Easter Sale Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: 70percent

Certensure Logo
  1. Home
  2. CyberArk
  3. CyberArk CDE Certification
  4. PAM-CDE-RECERT - CyberArk CDE Recertification

CyberArk PAM-CDE-RECERT CyberArk CDE Recertification Exam Practice Test

Demo: 66 questions
Total 221 questions
Get PAM-CDE-RECERT Full Access Download PAM-CDE-RECERT PDF

CyberArk CDE Recertification Questions and Answers

Question 1

Which components can connect to a satellite Vault in distributed Vault architecture?

Options:

A.

CPM, EPM, PTA

B.

PVWA, PSM

C.

CPM,PVWA, PSM

D.

CPM, PSM

Question 2

Match each permission to where it can be found.

Options:

Question 3

Match the connection component to the corresponding OS/Function.

Options:

Question 4

What is the maximum number of levels of authorization you can set up in Dual Control?

Options:

A.

1

B.

2

C.

3

D.

4

Question 5

Which service should NOT be running on the DR Vault when the primary Production Vault is up?

Options:

A.

PrivateArk Database

B.

PrivateArk Server

C.

CyberArk Vault Disaster Recovery (DR) service

D.

CyberArk Logical Container

Question 6

What is the chief benefit of PSM?

Options:

A.

Privileged session isolation

B.

Automatic password management

C.

Privileged session recording

D.

‘Privileged session isolation’ and ‘Privileged session recording’

Question 7

Which parameter must be provided when registering a primary Vault in Azure, but not in Amazon Web Services''

Options:

A.

/RecPub

B.

/AdminPass

C.

/MasterPass

D.

/RDPGateway

Question 8

Which of the following options is not set in the Master Policy?

Options:

A.

Password Expiration Time

B.

Enabling and Disabling of the Connection Through the PSM

C.

Password Complexity

D.

The use of “One-Time-Passwords”

Question 9

You are creating a shared safe for the help desk.

What must be considered regarding the naming convention?

Options:

A.

Ensure your naming convention is no longer than 20 characters.

B.

Combine environments, owners and platforms to minimize the total number of safes created.

C.

Safe owners should determine the safe name to enable them to easily remember it.

D.

The use of these characters V:*<>".| is not allowed.

Question 10

Which browser is supported for PSM Web Connectors developed using the CyberArk Plugin Generator Utility (PGUP

Options:

A.

Internet Explorer

B.

Google Chrome

C.

Microsoft Edge

D.

Firefox

Question 11

You want to generate a license capacity report.

Which tool accomplishes this?

Options:

A.

Password Vault Web Access

B.

PrivateArk Client

C.

DiagnoseDB Report

D.

RestAPI

Question 12

Which SMTP address can be set on the Notification Settings page to re-invoke the ENE setup wizard after the initial Vault installation.

Options:

A.

255.255.255.255

B.

8.8.8.8

C.

192.168.1.1

D.

1.1.1.1

Question 13

Which report could show all accounts that are past their expiration dates?

Options:

A.

Privileged Account Compliance Status report

B.

Activity log

C.

Privileged Account Inventory report

D.

Application Inventory report

Question 14

Which of the following components can be used to create a tape backup of the Vault?

Options:

A.

Disaster Recovery

B.

Distributed Vaults

C.

Replicate

D.

High Availability

Question 15

You need to move a platform from using PMTerminal to using Terminal Plugin Controller (TPC) What must you do?

Options:

A.

Within PVWA

Click Administration > Platform Management

Select the platform and then click Edit.

In the left pane, click Automatic Password Management > CPM Plug-in

Set the ExeName parameter value to CyberArk TPC exe

B.

Using PnvateArk. select the PasswordManager_Shared safe, and then select open Locate the mi file relating to the platform you wish to change and double click

At the bottom of the file, insert a line "UseTPC = True" Remove any lines that reference "PMTerminal" and save Return the mi file to the safe Restart CPM for this change to take effect

C.

Open the process file of the platform you wish to configure to use TPC Add the following parameter under the States section; "use TPC=yes"

D.

It is not possible to change a platform from using PMTerminal to using TPC You must locate a new version of the platform that supports TPC and import the new platform over-writing the existing platform

Question 16

In the Private Ark client, how do you add an LDAP group to a CyberArk group?

