New Year Special Limited Time Flat 70% Discount offer - Ends in 0d 00h 00m 00s - Coupon code: 70spcl

CyberArk CAU302 CyberArk Defender + Sentry Exam Practice Test

Page: 1 / 24
Total 237 questions

CyberArk Defender + Sentry Questions and Answers

Question 1

Multiple Vault Servers can be load balanced.

Options:

A.

True

B.

False

Question 2

Which Master Policy Setting(s) must be active in order to have an account checked-out by one user for a predetermined amount of time?

Options:

A.

Require dual control password access Approval

B.

Enforce check-in/check-out exclusive access

C.

Enforce one-time password access

D.

Enforce check-in/check-out exclusive access & Enforce one-time password access

Question 3

Which of the following are prerequisites for installing PVWA Check all that Apply

Options:

A.

Web Services Role

B.

NET 4.5.1 Framework Feature

C.

Remote Desktop Services Role

D.

Windows BitLocker

Question 4

After the Vault Server is installed, the Microsoft Windows Firewall is now commandeered by the Vault Can the administrator change these firewall rules?

Options:

A.

Yes, but the administrator can only modify the firewall rules by editing the dbparm.ini file and the restarting the vault

B.

Yes, the administrator can still modify Firewall rules via the Windows Firewall interface

C.

No, the Vault does not permit any changes to the Firewall due to security requirements

D.

Yes, but the administrator can only modify the firewall rules by editing the FirewallRuIes mi file and the restarting the vault

Question 5

What is the primary purpose of Dual Control?

Options:

A.

Reduced risk of credential theft

B.

More frequent password changes

C.

Non-repudiation (individual accountability)

D.

To force a ‘collusion to commit’ fraud ensuring no single actor may use a password without authorization

Question 6

In the vault each password is encrypted with a unique encryption key.

Options:

A.

TRUE

B.

FALSE

Question 7

Auto-Detection can be configured to leverage LDAP/S.

Options:

A.

TRUE

B.

FALSE

Question 8

During ENE integration you should specify the Fully-Qualified Domain Name (FQDN) of the SMTP Gateway server.

Options:

A.

TRUE

B.

FALSE

Question 9

An SMTP integration allows you to forward audit records to a monitoring solution.

Options:

A.

TRUE

B.

FALSE

Question 10

What is the PRIMARY reason for installing more than 1 active CPM?

Options:

A.

Installing CPMs in multiple sites prevents complex firewall rules to manage devices at remote sites.

B.

Multiple instances create fault tolerance.

C.

Multiple instances increase response time.

D.

Having additional CPMs increases the maximum number of devices CyberArk can manage

Question 11

When working with the CyberArk Disaster Recovery (DR) solution, which services should be running on the DR Vault?

Options:

A.

CyberArk Vault Disaster Recovery (DR), PrivateArk Database

B.

CyberArk Vault Disaster Recovery

C.

CyberArk Vault Disaster Recovery, PrivateArk Database, PrivateArk Server

D.

CyberArk Vault Disaster Recovery, PrivateArk Database, CyberArk Event Notification Engine

Question 12

Which of these accounts onboarding methods is considered proactive?

Options:

A.

Accounts Discovery

B.

Detecting accounts with PTA

C.

A Rest API integration with account provisioning software

D.

A DNA scan

Question 13

Which of the following sends out Simple Network Management Protocol (SNMP) traps?

Options:

A.

PrivateArk Remote Control Agent

B.

PrivateArk Server

C.

CyberArk Event Notification Engine

D.

CyberArk SNMP agent

Question 14

Which user is automatically given all Safe authorizations on all Safes?

Options:

A.

Administrator

B.

Master

C.

Auditor

D.

Operator

Question 15

You are successfully managing passwords in the alpha.cyberark com domain; however when you attempt to manage a password in the beta.cyberark.com domain, you receive the 'network path not found* error What should you check first?

Options:

A.

That the username and password are correct.

B.

That the CPM can successfully resolve addresses in the beta cyberark com domain

C.

That the end user has the correct permissions on the safe

D.

That an appropriate trust relationship exists between alphaxyberark.com and beta.cyberark.com

Question 16

Which is the correct order of installation for PAS components?

Options:

A.

Vault. CPM. PVWA. PSM

B.

CPM, Vault. PSM. PVWA

C.

Vault, CPM. PSM, PVWA

D.

PVWA, Vault, CPM. PSM

Question 17

A SIEM integration allows you to forward ITALOG records to a monitoring solution.

Options:

A.

TRUE

B.

