Labour Day Special Limited Time 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: geek65

PAM-DEF CyberArk Defender - PAM Questions and Answers

Questions 4

What are the minimum permissions to add multiple accounts from a file when using PVWA bulk-upload? (Choose three.)

Options:

A.

add accounts

B.

rename accounts

C.

update account content

D.

update account properties

E.

view safe members

F.

add safes

Buy Now
Questions 5

A new HTML5 Gateway has been deployed in your organization.

Where do you configure the PSM to use the HTML5 Gateway?

Options:

A.

Administration > Options > Privileged Session Management > Configured PSM Servers > Connection Details > Add PSM Gateway

B.

Administration > Options > Privileged Session Management > Add Configured PSM Gateway Servers

C.

Administration > Options > Privileged Session Management > Configured PSM Servers > Add PSM Gateway

D.

Administration > Options > Privileged Session Management > Configured PSM Servers > Connection Details

Buy Now
Questions 6

Which Master Policy Setting must be active in order to have an account checked-out by one user for a pre-determined amount of time?

Options:

A.

Require dual control password access Approval

B.

Enforce check-in/check-out exclusive access

C.

Enforce one-time password access

D.

Enforce check-in/check-out exclusive access & Enforce one-time password access

Buy Now
Questions 7

VAULT authorizations may be granted to_____.

Options:

A.

Vault Users

B.

Vault Groups

C.

LDAP Users

D.

LDAP Groups

Buy Now
Questions 8

In the screenshot displayed, you just configured the usage in CyberArk and want to update its password.

What is the least intrusive way to accomplish this?

Options:

A.

Use the “change” button on the usage’s details page.

B.

Use the “change” button on the parent account’s details page.

C.

Use the “sync” button on the usage’s details page.

D.

Use the “reconcile” button on the parent account’s details page.

Buy Now
Questions 9

Via Password Vault Web Access (PVWA), a user initiates a PSM connection to the target Linux machine using RemoteApp. When the client’s machine makes an RDP connection to the PSM server, which user will be utilized?

Options:

A.

Credentials stored in the Vault for the target machine

B.

Shadowuser

C.

PSMConnect

D.

PSMAdminConnect

Buy Now
Questions 10

Match each permission to where it can be found.

Options:

Buy Now
Questions 11

When should vault keys be rotated?

Options:

A.

when it is copied to file systems outside the vault

B.

annually

C.

whenever a CyberArk user leaves the organization

D.

when migrating to a new data center

Buy Now
Questions 12

What must you specify when configuring a discovery scan for UNIX? (Choose two.)

Options:

A.

Vault Administrator

B.

CPM Scanner

C.

root password for each machine

D.

list of machines to scan

E.

safe for discovered accounts

Buy Now
Questions 13

Match each key to its recommended storage location.

Options:

Buy Now
Questions 14

When onboarding multiple accounts from the Pending Accounts list, which associated setting must be the same across the selected accounts?

Options:

A.

Platform

B.

Connection Component

C.

CPM

D.

Vault

Buy Now
Questions 15

Which statement is correct concerning accounts that are discovered, but cannot be added to the Vault by an automated onboarding rule?

Options:

A.

They are added to the Pending Accounts list and can be reviewed and manually uploaded.

B.

They cannot be onboarded to the Password Vault.

C.

They must be uploaded using third party tools.

D.

They are not part of the Discovery Process.

Buy Now
Questions 16

The primary purpose of exclusive accounts is to ensure non-repudiation (Individual accountability).

Options:

A.

TRUE

B.

FALS

Buy Now
Questions 17

Which user(s) can access all passwords in the Vault?

Options:

A.

Administrator

B.

Any member of Vault administrators

C.

Any member of auditors

D.

Master

Buy Now
Questions 18

Due to network activity, ACME Corp’s PrivateArk Server became active on the OR Vault while the Primary Vault was also running normally. All the components continued to point to the Primary Vault.

Which steps should you perform to restore DR replication to normal?

Options:

A.

Replicate data from DR Vault to Primary Vault > Shutdown PrivateArk Server on DR Vault > Start replication on DR vault

B.

Shutdown PrivateArk Server on DR Vault > Start replication on DR vault

C.

