CyberArk PAM-DEF Online Practice Questions and Exam Preparation

CyberArk PAM-DEF Online Questions & Answers

• Question 41:

  A new colleague created a directory mapping between the Active Directory groups and the Vault. Where can the newly Configured directory mapping be tested?

  A. Connect to the Active Directory and ensure the organizational unit exists.
  B. Connect to Sailpoint (or similar tool) to ensure the organizational unit is correctly named; log in to the PVWA with "Administrator" and confirm authentication succeeds.
  C. Search for members that exist only in the mapping group to grant them safe permissions through the PVWA.
  D. Connect to the PrivateArk Client with the Administrator Account to see if there is a user in the Vault Admin Group.
  C. Search for members that exist only in the mapping group to grant them safe permissions through the PVWA.

• Question 42:

  CyberArk recommends implementing object level access control on all Safes.

  A. True
  B. False
  B. False

• Question 43:

  When should vault keys be rotated?

  A. when it is copied to file systems outside the vault
  B. annually
  C. whenever a CyberArk user leaves the organization
  D. when migrating to a new data center
  A. when it is copied to file systems outside the vault

• Question 44:

  Which permissions are needed for the Active Directory user required by the Windows Discovery process?

  A. Domain Admin
  B. LDAP Admin
  C. Read/Write
  D. Read
  D. Read

  ---

  Explanation/Reference:

  Reference: https://docs.cyberark.com/Product-Doc/OnlineHelp/PAS/10.10/en/Content/PASIMP/Supported-Target-Machines.htm

• Question 45:

  What does the minvalidity parameter on a platform policy determine?

  A. time between a password retrieval and the account becoming eligible for a password change
  B. timeout for users signed into the PVWA as configured in the global settings
  C. minimum amount of time that Just In Time access is valid
  D. time in minutes before an empty safe will be automatically deleted
  A. time between a password retrieval and the account becoming eligible for a password change

• Question 46:

  You are creating a new Rest API user that utilizes CyberArk Authentication. What is a correct process to provision this user?

  A. Private Ark Client > Tools > Administrative Tools > Users and Groups > New > User
  B. Private Ark Client > Tools > Administrative Tools > Directory Mapping > Add
  C. PVWA > User Provisioning > LDAP Integration > Add Mapping
  D. PVWA > User Provisioning > Users and Groups > New > User
  B. Private Ark Client > Tools > Administrative Tools > Directory Mapping > Add

  ---

  Explanation/Reference:

  Reference: https://docs.cyberark.com/Product-Doc/OnlineHelp/PAS/Latest/en/Content/WebServices/Implementing%20Privileged%20Account%20Security%20Web%20Services%20.htm

• Question 47:

  Which statement about the Master Policy best describes the differences between one-time password and exclusive access functionality?

  A. Exclusive access means that only a specific group of users may use the account. After an account on a one-time password platform is used, the account is deleted from the safe automatically.
  B. Exclusive access locks the account indefinitely. One-time password can be used replace invalid account passwords.
  C. Exclusive access is enabled by default in the Master Policy. One-time password should only be enabled for emergencies.
  D. Exclusive access allows only one person to check-out an account at a time. One-time password schedules an account for a password change after the MinValidityPeriod period expires.
  D. Exclusive access allows only one person to check-out an account at a time. One-time password schedules an account for a password change after the MinValidityPeriod period expires.

• Question 48:

  Which of the following statements are NOT true when enabling PSM recording for a target Windows server? (Choose all that apply)

  A. The PSM software must be instated on the target server
  B. PSM must be enabled in the Master Policy (either directly, or through exception)
  C. PSMConnect must be added as a local user on the target server
  D. RDP must be enabled on the target server
  A. The PSM software must be instated on the target server
  B. PSM must be enabled in the Master Policy (either directly, or through exception)

• Question 49:

  Which PTA sensors are required to detect suspected credential theft? (Choose two.)

  A. Logs
  B. Vault Logs
  C. PSM Logs
  D. CPM Logs
  E. EPM
  A. Logs
  B. Vault Logs

• Question 50:

  Your organization requires all passwords be rotated every 90 days. Where can you set this regulatory requirement?

  A. Master Policy
  B. Safe Templates
  C. PVWAConfig.xml
  D. Platform Configuration
  A. Master Policy