CyberArk CyberArk Certifications PAM-CDE-RECERT Questions & Answers

• Question 141:

  You are creating a new Rest API user that utilizes CyberArk Authentication. What is a correct process to provision this user?

  A. Private Ark Client > Tools > Administrative Tools > Users and Groups > New > User

  B. Private Ark Client > Tools > Administrative Tools > Directory Mapping > Add

  C. PVWA > User Provisioning > LDAP Integration > Add Mapping

  D. PVWA > User Provisioning > Users and Groups > New > User

  Correct Answer: A

• Question 142:

  A Vault Administrator team member can log in to CyberArk, but for some reason, is not given Vault Admin rights. Where can you check to verify that the Vault Admins directory mapping points to the correct AD group?

  A. PVWA > User Provisioning > LDAP Integration > Mapping Criteria

  B. PVWA > User Provisioning > LDAP Integration > Map Name

  C. PVWA > Administration > LDAP Integration > Mappings

  D. PVWA > Administration > LDAP Integration > AD Groups

  Correct Answer: A

• Question 143:

  Your customer, ACME Corp, wants to store the Safes Data in Drive D instead of Drive C.

  Which file should you edit?

  A. TSparm.ini

  B. Vault.ini

  C. DBparm.ini

  D. user.ini

  Correct Answer: A

  Reference: https://cyberark-customers.force.com/s/article/00004103

• Question 144:

  What is the purpose of the password change process?

  A. To test that CyberArk is storing accurate credentials for accounts

  B. To change the password of an account according to organizationally defined password rules

  C. To allow CyberArk to manage unknown or lost credentials

  D. To generate a new complex password

  Correct Answer: B

• Question 145:

  What is mandatory for a PVWA installation?

  A. A DNS entry for PVWA url must be created.

  B. A company signed TLS certificate must be imported into the server

  C. A vault Administrator user must be used to register the PVWA

  D. Data Execution Prevention must be disabled.

  Correct Answer: C

• Question 146:

  In accordance with best practice, SSH access is denied for root accounts on UNIX/LINUX system. What is the BEST way to allow CPM to manage root accounts.

  A. Create a privileged account on the target server. Allow this account the ability to SSH directly from the CPM machine. Configure this account as the Reconcile account of the target server's root account.

  B. Create a non-privileged account on the target server. Allow this account the ability to SSH directly from the CPM machine. Configure this account as the Logon account of the target server's root account.

  C. Configure the Unix system to allow SSH logins.

  D. Configure the CPM to allow SSH logins.

  Correct Answer: B

• Question 147:

  As long as you are a member of the Vault Admins group you can grant any permission on any safe.

  A. TRUE

  B. FALSE

  Correct Answer: B

  Being in Vault admins group only give you access to safes which are created during installation (safe created in installation process )-This is clearly mentioned in documents .

• Question 148:

  For an account attached to a platform that requires Dual Control based on a Master Policy exception, how would you configure a group of users to access a password without approval.

  A. Create an exception to the Master Policy to exclude the group from the workflow process.

  B. Edith the master policy rule and modify the advanced' Access safe without approval' rule to include the group.

  C. On the safe in which the account is stored grant the group the' Access safe without audit' authorization.

  D. On the safe in which the account is stored grant the group the' Access safe without confirmation' authorization.

  Correct Answer: D

• Question 149:

  What is a prerequisite step before CyberArk can be configured to support RADIUS authentication?

  A. Log on to the PrivateArk Client, display the user properties of the user to configure, run the Authentication method drop-down list, and select RADIUS authentication.

  B. In the RADIUS server, define the CyberArk Vault as RADIUS client/agent.

  C. In the Vault Installation folder, run CAVaultManger as Administrator with the SecureSecretFiles command.

  D. Navigate to /Server/Conf and open DBParms.ini and set the RadiusServersInfo parameter.

  Correct Answer: B

• Question 150:

  Which values are acceptable in the address field of an Account?

  A. It must be a Fully Qualified Domain Name (FQDN)

  B. It must be an IP address

  C. It must be NetBIOS name

  D. Any name that is resolvable on the Central Policy Manager (CPM) server is acceptable

  Correct Answer: D