Shutdown PrivateArk Server on Primary Vault > Replicate data from DR Vault to Primary Vault > Shutdown PrivateArk Server on DR Vault > Start replication on DR vault

D.

Shutdown PrivateArk Server on DR Vault > Replicate data from DR Vault to Primary Vault > Shutdown PrivateArk Server on DR Vault > Start replication on DR vault

Buy Now
Questions 19

Match each PTA alert category with the PTA sensors that collect the data for it.

Options:

Buy Now
Questions 20

Which onboarding method would you use to integrate CyberArk with your accounts provisioning process?

Options:

A.

Accounts Discovery

B.

Auto Detection

C.

Onboarding RestAPI functions

D.

PTA Rules

Buy Now
Questions 21

You need to enable the PSM for all platforms.

Where do you perform this task?

Options:

A.

Platform Management > (Platform) > UI & Workflows

B.

Master Policy > Session Management

C.

Master Policy > Privileged Access Workflows

D.

Administration > Options > Connection Components

Buy Now
Questions 22

Which methods can you use to add a user directly to the Vault Admin Group? (Choose three.)

Options:

A.

REST API

B.

PrivateArk Client

C.

PACLI

D.

PVWA

E.

Active Directory

F.

Sailpoint

Buy Now
Questions 23

Which certificate type do you need to configure the vault for LDAP over SSL?

Options:

A.

the CA Certificate that signed the certificate used by the External Directory

B.

a CA signed Certificate for the Vault server

C.

a CA signed Certificate for the PVWA server

D.

a self-signed Certificate for the Vault

Buy Now
Questions 24

Users are unable to launch Web Type Connection components from the PSM server. Your manager asked you to open the case with CyberArk Support.

Which logs will help the CyberArk Support Team debug the issue? (Choose three.)

Options:

A.

PSMConsole.log

B.

PSMDebug.log

C.

PSMTrace.log

D.

.Component.log

E.

PMconsole.log

F.

ITAlog.log

Buy Now
Questions 25

Which report provides a list of account stored in the vault.

Options:

A.

Privileged Accounts Inventory

B.

Privileged Accounts Compliance Status

C.

Entitlement Report

D.

Active Log

Buy Now
Questions 26

Ad-Hoc Access (formerly Secure Connect) provides the following features. Choose all that apply.

Options:

A.

PSM connections to target devices that are not managed by CyberArk.

B.

Session Recording.

C.

Real-time live session monitoring.

D.

PSM connections from a terminal without the need to login to the PVWA.

Buy Now
Questions 27

The System safe allows access to the Vault configuration files.

Options:

A.

TRUE

B.

FALS

Buy Now
Questions 28

Where can a user with the appropriate permissions generate a report? (Choose two.)

Options:

A.

PVWA > Reports

B.

PrivateArk Client

C.

Cluster Vault Manager

D.

PrivateArk Server Monitor

E.

PARClient

Buy Now
Questions 29

You are logging into CyberArk as the Master user to recover an orphaned safe.

Which items are required to log in as Master?

Options:

A.

Master CD, Master Password, console access to the Vault server, Private Ark Client

B.

Operator CD, Master Password, console access to the PVWA server, PVWA access

C.

Operator CD, Master Password, console access to the Vault server, Recover.exe

D.

Master CD, Master Password, console access to the PVWA server, Recover.exe

Buy Now
Questions 30

When a group is granted the 'Authorize Account Requests' permission on a safe Dual Control requests must be approved by

Options:

A.

Any one person from that group

B.

Every person from that group

C.

The number of persons specified by the Master Policy

D.

That access cannot be granted to groups

Buy Now
Questions 31

The Vault administrator can change the Vault license by uploading the new license to the system Safe.

Options:

A.

True

B.

False

Buy Now
Questions 32

Which master policy settings ensure non-repudiation?

Options:

A.

Require password verification every X days and enforce one-time password access.

B.

Enforce check-in/check-out exclusive access and enforce one-time password access.

C.

Allow EPV transparent connections ('Click to connect') and enforce check-in/check-out exclusive access.

D.

Allow EPV transparent connections ('Click to connect') and enforce one-time password access.

Buy Now
Questions 33

Which command generates a full backup of the Vault?

Options:

A.

PAReplicate.exe Vault.ini /LogonFromFile user.ini /FullBackup

B.