FALSE

Question 18

Two-factor authentication can be implemented by integrating the Vault with a RADIUS server configured to require PIN and token.

Options:

A.

True

B.

False

Question 19

For an account attached to a platform that requires Dual Control based on a Master Policy exception, how would you configure access a password without approval

Options:

A.

Create an exception to the Master Policy to exclude the group from the workflow process.

B.

Edit the master policy rule and modify the advanced 'Access safe without approval' rule to include the group.

C.

On the safe in which the account is stored grant the group the 'Access safe without audit' authorization.

D.

On the safe in which the account is stored grant the group the 'Access safe without confirmation' authorization

Question 20

An SMTP integration allows you to forward audit records from the vault to the SIEM.

Options:

A.

TRUE

B.

FALSE

Question 21

When on-boarding accounts using Accounts Feed. Which of the following is true"?

Options:

A.

You must specify an existing Safe where the account will be stored when it is on-boarded to the Vault.

B.

You can specify the name of a new safe that will be created where the account will be stored when it is on-boarded to the Vault.

C.

You can specify the name of a new Platform that will be created and associated with the account.

D.

Any account that is on-boarded can be automatically reconciled regardless of the platform it is associated with

Question 22

What is the primary purpose of Exclusive Accounts?

Options:

A.

Reduced risk of credential theft

B.

More frequent password changes

C.

Non-repudiation (individual accountability)

D.

To force a ‘collusion to commit’ fraud ensuring no single actor may use a password without authorization

Question 23

Can you forward audit records to your monitoring solution via SIEM integration?

Options:

A.

Yes

B.

No

Question 24

In order to connect to a target device through PSM. the account credentials used for the connection must be stored in the vault?

Options:

A.

True

B.

False. Because the user can also enter credentials manually using Secure Connect

C.

False. Because if credentials are not stored in the vault, the PSM will log into the target device as PSMConnect.

D.

False Because if credentials are not stored in the vault, the PSM will prompt for credentials

Question 25

The vault server uses a modified version of the Microsoft Windows firewall

Options:

A.

TRUE

B.

FALSE

Question 26

When Dual Control is enabled a user must first submit a request in the Password Vault Web Access (PVWA) and receive approval before being able to launch a secure connection via PSM for Windows (previously known as RDP Proxy).

Options:

A.

True

B.

False, a user can submit the request after the connection has already been initiated via the PSM for Windows.

Question 27

HA, DR, Replicate are mutually exclusive and cannot be used in the same environment.

Options:

A.

TRUE

B.

FALSE

Question 28

An Auditor needs to login to the PSM in order to live monitor an active session. Which User ID is used to establish the RDP connection to the PSM server?

Options:

A.

PSMConnect

B.

PSMMaster

C.

PSMGwUser

D.

PSMAdminConnect

Question 29

In a Disaster Recovery (DR) environment, which of the following should NEVER be configured for automatic failover due to the possibility of split-brain phenomenon?

Options:

A.

Password Vault Web Access (PVWA)

B.

PSM

C.

CPM

D.

PTA

Question 30

In order to retrieve data from the vault a user MUST use an interface provided by CyberArk.

Options:

A.

TRUE

B.

FALSE

Question 31

After the Vault server is installed, the Microsoft Windows firewall is now commandeered by the Vault. Can the administrator change these firewall rules?

Options:

A.

Yes, but the administrator can only modify the firewall rules by editing the dbparm.ini file and the restarting the Vault.

B.

Yes, the administrator can still modify firewall rules via the Windows firewall interface.

C.

No, the Vault does not permit any changes to the firewall due to security requirements.

D.

Yes, but the administrator can only modify the firewall rules by editing the FirewallRules.ini file and the restarting the Vault.

Question 32

Which parameter controls how often the Central Policy Manager (CPM) looks for soon-to-be-expired passwords that need to be changed?

Options:

A.

HeadStartInterval

B.

Interval

C.

ImmediateInterval

D.

The CPM does not change the password under this circumstance

Question 33

A safe was recently created by a user who is a member of the LDAP Vault Administrators group. Which of the

following users does not have access to the newly created safe by default?

Options:

A.

Master

B.

Administrator

C.

Auditor

D.

Backup

Question 34

Which type of automatic remediation can be performed by the PTA in case of a suspected credential theft security event?

Options:

A.

Password change

B.

Password reconciliation

C.

Session suspension

D.

Session termination

Question 35

Assuming a safe has been configured to be accessible during certain hours of the day, a Vault Admin may still access that safe outside of those hours.

Options:

A.

TRUE

B.

FALSE

Page: 1 / 24
Total 237 questions