Options:

A.

Select Update on the CyberArk group, and then click Add > LDAP Group

B.

Select Update on the LDAP Group, and then click Add > LDAP Group

C.

Select Member Of on the CyberArk group, and then click Add > LDAP Group

D.

Select Member Of on the LDAP group, and then click Add > LDAP Group

Question 17

The primary purpose of exclusive accounts is to ensure non-repudiation (Individual accountability).

Options:

A.

TRUE

B.

FALS

Question 18

Match the log file name with the CyberArk Component that generates the log.

Options:

Question 19

An auditor needs to login to the PSM in order to live monitor an active session. Which user ID is used to establish the RDP connection to the PSM server?

Options:

A.

PSMConnect

B.

PSMMaster

C.

PSMGwUser

D.

PSMAdminConnect

Question 20

The Privileged Access Management solution provides an out-of-the-box target platform to manage SSH keys, called UNIX Via SSH Keys.

How are these keys managed?

Options:

A.

CyberArk stores Private keys in the Vault and updates Public keys on target systems.

B.

CyberArk stores Public keys in the Vault and updates Private keys on target systems.

C.

CyberArk does not store Public or Private keys and instead uses a reconcile account to create keys on demand.

D.

CyberArk stores both Private and Public keys and can update target systems with either key.

Question 21

Which PTA sensors are required to detect suspected credential theft?

Options:

A.

Logs, Vault Logs

B.

Logs, Network Sensor, Vault Logs

C.

Logs, PSM Logs, CPM Logs

D.

Logs, Network Sensor, EPM

Question 22

Which component must be installed on the Vault if Distributed Vaults is used with PSM?

Options:

A.

RabbitMQ

B.

Disaster Recovery

C.

Remote Control Client

D.

Distributed Vault Server

Question 23

A customer is moving from an on-premises to a public cloud deployment. What is the best and most cost-effective option to secure the server key?

Options:

A.

Install the Vault in the cloud the same way that you would in an on-premises environment Place the server key in a password protected folder on the operating system

B.

Install the Vault in the cloud the same way that you would in an on-premises environment Purchase a Hardware Security Module to secure the server key

C.

Install the Vault using the Amazon Machine Images and secure the server key using native cloud Key Management Systems

D.

Install the Vault using the Amazon Machine Images and secure the server key with a Hardware Security Module

Question 24

Your customer has five main data centers with one PVWA in each center under different URLs. How can you make this setup fault tolerant?

Options:

A.

This setup is already fault tolerant

B.

Install more PVWAs in each data center

C.

Continuously monitor PVWA status and send users the link to another PVWA if issues are encountered

D.

Load balance all PVWAs under same urL

Question 25

To manage automated onboarding rules, a CyberArk user must be a member of which group?

Options:

A.

Vault Admins

B.

CPM User

C.

Auditors

D.

Administrators

Question 26

You are onboarding an account that is not supported out of the box.

What should you do first to obtain a platform to import?

Options:

A.

Create a service ticket in the customer portal explaining the requirements of the custom platform.

B.

Search common community portals like stackoverflow, reddit, github for an existing platform.

C.

From the platforms page, uncheck the “Hide non-supported platforms” checkbox and see if a platform meeting your needs appears.

D.

Visit the CyberArk marketplace and search for a platform that meets your needs.

Question 27

The Password upload utility can be used to create safes.

Options:

A.

TRUE

B.

FALS

Question 28

Can the 'Connect' button be used to initiate an SSH connection, as root, to a Unix system when SSH access for root is denied?

Options:

A.

Yes, when using the connect button, CyberArk uses the PMTerminal.exe process which bypasses the root SSH restriction.

B.

Yes, only if a logon account is associated with the root account and the user connects through the PSM-SSH connection component.

C.

Yes, if a logon account is associated with the root account.

D.

No, it is not possible.

Question 29

What is the purpose of the PrivateArk Server service?

Options:

A.

Executes password changes

B.

Maintains Vault metadata

C.

Makes Vault data accessible to components

D.

Sends email alerts from the Vault

Question 30

What is the easiest way to duplicate an existing platform?

