Labour Day Special Limited Time 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: netbudy65

PAM-DEF CyberArk Defender - PAM Questions and Answers

Questions 4

A Vault Administrator team member can log in to CyberArk, but for some reason, is not given Vault Admin rights.

Where can you check to verify that the Vault Admins directory mapping points to the correct AD group?

Options:

A.

PVWA > User Provisioning > LDAP Integration > Mapping Criteria

B.

PVWA > User Provisioning > LDAP Integration > Map Name

C.

PVWA > Administration > LDAP Integration > Mappings

D.

PVWA > Administration > LDAP Integration > AD Groups

Buy Now
Questions 5

Which values are acceptable in the address field of an Account?

Options:

A.

It must be a Fully Qualified Domain Name (FQDN)

B.

It must be an IP address

C.

It must be NetBIOS name

D.

Any name that is resolvable on the Central Policy Manager (CPM) server is acceptable

Buy Now
Questions 6

It is possible to restrict the time of day, or day of week that a [b]verify[/b] process can occur

Options:

A.

TRUE

B.

FALSE

Buy Now
Questions 7

The Accounts Feed contains:

Options:

A.

Accounts that were discovered by CyberArk in the last 30 days

B.

Accounts that were discovered by CyberArk that have not yet been onboarded

C.

All accounts added to the vault in the last 30 days

D.

All users added to CyberArk in the last 30 days

Buy Now
Questions 8

In addition to add accounts and update account contents, which additional permission on the safe is required to add a single account?

Options:

A.

Upload Accounts Properties

B.

Rename Accounts

C.

Update Account Properties

D.

Manage Safe

Buy Now
Questions 9

Match each key to its recommended storage location.

Options:

Buy Now
Questions 10

Which authorizations are required in a recording safe to allow a group to view recordings?

Options:

Buy Now
Questions 11

In the Private Ark client, how do you add an LDAP group to a CyberArk group?

Options:

A.

Select Update on the CyberArk group, and then click Add > LDAP Group

B.

Select Update on the LDAP Group, and then click Add > LDAP Group

C.

Select Member Of on the CyberArk group, and then click Add > LDAP Group

D.

Select Member Of on the LDAP group, and then click Add > LDAP Group

Buy Now
Questions 12

You notice an authentication failure entry for the DR user in the ITALog.

What is the correct process to fix this error? (Choose two.)

Options:

A.

PrivateArk Client > Tools > Administrative Tools > Users and Groups > DR User > Update > Authentication > Update Password.

B.

Create a new credential file, on the DR Vault, using the CreateCredFile utility and the newly set password.

С. Create a new credential file, on the Primary Vault, using the CreateCredFile utility and the newly set password.

C.

PVWA > User Provisioning > Users and Groups > DR User > Update Password.

D.

PrivateArk Client > Tools > Administrative Tools > Users and Groups > PAReplicate User > Update > Authentication > Update Password.

Buy Now
Questions 13

Which command configures email alerts within PTA if settings need to be changed post install?

Options:

A.

/opt/tomcat/utility/emailConfiguration.sh

B.

/opt/PTA/emailConfiguration.sh

C.

/opt/PTA/utility/emailConfig.sh

D.

/opt/tomcat/utility/emailSetup.sh

Buy Now
Questions 14

If PTA is integrated with a supported SIEM solution, which detection becomes available?

Options:

A.

unmanaged privileged account

B.

privileged access to the Vault during irregular days

C.

riskySPN

D.

exposed credentials

Buy Now
Questions 15

Which report provides a list of account stored in the vault.

Options:

A.

Privileged Accounts Inventory

B.

Privileged Accounts Compliance Status

C.

Entitlement Report

D.

Active Log

Buy Now
Questions 16

Target account platforms can be restricted to accounts that are stored m specific Safes using the Allowed Safes property.

Options:

A.

TRUE

B.

FALSE

Buy Now
Questions 17

Where can a user with the appropriate permissions generate a report? (Choose two.)

Options:

A.

PVWA > Reports

B.

PrivateArk Client

C.

Cluster Vault Manager

D.

PrivateArk Server Monitor

E.

PARClient

Buy Now
Questions 18

What is the easiest way to duplicate an existing platform?

Options:

A.

From PrivateArk, copy/paste the appropriate Policy.ini file; then rename it.

B.

