Free CAU302 Exam Dumps Preview

Question 1

Single choice

What is the primary purpose of One Time Passwords?

1. A

   Reduced risk of credential theft

2. B

   More frequent password changes

3. C

   Non-repudiation (individual accountability)

4. D

   To force a `collusion to commit' fraud ensuring no single actor may use a password without
   authorization

Reveal answer details Close answer details

Correct answerA

Question 2

Single choice

CyberArk implements license limits by controlling the number and types of users that can be provisioned in the vault.

1. A

   TRUE

2. B

   FALSE

Reveal answer details Close answer details

Correct answerA

Explanation

https://docs.cyberark.com/Product-Doc/OnlineHelp/PAS/Latest/en/Content/PASIMP/Managing-the-CyberArk-License.htm

Question 3

Single choice

It is possible to restrict the time of day. or day of week that a verify process can occur.

1. A

   TRUE

2. B

   FALSE

Reveal answer details Close answer details

Correct answerA

Question 4

Single choice

Can you forward audit records to your monitoring solution via SIEM integration?

1. A

   Yes

2. B

   No

Reveal answer details Close answer details

Correct answerA

Question 5

Single choice

When a DR vault server becomes an active vault, it will automatically fail bacK to the original state once the primary vault comes back online.

1. A

   True, this is the default behavior

2. B

   False, this is not possible

3. C

   True, if the 'AllowFailback' setting is set to yes in the PADR.ini file.

4. D

   True, if the 'AllowFailback' setting is set to yes in the dbparm ini file.

Reveal answer details Close answer details

Correct answerB

Explanation

There is no "Failback" parameter. When a failover happens, the ONLY way to fail back is a manual failback.

Question 6

Single choice

For the hardening process to complete successfully, security products like Antivirus should be installed on the Vault server before running the vault installer.

1. A

   TRUE

2. B

   FALSE

Reveal answer details Close answer details

Correct answerB

Explanation

No third party tools should be installed on the vault server.

Question 7

Single choice

An SMTP integration allows you to forward audit records from the vault to the SIEM.

1. A

   TRUE

2. B

   FALSE

Reveal answer details Close answer details

Correct answerB

Question 8

Single choice

Which of the following statements are NOT true when enabling PSM recording for a target Windows server? Choose all that apply

1. A

   The PSM software must be installed on the target server

2. B

   PSM must be enabled in the Master Policy {either directly, or through exception).

3. C

   PSMConnect must be added as a local user on the target server

4. D

   RDP must be enabled on the target server

Reveal answer details Close answer details

Correct answerC

Question 9

Single choice

In order to retrieve data from the vault a user MUST use an interface provided by CyberArk.

1. A

   TRUE

2. B

   FALSE

Reveal answer details Close answer details

Correct answerA

Question 10

Single choice

It is possible to leverage DNA to provide discovery functions that are not available with auto-detection.

1. A

   TRUE

2. B

   FALSE

Reveal answer details Close answer details

Correct answerA

Explanation

https://docs.cyberark.com/Product-Doc/OnlineHelp/PrivCloud/Latest/en/Content/Privilege%20Cloud/PrivCloud-Assess-network.htm#:~:text=CyberArk%20DNA%20is%20a%20discovery,privileged%20and%20non%2Dprivileged%20accounts.

Question 11

Single choice

What is the proper way to allow the Vault to resolve host names?

1. A

   Define a DNS server

2. B

   Define a WINS server

3. C

   Defining the local hosts file

4. D

   The Vault cannot resolve host names due to security standards

Reveal answer details Close answer details

Correct answerC

Question 12

Single choice

What is the maximum number of levels of authorizations you can set up in Dual Control?

1. A

   1

2. B

   2

3. C

   3

4. D

   4

Reveal answer details Close answer details

Correct answerB

Explanation

Require multi-level password access approval - This advanced setting enforces an access control workflow in which end users require two levels of authorization before they can access privileged accounts.

https://docs.cyberark.com/Product-Doc/OnlineHelp/PAS/Latest/en/Content/PASIMP/PVWA-Dual-Control.htm

Question 13

Single choice

When working with the CyberArk Cluster, the Virtual IP is used by:

1. A

   The CyberArk components to communicate with the Vault Cluster over the public network.

