CyberArk EPM-DEF Online Practice Questions and Exam Preparation

CyberArk EPM-DEF Online Questions & Answers

• Question 1:

  What is a valid step to investigate an EPM agent that is unable to connect to the EPM server?

  A. On the end point, open a browser session to the URL of the EPM server.
  B. Ping the endpoint from the EPM server.
  C. Ping the server from the endpoint.
  D. Restart the end point
  C. Ping the server from the endpoint.

• Question 2:

  An EPM Administrator is looking to enable the Threat Deception feature, under what section should the EPM Administrator go to enable this feature?

  A. Threat Protection Inbox
  B. Policies
  C. Threat Intelligence
  D. Policy Audit
  B. Policies

• Question 3:

  An end user is experiencing performance issues on their device after the EPM Agent had been installed on their machine. What should the EPM Administrator do first to help resolve the issue?

  A. Verify any 3rd party security solutions have been added to EPM's Files To Be Ignored Always configuration and CyberArk EPM has also been excluded from the 3rd party security solutions.
  B. Enable the Default Policy's Privilege Management Control, Unhandled Privileged Applications in Elevate mode.
  C. Rerun the agent installation on the user's machine to repair the installation.
  D. Uninstall or disable any anti-virus software prohibiting the EPM Agent functionalities.
  D. Uninstall or disable any anti-virus software prohibiting the EPM Agent functionalities.

• Question 4:

  Where would an EPM admin configure an application policy that depends on a script returning true for an end user's machine being connected to an open (no password protection) Wi-Fi?

  A. Advanced Policy - Application Control - Check Wi-Fi security
  B. Advanced Policy - Options: Conditional enforcement - Apply Policy according to Script execution result
  C. Default policies - Check if network access is secure
  D. Advanced Policy - Access - Specify permissions to be set for Wi-Fi network security
  B. Advanced Policy - Options: Conditional enforcement - Apply Policy according to Script execution result

• Question 5:

  What is the CyberArk recommended practice when deploying the EPM agent to non- persistent VDIs?

  A. A separate set
  B. a VDI advanced policy
  C. a separate license
  D. A separate computer group
  D. A separate computer group

• Question 6:

  Which threat intelligence source requires the suspect file to be sent externally?

  A. NSRL
  B. Palo Alto Wildfire
  C. VirusTotal
  D. CyberArk Application Risk Analysis Service (ARA)
  C. VirusTotal

• Question 7:

  For Advanced Policies, what can the target operating system users be set to?

  A. Local or AD users and groups, Azure AD User, Azure AD Group
  B. AD Groups, Azure AD Groups
  C. Local or AD users and groups
  D. Local or AD users, Azure AD Users
  C. Local or AD users and groups

• Question 8:

  Which EPM reporting tool provides a comprehensive view of threat detection activity?

  A. Threat Detection Dashboard
  B. Detected Threats
  C. Threat Detection Events
  D. McAfee ePO Reports
  A. Threat Detection Dashboard

  ---

  explanation:

  Explanation/Reference:

• Question 9:

  Select the default threat intelligence source that requires additional licensing.

  A. VirusTotal
  B. Palo Alto WildFire
  C. CyberArk Application Risk Analysis Service
  D. NSRL
  B. Palo Alto WildFire

• Question 10:

  A particular user in company ABC requires the ability to run any application with administrative privileges every day that they log in to their systems for a total duration of 5 working days.

  What is the correct solution that an EPM admin can implement?

  A. An EPM admin can generate a JIT access and elevation policy with temporary access timeframe set to 120 hours
  B. An EPM admin can generate a JIT access and elevation policy with temporary access timeframe set to 120 hours and Terminate administrative processes when the policy expires option unchecked
  C. An EPM admin can create an authorization token for each application needed by running: EPMOPAGtool.exe -command gentoken -targetUser -filehash -timeLimit 120 -action run
  D. An EPM admin can create a secure token for the end user's computer and instruct the end user to open an administrative command prompt and run the command vfagent.exe - UseToken
  B. An EPM admin can generate a JIT access and elevation policy with temporary access timeframe set to 120 hours and Terminate administrative processes when the policy expires option unchecked