From the PVWA, navigate to the platforms page, select an existing platform that is similar to the new target account platform and then click Duplicate; name the new platform.

C.

From PrivateArk, copy/paste the appropriate settings in PVConfiguration.xml; then update the policyName variable.

D.

From the PVWA, navigate to the platforms page, select an existing platform that is similar to the new target account platform, manually update the platform settings and click “Save as” INSTEAD of save to duplicate and rename the platform.

Buy Now
Questions 19

Which of these accounts onboarding methods is considered proactive?

Options:

A.

Accounts Discovery

B.

Detecting accounts with PTA

C.

A Rest API integration with account provisioning software

D.

A DNA scan

Buy Now
Questions 20

A user needs to view recorded sessions through the PVWA.

Without giving auditor access, which safes does a user need access to view PSM recordings? (Choose two.)

Options:

A.

Recordings safe

B.

Safe the account is in

C.

System safe

D.

PVWAConfiguration safe

E.

VaultInternal safe

Buy Now
Questions 21

Which keys are required to be present in order to start the PrivateArk Server service?

Options:

A.

Recovery public key

B.

Recovery private key

C.

Server key

D.

Safe key

Buy Now
Questions 22

Which master policy settings ensure non-repudiation?

Options:

A.

Require password verification every X days and enforce one-time password access.

B.

Enforce check-in/check-out exclusive access and enforce one-time password access.

C.

Allow EPV transparent connections ('Click to connect') and enforce check-in/check-out exclusive access.

D.

Allow EPV transparent connections ('Click to connect') and enforce one-time password access.

Buy Now
Questions 23

Users are unable to launch Web Type Connection components from the PSM server. Your manager asked you to open the case with CyberArk Support.

Which logs will help the CyberArk Support Team debug the issue? (Choose three.)

Options:

A.

PSMConsole.log

B.

PSMDebug.log

C.

PSMTrace.log

D.

.Component.log

E.

PMconsole.log

F.

ITAlog.log

Buy Now
Questions 24

In the screenshot displayed, you just configured the usage in CyberArk and want to update its password.

What is the least intrusive way to accomplish this?

Options:

A.

Use the “change” button on the usage’s details page.

B.

Use the “change” button on the parent account’s details page.

C.

Use the “sync” button on the usage’s details page.

D.

Use the “reconcile” button on the parent account’s details page.

Buy Now
Questions 25

What are the mandatory fields when onboarding from Pending Accounts? (Choose two.)

Options:

A.

Address

B.

Safe

C.

Account Description

D.

Platform

E.

CPM

Buy Now
Questions 26

To change the safe where recordings are kept for a specific platform, which setting must you update in the platform configuration?

Options:

A.

SessionRecorderSafe Most Voted

B.

SessionSafe

C.

RecordingsPath

D.

RecordingLocation

Buy Now
Questions 27

In a rule using “Privileged Session Analysis and Response” in PTA, which session options are available to configure as responses to activities?

Options:

A.

Suspend, Terminate, None

B.

Suspend, Terminate, Lock Account

C.

Pause, Terminate, None

D.

Suspend, Terminate

Buy Now
Questions 28

Via Password Vault Web Access (PVWA), a user initiates a PSM connection to the target Linux machine using RemoteApp. When the client’s machine makes an RDP connection to the PSM server, which user will be utilized?

Options:

A.

Credentials stored in the Vault for the target machine

B.

Shadowuser

C.

PSMConnect

D.

PSMAdminConnect

Buy Now
Questions 29

Before failing back to the production infrastructure after a DR exercise, what must you do to maintain audit history during the DR event?

Options:

A.

Ensure that the Production Instance replicates changes that occurred from the Disaster Recovery Instance.

B.

Briefly stop and start the Disaster Recovery Instance before attempting to fail components back to the Production Instance.

C.

Stop the CPM services before starting the production server.

D.

Perform an IIS Reset on all PVWA servers.

Buy Now
Questions 30

A new domain controller has been added to your domain. You need to ensure the CyberArk infrastructure can use the new domain controller for authentication.

Which locations must you update?

Options:

A.

on the Vault server in Windows\System32\Etc\Hosts and in the PVWA Application under Administration > LDAP Integration > Directories > Hosts

B.

on the Vault server in Windows\System32\Etc\Hosts and on the PVWA server in Windows\System32\Etc\Hosts

C.

in the Private Ark client under Tools > Administrative Tools > Directory Mapping

D.

on the Vault server in the certificate store and on the PVWA server in the certificate store

Buy Now
Questions 31

CyberArk implements license limits by controlling the number and types of users that can be provisioned in the vault.

