CyberArk Pam Final Exam Questions
with All Actual Answers 2026-2027
Updated.
What do you need on the Vault to support LDAP over SSL?
A. CA Certificate(s) used to sign the External Directory certificate
B. RECPRV.key
C. a private key for the external directory
D. self-signed Certificate(s) for the Vault - Answer Answer: A
You are troubleshooting a PVWA slow response.
Which log files should you analyze first? (Choose two.)
A. ITALog.log
B. web.config
C. CyberArk.WebApplication.log
D. CyberArk.WebConsole.log - Answer Answer: CD
What is the easiest way to duplicate an existing platform?
A. From PrivateArk, copy/paste the appropriate Policy.ini file; then rename it.
B. From the PVWA, navigate to the platforms page, select an existing platform that is similar to
the new target account platform and then click Duplicate; name the new platform.
C. From PrivateArk, copy/paste the appropriate settings in PVConfiguration.xml; then update
the policyName variable.
D. From the PVWA, navigate to the platforms page, select an existing platform that is similar to
the new target account platform, manually update the platform settings and click "Save as"
INSTEAD of save to duplicate and rename the platform. - Answer Answer: B
Due to corporate storage constraints, you have been asked to disable session monitoring and
recording for 500 testing accounts used for your lab environment.
How do you accomplish this?
A. Master Policy>select Session Management>add Exceptions to the platform(s)>disable Session
Monitoring and Recording policies
B. Administration>Platform Management>select the platform(s)>disable Session Monitoring
and Recording
C. Polices>Access Control (Safes)>select the safe(s)>disable Session Monitoring and Recording
policies
,D. Administration>Configuration Options>Options>select Privilege Session
Management>disable Session Monitoring and Recording policies - Answer Answer: A
A user requested access to view a password secured by dual-control and is unsure who to
contact to expedite the approval process. The Vault Admin has been asked to look at the
account and identify who can approve their request.
What is the correct location to identify users or groups who can approve?
A. PVWA > Administration > Platform Configuration > Edit Platform > UI & Workflow > Dual
Control > Approvers
B. PVWA > Policies > Access Control (Safes) > Select the safe > Safe Members > Workflow >
Authorize Password Requests
C. PVWA > Account List > Edit > Show Advanced Settings > Dual Control > Direct Managers
D. PrivateArk > Admin Tools > Users and Groups > Auditors (Group Membership) - Answer
Answer: B
What must you specify when configuring a discovery scan for UNIX? (Choose two.)
A. Vault Administrator
B. CPM Scanner
C. root password for each machine
D. list of machines to scan
E. safe for discovered accounts - Answer Answer: BD
To change the safe where recordings are kept for a specific platform, which setting must you
update in the platform configuration?
A. SessionRecorderSafe
B. SessionSafe
C. RecordingsPath
D. RecordingLocation - Answer Answer: A
Which processes reduce the risk of credential theft? (Choose two.)
A. require dual control password access approval
B. require password change every X days
C. enforce check-in/check-out exclusive access
D. enforce one-time password access - Answer Answer: BD
You are onboarding 5,000 UNIX root accounts for rotation by the CPM. You discover that the
CPM is unable to log in directly with the root account and will need to use a secondary account.
, How can this be configured to allow for password management using least privilege?
A. Configure each CPM to use the correct logon account.
B. Configure each CPM to use the correct reconcile account.
C. Configure the UNIX platform to use the correct logon account.
D. Configure the UNIX platform to use the correct reconcile account. - Answer Answer: C
Which methods can you use to add a user directly to the Vault Admin Group? (Choose three.)
A. REST API
B. PrivateArk Client
C. PACLI
D. PVWA
E. Active Directory
F. Sailpoint - Answer Answer: ABC
Which Automatic Remediation is configurable for a PTA detection of a "Suspected Credential
Theft"?
A. Add to Pending
B. Rotate Credentials
C. Reconcile Credentials
D. Disable Account - Answer Answer: B
Which item is an option for PSM recording customization?
A. Windows events text recorder with automatic play-back
B. Windows events text recorder and universal keystrokes recording simultaneously
C. Universal keystrokes text recorder with windows events text recorder disabled
D. Custom audio recording for windows events - Answer Answer: C
You want to create a new onboarding rule.
Where do you accomplish this?
A. In PVWA, click Reports > Unmanaged Accounts > Rules
B. In PVWA, click Options > Platform Management > Onboarding Rules
C. In PrivateArk, click Tools > Onboarding Rules
D. In PVWA, click Accounts > Onboarding Rules - Answer Answer: D
What does the Export Vault Data (EVD) utility do?
with All Actual Answers 2026-2027
Updated.
