Free PAM-DEF Exam Dumps Preview

Question 1

Single choice

What can you do to ensure each component server is operational?

1. A

   Logon to PVWA with v10 UI, navigate to Healthcheck, and validate each component server is connected to the Vault.

2. B

   Ping each component server to ensure connectivity.

3. C

   Use the PrivateArk client to connect to the Vault server and validate all the services are running.

4. D

   Install the Vault Server interface on a remote machine to avoid interactive logon to the Vault OS and review the ITALog.log through the Vault Server interface.

Reveal answer details Close answer details

Correct answerA

Question 2

Multiple choice

Where can a user with the appropriate permissions generate a report? (Choose two.)

1. A

   PVWA > Reports

2. B

   PrivateArk Client

3. C

   Cluster Vault Manager

4. D

   PrivateArk Server Monitor

5. E

   PARClient

Reveal answer details Close answer details

Correct answersA, B

Question 3

Single choice

Your organization requires all passwords be rotated every 90 days.

Where can you set this regulatory requirement?

1. A

   Master Policy

2. B

   Safe Templates

3. C

   PVWAConfig.xml

4. D

   Platform Configuration

Reveal answer details Close answer details

Correct answerA

Question 4

Single choice

Due to corporate storage constraints, you have been asked to disable session monitoring and recording for 500 testing accounts used for your lab environment.

How do you accomplish this?

1. A

   Master Policy>select Session Management>add Exceptions to the platform(s)>disable Session
   Monitoring and Recording policies

2. B

   Administration>Platform Management>select the platform(s)>disable Session Monitoring and
   Recording

3. C

   Polices>Access Control (Safes)>select the safe(s)>disable Session Monitoring and Recording policies

4. D

   Administration>Configuration Options>Options>select Privilege Session Management>disable Session
   Monitoring and Recording policies

Reveal answer details Close answer details

Correct answerA

Question 5

Single choice

The System safe allows access to the Vault configuration files.

1. A

   TRUE

2. B

   FALS

Reveal answer details Close answer details

Correct answerA

Question 6

Single choice

Which CyberArk group does a user need to be part of to view recordings or live monitor sessions?

1. A

   Auditors

2. B

   Vault Admin

3. C

   DR Users

4. D

   Operators

Reveal answer details Close answer details

Correct answerA

Explanation

References:
https://docs.cyberark.com/Product-Doc/OnlineHelp/PAS/Latest/en/Content/PASIMP/Monitoring-Privileged-Sessions.htm?TocPath=End%20User%7CMonitor%20Sessions%7CClassic%20Interface%7C_____1

Question 7

Single choice

You are concerned about the Windows Domain password changes occurring during business hours.

Which settings must be updated to ensure passwords are only rotated outside of business hours?

1. A

   In the platform policy -
   Automatic Password Management > Password Change > ToHour & FromHour

2. B

   in the Master Policy Account Change Window > ToHour & From Hour

3. C

   Administration Settings -
   CPM Settings > ToHour & FromHour

4. D

   On each individual account -
   Edit > Advanced > ToHour & FromHour

Reveal answer details Close answer details

Correct answerA

Question 8

Multiple choice

You need to recover an account localadmin02 for target server 10.0.123.73 stored in Safe Team1.

What do you need to recover and decrypt the object? (Choose three.)

1. A

   Recovery Private Key

2. B

   Recover.exe

3. C

   Vault data

4. D

   Recovery Public Key

5. E

   Server Key

6. F

   Master Password

Reveal answer details Close answer details

Correct answersA, D, E

Explanation

References:
https://docs.cyberark.com/Product-Doc/OnlineHelp/PAS/Latest/en/Content/PASIMP/Server-Keys.htm?TocPath=Administration%7CComponents%7CDigital%20Vault%7CAdvanced%20Digital%20Vault%20Environment%7CCyberArk%20Vault%20Structure%7C_____3

Question 9

Drag & drop

DRAG DROP

Match each component to its respective Log File location.

