CyberArk PAM-DEF Online Practice Questions and Exam Preparation

CyberArk PAM-DEF Online Questions & Answers

• Question 171:

  As long as you are a member of the Vault Admins group, you can grant any permission on any safe that you have access to.

  A. TRUE
  B. FALSE
  B. FALSE

  ---

  Explanation/Reference:

  Being in Vault admins group only give you access to safes which are created during installation (safe created in installation process ) -This is clearly mentioned in documents.

• Question 172:

  Due to corporate storage constraints, you have been asked to disable session monitoring and recording for 500 testing accounts used for your lab environment. How do you accomplish this?

  A. Master Policy>select Session Management>add Exceptions to the platform(s)>disable Session Monitoring and Recording policies
  B. Administration>Platform Management>select the platform(s)>disable Session Monitoring and Recording
  C. Polices>Access Control (Safes)>select the safe(s)>disable Session Monitoring and Recording policies
  D. Administration>Configuration Options>Options>select Privilege Session Management>disable Session Monitoring and Recording policies
  A. Master Policy>select Session Management>add Exceptions to the platform(s)>disable Session Monitoring and Recording policies

• Question 173:

  What is the primary purpose of One Time Passwords?

  A. Reduced risk of credential theft
  B. More frequent password changes
  C. Non-repudiation (individual accountability)
  D. To force a 'collusion to commit' fraud ensuring no single actor may use a password without authorization.
  A. Reduced risk of credential theft

• Question 174:

  Which of the following PTA detections are included in the Core PAS offering?

  A. Suspected Credential Theft
  B. Over-Pass-The Hash
  C. Golden Ticket
  D. Unmanaged Privileged Access
  D. Unmanaged Privileged Access

• Question 175:

  Which of the following are secure options for storing the contents of the Operator CD, while still allowing the contents to be accessible upon a planned Vault restart? (Choose three.)

  A. Store the CD in a physical safe and mount the CD every time Vault maintenance is performed
  B. Copy the entire contents of the CD to the system Safe on the Vault
  C. Copy the entire contents of the CD to a folder on the Vault Server and secure it with NTFS permissions
  D. Store the server key in a Hardware Security Module (HSM) and copy the rest the keys from the CD to a folder on the Vault Server and secure it with NTFS permissions
  A. Store the CD in a physical safe and mount the CD every time Vault maintenance is performed
  C. Copy the entire contents of the CD to a folder on the Vault Server and secure it with NTFS permissions
  D. Store the server key in a Hardware Security Module (HSM) and copy the rest the keys from the CD to a folder on the Vault Server and secure it with NTFS permissions

• Question 176:

  Which accounts can be selected for use in the Windows discovery process? (Choose two.)

  A. an account stored in the Vault
  B. an account specified by the user
  C. the Vault Administrator
  D. any user with Auditor membership
  E. the PasswordManager user
  A. an account stored in the Vault
  B. an account specified by the user

• Question 177:

  Which usage can be added as a service account platform?

  A. Kerberos Tokens
  B. IIS Application Pools
  C. PowerShell Libraries
  D. Loosely Connected Devices
  B. IIS Application Pools

  ---

  Explanation/Reference:

  Reference: https://docs.cyberark.com/Product-Doc/OnlineHelp/PAS/11.3/en/Content/PASIMP/LooselyConnectedDevices.htm

• Question 178:

  To enable the Automatic response "Add to Pending" within PTA when unmanaged credentials are found, what are the minimum permissions required by PTAUser for the PasswordManager_pending safe?

  A. List Accounts, View Safe members, Add accounts (includes update properties), Update Account content, Update Account properties
  B. List Accounts, Add accounts (includes update properties), Delete Accounts, Manage Safe
  C. Add accounts (includes update properties), Update Account content, Update Account properties, View Audit D. View Accounts, Update Account content, Update Account properties, Access Safe without confirmation, Manage Safe, View Audit
  A. List Accounts, View Safe members, Add accounts (includes update properties), Update Account content, Update Account properties

• Question 179:

  You are adding a new application in the Remote Access portal.

  Which authentication methods can you use to authenticate users to the PVWA? (Choose two.)

  A. Password
  B. OpenID
  C. Certificate
  D. SAML
  E. OTP
  B. OpenID
  D. SAML

• Question 180:

  Which of the following PTA detections require the deployment of a Network Sensor or installing the PTA Agent on the domain controller?

  A. Suspected credential theft
  B. Over-Pass-The-Hash
  C. Golden Ticket
  D. Unmanaged privileged access
  C. Golden Ticket