Options:

A.

TRUE

B.

FALSE

Buy Now
Questions 32

Your organization has a requirement to allow users to “check out passwords” and connect to targets with the same account through the PSM.

What needs to be configured in the Master policy to ensure this will happen?

Options:

A.

Enforce check-in/check-out exclusive access = active; Require privileged session monitoring and isolation = active

B.

Enforce check-in/check-out exclusive access = inactive; Require privileged session monitoring and isolation = inactive

C.

Enforce check-in/check-out exclusive access = inactive; Record and save session activity = active

D.

Enforce check-in/check-out exclusive access = active; Record and save session activity = inactive

Buy Now
Questions 33

Which of the following files must be created or configured m order to run Password Upload Utility? Select all that apply.

Options:

A.

PACli.ini

B.

Vault.ini

C.

conf.ini

D.

A comma delimited upload file

Buy Now
Questions 34

Which of the following Privileged Session Management solutions provide a detailed audit log of session activities?

Options:

A.

PSM (i.e., launching connections by clicking on the "Connect" button in the PVWA)

B.

PSM for Windows (previously known as RDP Proxy)

C.

PSM for SSH (previously known as PSM SSH Proxy)

D.

All of the above

Buy Now
Questions 35

Which service should NOT be running on the DR Vault when the primary Production Vault is up?

Options:

A.

PrivateArk Database

B.

PrivateArk Server

C.

CyberArk Vault Disaster Recovery (DR) service

D.

CyberArk Logical Container

Buy Now
Questions 36

If a user is a member of more than one group that has authorizations on a safe, by default that user is granted________.

Options:

A.

the vault will not allow this situation to occur.

B.

only those permissions that exist on the group added to the safe first.

C.

only those permissions that exist in all groups to which the user belongs.

D.

the cumulative permissions of all groups to which that user belongs.

Buy Now
Questions 37

Match the Status of Service on a DR Vault to what is displayed when it is operating normally in Replication mode.

Options:

Buy Now
Questions 38

When a DR Vault Server becomes an active vault, it will automatically revert back to DR mode once the Primary Vault comes back online.

Options:

A.

True; this is the default behavior

B.

False, the Vault administrator must manually set the DR Vault to DR mode by setting “FailoverMode=no” in the padr.ini file

C.

True, if the AllowFailback setting is set to “yes” in the padr.ini file

D.

False, the Vault administrator must manually set the DR Vault to DR mode by setting “FailoverMode=no” in the dbparm.ini file

Buy Now
Questions 39

A new colleague created a directory mapping between the Active Directory groups and the Vault.

Where can the newly Configured directory mapping be tested?

Options:

A.

Connect to the Active Directory and ensure the organizational unit exists.

B.

Connect to Sailpoint (or similar tool) to ensure the organizational unit is correctly named; log in to the PVWA with "Administrator" and confirm authentication succeeds.

C.

Search for members that exist only in the mapping group to grant them safe permissions through the PVWA.

D.

Connect to the PrivateArk Client with the Administrator Account to see if there is a user in the Vault Admin Group.

Buy Now
Questions 40

Match the built-in Vault User with the correct definition.

Options:

Buy Now
Questions 41

Time of day or day of week restrictions on when password verifications can occur configured in ____________________.

Options:

A.

The Master Policy

B.

The Platform settings

C.

The Safe settings

D.

The Account Details

Buy Now
Questions 42

You want to build a connector that connects to a website through the Web applications for PSM framework.

Which default connector do you duplicate and modify?

Options:

A.

PSM-ChromeSample

B.

PSM-WebForm

C.

PSM-WebApp

D.

PSM-WebAppSample

Buy Now
Questions 43

What is the chief benefit of PSM?

Options:

A.

Privileged session isolation

B.

Automatic password management

C.

Privileged session recording

D.

‘Privileged session isolation’ and ‘Privileged session recording’

Buy Now
Questions 44

Assuming a safe has been configured to be accessible during certain hours of the day, a Vault Admin may still access that safe outside of those hours.

Options:

A.

TRUE

B.

FALSE

Buy Now
Questions 45

You created a new safe and need to ensure the user group cannot see the password, but can connect through the PSM.

