Question 1

You have been asked to turn off the time access restrictions for a safe. Where is this setting found?

Accepted Answer

The time access restrictions for a safe are configured in the PrivateArk Administrative Client, which is a graphical user interface that allows users to manage safes
and their properties. The time access restrictions are set in the Time Access Restrictions tab of the Safe properties window. This tab enables users to specify the
days and hours when the safe can be accessed. If the time access restrictions are turned off, the safe can be accessed at any time. References: PrivateArk Safe
management, Advanced Safe Management

Question 2

Which one the following reports is NOT generated by using the PVWA?

Accepted Answer

The PVWA can generate various reports on the privileged accounts and applications in the system, based on different filters and criteria. However, the Safes List
report is not one of them. The Safes List report is generated by using the PrivateArk Client, and it provides a list of Safes and their properties according to location.
References:
Defender-PAM Study Guide, Reports and Audits

Question 3

Which of the Following can be configured in the Master Poky? Choose all that apply.

Accepted Answer

The Master Policy is a centralized overview of the security and compliance policy of privileged accounts in the organization. It allows the administrator to configure
compliance driven rules that are defined as the baseline for the enterprise. The Master Policy includes the following main concepts1:
? Basic policy rules: These rules allow the administrator to define specific aspects of privileged account management, such as privileged access workflows,
password management, session monitoring and auditing.
? Advanced policy rules: Some basic policy rules have related advanced settings that provide more granular control over the policy enforcement.
? Exceptions: These are policy rules that differ from the overall Master Policy for a specific scope of accounts, such as accounts associated with a specific
platform.
The Master Policy rules are divided into four sections2:
? Privileged Access Workflows: These rules define how the organization manages access to privileged accounts, such as requiring dual control, one-time
passwords, exclusive passwords, transparent connections, reason for access, etc.
? Password Management: These rules determine how passwords are managed, such as requiring password change, password verification, password
reconciliation, ticketing integration, required properties, custom connection components, etc.
? Session Management: These rules determine whether or not privileged sessions are recorded and how they are monitored, such as requiring session isolation,
session recording, session audit, etc.
? Audit: This rule determines how Safe audits are retained, such as specifying the audit retention period.
Based on the above information, the following options can be configured in the Master Policy:
? A. Dual Control: This is a basic policy rule in the Privileged Access Workflows
section that determines whether users need to get approval from authorized users before accessing a privileged account2.
? B. One Time Passwords: This is a basic policy rule in the Privileged Access
Workflows section that determines whether users can only use a password once before it is changed2.
? C. Exclusive Passwords: This is a basic policy rule in the Privileged Access
Workflows section that determines whether users need to check out a password and prevent other users from accessing it until it is checked in2.
? H. Password Aging Rules: This is a basic policy rule in the Password Management
section that determines how often passwords need to be changed2. The following options cannot be configured in the Master Policy:
? D. Password Reconciliation: This is not a policy rule, but a process that restores
the password of a privileged account to the value that is stored in the Vault, in case it is changed or out of sync3.
? E. Ticketing Integration: This is not a policy rule, but a feature that enables the
integration of the Vault with external ticketing systems, such as ServiceNow, Jira, etc.
? F. Required Properties: This is not a policy rule, but a platform setting that determines which properties are mandatory for adding accounts to a platform.
? G. Custom Connection Components: This is not a policy rule, but a platform setting that determines which connection components are used to connect to target
systems, such as PVWA, PSM, PSMP, etc.
References:

From SurePassExam
https://www.surepassexam.com/PAM-DEF-exam-dumps.html (239 New Questions)
? 1: The Master Policy
? 2: Master Policy Rules
? 3: Password Reconciliation
? : Ticketing Integration
? : Required Properties
? : Custom Connection Components

Question 4

DRAG DROP
For each listed prerequisite, identify if it is mandatory or not mandatory to run the PSM Health Check.

Accepted Answer

According to the CyberArk documentation1, the prerequisites for running the PSM Health Check are:
? PSM service installed on Windows 2016 or Windows 2019
? Web Server (IIS 8.5) role is installed
? A valid SSL certificate is installed on the Web Server
Therefore, these prerequisites are mandatory for the PSM Health Check to work properly. The PSM service installed on Windows 2008 R2 is not mandatory, as it
is not supported by the PSM Health Check2.
References: PSM Health Check, PSM Health Check - CyberArk

Question 5

A new domain controller has been added to your domain. You need to ensure the CyberArk infrastructure can use the new domain controller for authentication.
Which locations must you update?

Accepted Answer

When a new domain controller is added to a domain, it is necessary to update the CyberArk infrastructure to ensure it can use the new domain controller for
authentication. This involves updating the hosts file on theVault server located
at Windows\System32\Etc\Hosts to include the new domain controller’s details. Additionally, within the PVWA Application, you need to navigate to Administration
> LDAP Integration > Directories > Hosts and update the information there as well. This ensures that both the Vault server and the PVWA Application are aware of
the new domain controller and can authenticate against it1.
References:
? CyberArk’s official documentation on configuring Active Directory integration, which includes details on setting up domain controllers for authentication2.
? Information on adding Active Directory as a directory service in CyberArk Identity, which discusses the integration of domain controllers3.

Question 6

A new HTML5 Gateway has been deployed in your organization. Where do you configure the PSM to use the HTML5 Gateway?