PAPreBackup.exe C:\PrivateArk\Server\Conf\Vault.ini Backup/Asdf1234 /full

C.

PARestore.exe PADR ini /LogonFromFile vault.ini /FullBackup

D.

CAVaultManager.exe RecoverBackupFiles /BackupPoolName BkpSvr1

Buy Now
Questions 34

Which parameter controls how often the CPM looks for Soon-to-be-expired Passwords that need to be changed.

Options:

A.

HeadStartInterval

B.

Interval

C.

ImmediateInterval

D.

The CPM does not change the password under this circumstance

Buy Now
Questions 35

When a DR Vault Server becomes an active vault, it will automatically revert back to DR mode once the Primary Vault comes back online.

Options:

A.

True; this is the default behavior

B.

False, the Vault administrator must manually set the DR Vault to DR mode by setting “FailoverMode=no” in the padr.ini file

C.

True, if the AllowFailback setting is set to “yes” in the padr.ini file

D.

False, the Vault administrator must manually set the DR Vault to DR mode by setting “FailoverMode=no” in the dbparm.ini file

Buy Now
Questions 36

It is possible to control the hours of the day during which a user may log into the vault.

Options:

A.

TRUE

B.

FALSE

Buy Now
Questions 37

You want to give a newly-created group rights to review security events under the Security pane. You also want to be able to update the status of these events.

Where must you update the group to allow this?

Options:

A.

in the PTAAuthorizationGroups parameter, found in Administration > Options > PTA

B.

in the PTAAuthorizationGroups parameter, found in Administration > Options > General

C.

in the SecurityEventsAuthorizationGroups parameter, found in Administration > Security > Options

D.

in the SecurityEventsFeedAuthorizationGroups parameter, found in Administration > Options > General

Buy Now
Questions 38

PSM for Windows (previously known as “RDP Proxy”) supports connections to the following target systems

Options:

A.

Windows

B.

UNIX

C.

Oracle

D.

All of the above

Buy Now
Questions 39

Where can you check that the LDAP binding is using TCP/636?

Options:

A.

in Active Directory under "Users OU" => "User Properties" => "External Bindings" => "Port"

B.

in PVWA, under "LDAP Integration" => "LDAP" => "Directories" => "" => "Hosts" => "Host"

C.

in PrivateArk Client, under "Tools" => "Administrative Tools" => "Directory Mapping" => ""

D.

From the PVWA, connect to the domain controller using Test-NetConnection on Port 636.

Buy Now
Questions 40

What is the purpose of the PrivateArk Server service?

Options:

A.

Executes password changes

B.

Maintains Vault metadata

C.

Makes Vault data accessible to components

D.

Sends email alerts from the Vault

Buy Now
Questions 41

Within the Vault each password is encrypted by:

Options:

A.

the server key

B.

the recovery public key

C.

the recovery private key

D.

its own unique key

Buy Now
Questions 42

Can the 'Connect' button be used to initiate an SSH connection, as root, to a Unix system when SSH access for root is denied?

Options:

A.

Yes, when using the connect button, CyberArk uses the PMTerminal.exe process which bypasses the root SSH restriction.

B.

Yes, only if a logon account is associated with the root account and the user connects through the PSM-SSH connection component.

C.

Yes, if a logon account is associated with the root account.

D.

No, it is not possible.

Buy Now
Questions 43

Which item is an option for PSM recording customization?

Options:

A.

Windows events text recorder with automatic play-back

B.

Windows events text recorder and universal keystrokes recording simultaneously

C.

Universal keystrokes text recorder with windows events text recorder disabled

D.

Custom audio recording for windows events

Buy Now
Questions 44

When on-boarding account using Accounts Feed, Which of the following is true?

Options:

A.

You must specify an existing Safe where are account will be stored when it is on boarded to the Vault

B.

You can specify the name of a new sale that will be created where the account will be stored when it is on-boarded to the Vault.

C.

You can specify the name of a new Platform that will be created and associated with the account

D.

Any account that is on boarded can be automatically reconciled regardless of the platform it is associated with.

Buy Now
Questions 45

You have been asked to identify the up or down status of Vault services.

Which CyberArk utility can you use to accomplish this task?

Options:

A.