Which safe permissions must you grant to the group? (Choose two.)

Options:

A.

List Accounts Most Voted

B.

Use Accounts Most Voted

C.

Access Safe without Confirmation

D.

Retrieve Files

E.

Confirm Request

Buy Now
Questions 46

Which PTA sensors are required to detect suspected credential theft?

Options:

A.

Logs, Vault Logs

B.

Logs, Network Sensor, Vault Logs

C.

Logs, PSM Logs, CPM Logs

D.

Logs, Network Sensor, EPM

Buy Now
Questions 47

Which usage can be added as a service account platform?

Options:

A.

Kerberos Tokens

B.

IIS Application Pools

C.

PowerShell Libraries

D.

Loosely Connected Devices

Buy Now
Questions 48

What does the Export Vault Data (EVD) utility do?

Options:

A.

exports data from the Vault to TXT or CSV files, or to MSSQL databases

B.

generates a backup file that can be used as a cold backup

C.

exports all passwords and imports them into another instance of CyberArk

D.

keeps two active vaults in sync

Buy Now
Questions 49

Due to corporate storage constraints, you have been asked to disable session monitoring and recording for 500 testing accounts used for your lab environment.

How do you accomplish this?

Options:

A.

Master Policy>select Session Management>add Exceptions to the platform(s)>disable Session Monitoring and Recording policies

B.

Administration>Platform Management>select the platform(s)>disable Session Monitoring and Recording Most Voted

C.

Polices>Access Control (Safes)>select the safe(s)>disable Session Monitoring and Recording policies

D.

Administration>Configuration Options>Options>select Privilege Session Management>disable Session Monitoring and Recording policies

Buy Now
Questions 50

When a DR Vault Server becomes an active vault, it will automatically fail back to the original state once the Primary Vault comes back online.

Options:

A.

True; this is the default behavior

B.

False; this is not possible

C.

True, if the AllowFailback setting is set to “yes” in the padr.ini file

D.

True, if the AllowFailback setting is set to “yes” in the dbparm.ini file

Buy Now
Questions 51

What is the maximum number of levels of authorization you can set up in Dual Control?

Options:

A.

1

B.

2

C.

3

D.

4

Buy Now
Questions 52

ADR Vault became active due to a failure of the primary Vault. Service on the primary Vault has now been restored. Arrange the steps to return the DR vault to its normal standby mode in the correct sequence.

Options:

Buy Now
Questions 53

A Simple Mail Transfer Protocol (SMTP) integration is critical for monitoring Vault activity and facilitating workflow processes, such as Dual Control.

Options:

A.

True

B.

False

Buy Now
Questions 54

SAFE Authorizations may be granted to____________.

Select all that apply.

Options:

A.

Vault Users

B.

Vault Group

C.

LDAP Users

D.

LDAP Groups

Buy Now
Questions 55

Which of the Following can be configured in the Master Poky? Choose all that apply.

Options:

A.

Dual Control

B.

One Time Passwords

C.

Exclusive Passwords

D.

Password Reconciliation

E.

Ticketing Integration

F.

Required Properties

G.

Custom Connection Components

Buy Now
Questions 56

A new HTML5 Gateway has been deployed in your organization.

From the PVWA, arrange the steps to configure a PSM host to use the HTML5 Gateway in the correct sequence.

Options:

Buy Now
Questions 57

Which Cyber Are components or products can be used to discover Windows Services or Scheduled Tasks that use privileged accounts? Select all that apply.

Options:

A.

Discovery and Audit (DMA)

B.

Auto Detection (AD)

C.

Export Vault Data (EVD)

D.

On Demand Privileges Manager (OPM)

E.

Accounts Discovery

Buy Now
Questions 58

What is required to enable access over SSH to a Unix account through both PSM and PSMP?

Options:

A.

The platform must contain connection components for PSM-SSH and PSMP-SSH.

B.

PSM and PSMP must already have stored the SSH Fingerprint for the Unix host.

C.

The 'Enable PSMP' setting in the Unix platform must be set to Yes.

D.

A duplicate platform (Called) with the PSMP settings must be created.

Buy Now
Questions 59

Which methods can you use to add a user directly to the Vault Admin Group? (Choose three.)

Options:

A.

REST API

B.

PrivateArk Client

C.

PACLI

D.

PVWA

E.