Reveal answer details Close answer details

Explanation

References:
https://docs.cyberark.com/Product-Doc/OnlineHelp/PAS/12.1/en/Content/PAS%20INST/Optional-PSM-in-a-Vault-Disaster-Recovery-Site.htm?TocPath=Installation%7CInstall%20PAS%C2%A0on-premise%7CInstall%20PSM%7CAdvanced%20PSM%20Implementations%7C_____8
https://docs.cyberark.com/Product-Doc/OnlineHelp/PAS/11.4/en/Content/PTA/PTA-Data-Locations.htm

Question 10

Multiple choice

According to CyberArk, which issues most commonly cause installed components to display as disconnected in the System Health Dashboard? (Choose two.)

1. A

   network instabilities/outages

2. B

   vault license expiry

3. C

   credential de-sync

4. D

   browser compatibility issues

5. E

   installed location file corruption

Reveal answer details Close answer details

Correct answersA, C

Question 11

Single choice

The vault supports Subnet Based Access Control.

1. A

   TRUE

2. B

   FALSE

Reveal answer details Close answer details

Correct answerA

Question 12

Single choice

You are onboarding 5,000 UNIX root accounts for rotation by the CPM. You discover that the CPM is unable to log in directly with the root account and will need to use a secondary account.

How should this be configured to allow for password management using least privilege?

1. A

   Configure each CPM to use the correct logon account.

2. B

   Configure each CPM to use the correct reconcile account.

3. C

   Configure the UNIX platform to use the correct logon account.

4. D

   Configure the UNIX platform to use the correct reconcile account.

Reveal answer details Close answer details

Correct answerC

Explanation

References:
https://docs.cyberark.com/Product-Doc/OnlineHelp/PrivCloud/Latest/en/Content/PASIMP/Linked-PAS-Accounts.htm#Overview

Question 13

Single choice

If the AccountUploader Utility is used to create accounts with SSH keys, which parameter do you use to set the full or relative path of the SSH private key file that will be attached to the account?

1. A

   KeyPath

2. B

   KeyFile

3. C

   ObjectName

4. D

   Address

Reveal answer details Close answer details

Correct answerB

Explanation

References:
https://docs.cyberark.com/Product-Doc/OnlineHelp/PAS/10.10/en/Content/PASIMP/Adding-Accounts-with-SSH-Keys-using-the-AccountUploader-Utility-Appendix.htm

Question 14

Single choice

When managing SSH keys, the CPM stored the Private Key

1. A

   In the Vault

2. B

   On the target server

3. C

   A & B

4. D

   Nowhere because the private key can always be generated from the public key.

Reveal answer details Close answer details

Correct answerA

Question 15

Multiple choice

Where can you assign a Reconcile account? (Choose two.)

1. A

   in PVWA at the account level

2. B

   in PVWA in the platform configuration

3. C

   in the Master policy of the PVWA

4. D

   at the Safe level

5. E

   in the CPM settings

Reveal answer details Close answer details

Correct answersA, B

Question 16

Single choice

To enable the Automatic response "Add to Pending" within PTA when unmanaged credentials are found, what are the minimum permissions required by PTAUser for the PasswordManager_pending safe?

1. A

   List Accounts, View Safe members, Add accounts (includes update properties), Update Account
   content, Update Account properties

2. B

   List Accounts, Add accounts (includes update properties), Delete Accounts, Manage Safe

3. C

   Add accounts (includes update properties), Update Account content, Update Account properties, View

   Audit

4. D

   View Accounts, Update Account content, Update Account properties, Access Safe without
   confirmation, Manage Safe, View Audit

Reveal answer details Close answer details

Correct answerA

Question 17

Single choice

What does the minvalidity parameter on a platform policy determine?

1. A

   time between a password retrieval and the account becoming eligible for a password change

2. B

   timeout for users signed into the PVWA as configured in the global settings

3. C

   minimum amount of time that Just In Time access is valid

4. D

   time in minutes before an empty safe will be automatically deleted

Reveal answer details Close answer details

Correct answerA

Question 18

Single choice

When creating an onboarding rule, it will be executed upon .