2. B

   The Vault nodes for exchanging keep alive messages over the public network.

3. C

   The CyberArk components to communicate with the Vault Cluster over the private network.

4. D

   The Vault nodes for exchanging keep alive messages over the public network.

Reveal answer details Close answer details

Correct answerA

Question 14

Single choice

SAFE Authorizations may be granted to___________________.

1. A

   Vault Users

2. B

   Vault Groups

3. C

   LDAP Users

4. D

   LDAP Groups

5. E

   All of above

Reveal answer details Close answer details

Correct answerE

Explanation

https://docs.cyberark.com/Product-Doc/OnlineHelp/PAS/Latest/en/Content/PASIMP/Safes-add-a-safe-member.htm

Question 15

Multiple choice

Which keys are required to be present in order to start the PrivateArk Server Service? Select all that apply.

1. A

   Server Key

2. B

   Recovery Public Key

3. C

   Recovery Private Key

4. D

   Safe Key

Reveal answer details Close answer details

Correct answersA, B

Explanation

References:
https://www.reddit.com/r/CyberARk/comments/8s96n8/certificat_problem_with_my_vault/

Question 16

Single choice

A Logon Account can be specified in the Master Policy

1. A

   TRUE

2. B

   FALSE

Reveal answer details Close answer details

Correct answerB

Explanation

Nowhere in the master policy can you choose a logon account to use. It wouldn't make sense even, as different logon accounts are used for different systems, and master policy applies to all platforms regardless to which system it is used.

All available master policy settings can be found here:
https://docs.cyberark.com/Product-Doc/OnlineHelp/PAS/Latest/en/Content/PASIMP/Working-with-Master-Policy-Rules.htm

Question 17

Single choice

It is impossible to override Master Policy settings for a Platform.

1. A

   TRUE

2. B

   FALSE

Reveal answer details Close answer details

Correct answerB

Question 18

Single choice

The PSM requires the Remote Desktop Web Access role service.

1. A

   True

2. B

   False

Reveal answer details Close answer details

Correct answerB

Explanation

The RDS that requires PSM is Remote Desktop Session Host.

Remote Desktop Gateway, Remote Desktop Web Access, and Remote Desktop Licensing are incorrect.

Question 19

Single choice

According to the default web options settings, which group grants access to the reports page?

1. A

   PVWAMonitor

2. B

   PVWAUsers

3. C

   Auditors

4. D

   Vault administrators

Reveal answer details Close answer details

Correct answerA

Explanation

References:
https://docs.cyberark.com/Product-Doc/OnlineHelp/PAS/Latest/en/Content/PASIMP/
ReportsInPVWA.htm

Question 20

Single choice

tsparm.ini is the main configuration file for the vault.

1. A

   TRUE

2. B

   FALSE

Reveal answer details Close answer details

Correct answerB

Question 21

Single choice

Which user is automatically given all Safe authorizations on all Safes?

1. A

   Administrator

2. B

   Master

3. C

   Auditor

4. D

   Operator

Reveal answer details Close answer details

Correct answerB

Question 22

Single choice

What is the purpose of the PrivateArk Server service?

1. A

   Executes password changes.

2. B

   Makes vault data accessible to components.

3. C

   Maintains vault metadata.

4. D

   Sends email alert from the Vault

Reveal answer details Close answer details

Correct answerB

Question 23

Single choice

Can ITALOG records be forwarded to the monitoring solution via Security Information and Event Management (SIEM) integration?

1. A

   Yes

2. B

   No

Reveal answer details Close answer details

Correct answerB

Question 24

Multiple choice

What are the functions of the Remote Control Agent service? (Choose all that apply.)

1. A

   Allows remote monitoring of the Vault

2. B

   Sends SNMP traps from the Vault

3. C

   Maintains audit data

4. D

   Allows CyberArk Services to be managed (start/stop/status) remotely

Reveal answer details Close answer details

Correct answersA, B, D

Question 25

Single choice

The Password upload utility can be used to create safes.