Active Directory

F.

Sailpoint

Buy Now
Questions 60

Which of the following properties are mandatory when adding accounts from a file? (Choose three.)

Options:

A.

Safe Name

B.

Platform ID

C.

All required properties specified in the Platform

D.

Username

E.

Address

F.

Hostname

Buy Now
Questions 61

What is the primary purpose of One Time Passwords?

Options:

A.

Reduced risk of credential theft

B.

More frequent password changes

C.

Non-repudiation (individual accountability)

D.

To force a 'collusion to commit' fraud ensuring no single actor may use a password without authorization.

Buy Now
Questions 62

Which built-in report from the reports page in PVWA displays the number of days until a password is due to expire?

Options:

A.

Privileged Accounts Inventory

B.

Privileged Accounts Compliance Status

C.

Activity Log

D.

Privileged Accounts CPM Status

Buy Now
Questions 63

A Reconcile Account can be specified in the Master Policy.

Options:

A.

TRUE

B.

FALSE

Buy Now
Questions 64

According to the DEFAULT Web Options settings, which group grants access to the REPORTS page?

Options:

A.

PVWAUsers

B.

Vault Admins

C.

Auditors

D.

PVWAMonitor

Buy Now
Questions 65

Which type of automatic remediation can be performed by the PTA in case of a suspected credential theft security event?

Options:

A.

Password change

B.

Password reconciliation

C.

Session suspension

D.

Session termination

Buy Now
Questions 66

Which statement is correct concerning accounts that are discovered, but cannot be added to the Vault by an automated onboarding rule?

Options:

A.

They are added to the Pending Accounts list and can be reviewed and manually uploaded.

B.

They cannot be onboarded to the Password Vault.

C.

They must be uploaded using third party tools.

D.

They are not part of the Discovery Process.

Buy Now
Questions 67

One can create exceptions to the Master Policy based on ____________________.

Options:

A.

Safes

B.

Platforms

C.

Policies

D.

Accounts

Buy Now
Questions 68

Which certificate type do you need to configure the vault for LDAP over SSL?

Options:

A.

the CA Certificate that signed the certificate used by the External Directory

B.

a CA signed Certificate for the Vault server

C.

a CA signed Certificate for the PVWA server

D.

a self-signed Certificate for the Vault

Buy Now
Questions 69

What is the purpose of the PrivateArk Server service?

Options:

A.

Executes password changes

B.

Maintains Vault metadata

C.

Makes Vault data accessible to components

D.

Sends email alerts from the Vault

Buy Now
Questions 70

When an account is unable to change its own password, how can you ensure that password reset with the reconcile account is performed each time instead of a change?

Options:

A.

Set the parameter RCAllowManualReconciliation to Yes.

B.

Set the parameter ChangePasswordinResetMade to Yes.

C.

Set the parameter IgnoreReconcileOnMissingAccount to No.

D.

Set the UnlockUserOnReconcile to Yes.

Buy Now
Questions 71

Due to network activity, ACME Corp’s PrivateArk Server became active on the OR Vault while the Primary Vault was also running normally. All the components continued to point to the Primary Vault.

Which steps should you perform to restore DR replication to normal?

Options:

A.

Replicate data from DR Vault to Primary Vault > Shutdown PrivateArk Server on DR Vault > Start replication on DR vault

B.

Shutdown PrivateArk Server on DR Vault > Start replication on DR vault

C.

Shutdown PrivateArk Server on Primary Vault > Replicate data from DR Vault to Primary Vault > Shutdown PrivateArk Server on DR Vault > Start replication on DR vault

D.

Shutdown PrivateArk Server on DR Vault > Replicate data from DR Vault to Primary Vault > Shutdown PrivateArk Server on DR Vault > Start replication on DR vault

Buy Now
Questions 72

You created a new platform by duplicating the out-of-box Linux through the SSH platform.

Without any change, which Text Recorder Type(s) will the new platform support? (Choose two.)

Options:

A.

SSH Text Recorder

B.

Universal Keystrokes Text Recorder

C.

Events Text Recorder

D.

SQL Text Recorder

E.

Telnet Commands Text Recorder

Buy Now
Exam Code: PAM-DEF
Exam Name: CyberArk Defender - PAM
Last Update: May 3, 2024
Questions: 239

PDF + Testing Engine

$130

Testing Engine

$95

PDF (Q&A)

$80