1. A

   All accounts in the pending accounts list

2. B

   Any future accounts discovered by a discovery process

3. C

   Both "All accounts in the pending accounts list" and "Any future accounts discovered by a discovery process"

Reveal answer details Close answer details

Correct answerB

Question 19

Single choice

Which report provides a list of account stored in the vault.

1. A

   Privileged Accounts Inventory

2. B

   Privileged Accounts Compliance Status

3. C

   Entitlement Report

4. D

   Active Log

Reveal answer details Close answer details

Correct answerA

Question 20

Single choice

Which permissions are needed for the Active Directory user required by the Windows Discovery process?

1. A

   Domain Admin

2. B

   LDAP Admin

3. C

   Read/Write

4. D

   Read

Reveal answer details Close answer details

Correct answerD

Explanation

References:
https://docs.cyberark.com/Product-Doc/OnlineHelp/PAS/10.10/en/Content/PASIMP/Supported-Target-Machines.htm

Question 21

Single choice

In your organization the "click to connect" button is not active by default.

How can this feature be activated?

1. A

   Policies > Master Policy > Allow EPV transparent connections > Inactive

2. B

   Policies > Master Policy > Session Management > Require privileged session monitoring and isolation
   > Add Exception

3. C

   Policies > Master Policy > Allow EPV transparent connections > Active

4. D

   Policies > Master Policy > Password Management

Reveal answer details Close answer details

Correct answerC

Explanation

References:
https://docs.cyberark.com/Product-Doc/OnlineHelp/PAS/11.1/en/Content/
TranparentConnections_Web.htm

Question 22

Single choice

A Reconcile Account can be specified in the Master Policy.

1. A

   TRUE

2. B

   FALSE

Reveal answer details Close answer details

Correct answerB

Question 23

Single choice

For a safe with Object Level Access enabled you can turn off Object Level Access Control when it no longer needed on the safe.

1. A

   TRUE

2. B

   FALSE

Reveal answer details Close answer details

Correct answerB

Question 24

Single choice

You receive this error:

"Error in changepass to user domain\user on domain server(\domain.(winRc=5) Access is denied."

Which root cause should you investigate?

1. A

   The account does not have sufficient permissions to change its own password.

2. B

   The domain controller is unreachable.

3. C

   The password has been changed recently and minimum password age is preventing the change.

4. D

   The CPM service is disabled and will need to be restarted.

Reveal answer details Close answer details

Correct answerA

Explanation

References:
https://cyberark-customers.force.com/s/article/CPM-can-login-and-verify-a-password-but-can-t-change-the-password-winRc-5-Access-is-denied

Question 25

Single choice

PSM captures a record of each command that was executed in Unix.

1. A

   TRIE

2. B

   FALSE

Reveal answer details Close answer details

Correct answerA

Question 26

Single choice

In PVWA, you are attempting to play a recording made of a session by user jsmith, but there is no option to "Fast Forward" within the video. It plays and only allows you to skip between commands instead. You are

also unable to download the video.

What could be the cause?

1. A

   Recording is of a PSM for SSH session.

2. B

   The browser you are using is out of date and needs an update to be supported.

3. C

   You do not have the "View Audit" permission on the safe where the account is stored.

4. D

   You need to update the recorder settings in the platform to enable screen capture every 10000 ms or less.

Reveal answer details Close answer details

Correct answerA

Explanation

References:
https://cyberark-customers.force.com/s/article/00004935

Question 27

Single choice

What is the easiest way to duplicate an existing platform?

1. A

   From PrivateArk, copy/paste the appropriate Policy.ini file; then rename it.

2. B

   From the PVWA, navigate to the platforms page, select an existing platform that is similar to the new
   target account platform and then click Duplicate; name the new platform.

3. C

   From PrivateArk, copy/paste the appropriate settings in PVConfiguration.xml; then update the
   policyName variable.