1. A

   TRUE

2. B

   FALSE

Reveal answer details Close answer details

Correct answerA

Explanation

https://docs.cyberark.com/Product-Doc/OnlineHelp/PAS/Latest/en/Content/PASIMP/Password-Upload-Utility.htm

Question 26

Single choice

What is the primary purpose of Exclusive Accounts?

1. A

   Reduced risk of credential theft

2. B

   More frequent password changes

3. C

   Non-repudiation (individual accountability)

4. D

   To force a `collusion to commit' fraud ensuring no single actor may use a password without
   authorization

Reveal answer details Close answer details

Correct answerC

Question 27

Single choice

A SIEM integration allows you to forward audit records to a monitoring solution.

1. A

   TRUE

2. B

   FALSE

Reveal answer details Close answer details

Correct answerB

Question 28

Single choice

In Accounts Discovery, you can configure a Windows discovery to scan______________.

1. A

   as many OUs as you wish

2. B

   up to three OUs.

3. C

   only one OU.

4. D

   a number of OUs determined by the OUstoScan setting under the Accounts Feed section in the Administration tab

Reveal answer details Close answer details

Correct answerC

Question 29

Single choice

Which file is used to configure the ENE service?

1. A

   ENE.ini

2. B

   ENEConfig.ini

3. C

   dbparm.ini

4. D

   paragent.ini

Reveal answer details Close answer details

Correct answerC

Question 30

Single choice

Which credentials does CyberArk use when managing a target account?

1. A

   Those of the service account for the CyberArk Password Manager
   service

2. B

   A Domain Administrator account created for this purpose

3. C

   The credentials of the target account

4. D

   An account assigned by the Master Policy

Reveal answer details Close answer details

Correct answerA

Question 31

Single choice

When working with the CyberArk Cluster, which service is considered Optional (i.e.
, failure of the service does not mandate a failover)?

1. A

   PrivateArk Server

2. B

   PrivateArk Database

3. C

   Event Notification Engine

4. D

   Logic Container

Reveal answer details Close answer details

Correct answerC

Question 32

Single choice

Which user(s) can access all passwords in the vault?

1. A

   Administrator

2. B

   Any member of Vault Admins

3. C

   Any member of Auditors

4. D

   Master

Reveal answer details Close answer details

Correct answerD

Question 33

Single choice

When managing SSH keys, the CPM stores the Public Key ________________.

1. A

   In the Vault

2. B

   On the target server

3. C

   A & B

4. D

   Nowhere because the public key can always be generated from the private key

Reveal answer details Close answer details

Correct answerB

Question 34

Single choice

In accordance with best practice. SSH access is denied for root accounts on UNIX/LINUX systems. What is the BEST way to allow CPM to manage root accounts.

1. A

   Create a privileged account on the target server Allow this account the ability to SSH directly from the CPM machine Configure this account as the Reconcile account of the target server's root account.

2. B

   Create a non-privileged account on the target server Allow this account the ability to SSH directly from the CPM machine. Configure this account as the Logon account of the target server's root account

3. C

   Configure the Unix system to allow SSH logins.

4. D

   Configure the CPM to allow SSH logins

Reveal answer details Close answer details

Correct answerB

Question 35

Single choice

To support a fault tolerant and high-availability architecture, the Password Vault Web Access (PVWA) servers need to be configured to communicate with the Primary Vault and Satellite Vaults.

What file needs to be changed on the PVWA to enable this setup?

1. A

   Vault.ini

2. B

   dbparm.ini

3. C

   pvwa.ini

4. D

   Satellite.ini

Reveal answer details Close answer details

Correct answerA

Question 36

Single choice

Users complain they are unsuccessful attempting to authenticate to the PVWA web site.
After entering their credentials, they receive a "Timeout has expired". You test the URL using multiple browsers and receive the same error. The CyberArk.WebApplication.log shows the "ITACM012S Timeout
has expired" log entry.

What is the next troubleshooting step you should take?

1. A

   Run an IISRESET on the PVWA server

2. B

   Check the CyberArk.WebConsole.log for errors

3. C

   Check network firewall rules to ensure the PVWA can communicate to the Vault over tcp_1858

4. D

   Check the health of the Vault Server and ensure all services are running

Reveal answer details Close answer details

Correct answerC