Options:

A.

From PrivateArk, copy/paste the appropriate Policy.ini file: then rename it.

B.

from the PVWA, navigate to the platforms page, select the existing platform that is similar to the new target account platform and click Duplicate, name the new platform.

C.

From PrivateArk, cop/paste the appropriate setting in the PVConfiguration.xml then update the policName variable.

D.

From the PVWA, navigate to the platforms page, select existing platform that is similar to the new target account platform, manually update the platform settings and click "Save as" instead of save to duplicate and rename the platform.

Question 31

To enable the Automatic response “Add to Pending” within PTA when unmanaged credentials are found, what are the minimum permissions required by PTAUser for the PasswordManager_pending safe?

Options:

A.

List Accounts, View Safe members, Add accounts (includes update properties), Update Account content, Update Account properties

B.

List Accounts, Add accounts (includes update properties), Delete Accounts, Manage Safe

C.

Add accounts (includes update properties), Update Account content, Update Account properties, View Audit

D.

View Accounts, Update Account content, Update Account properties, Access Safe without confirmation, Manage Safe, View Audit

Question 32

As long as you are a member of the Vault Admins group, you can grant any permission on any safe that you have access to.

Options:

A.

TRUE

B.

FALSE

Question 33

When creating Distributed Vault environment architecture, what is the maximum number of Vault servers that can be deployed''

Options:

A.

5 - number of primary and satellite Vaults can be specified during installation

B.

3- all primary

C.

6-1 primary and 5 satellite

D.

10-2 primary and 8 satellite

Question 34

What is the purpose of the password change process?

Options:

A.

To test that CyberArk is storing accurate credentials for accounts

B.

To change the password of an account according to organizationally defined password rules

C.

To allow CyberArk to manage unknown or lost credentials

D.

To generate a new complex password

Question 35

Before the hardening process your customer identified a PSM Universal Connector executable that will be required to run on the PSM Which file should you update to allow this to run?

Options:

A.

PSMConfigureAppLockerxml

B.

PSMHardening xml

C.

PSMAppConfig xml

D.

PSMConfigureHardening xml

Question 36

What is the easiest way to duplicate an existing platform?

Options:

A.

From PrivateArk, copy/paste the appropriate Policy.ini file; then rename it.

B.

From the PVWA, navigate to the platforms page, select an existing platform that is similar to the new target account platform and then click Duplicate; name the new platform.

C.

From PrivateArk, copy/paste the appropriate settings in PVConfiguration.xml; then update the policyName variable.

D.

From the PVWA, navigate to the platforms page, select an existing platform that is similar to the new target account platform, manually update the platform settings and click “Save as” INSTEAD of save to duplicate and rename the platform.

Question 37

Select the best practice for storing the Master CD.

Options:

A.

Copy the files to the Vault server and discard the CD

B.

Copy the contents of the CD to a Hardware Security Module (HSM) and discard the CD

C.

Store the CD in a secure location, such as a physical safe

D.

Store the CD in a secure location, such as a physical safe, and copy the contents of the CD to a folder secured with NTFS permissions on the Vault

Question 38

Which parameters can be used to harden the Credential Files (CredFiles) while using CreateCredFile Utility? (Choose three.)

Options:

A.

Operating System Username

B.

Host IP Address

C.

Client Hostname

D.

Operating System Type (Linux/Windows/HP-UX)

E.

Vault IP Address

F.

Time Frame

Question 39

Customers who have the ‘Access Safe without confirmation’ safe permission on a safe where accounts are configured for Dual control, still need to request approval to use the account.

Options:

A.

TRUE

B.

FALSE

Question 40

To ensure all sessions are being recorded, a CyberArk administrator goes to the master policy and makes configuration changes.

Which configuration is correct?

Options:

A.

Require privileged session monitoring and isolation = inactive; Record and save session activity = active.

B.

Require privileged session monitoring and isolation = inactive; Record and save session activity = inactive.

C.

Require privileged session monitoring and isolation = active; Record and save session activity = active.

D.

Require privileged session monitoring and isolation = active; Record and save session activity = inactive.

Question 41

What is mandatory for a PVWA installation?

Options:

A.

A DNS entry for PVWA url must be created.

