Defender PAM Sample Questions And Verified Correct Answers Guaranteed Answers.

Which values are acceptable in the address field of an Account? - correct answer Any name that is resolvable on the Central Policy Manager (CPM) server is acceptable. The Account Feed contains: - correct answer Accounts that were discovered by CyberArk that have not yet been onboarded. The password upload utility must run from the Central Policy Manager (CPM) server. (T/F) - correct answer False Accounts Discovery allows secure connections to domain controllers. (T/F) - correct answer True The password upload utility can be used to create Safes? (T/F) - correct answer True Which account onboarding method is considered proactive? - correct answer A Rest API integration with account provisioning software. When creating an onboarding rule, it will be executed upon _____? - correct answer Any future accounts discovered by a discovery process What are the functions of the Remote Control Agent Service (3)? - correct answer 1. Allows remote monitoring of the vault 2. Sends SNMP traps from the Vault 3. Allows CyberArk services to be managed (start/stop/status) remotely The Vault administrator can change the Vault license by uploading the new License to the system safe? (T/F) - correct answer True CyberArk implements license limits by controlling the number and types of users that can be provisioned in the Vault? (T/F) - correct answer True PSM for Windows (previously known as RDP Proxy) supports connections to which target systems? - correct answer Windows, Unix, and Oracle PSH for SSH (previously known as PSM-SSH Proxy) supports connections to which of the following target systems? - correct answer Unix Within the Vault each password is encrypted by what? - correct answer Its own unique key Which utilities could a Vault admin use to change debugging levels on the Vault without having to restart the cault? - correct answer PAR Agent & PrivateArk Server Central Admin How does the vault admin apply a new license file? - correct answer Upload the file to the system safe Which keys are required to be present in order to start the PrivateArk Server service? - correct answer Recovery public key & Server key What is the purpose of the CyberArk Event Notification Engine service? - correct answer It sends email messages from the Vault What is the purpose of the PrivateArk Database service? - correct answer Maintains vault metadata What is the purpose of the PrivateArk Server service? - correct answer Makes vault data accessible to components What is best practice for storing the Master CD? - correct answer Store the CD in a secure location, such as a physical safe What are two secure options for storing the contents of the Operator CD, while still allowing the contents to be accessible upon a planned Vault restart? - correct answer Store the CD in a physical safe and mount the CD every time vault maintenance is performed. Copy the contents of the CD to a folder on the vault server and secure it with NTFS permissions. Store the server key in a Hardware Security Module. What service should NOT be running on the DR Vault when the primary Production Vault is up? - correct answer PrivateArk Server What log contains info about errors related to the PTA - correct answer When a DR Vault Server becomes an active vault, it will automatically fail back to the original state once the Primary Valt comes back online? (T/F) - correct answer False, this is not possible When a DR Vault Server becomes an active vault, it will automatically revert back to DR mode once the Primary Vault comes back online? (T/F) - correct answer False; the Vault admin must manually set the DR Vault to DR mode by setting "FailoverMode=no" in the file What component can be used to create a tape backup of the vault? - correct answer Replicate A vault admin has associated a logon account to one of their UNIX root accounts in the Vault. When attempting to change the root account's password the Central Policy Manager will: - correct answer login to the system as the logon account, run the SU command to login as root, and then change the root's password For a safe with object level; access control enabled the Vault admin is able to turn off the object level access control when it is no longer needed on the safe? (T/F) - correct answer False Does the vault support Subnet Based Access Control? - correct answer Yes Assuming the Safe has been configured to be accessible during certain hours of the day, a Vault admin may still access that Safe outside those hours? (T/F) - correct answer False A Simple Mail Transfer Protocol (SMTP) integrating is critical for monitoring Vault activity and facilitating workflow processes, such as Dual Control? (T/F) - correct answer True What is the purpose of the password verify process? - correct answer To test that CyberArk is storing accurate credentials fr accounts What is the purpose of the password change process? - correct answer To change the passoword of an account according to organizationally defined password rules In order to grant a permission to a user, an admin MUST possess that permission? (T/F) - correct answer True A logon account can be specified in the platform settings? (T/F) - correct answer True What Master Policy settings must be active in order to have an account checked out by one user for a pre-determined amount of time? - correct answer Enforce check-in/check-out exclusive access and enforce one-time password access What combo of Safe member permissions will allow end users to log in to a remote machine transparently but NOT show or copy the password? - correct answer User, List Accounts CyberArk recommends implementing object level access control on all Safes? (T/F) - correct answer False Which credentials does CyberArk use when managing a Target account? - correct answer The credentials of the Target account What is the purpose of the reconcile process? - correct answer Manage lost or unknown credentials What is the process to remove object level access control from a Safe? - correct answer This cannot be done Access control to passwords is implemented by? - correct answer Safe authorizations If a user is a member of more than one group that has authorizations on a Safe, by default that user is granted what? - correct answer The cumulative permissions of all the groups to which that user belongs Users who have the "Access Safe without confirmation" permission on a Safe where accounts are configured for Dual Control still need to request approval to use the account? (T/F) - correct answer False