CyberArk CyberArk Certifications EPM-DEF Questions & Answers

• Question 41:

  When deploying Ransomware Protection, what tasks should be considered before enabling this functionality? (Choose two.)

  A. Add trusted software to the Authorized Applications (Ransomware protection) Application Group

  B. Add trusted software to the Allow Application Group

  C. Add additional files, folders, and/or file extensions to be included to Ransomware Protection

  D. Enable Detect privileged unhandled applications under Default Policies

  Correct Answer: AC

• Question 42:

  For the CyberArk EPM Threat Deception Credential Lure feature, what is the recommendation regarding the username creation?

  A. The username should match to an existing account.

  B. The username should have a strong password associated.

  C. The username should not match to an existing account.

  D. The username should match the built-in local Administrator.

  Correct Answer: C

• Question 43:

  An EPM Administrator would like to notify end users whenever the Elevate policy is granting users elevation for their applications. Where should the EPM Administrator go to enable the end-user dialog?

  A. End-user UI in the left panel of the console

  B. Advanced, Agent Configurations

  C. Default Policies

  D. End-User UI within the policy

  Correct Answer: D

• Question 44:

  Can the EPM Set Administrator configure Audit Dialog Pop-ups for the Record Audit Video option?

  A. Yes, when Audit Video recording started, when Audit Video recording stopped, and when Audit Recording video reached size limit.

  B. Yes, when Audit Video recording started, when not enough disk space to start the video recording, and when video recording is initializing.

  C. Yes, when Audit Video recording started, when Audit Video recording is uploaded to the EPM server, and when audit recording cannot be initialized.

  D. No, Audit Video is only available without the possibility of having End-User dialog pop- ups.

  Correct Answer: D

• Question 45:

  How does a Trusted Source policy affect an application?

  A. Applications will be allowed to run and will only elevate if required.

  B. Applications will be allowed to run and will inherit the process token from the EPM agent.

  C. Applications will be allowed to run always in elevated mode.

  D. Application from the defined trusted sources must be configured on a per application basis, in order to define run and elevation parameters.

  Correct Answer: D

• Question 46:

  When working with credential rotation at the EPM level, what is the minimum time period that can be set between connections?

  A. 1 hour

  B. 5 hours

  C. 24 hours

  D. 72 hours

  Correct Answer: D

• Question 47:

  What is required to configure SAML authentication on EPM?

  A. OAuth token

  B. Signed Authentication Request

  C. Encrypted Assertion

  D. Signed SAML Response

  Correct Answer: D

• Question 48:

  When blocking applications, what is the recommended practice regarding the end-user UI?

  A. Show a block prompt for blocked applications.

  B. Show no prompts for blocked applications.

  C. Hide the CyberArk EPM Agent icon in the system tray.

  D. Enable the Default Deny policy.

  Correct Answer: A

• Question 49:

  A particular user in company ABC requires the ability to run any application with administrative privileges every day that they log in to their systems for a total duration of 5 working days.

  What is the correct solution that an EPM admin can implement?

  A. An EPM admin can generate a JIT access and elevation policy with temporary access timeframe set to 120 hours

  B. An EPM admin can generate a JIT access and elevation policy with temporary access timeframe set to 120 hours and Terminate administrative processes when the policy expires option unchecked

  C. An EPM admin can create an authorization token for each application needed by running: EPMOPAGtool.exe -command gentoken -targetUser -filehash -timeLimit 120 -action run

  D. An EPM admin can create a secure token for the end user's computer and instruct the end user to open an administrative command prompt and run the command vfagent.exe - UseToken

  Correct Answer: B

• Question 50:

  Select the default threat intelligence source that requires additional licensing.

  A. VirusTotal

  B. Palo Alto WildFire

  C. CyberArk Application Risk Analysis Service

  D. NSRL

  Correct Answer: B