CyberArk Defender Exam Questions and Answers 2022

Users can be restricted to using certain CyberArk interfaces (e.g. PVWA or PACLI) - ANSWER True It is impossible to override Master Policy settings for a Platform - ANSWER False It is possible to restrict the time of day, or day of week that a verify process can occur - ANSWER True Users who have the 'Access Safe without confirmation' safe permission on a safe where accounts are configured for Duel control, still need to request approval to use the account - ANSWER False Which of the following statements are NOT true when enabling PSM recording for a target Windows server? - ANSWER a. The PSM software must be installed on the target server b. PSM connect must be added as a local user on the target server What is the purpose of the Immediate Interval setting in a CPM policy? - ANSWER To control the maximum amount of time the CPM will wait for a password change to complete It is possible to control the hours of the day during which a user may log into the vault - ANSWER True PSM captures a record of each command that was issued in SQL Plus - ANSWER True Target account platforms can be restricted to accounts that are stored in specific Safes using the Allowed Safes property - ANSWER True PSM captures a record of each command that was executed in Unix - ANSWER True Which report could show all audit data in the vault? - ANSWER Activity Log The primary purpose of exclusive accounts is to ensure non-repudiation (individual accountability) - ANSWER True Which of the following files must be created or configured in order to run Password Upload Utility? - ANSWER V, C, A comma delimited upload file The Password upload utility can be used to create safes - ANSWER True When managing SSH keys, CPM automatically pushes the Public Key to the target system - ANSWER True It is possible to leverage DNA to provide discovery functions that are not available with auto-detection - ANSWER True If a user is a member of more than one group that has authorizations on a safe, by default that user is granted ______________. - ANSWER The cumulative permissions of all the groups to which that user belongs Reports can be scheduled to run on a periodic basis - ANSWER True In accordance with best practice, SSH access is denied for root accounts on UNIX/LINUX systems. What is the BEST way to allow CPM to manage root accounts? - ANSWER Create a non-privileged account on the target server. Allow this account the ability to SSH directly from the CPM machine. Configure this account as the Logon account of the target server's root account. Which user is automatically given all Safe authorizations on all Safes? - ANSWER Master The System safe allows access to the Vault configuration files - ANSWER True Ad-Hoc (formerly Secure Connect) provides the following features: - ANSWER PSM connections to target devices that are not managed by CyberArk, Session Recording, Real-Time live session monitoring Which report provides a list of accounts stored in the vault? - ANSWER Privileged Accounts Inventory One-time passwords reduce the risk of Pass the Hash vulnerabilities in Windows - ANSWER True In order to connect to a target device through PSM, the account credentials used for the connection must be stored in the vault? - ANSWER FALSE. Because if credentials are not stored in the vault, the PSM will prompt for credentials SAFE authorizations may be granted to _____. - ANSWER Vault users, Vault groups, LDAP users, LDAP groups Which CyberArk components or products can be used to discover Windows Services or Scheduled Tasks that use privileged accounts? - ANSWER Discovery and Audit (DNA), Auto Detection (AD, Accounts Discovery It is possible to control the hours of the day during which a safe may be used - ANSWER True What is the purpose of the Head Start Interval setting in a platform? - ANSWER It instructions the CPM to initiate the password change process X number of days before expiration You have associated a logon account to one of your UNIX root accounts to the vault. When attempting to verify the root accounts password will... - ANSWER Log in first with the logon account, then run the su command to log in as root using the password vault A Reconcile account can be specified in the platform settings - ANSWER True When managing SSH keys, CPM automatically pushes the Private Key to all systems that use it - ANSWER False What is the purpose of the Allowed Safes parameter in a CPM policy? - ANSWER To improve performane by reducing CPM workload, to prevent accidental use of a policy in the wrong safe A Logon Account can be specified in the Master Policy - ANSWER False Which one of the following reports is NOT generated by using the PVWA? - ANSWER Safes List Vault authorizations may be granted to - ANSWER Vault Users, LDAP Users When On-boarding accounts using Accounts Feed, which of the following is true? - ANSWER You can specify the name of a new safe that will be created where the account will be stored when it is on-boarded to the Vault What is the maximum number of levels of authorizations you can set up in Dual Control? - ANSWER 2