B.

A company signed TLS certificate must be imported into the server

C.

A vault Administrator user must be used to register the PVWA

D.

Data Execution Prevention must be disabled.

Question 42

A new domain controller has been added to your domain. You need to ensure the CyberArk infrastructure can use the new domain controller for authentication.

Which locations must you update?

Options:

A.

on the Vault server in Windows\System32\Etc\Hosts and in the PVWA Application under Administration > LDAP Integration > Directories > Hosts

B.

on the Vault server in Windows\System32\Etc\Hosts and on the PVWA server in Windows\System32\Etc\Hosts

C.

in the Private Ark client under Tools > Administrative Tools > Directory Mapping

D.

on the Vault server in the certificate store and on the PVWA server in the certificate store

Question 43

You have been asked to secure a set of shared accounts in CyberArk whose passwords will need to be used by end users. The account owner wants to be able to track who was using an account at any given moment.

Which security configuration should you recommend?

Options:

A.

Configure one-time passwords for the appropriate platform in Master Policy.

B.

Configure shared account mode on the appropriate safe.

C.

Configure both one-time passwords and exclusive access for the appropriate platform in Master Policy.

D.

Configure object level access control on the appropriate safe.

Question 44

You are configuring the vault to send syslog audit data to your organization's SIEM solution. What is a valid value for the SyslogServerProtocol parameter in DBPARM.ini file?

Options:

A.

TLS

B.

SSH

C.

SMTP

D.

SNMP

Question 45

Which is the primary purpose of exclusive accounts?

Options:

A.

Reduced risk of credential theft

B.

More frequent password changes

C.

Non-repudiation (individual accountability)

D.

To force a ‘collusion to commit’ fraud ensuring no single actor may use a password without authorization

Question 46

If a customer has one data center and requires high availability, how many PVWA's should be deployed.

Options:

A.

Two

B.

One PVWA cluster

C.

One

D.

Two PVWA Cluster

Question 47

A user is receiving the error message “ITATS006E Station is suspended for User jsmith” when attempting to sign into the Password Vault Web Access (PVWA). Which utility would a Vault administrator use to correct this problem?

Options:

A.

createcredfile.exe

B.

cavaultmanager.exe

C.

PrivateArk

D.

PVWA

Question 48

You receive this error:

“Error in changepass to user domain\user on domain server(\domain.(winRc=5) Access is denied.”

Which root cause should you investigate?

Options:

A.

The account does not have sufficient permissions to change its own password.

B.

The domain controller is unreachable.

C.

The password has been changed recently and minimum password age is preventing the change.

D.

The CPM service is disabled and will need to be restarted.

Question 49

After installing the first PSM server and before installing additional PSM servers you must ensure the user performing the installation is not a direct owner of which safe?

Options:

A.

PSMUnmanagedSessionAccounts Safe

B.

PSMRecordmgsSessionAccounts Safe

C.

PSMUnmanagedApphcationAccounts Safe

D.

PSMSessionBackupAccounts Safe

Question 50

An auditor initiates a live monitoring session to PSM server to view an ongoing live session. When the auditor’s machine makes an RDP connection the PSM server, which user will be used?

Options:

A.

PSMAdminConnect

B.

Shadowuser

C.

PSMConnect

D.

Credentials stored in the Vault for the target machine

Question 51

One can create exceptions to the Master Policy based on ____________________.

Options:

A.

Safes

B.

Platforms

C.

Policies

D.

Accounts

Question 52

Which of the following logs contains information about errors related to PTA?

Options:

A.

ITAlog.log

B.

diamond.log

C.

pm_error.log

D.

WebApplication.log

Question 53

Which components support fault tolerance.

Options:

A.

CPM and PVWA

B.

PVWA and PSM

C.

PSM and PTA

D.

CPM and PTA

Question 54

Which utilities could you use to change debugging levels on the vault without having to restart the vault. Select all that apply.

Options:

A.

PAR Agent

B.

PrivateArk Server Central Administration

C.

Edit DBParm.ini in a text editor.

D.

Setup.exe

Question 55

In your organization the “click to connect” button is not active by default.

How can this feature be activated?

Options:

A.

