CyberArk CyberArk Certifications PAM-DEF Questions & Answers

• Question 101:

  Which configuration file is used by the CPM scanner when scanning UNIX/Linux devices?

  A. UnixPrompts.ini

  B. plink.exe

  C. dbparm.ini

  D. UnixScanner.ini

  Correct Answer: A

• Question 102:

  Before failing back to the production infrastructure after a DR exercise, what must you do to maintain audit history during the DR event?

  A. Ensure that the Production Instance replicates changes that occurred from the Disaster Recovery Instance.

  B. Briefly stop and start the Disaster Recovery Instance before attempting to fail components back to the Production Instance.

  C. Stop the CPM services before starting the production server.

  D. Perform an IIS Reset on all PVWA servers.

  Correct Answer: A

• Question 103:

  When the CPM connects to a database, which interface is most commonly used?

  A. Kerberos

  B. ODBC

  C. VBScript

  D. Sybase

  Correct Answer: B

• Question 104:

  Which Vault authorization does a user need to have assigned to able to generate the "Entitlement Report" from the reports page in PVWA? (Choose two.)

  A. Manage Users

  B. Audit Users

  C. Read Activity

  D. View Entitlements

  E. List Accounts

  Correct Answer: DE

• Question 105:

  You are configuring CyberArk to use HTML5 gateways exclusively for PSM connections.

  In the PVWA, where do you set DefaultConnectionMethod to HTML5?

  A. Options > Privileged Session Management UI

  B. Options > Privileged Session Management

  C. Options > Privileged Session Management Defaults

  D. Options > Privileged Session Management Interface

  Correct Answer: A

• Question 106:

  Which statement is true about setting the reconcile account at the platform level?

  A. This is the only way to enable automatic reconciliation of account passwords.

  B. CPM performance will be improved when the reconcile account is set at the platform level.

  C. A rule can be used to specify the reconcile account dynamically or a specific reconcile account can be selected.

  D. This configuration prevents the association from becoming broken if the reconcile account is moved to a different safe.

  Correct Answer: C

• Question 107:

  A recently-hired colleague onboarded five new Local Accounts that are used for five standalone Windows Servers. After attempting to connect to the servers from PVWA, the colleague noticed that the "Connect" button was greyed out for all five new accounts.

  What can you do to help your colleague resolve this issue? (Choose two.)

  A. Verify that the address field is populated with an IP or FQDN of each server.

  B. Verify that the correct PSM connection component appears within account platform settings.

  C. Verify that the address field is blank and that the correct PSM connection component appears within account platform settings.

  D. Notify the Windows Team that created the new accounts that the CyberArk PAM solution is not designed to manage local accounts on Windows Servers.

  E. Verify that the "Disable automatic management for this account" setting for each account is not enabled.

  Correct Answer: AB

• Question 108:

  Which tools can you use to identify the machines and accounts that create the highest risk and are exposed to lateral movement? (Choose two.)

  A. Accounts Discovery Feed

  B. CyberArk DNA Report

  C. REST API Scripts

  D. CyberArk DNA Map

  E. Get-LocalUser Powershell cmdlet

  Correct Answer: BD

• Question 109:

  Which statement about the Master Policy best describes the differences between one-time password and exclusive access functionality?

  A. Exclusive access means that only a specific group of users may use the account. After an account on a one-time password platform is used, the account is deleted from the safe automatically.

  B. Exclusive access locks the account indefinitely. One-time password can be used replace invalid account passwords.

  C. Exclusive access is enabled by default in the Master Policy. One-time password should only be enabled for emergencies.

  D. Exclusive access allows only one person to check-out an account at a time. One-time password schedules an account for a password change after the MinValidityPeriod period expires.

  Correct Answer: D

• Question 110:

  A company has multiple business units that have their own set of vendors. Each business unit has a distinct role to manage vendor access. The business units want to have full control over the invitation process for their set of vendors.

  After inviting the user to the Remote Access portal, which permissions should be delegated?

  A. Administrator

  B. User

  C. Vendor Manager

  D. Viewer

  Correct Answer: C