Vault Replicator

B.

PAS Reporter

C.

Remote Control Agent

D.

Syslog

Buy Now
Questions 46

A user is receiving the error message “ITATS006E Station is suspended for User jsmith” when attempting to sign into the Password Vault Web Access (PVWA). Which utility would a Vault administrator use to correct this problem?

Options:

A.

createcredfile.exe

B.

cavaultmanager.exe

C.

PrivateArk

D.

PVWA

Buy Now
Questions 47

When an account is unable to change its own password, how can you ensure that password reset with the reconcile account is performed each time instead of a change?

Options:

A.

Set the parameter RCAllowManualReconciliation to Yes.

B.

Set the parameter ChangePasswordinResetMade to Yes.

C.

Set the parameter IgnoreReconcileOnMissingAccount to No.

D.

Set the UnlockUserOnReconcile to Yes.

Buy Now
Questions 48

You created a new safe and need to ensure the user group cannot see the password, but can connect through the PSM.

Which safe permissions must you grant to the group? (Choose two.)

Options:

A.

List Accounts Most Voted

B.

Use Accounts Most Voted

C.

Access Safe without Confirmation

D.

Retrieve Files

E.

Confirm Request

Buy Now
Questions 49

A logon account can be specified in the platform settings.

Options:

A.

True

B.

False

Buy Now
Questions 50

When a DR Vault Server becomes an active vault, it will automatically fail back to the original state once the Primary Vault comes back online.

Options:

A.

True; this is the default behavior

B.

False; this is not possible

C.

True, if the AllowFailback setting is set to “yes” in the padr.ini file

D.

True, if the AllowFailback setting is set to “yes” in the dbparm.ini file

Buy Now
Questions 51

When running a “Privileged Accounts Inventory” Report through the Reports page in PVWA on a specific safe, which permission/s are required on that safe to show complete account inventory information?

Options:

A.

List Accounts, View Safe Members

B.

Manage Safe Owners

C.

List Accounts, Access Safe without confirmation

D.

Manage Safe, View Audit

Buy Now
Questions 52

SAFE Authorizations may be granted to____________.

Select all that apply.

Options:

A.

Vault Users

B.

Vault Group

C.

LDAP Users

D.

LDAP Groups

Buy Now
Questions 53

What is the configuration file used by the CPM scanner when scanning UNIX/Linux devices?

Options:

A.

UnixPrompts.ini

B.

plink.exe

C.

dbparm.ini

D.

PVConfig.xml

Buy Now
Questions 54

Which change could CyberArk make to the REST API that could cause existing scripts to fail?

Options:

A.

adding optional parameters in the request

B.

adding additional REST methods

C.

removing parameters

D.

returning additional values in the response

Buy Now
Questions 55

Which authorizations are required in a recording safe to allow a group to view recordings?

Options:

Buy Now
Questions 56

You are creating a shared safe for the help desk.

What must be considered regarding the naming convention?

Options:

A.

Ensure your naming convention is no longer than 20 characters.

B.

Combine environments, owners and platforms to minimize the total number of safes created.

C.

Safe owners should determine the safe name to enable them to easily remember it.

D.

The use of these characters V:*<>".| is not allowed.

Buy Now
Questions 57

What is the purpose of the HeadStartlnterval setting m a platform?

Options:

A.

It determines how far in advance audit data is collected tor reports

B.

It instructs the CPM to initiate the password change process X number of days before expiration.

C.

It instructs the AIM Provider to ‘skip the cache' during the defined time period

D.

It alerts users of upcoming password changes x number of days before expiration.

Buy Now
Questions 58

Which dependent accounts does the CPM support out-of-the-box? (Choose three.)

Options:

A.

Solaris Configuration file

B.

Windows Services

C.

Windows Scheduled

D.

Windows DCOM Applications

E.

Windows Registry

F.

Key Tab file

Buy Now
Questions 59

If a password is changed manually on a server, bypassing the CPM, how would you configure the account so that the CPM could resume management automatically?

Options:

A.

Configure the Provider to change the password to match the Vault’s Password

B.

Associate a reconcile account and configure the platform to reconcile automatically

C.

Associate a logon account and configure the platform to reconcile automatically

D.

