Question 1

Which statement is correct about using the AllowedSafes platform parameter?

Accepted Answer

The correct statement about using the AllowedSafes platform parameter is that it prevents the Central Policy Manager (CPM) from scanning all safes, restricting it
to scan only safes that match the AllowedSafes configuration. This parameter is crucial in large-scale deployments where efficiency and resource management are
key. By specifying which safes the CPM should manage, unnecessary scanning of irrelevant safes is avoided, thus optimizing the CPM's performance and
reducing the load on the CyberArk environment. This configuration can be found in the platform management section of the CyberArk documentation.

Question 2

After a scripted installation has successfully installed the PSM, which post-installation task is performed?

Accepted Answer

After the successful scripted installation of the Privileged Session Manager (PSM), one of the post-installation tasks is to disable the screen saver for the PSM
local users. This is done to ensure that the PSMConnect and PSMAdminConnect users, which are created during the installation process, do not have a screen
saver activated that could interfere with the operation of the PSM.
References:
? CyberArk documentation on PSM post-installation tasks1.
? CyberArk documentation on disabling the screen saver for PSM local users

Question 3

How should you configure PSM for SSH to support load balancing?

Accepted Answer

To support load balancing for PSM for SSH, the configuration should be done by using a network load balancer. This method involves placing a network load
balancer in front of multiple PSM for SSH servers to distribute incoming SSH traffic evenly among them. This setup enhances the availability and scalability of PSM
for SSH by ensuring that no single server becomes a bottleneck, thereby improving performance and reliability during high usage scenarios.

Question 4

During CPM hardening, which locally created users are granted Logon as a Service rights in the local group policy? (Choose 2.)

Accepted Answer

During the Central Policy Manager (CPM) hardening process, the locally created users that are granted 'Logon as a Service' rights in the local group policy are
typically PasswordManager and PasswordManagerUser. These accounts are crucial for the CPM??s operation as they handle password management tasks and
require the ability to log on as a service to perform their functions effectively. This configuration is established to ensure that these service accounts can operate
under service control manager without interruption, which is critical for automated password rotations and other security processes managed by the CPM. This
detail is typically outlined in the CyberArk CPM installation and configuration guide.

Question 5

Which statement is correct regarding the LDAP integration with CyberArk Privilege Cloud Standard?

Accepted Answer

For LDAP integration with CyberArk Privilege Cloud Standard, the correct statement is that only the Issuing CA certificate is required for certificate trust to your
directory server. This setup simplifies the process of establishing a trusted connection between CyberArk and the LDAP server by necessitating only the
certification of the issuing Certificate Authority (CA), rather than needing multiple certificates from different levels of the trust chain. This approach ensures that the
SSL/TLS communication between CyberArk and the LDAP server is secured based on the trust of the issuing CA??s certificate.

Question 6

When installing the first CPM within Privilege Cloud using the Connector Management Agent, what should you set the Installation Mode to in the CPM section?

Accepted Answer

When installing the first CyberArk Privilege Management (CPM) instance in the Privilege Cloud using the Connector Management Agent, the installation mode
should be set to "Active". This configuration sets the CPM to be actively involved in password management and task processing without being in a standby or
passive mode. Here are the step-by-step details:
? Download the Connector Management Agent: Obtain the installer from the CyberArk Marketplace or your installation kit.
? Run the Installer: Start the setup and select the CPM component to install.
? Choose Installation Mode: When prompted, select "Active" as the installation mode. This sets up the CPM as the primary node responsible for handling
password management operations.
This setup ensures that the CPM is immediately active and capable of handling requests without waiting for manual intervention or failover.
Reference: CyberArk??s official documentation provides guidance on setting up the CPM, where it specifies the modes and their purposes.

Question 7

In large-scale environments, it is important to enable the CPM to focus its search operations on specific Safes instead of scanning all Safes it sees in the Vault.
How is this accomplished?

Accepted Answer

In large-scale environments, to enable the Central Policy Manager (CPM) to focus its search operations on specific Safes instead of scanning all Safes it sees in
the Vault, the AllowedSafes parameter on each platform policy is used. This parameter can be configured within the platform settings in the CyberArk
administration interface. By specifying safes in the AllowedSafes parameter, the CPM will only manage credentials within those designated safes, thereby
optimizing performance and managing resources more efficiently by not scanning unnecessary safes. This setting is crucial for large environments where the CPM
needs to be as efficient as possible due to the volume of managed accounts.

Question 8

Your customer is using Privilege Cloud Shared Services. What is the correct CyberArk Vault address for this customer?

Accepted Answer

For customers using CyberArk Privilege Cloud Shared Services, the correct format for the CyberArk Vault address is: ? vault-.privilegecloud.cyberark.cloud (Option B). This format is used to access the vault services provided by CyberArk in the cloud environment, where is the unique identifier assigned to the customer??s specific instance of the Privilege Cloud. Reference: CyberArk??s Privilege Cloud documentation provides details on how to access various services, including the vault. The standard naming convention for accessing the vault services in the cloud typically follows this format.

Question 9

According to best practice, when considering the location of PSM Connector servers in Privilege Cloud environments, where should the PSM be placed?

Accepted Answer

According to best practice, when considering the location of PSM Connector servers in Privilege Cloud environments, the PSM should be placed near the target
devices. This placement minimizes latency and maximizes performance by reducing the distance that data has to travel between the PSM servers and the devices
they are managing. This is particularly important for maintaining high efficiency and response times during remote session management and operations, which are
critical for the overall effectiveness of the Privilege Cloud environment.

(50 New Questions)

Question 10

To disable the PSM default Support for Browser Sessions, which option should be set to 'No* before running Hardening?

Accepted Answer

To disable the PSM default support for browser sessions, the option SupportBrowsers should be set to 'No' before running the hardening process. This
configuration change is made within the PSM??s configuration files, typically found in the PSM's administrative interface or directly within specific XML
configuration files like PSMHardening.xml. Setting this option to 'No' prevents the PSM from processing session requests that involve web browsers, thereby
enhancing security by limiting the session types the PSM will support. This setting is particularly important in environments where web browsing sessions are
deemed unnecessary or too risky.