CyberArk CyberArk Certifications EPM-DEF Questions & Answers

• Question 21:

  Before enabling Ransomware Protection, what should the EPM Administrator do first?

  A. Enable the Privilege Management Inbox in Elevate mode.

  B. Enable the Control Applications Downloaded From The Internet feature in Restrict mode.

  C. Review the Authorized Applications (Ransomware Protection) group and update if necessary.

  D. Enable Threat Protection and Threat Intelligence modules.

  Correct Answer: C

• Question 22:

  An application has been identified by the LSASS Credentials Harvesting Module.

  What is the recommended approach to excluding the application?

  A. In Agent Configurations, add the application to the Threat Protection Exclusions

  B. Add the application to the Files to be Ignored Always in Agent Configurations.

  C. Exclude the application within the LSASS Credentials Harvesting module.

  D. Add the application to an Advanced Policy or Application Group with an Elevate policy action.

  Correct Answer: A

• Question 23:

  CyberArk EPM's Ransomware Protection comes with file types to be protected out of the box. If an EPM Administrator would like to remove a file type from Ransomware Protection, where can this be done?

  A. Policy Scope within Protect Against Ransomware

  B. Authorized Applications (Ransomware Protection) within Application Groups

  C. Set Security Permissions within Advanced Policies

  D. Protected Files within Agent Configurations

  Correct Answer: D

• Question 24:

  What are the predefined application groups?

  A. Developer group, Administrator group

  B. Run as Administrator, Run as Developer, Block

  C. Elevate, Allow, Block, Developer Applications

  D. Block Only

  Correct Answer: C

• Question 25:

  An EPM Administrator would like to enable a Threat Protection policy, however, the policy protects an application that is not installed on all endpoints.

  What should the EPM Administrator do?

  A. Enable the Threat Protection policy and configure the Policy Targets.

  B. Do not enable the Threat Protection policy.

  C. Enable the Threat Protection policy only in Detect mode.

  D. Split up the endpoints in to separate Sets and enable Threat Protection for only one of the Sets.

  Correct Answer: D

• Question 26:

  Which of the following application options can be used when defining trusted sources?

  A. Publisher, Product, Size, URL

  B. Publisher, Name, Size, URI

  C. Product, URL, Machine, Package

  D. Product, Publisher, User/Group, Installation Package

  Correct Answer: D

• Question 27:

  An EPM Administrator would like to include a particular file extension to be monitored and protected under Ransomware Protection. What setting should the EPM Administrator configure to add the extension?

  A. Authorized Applications (Ransomware Protection)

  B. Files to be Ignored Always

  C. Anti-tampering Protection

  D. Default Policies

  Correct Answer: A

  Reference: https://docs.cyberark.com/Product-Doc/OnlineHelp/EPM/Latest/en/Content/EPM/Server%20User%20Guide/PrivMgmnt- Ransomware-NewUI.htm

• Question 28:

  What are the policy targeting options available for a policy upon creation?

  A. AD Users and Groups, Computers in AD Security Groups, Servers

  B. Computers in this set, Computers in AD Security Groups, Users and Groups

  C. OS Computers, EPM Sets, AD Users

  D. EPM Sets, Computers in AD Security Groups, AD Users and AD Security Groups

  Correct Answer: D

• Question 29:

  Which of the following is CyberArk's Recommended FIRST roll out strategy?

  A. Implement Application Control

  B. Implement Privilege Management

  C. Implement Threat Detection

  D. Implement Ransomware Protection

  Correct Answer: B

  Reference: https://hkrtrainings.com/what-is-cyberark

• Question 30:

  How does CyberArk EPM's Ransomware Protection feature monitor for Ransomware Attacks?

  A. It compares known ransomware signatures retrieved from virus databases.

  B. It sandboxes the suspected ransomware and applies heuristics.

  C. It monitors for any unauthorized access to specified files.

  D. It performs a lookup of file signatures against VirusTotal's database.

  Correct Answer: B