Run the correct auto detection process to rediscover the password

Buy Now
Questions 60

Before failing back to the production infrastructure after a DR exercise, what must you do to maintain audit history during the DR event?

Options:

A.

Ensure that the Production Instance replicates changes that occurred from the Disaster Recovery Instance.

B.

Briefly stop and start the Disaster Recovery Instance before attempting to fail components back to the Production Instance.

C.

Stop the CPM services before starting the production server.

D.

Perform an IIS Reset on all PVWA servers.

Buy Now
Questions 61

Which permissions are needed for the Active Directory user required by the Windows Discovery process?

Options:

A.

Domain Admin

B.

LDAP Admin

C.

Read/Write

D.

Read

Buy Now
Questions 62

To change the safe where recordings are kept for a specific platform, which setting must you update in the platform configuration?

Options:

A.

SessionRecorderSafe Most Voted

B.

SessionSafe

C.

RecordingsPath

D.

RecordingLocation

Buy Now
Questions 63

ADR Vault became active due to a failure of the primary Vault. Service on the primary Vault has now been restored. Arrange the steps to return the DR vault to its normal standby mode in the correct sequence.

Options:

Buy Now
Questions 64

A new colleague created a directory mapping between the Active Directory groups and the Vault.

Where can the newly Configured directory mapping be tested?

Options:

A.

Connect to the Active Directory and ensure the organizational unit exists.

B.

Connect to Sailpoint (or similar tool) to ensure the organizational unit is correctly named; log in to the PVWA with "Administrator" and confirm authentication succeeds.

C.

Search for members that exist only in the mapping group to grant them safe permissions through the PVWA.

D.

Connect to the PrivateArk Client with the Administrator Account to see if there is a user in the Vault Admin Group.

Buy Now
Questions 65

The Accounts Feed contains:

Options:

A.

Accounts that were discovered by CyberArk in the last 30 days

B.

Accounts that were discovered by CyberArk that have not yet been onboarded

C.

All accounts added to the vault in the last 30 days

D.

All users added to CyberArk in the last 30 days

Buy Now
Questions 66

What does the Export Vault Data (EVD) utility do?

Options:

A.

exports data from the Vault to TXT or CSV files, or to MSSQL databases

B.

generates a backup file that can be used as a cold backup

C.

exports all passwords and imports them into another instance of CyberArk

D.

keeps two active vaults in sync

Buy Now
Questions 67

You have been asked to turn off the time access restrictions for a safe.

Where is this setting found?

Options:

A.

PrivateArk Client

B.

RestAPI

C.

PVWA

D.

Vault

Buy Now
Questions 68

Which CyberArk group does a user need to be part of to view recordings or live monitor sessions?

Options:

A.

Auditors

B.

Vault Admin

C.

DR Users

D.

Operators

Buy Now
Questions 69

It is possible to leverage DNA to provide discovery functions that are not available with auto-detection.

Options:

A.

TRUE

B.

FALS

Buy Now
Questions 70

For Digital Vault Cluster in a high availability configuration, how does the cluster determine if a node is down?

Options:

A.

The heartbeat s no longer detected on the private network.

B.

The shared storage array is offline.

C.

An alert is generated in the Windows Event log.

D.

The Digital Vault Cluster does not detect a node failure.

Buy Now
Questions 71

Which of the following files must be created or configured m order to run Password Upload Utility? Select all that apply.

Options:

A.

PACli.ini

B.

Vault.ini

C.

conf.ini

D.

A comma delimited upload file

Buy Now
Questions 72

You receive this error:

“Error in changepass to user domain\user on domain server(\domain.(winRc=5) Access is denied.”

Which root cause should you investigate?

Options:

A.

The account does not have sufficient permissions to change its own password.

B.

The domain controller is unreachable.

C.

The password has been changed recently and minimum password age is preventing the change.

D.

The CPM service is disabled and will need to be restarted.

Buy Now
Exam Code: PAM-DEF
Exam Name: CyberArk Defender - PAM
Last Update: Apr 23, 2024
Questions: 239
PAM-DEF pdf

PAM-DEF PDF

$28  $80
PAM-DEF Engine

PAM-DEF Testing Engine

$33.25  $95
PAM-DEF PDF + Engine

PAM-DEF PDF + Testing Engine

$45.5  $130