Special Summer Sale - Special 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: 70dumps

PAM-CDE-RECERT Questions and Answers

Question # 6

In a default CyberArk installation, which group must a user be a member of to view the “reports” page in PVWA?

A.

PVWAMonitor

B.

ReportUsers

C.

PVWAReports

D.

Operators

Full Access
Question # 7

According to the DEFAULT Web Options settings, which group grants access to the REPORTS page?

A.

PVWAUsers

B.

Vault Admins

C.

Auditors

D.

PVWAMonitor

Full Access
Question # 8

The Accounts Feed contains:

A.

Accounts that were discovered by CyberArk in the last 30 days

B.

Accounts that were discovered by CyberArk that have not yet been onboarded

C.

All accounts added to the vault in the last 30 days

D.

All users added to CyberArk in the last 30 days

Full Access
Question # 9

Match the Status of Service on a DR Vault to what is displayed when it is operating normally in Replication mode.

Full Access
Question # 10

You need to move a platform from using PMTerminal to using Terminal Plugin Controller (TPC) What must you do?

A.

Within PVWA

Click Administration > Platform Management

Select the platform and then click Edit.

In the left pane, click Automatic Password Management > CPM Plug-in

Set the ExeName parameter value to CyberArk TPC exe

B.

Using PnvateArk. select the PasswordManager_Shared safe, and then select open Locate the mi file relating to the platform you wish to change and double click

At the bottom of the file, insert a line "UseTPC = True" Remove any lines that reference "PMTerminal" and save Return the mi file to the safe Restart CPM for this change to take effect

C.

Open the process file of the platform you wish to configure to use TPC Add the following parameter under the States section; "use TPC=yes"

D.

It is not possible to change a platform from using PMTerminal to using TPC You must locate a new version of the platform that supports TPC and import the new platform over-writing the existing platform

Full Access
Question # 11

You need to recover an account localadmin02 for target server 10.0.123.73 stored in Safe Team1.

What do you need to recover and decrypt the object? (Choose three.)

A.

Recovery Private Key

B.

Recover.exe

C.

Vault data

D.

Recovery Public Key

E.

Server Key

F.

Master Password

Full Access
Question # 12

Match each component to its respective Log File location.

Full Access
Question # 13

What is the default username for the PSM for SSH maintenance user?

A.

proxymng

B.

psmpjnamtenance

C.

psmpma/ntenanceuser

D.

psmpmnguser

Full Access
Question # 14

For a safe with Object Level Access enabled you can turn off Object Level Access Control when it no longer needed on the safe.

A.

TRUE

B.

FALSE

Full Access
Question # 15

When a DR Vault Server becomes an active vault, it will automatically fail back to the original state once the Primary Vault comes back online.

A.

True; this is the default behavior

B.

False; this is not possible

C.

True, if the AllowFailback setting is set to “yes” in the padr.ini file

D.

True, if the AllowFailback setting is set to “yes” in the dbparm.ini file

Full Access
Question # 16

A Logon Account can be specified in the Master Policy.

A.

TRUE

B.

FALSE

Full Access
Question # 17

Which step is required to register a Vault manually in Amazon Web Services using CAVaultManager?

A.

Specify Amazon as the cloud vendor using the CloudVendor Flag

B.

After running the postinstall utility, restart the "PrivateArk Server" service

C.

Specify the Cloud region using the /CloudRegion flag

D.

Specify whether the Vault is distributed or stand alone

Full Access
Question # 18

dbparm.ini is the main configuration file for the Vault.

A.

True

B.

False

Full Access
Question # 19

You are logging into CyberArk as the Master user to recover an orphaned safe.

Which items are required to log in as Master?

A.

Master CD, Master Password, console access to the Vault server, Private Ark Client

B.

Operator CD, Master Password, console access to the PVWA server, PVWA access

C.

Operator CD, Master Password, console access to the Vault server, Recover.exe

D.

Master CD, Master Password, console access to the PVWA server, Recover.exe

Full Access
Question # 20

CyberArk user Neil is trying to connect to the Target Linux server 192.168.1.64 using a domain account ACME/linuxuser01 on Domain Acme.corp using PSM for SSH server 192.168.65.145. What is the correct syntax?

A.

Ssh neil@linuxuser01:acme.corp@192.168.1.64@192.168.1.45

B.

Ssh neil@linuxuser01#acme.corp@192.168.1.64@192.168.1.45

C.

Ssh neil@linuxuser01@192.168.1.64@192.168.65.145

D.

Ssh neil@linuxuser01@acme.corp@192.168.1.64@192.168.1.45

Full Access
Question # 21

What is the configuration file used by the CPM scanner when scanning UNIX/Linux devices?

