Choose two.)
Before failing back to the production infrastructure after a DR exercise, what must you do to maintain audit history during the DR event?
You created a new platform by duplicating the out-of-box Linux through the SSH platform.
Without any change, which Text Recorder Type(s) will the new platform support? (Choose two.)
The Vault administrator can change the Vault license by uploading the new license to the system Safe.
A user with administrative privileges to the vault can only grant other users privileges that he himself has.
Match each key to its recommended storage location.
A new HTML5 Gateway has been deployed in your organization.
From the PVWA, arrange the steps to configure a PSM host to use the HTML5 Gateway in the correct sequence.
To manage automated onboarding rules, a CyberArk user must be a member of which group?
You are creating a Dual Control workflow for a team’s safe.
Which safe permissions must you grant to the Approvers group?
Which file must be edited on the Vault to configure it to send data to PTA?
Target account platforms can be restricted to accounts that are stored m specific Safes using the Allowed Safes property.
If a password is changed manually on a server, bypassing the CPM, how would you configure the account so that the CPM could resume management automatically?
Which change could CyberArk make to the REST API that could cause existing scripts to fail?
Which parameter controls how often the CPM looks for Soon-to-be-expired Passwords that need to be changed.