Policies > Master Policy > Allow EPV transparent connections > Inactive

B.

Policies > Master Policy > Session Management > Require privileged session monitoring and isolation > Add Exception

C.

Policies > Master Policy > Allow EPV transparent connections > Active

D.

Policies > Master Policy > Password Management

Question 56

Which statement is correct concerning accounts that are discovered, but cannot be added to the Vault by an automated onboarding rule?

Options:

A.

They are added to the Pending Accounts list and can be reviewed and manually uploaded.

B.

They cannot be onboarded to the Password Vault.

C.

They must be uploaded using third party tools.

D.

They are not part of the Discovery Process.

Question 57

For Digital Vault Cluster in a high availability configuration, how does the cluster determine if a node is down?

Options:

A.

The heartbeat s no longer detected on the private network.

B.

The shared storage array is offline.

C.

An alert is generated in the Windows Event log.

D.

The Digital Vault Cluster does not detect a node failure.

Question 58

What is the purpose of the HeadStartlnterval setting m a platform?

Options:

A.

It determines how far in advance audit data is collected tor reports

B.

It instructs the CPM to initiate the password change process X number of days before expiration.

C.

It instructs the AIM Provider to ‘skip the cache' during the defined time period

D.

It alerts users of upcoming password changes x number of days before expiration.

Question 59

You are creating a new Rest API user that utilizes CyberArk Authentication.

What is a correct process to provision this user?

Options:

A.

Private Ark Client > Tools > Administrative Tools > Users and Groups > New > User

B.

Private Ark Client > Tools > Administrative Tools > Directory Mapping > Add

C.

PVWA > User Provisioning > LDAP Integration > Add Mapping

D.

PVWA > User Provisioning > Users and Groups > New > User

Question 60

Which combination of Safe member permissions will allow end users to log in to a remote machine transparently but NOT show or copy the password?

Options:

A.

Use Accounts, Retrieve Accounts, List Accounts

B.

Use Accounts, List Accounts

C.

Use Accounts

D.

List Accounts, Retrieve Accounts

Question 61

It is possible to leverage DNA to provide discovery functions that are not available with auto-detection.

Options:

A.

TRUE

B.

FALS

Question 62

Due to network activity, ACME Corp’s PrivateArk Server became active on the OR Vault while the Primary Vault was also running normally. All the components continued to point to the Primary Vault.

Which steps should you perform to restore DR replication to normal?

Options:

A.

Replicate data from DR Vault to Primary Vault > Shutdown PrivateArk Server on DR Vault > Start replication on DR vault

B.

Shutdown PrivateArk Server on DR Vault > Start replication on DR vault

C.

Shutdown PrivateArk Server on Primary Vault > Replicate data from DR Vault to Primary Vault > Shutdown PrivateArk Server on DR Vault > Start replication on DR vault

D.

Shutdown PrivateArk Server on DR Vault > Replicate data from DR Vault to Primary Vault > Shutdown PrivateArk Server on DR Vault > Start replication on DR vault

Question 63

What is the purpose of the CyberArk Event Notification Engine service?

Options:

A.

It sends email messages from the Central Policy Manager (CPM)

B.

It sends email messages from the Vault

C.

It processes audit report messages

D.

It makes Vault data available to components

Question 64

What is the primary purpose of One Time Passwords?

Options:

A.

Reduced risk of credential theft

B.

More frequent password changes

C.

Non-repudiation (individual accountability)

D.

To force a 'collusion to commit' fraud ensuring no single actor may use a password without authorization.

Question 65

As vault Admin you have been asked to configure LDAP authentication for your organization's CyberArk users. Which permissions do you need to complete this task?

Options:

A.

Audit Users and Add Network Areas

B.

Audit Users and Manage Directory Mapping

C.

Audit Users and Add/Update Users

D.

Audit Users and Activate Users

Question 66

What is the configuration file used by the CPM scanner when scanning UNIX/Linux devices?

Options:

A.

UnixPrompts.ini

B.

plink.exe

C.

dbparm.ini

D.

PVConfig.xml

Load More PAM-CDE-RECERT Questions
Demo: 66 questions
Total 221 questions
Get PAM-CDE-RECERT Full Access Download PAM-CDE-RECERT PDF