A.

UnixPrompts.ini

B.

plink.exe

C.

dbparm.ini

D.

PVConfig.xml

Full Access
Question # 22

What is a prerequisite step before CyberArk can be configured to support RADIUS authentication?

A.

Log on to the PrivateArk Client, display the user properties of the user to configure, run the Authentication method drop-down list, and select RADIUS authentication.

B.

In the RADIUS server, define the CyberArk Vault as RADIUS client/agent.

C.

In the Vault Installation folder, run CAVaultManger as Administrator with the SecureSecretFiles command.

D.

Navigate to /Server/Conf and open DBParms.ini and set the RadiusServersInfo parameter.

Full Access
Question # 23

You have been asked to design the number of PVWAs a customer must deploy. The customer has three data centers with a distributed vault in each, requires high availability, and wants to use all vaults, at all times. How many PVWAs does the customer need?

A.

six

B.

four

C.

two

D.

three

Full Access
Question # 24

Select the best practice for storing the Master CD.

A.

Copy the files to the Vault server and discard the CD

B.

Copy the contents of the CD to a Hardware Security Module (HSM) and discard the CD

C.

Store the CD in a secure location, such as a physical safe

D.

Store the CD in a secure location, such as a physical safe, and copy the contents of the CD to a folder secured with NTFS permissions on the Vault

Full Access
Question # 25

It is possible to restrict the time of day, or day of week that a [b]verify[/b] process can occur

A.

TRUE

B.

FALSE

Full Access
Question # 26

Which of the following PTA detections require the deployment of a Network Sensor or installing the PTA Agent on the domain controller?

A.

Suspected credential theft

B.

Over-Pass-The-Hash

C.

Golden Ticket

D.

Unmanaged privileged access

Full Access
Question # 27

One can create exceptions to the Master Policy based on ____________________.

A.

Safes

B.

Platforms

C.

Policies

D.

Accounts

Full Access
Question # 28

What is the purpose of the Interval setting in a CPM policy?

A.

To control how often the CPM looks for System Initiated CPM work.

B.

To control how often the CPM looks for User Initiated CPM work.

C.

To control how long the CPM rests between password changes.

D.

To control the maximum amount of time the CPM will wait for a password change to complete.

Full Access
Question # 29

Can the 'Connect' button be used to initiate an SSH connection, as root, to a Unix system when SSH access for root is denied?

A.

Yes, when using the connect button, CyberArk uses the PMTerminal.exe process which bypasses the root SSH restriction.

B.

Yes, only if a logon account is associated with the root account and the user connects through the PSM-SSH connection component.

C.

Yes, if a logon account is associated with the root account.

D.

No, it is not possible.

Full Access
Question # 30

You are installing multiple PVWAs behind a load balancer. Which statement is correct?

A.

Port 1858 must be opened between the load balancer and the PVWAs

B.

The load balancer must be configured in DNS round robin.

C.

The load balancer must support "sticky sessions".

D.

The LoadBalancerClientAddressHeader parameter in the PVwA.ini file must be set.

Full Access
Question # 31

When creating an onboarding rule, it will be executed upon.

A.

All accounts in the pending accounts list

B.

Any future accounts discovered by a discovery process

C.

Both “All accounts in the pending accounts list” and “Any future accounts discovered by a discovery process”

Full Access
Question # 32

The System safe allows access to the Vault configuration files.

A.

TRUE

B.

FALS

Full Access
Question # 33

Which onboarding method would you use to integrate CyberArk with your accounts provisioning process?

A.

Accounts Discovery

B.

Auto Detection

C.

Onboarding RestAPI functions

D.

PTA Rules

Full Access
Question # 34

Match each PTA alert category with the PTA sensors that collect the data for it.

Full Access
Question # 35

A customer is deploying PVWAs in the Amazon Web Services Public Cloud. Which load balancing option does CyberArk recommend?

A.

Network Load Balancer

B.

Classic Load Balancer

C.

HTTPS load balancer

D.

Public standard load balancer

Full Access
Question # 36

Time of day or day of week restrictions on when password verifications can occur configured in ____________________.

A.

The Master Policy

B.

The Platform settings

C.

The Safe settings

D.

The Account Details

Full Access
Question # 37

You are helping a customer prepare a Windows server for PSM installation. What is required for a successful installation?

A.

Window 2012 KB4558843

B.

Remote Desktop services (RDS) Session Host Roles

C.

Windows 2016 KB4558843

D.

Remote Desktop services (RDS) Session Broker

Full Access
Question # 38

PSM captures a record of each command that was executed in Unix.