What do you need on the Vault to support LDAP over SSL?
A. CA Certificate(s) used to sign the External Directory certificate
B. RECPRV.key
C. a private key for the external directory
D. self-signed Certificate(s) for the Vault - Answer Answer: A
You are troubleshooting a PVWA slow response.
Which log files should you analyze first? (Choose two.)
A. ITALog.log
B. web.config
C. CyberArk.WebApplication.log
D. CyberArk.WebConsole.log - Answer Answer: CD
What is the easiest way to duplicate an existing platform?
A. From PrivateArk, copy/paste the appropriate Policy.ini file; then rename it.
B. From the PVWA, navigate to the platforms page, select an existing platform that is similar to
the new target account platform and then click Duplicate; name the new platform.
C. From PrivateArk, copy/paste the appropriate settings in PVConfiguration.xml; then update
the policyName variable.
D. From the PVWA, navigate to the platforms page, select an existing platform that is similar to
the new target account platform, manually update the platform settings and click "Save as"
INSTEAD of save to duplicate and rename the platform. - Answer Answer: B
Due to corporate storage constraints, you have been asked to disable session monitoring and
recording for 500 testing accounts used for your lab environment.
How do you accomplish this?
A. Master Policy>select Session Management>add Exceptions to the platform(s)>disable Session
Monitoring and Recording policies
B. Administration>Platform Management>select the platform(s)>disable Session Monitoring
and Recording
C. Polices>Access Control (Safes)>select the safe(s)>disable Session Monitoring and Recording
policies
,D. Administration>Configuration Options>Options>select Privilege Session
Management>disable Session Monitoring and Recording policies - Answer Answer: A
A user requested access to view a password secured by dual-control and is unsure who to
contact to expedite the approval process. The Vault Admin has been asked to look at the
account and identify who can approve their request.
What is the correct location to identify users or groups who can approve?
A. PVWA > Administration > Platform Configuration > Edit Platform > UI & Workflow > Dual
Control > Approvers
B. PVWA > Policies > Access Control (Safes) > Select the safe > Safe Members > Workflow >
Authorize Password Requests
C. PVWA > Account List > Edit > Show Advanced Settings > Dual Control > Direct Managers
D. PrivateArk > Admin Tools > Users and Groups > Auditors (Group Membership) - Answer
Answer: B
What must you specify when configuring a discovery scan for UNIX? (Choose two.)
A. Vault Administrator
B. CPM Scanner
C. root password for each machine
D. list of machines to scan
E. safe for discovered accounts - Answer Answer: BD
To change the safe where recordings are kept for a specific platform, which setting must you
update in the platform configuration?
A. SessionRecorderSafe
B. SessionSafe
C. RecordingsPath
D. RecordingLocation - Answer Answer: A
Which processes reduce the risk of credential theft? (Choose two.)
A. require dual control password access approval
B. require password change every X days
C. enforce check-in/check-out exclusive access
D. enforce one-time password access - Answer Answer: BD
You are onboarding 5,000 UNIX root accounts for rotation by the CPM. You discover that the
CPM is unable to log in directly with the root account and will need to use a secondary account.
, How can this be configured to allow for password management using least privilege?
A. Configure each CPM to use the correct logon account.
B. Configure each CPM to use the correct reconcile account.
C. Configure the UNIX platform to use the correct logon account.
D. Configure the UNIX platform to use the correct reconcile account. - Answer Answer: C
Which methods can you use to add a user directly to the Vault Admin Group? (Choose three.)
A. REST API
B. PrivateArk Client
C. PACLI
D. PVWA
E. Active Directory
F. Sailpoint - Answer Answer: ABC
Which Automatic Remediation is configurable for a PTA detection of a "Suspected Credential
Theft"?
A. Add to Pending
B. Rotate Credentials
C. Reconcile Credentials
D. Disable Account - Answer Answer: B
Which item is an option for PSM recording customization?
A. Windows events text recorder with automatic play-back
B. Windows events text recorder and universal keystrokes recording simultaneously
C. Universal keystrokes text recorder with windows events text recorder disabled
D. Custom audio recording for windows events - Answer Answer: C
You want to create a new onboarding rule.
Where do you accomplish this?
A. In PVWA, click Reports > Unmanaged Accounts > Rules
B. In PVWA, click Options > Platform Management > Onboarding Rules
C. In PrivateArk, click Tools > Onboarding Rules
D. In PVWA, click Accounts > Onboarding Rules - Answer Answer: D
What does the Export Vault Data (EVD) utility do?