Accepted Answer

After deploying a new HTML5 Gateway in your organization, you configure the PSM to use the HTML5 Gateway by navigating to the Administration section in the
PVWA. From there, you go to Options, then Privileged Session Management, and under Configured PSM Servers, you will find the option to Add PSM Gateway1.
This is where you can specify the details of the newly deployed HTML5 Gateway to ensure that the PSM can utilize it for secure remote access to target machines
through an HTML5-based session. References:
? CyberArk’s official documentation provides a step-by-step guide on how to install and configure the PSM HTML5 Gateway, including the process of adding the
gateway to the PSM configuration1.
? For more detailed instructions and best practices on configuring the PSM with an HTML5 Gateway, refer to the CyberArk Defender PAM course materials and
study guides

Question 7

What is the purpose of a linked account?

Accepted Answer

A linked account is an account that is associated with another account to enable the password management process. A linked account can be used for various
purposes, such as logging on to a target system, changing the password of another account, or enabling privileged commands. A linked account can be defined
either on the platform level or on the account level, depending on the type and scope of the linked account. The types of linked accounts that are supported by
CyberArk are1:
? Logon account: An account that contains the password required to log on to a remote machine in order to perform a task using the regular account. A common
use case for using a logon account is managing root accounts on a Unix system. The best practice for Unix systems is to disallow the root user from logging in
using SSH. However, SSH is what the CPM uses to sign in to a system to manage the password. To manage the root password without violating this practice, the
CPM establishes the session with a non-root account and then SUs to root (the target account). This is done using a linked account called a logon account.
? Reconcile account: An account that contains the password used in reconciliation processes. Reconciliation is a process that restores the password of a
privileged account to the value that is stored in the Vault, in case it is changed or out of sync. A reconcile account is a privileged account that has the permission to
reset the password of another account on the target system. By associating a reconcile account with the target account, the CPM can use the reconcile account to
restore the password of the target account, in case it is changed or out of sync.
? Other additional accounts: Additional accounts can be used in various cases. For example:
The other options are not the purpose of a linked account, because:
? A. To ensure that a particular collection of accounts all have the same password.
This is not the purpose of a linked account, but of a group account. A group account is an account that is associated with multiple target systems that share the
same credentials. A group account allows the CPM to manage the password of multiple systems with a single password object in the Vault2.
? B. To ensure a particular set of accounts all change at the same time. This is not the purpose of a linked account, but of a password change schedule. A
password change schedule is a feature that allows the administrator to define a time frame for changing the passwords of a set of accounts. A password change
schedule can be configured either in the Master Policy or in the Platform settings3.
? C. To connect the CPNI to a target system. This is not the purpose of a linked account, but of a service account. A service account is an account that is used by
a service or an application to connect to a target system. A service account can be managed by the Central Credential Provider (CCP), which is a component that
provides applications and services with the credentials they need to access target systems4.
References:
? 1: Linked Accounts
? 2: Group Accounts
? 3: Password Change Schedule
? 4: Service Accounts

Question 8

Which of the following logs contains information about errors related to PTA?

Accepted Answer

According to the web search results, the diamond.log is the main log file that records the PTA system activities, such as receiving and processing events,
generating alerts, and sending notifications1. The diamond.log also contains information about errors related to PTA, such as connection failures, configuration
issues, parsing problems, or internal exceptions2. The diamond.log can be found in the /opt/tomcat/logs directory on the PTA machine1. The debug level of the
diamond.log can be changed using the changeLogLevel.sh utility or manually editing the log4j.properties file1. The diamond.log can be used for troubleshooting
PTA issues and viewing statistics

Question 9

A user is receiving the error message “ITATS006E Station is suspended for User jsmith” when attempting to sign into the Password Vault Web Access (PVWA).
Which utility would a Vault administrator use to correct this problem?

Accepted Answer

The PrivateArk is a utility that allows the Vault administrator to access and manage the Vault data, users, groups, policies, and settings. The PrivateArk can be
used to correct the problem of a user receiving the error message “ITATS006E Station is suspended for User jsmith” when attempting to sign into the PVWA. The
error message means that the user has exceeded the number of invalid password attempts and has been locked out from the Vault. To unlock the user, the Vault
administrator can use the PrivateArk to activate the suspended station for the user in the Trusted Net Areas1.
The other options are not utilities that can be used to correct this problem. The createcredfile.exe is a utility that creates a credential file for the CPM to connect to
the target systems2. The cavaultmanager.exe is a utility that performs various Vault maintenance tasks, such as backup, restore, and encryption3. The PVWA is
not a utility, but a web interface that allows the users to access and use the Vault features, such as
managing accounts, requesting passwords, and initiating sessions. References:
? Vault - ITATS006E Station is suspended for User Administrator - force.com, section “Resolution”
? Create a Credential File - CyberArk, section “Create a Credential File”
? Vault Maintenance - CyberArk, section “Vault Maintenance”
? [Password Vault Web Access - CyberArk], section “Password Vault Web Access”

Question 10

You have been given the requirement that certain accounts cannot have their passwords updated during business hours.
How can you set up a configuration to meet this requirement?

Accepted Answer

To ensure that certain accounts do not have their passwords updated during business hours, you can configure the password change parameters within the
platform settings to specify the permitted time frame for updates. This involves setting the FromHour andToHour parameters to define a window outside of
business hours during which the CyberArk Central Policy Manager (CPM) will perform automatic password changes1. By doing so, you can control when password
changes occur and ensure compliance with the specified requirement.
References:
? CyberArk Community: Discussion on configuring automatic password change parameters