A.

TRIE

B.

FALSE

Full Access
Question # 39

In order to connect to a target device through PSM, the account credentials used for the connection must be stored in the vault?

A.

True.

B.

False. Because the user can also enter credentials manually using Secure Connect.

C.

False. Because if credentials are not stored in the vault, the PSM will log into the target device as PSM Connect.

D.

False. Because if credentials are not stored in the vault, the PSM will prompt for credentials.

Full Access
Question # 40

Users can be resulted to using certain CyberArk interfaces (e.g.PVWA or PACLI).

A.

TRUE

B.

FALS

Full Access
Question # 41

Due to network activity, ACME Corp’s PrivateArk Server became active on the OR Vault while the Primary Vault was also running normally. All the components continued to point to the Primary Vault.

Which steps should you perform to restore DR replication to normal?

A.

Replicate data from DR Vault to Primary Vault > Shutdown PrivateArk Server on DR Vault > Start replication on DR vault

B.

Shutdown PrivateArk Server on DR Vault > Start replication on DR vault

C.

Shutdown PrivateArk Server on Primary Vault > Replicate data from DR Vault to Primary Vault > Shutdown PrivateArk Server on DR Vault > Start replication on DR vault

D.

Shutdown PrivateArk Server on DR Vault > Replicate data from DR Vault to Primary Vault > Shutdown PrivateArk Server on DR Vault > Start replication on DR vault

Full Access
Question # 42

You are creating a Dual Control workflow for a team’s safe.

Which safe permissions must you grant to the Approvers group?

A.

List accounts, Authorize account request

B.

Retrieve accounts, Access Safe without confirmation

C.

Retrieve accounts, Authorize account request

D.

List accounts, Unlock accounts

Full Access
Question # 43

A new domain controller has been added to your domain. You need to ensure the CyberArk infrastructure can use the new domain controller for authentication.

Which locations must you update?

A.

on the Vault server in Windows\System32\Etc\Hosts and in the PVWA Application under Administration > LDAP Integration > Directories > Hosts

B.

on the Vault server in Windows\System32\Etc\Hosts and on the PVWA server in Windows\System32\Etc\Hosts

C.

in the Private Ark client under Tools > Administrative Tools > Directory Mapping

D.

on the Vault server in the certificate store and on the PVWA server in the certificate store

Full Access
Question # 44

Which type of automatic remediation can be performed by the PTA in case of a suspected credential theft security event?

A.

Password change

B.

Password reconciliation

C.

Session suspension

D.

Session termination

Full Access
Question # 45

Which is the primary purpose of exclusive accounts?

A.

Reduced risk of credential theft

B.

More frequent password changes

C.

Non-repudiation (individual accountability)

D.

To force a ‘collusion to commit’ fraud ensuring no single actor may use a password without authorization

Full Access
Question # 46

A customer is moving from an on-premises to a public cloud deployment. What is the best and most cost-effective option to secure the server key?

A.

Install the Vault in the cloud the same way that you would in an on-premises environment Place the server key in a password protected folder on the operating system

B.

Install the Vault in the cloud the same way that you would in an on-premises environment Purchase a Hardware Security Module to secure the server key

C.

Install the Vault using the Amazon Machine Images and secure the server key using native cloud Key Management Systems

D.

Install the Vault using the Amazon Machine Images and secure the server key with a Hardware Security Module

Full Access
Question # 47

Platform settings are applied to _________.

A.

The entire vault.

B.

Network Areas

C.

Safes

D.

Individual Accounts

Full Access
Question # 48

Which Cyber Are components or products can be used to discover Windows Services or Scheduled Tasks that use privileged accounts? Select all that apply.

A.

Discovery and Audit (DMA)

B.

Auto Detection (AD)

C.

Export Vault Data (EVD)

D.

On Demand Privileges Manager (OPM)

E.

Accounts Discovery

Full Access
Question # 49

In addition to disabling Windows services or features not needed for PVWA operations, which tasks does PVWA Hardening.ps1 perform when run?

A.

Performs IIS hardening: Imports the CyberArk INF configuration

B.

Performs IIS hardening: Configures all group policy settings

C.

Performs IIS hardening: Renames the local Administrator Account

D.

Configures Windows Firewall: Removes all installation files.

Full Access
Question # 50

You have associated a logon account to one your UNIX cool accounts in the vault. When attempting to [b]change [/b] the root account’s password the CPM will…..

A.

Log in to the system as root, then change root's password

B.

Log in to the system as the logon account, then change roofs password

C.

Log in to the system as the logon account, run the su command to log in as root, and then change root’s password.

D.