4. D

   From the PVWA, navigate to the platforms page, select an existing platform that is similar to the new target account platform, manually update the platform settings and click "Save as" INSTEAD of save to duplicate and rename the platform.

Reveal answer details Close answer details

Correct answerB

Question 28

Single choice

According to the DEFAULT Web Options settings, which group grants access to the REPORTS page?

1. A

   PVWAUsers

2. B

   Vault Admins

3. C

   Auditors

4. D

   PVWAMonitor

Reveal answer details Close answer details

Correct answerD

Question 29

Multiple choice

Where can PTA be configured to send alerts? (Choose two.)

1. A

   SIEM

2. B

   Email

3. C

   Google Analytics

4. D

   EVD

5. E

   PAReplicate

Reveal answer details Close answer details

Correct answersA, B

Question 30

Single choice

You have been asked to turn off the time access restrictions for a safe.

Where is this setting found?

1. A

   PrivateArk

2. B

   RestAPI

3. C

   Password Vault Web Access (PVWA)

4. D

   Vault

Reveal answer details Close answer details

Correct answerA

Explanation

References:
https://docs.cyberark.com/Product-Doc/OnlineHelp/PAS/11.2/en/Content/PASIMP/Advanced-Safe-Management.htm

Question 31

Single choice

When should vault keys be rotated?

1. A

   when it is copied to file systems outside the vault

2. B

   annually

3. C

   whenever a CyberArk user leaves the organization

4. D

   when migrating to a new data center

Reveal answer details Close answer details

Correct answerA

Question 32

Multiple choice

You are adding a new application in the Remote Access portal.

Which authentication methods can you use to authenticate users to the PVWA? (Choose two.)

1. A

   Password

2. B

   OpenID

3. C

   Certificate

4. D

   SAML

5. E

   OTP

Reveal answer details Close answer details

Correct answersB, D

Question 33

Single choice

Which of the following logs contains information about errors related to PTA?

1. A

   ITAlog.log

2. B

   diamond.log

3. C

   pm_error.log

4. D

   WebApplication.log

Reveal answer details Close answer details

Correct answerB

Question 34

Single choice

Which configuration file is used by the CPM scanner when scanning UNIX/Linux devices?

1. A

   UnixPrompts.ini

2. B

   plink.exe

3. C

   dbparm.ini

4. D

   UnixScanner.ini

Reveal answer details Close answer details

Correct answerA

Question 35

Single choice

What is required to manage loosely connected devices?

1. A

   PSM for SSH

2. B

   EPM

3. C

   PSM

4. D

   PTA

Reveal answer details Close answer details

Correct answerB

Question 36

Single choice

What is the purpose of the password change process?

1. A

   To test that CyberArk is storing accurate credentials for accounts

2. B

   To change the password of an account according to organizationally defined password rules

3. C

   To allow CyberArk to manage unknown or lost credentials

4. D

   To generate a new complex password

Reveal answer details Close answer details

Correct answerB

Question 37

Multiple choice

Which of the following files must be created or configured m order to run Password Upload Utility? Select all that apply.

1. A

   PACli.ini

2. B

   Vault.ini

3. C

   conf.ini

4. D

   A comma delimited upload file

Reveal answer details Close answer details

Correct answersB, C, D

Question 38

Single choice

Which combination of Safe member permissions will allow end users to log in to a remote machine transparently but NOT show or copy the password?

1. A

   Use Accounts, Retrieve Accounts, List Accounts

2. B

   Use Accounts, List Accounts

3. C

   Use Accounts

4. D

   List Accounts, Retrieve Accounts

Reveal answer details Close answer details

Correct answerD

Question 39

Single choice

Which values are acceptable in the address field of an Account?

1. A

   It must be a Fully Qualified Domain Name (FQDN)

2. B

   It must be an IP address

3. C

   It must be NetBIOS name

4. D

   Any name that is resolvable on the Central Policy Manager (CPM) server is acceptable

Reveal answer details Close answer details

Correct answerD