None of these

Full Access
Question # 51

When a DR Vault Server becomes an active vault, it will automatically revert back to DR mode once the Primary Vault comes back online.

A.

True; this is the default behavior

B.

False, the Vault administrator must manually set the DR Vault to DR mode by setting “FailoverMode=no” in the padr.ini file

C.

True, if the AllowFailback setting is set to “yes” in the padr.ini file

D.

False, the Vault administrator must manually set the DR Vault to DR mode by setting “FailoverMode=no” in the dbparm.ini file

Full Access
Question # 52

Which report shows the accounts that are accessible to each user?

A.

Activity report

B.

Entitlement report

C.

Privileged Accounts Compliance Status report

D.

Applications Inventory report

Full Access
Question # 53

As long as you are a member of the Vault Admins group, you can grant any permission on any safe that you have access to.

A.

TRUE

B.

FALSE

Full Access
Question # 54

Which PTA sensors are required to detect suspected credential theft?

A.

Logs, Vault Logs

B.

Logs, Network Sensor, Vault Logs

C.

Logs, PSM Logs, CPM Logs

D.

Logs, Network Sensor, EPM

Full Access
Question # 55

Which user(s) can access all passwords in the Vault?

A.

Administrator

B.

Any member of Vault administrators

C.

Any member of auditors

D.

Master

Full Access
Question # 56

What is the purpose of the PrivateArk Server service?

A.

Executes password changes

B.

Maintains Vault metadata

C.

Makes Vault data accessible to components

D.

Sends email alerts from the Vault

Full Access
Question # 57

For Digital Vault Cluster in a high availability configuration, how does the cluster determine if a node is down?

A.

The heartbeat s no longer detected on the private network.

B.

The shared storage array is offline.

C.

An alert is generated in the Windows Event log.

D.

The Digital Vault Cluster does not detect a node failure.

Full Access
Question # 58

Which values are acceptable in the address field of an Account?

A.

It must be a Fully Qualified Domain Name (FQDN)

B.

It must be an IP address

C.

It must be NetBIOS name

D.

Any name that is resolvable on the Central Policy Manager (CPM) server is acceptable

Full Access
Question # 59

Which of the following options is not set in the Master Policy?

A.

Password Expiration Time

B.

Enabling and Disabling of the Connection Through the PSM

C.

Password Complexity

D.

The use of “One-Time-Passwords”

Full Access
Question # 60

Secure Connect provides the following. Choose all that apply.

A.

PSM connections to target devices that are not managed by CyberArk.

B.

Session Recording

C.

Real-time live session monitoring.

D.

PSM connections from a terminal without the need to login to the PVWA

Full Access
Question # 61

It is possible to control the hours of the day during which a user may log into the vault.

A.

TRUE

B.

FALSE

Full Access
Question # 62

Which of the following Privileged Session Management solutions provide a detailed audit log of session activities?

A.

PSM (i.e., launching connections by clicking on the "Connect" button in the PVWA)

B.

PSM for Windows (previously known as RDP Proxy)

C.

PSM for SSH (previously known as PSM SSH Proxy)

D.

All of the above

Full Access
Question # 63

SAFE Authorizations may be granted to____________.

Select all that apply.

A.

Vault Users

B.

Vault Group

C.

LDAP Users

D.

LDAP Groups

Full Access
Question # 64

What is the purpose of the password change process?

A.

To test that CyberArk is storing accurate credentials for accounts

B.

To change the password of an account according to organizationally defined password rules

C.

To allow CyberArk to manage unknown or lost credentials

D.

To generate a new complex password

Full Access
Question # 65

You have been asked to limit a platform called "Wmdows_Servers" to safes called "WindowsDCT and "WindowsDC2" The platform must not be assigned to any other safe What is the correct way to accomplish this?

A.

Edit the "Wmdows_Servers" platform, expand "Automatic Password Management", then select General and modify "AllowedSafes" to be (WindowsDC1)|(WindowsDC2).

B.

Edit the "Windows_Servers" platform, expand "Automatic Password Management", then select Options and modify "AllowedSafes" to be (Win")

C.

Edit the "WindowsDCI" and "WindowsDC2" safes through Safe Management. Add "Wmdows_Servers" to the "AliowedPlatforms".

D.

Log in to PnvateArk using an Administrative user, Select File Server File Categories. Locate the category "WindowsServersAllowedSafes" and specify "WindowsDC! WindowsDC2"

Full Access
Question # 66

Which permissions are needed for the Active Directory user required by the Windows Discovery process?

A.

Domain Admin

B.

LDAP Admin

C.

Read/Write

D.

Read

Full Access