Special Summer Sale 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: best70

PAM-CDE-RECERT CyberArk CDE Recertification Questions and Answers

Questions 4

For an account attached to a platform that requires Dual Control based on a Master Policy exception, how would you configure a group of users to access a password without approval.

Options:

A.

Create an exception to the Master Policy to exclude the group from the workflow process.

B.

Edith the master policy rule and modify the advanced’ Access safe without approval’ rule to include the group.

C.

On the safe in which the account is stored grant the group the’ Access safe without audit’ authorization.

D.

On the safe in which the account is stored grant the group the’ Access safe without confirmation’ authorization.

Buy Now
Questions 5

SAFE Authorizations may be granted to____________.

Select all that apply.

Options:

A.

Vault Users

B.

Vault Group

C.

LDAP Users

D.

LDAP Groups

Buy Now
Questions 6

One can create exceptions to the Master Policy based on ____________________.

Options:

A.

Safes

B.

Platforms

C.

Policies

D.

Accounts

Buy Now
Questions 7

What is the purpose of the PrivateArk Database service?

Options:

A.

Communicates with components

B.

Sends email alerts from the Vault

C.

Executes password changes

D.

Maintains Vault metadata

Buy Now
Questions 8

Time of day or day of week restrictions on when password verifications can occur configured in ____________________.

Options:

A.

The Master Policy

B.

The Platform settings

C.

The Safe settings

D.

The Account Details

Buy Now
Questions 9

Which utilities could you use to change debugging levels on the vault without having to restart the vault. Select all that apply.

Options:

A.

PAR Agent

B.

PrivateArk Server Central Administration

C.

Edit DBParm.ini in a text editor.

D.

Setup.exe

Buy Now
Questions 10

The password upload utility must run from the CPM server

Options:

A.

TRUE

B.

FALSE

Buy Now
Questions 11

A customer installed multiple PVWAs in the production environment behind a load balancer VIP. They subsequently observed that all incoming traffic from the load balancer VIP goes to only one PVWA, even though all the PVWAs are up and running. What could be the likely cause of this situation?

Options:

A.

The load balancing algorithm is the least connections algorithm.

B.

The Certificate of the load balancer is not a wild card cert

C.

The load balancing pool only has one PVWA server

D.

SSL passthrough is not configured on the load balancer.

Buy Now
Questions 12

You have been asked to design the number of PVWAs a customer must deploy. The customer has three data centers with a distributed vault in each, requires high availability, and wants to use all vaults, at all times. How many PVWAs does the customer need?

Options:

A.

six

B.

four

C.

two

D.

three

Buy Now
Questions 13

Match each key to its recommended storage location.

Options:

Buy Now
Questions 14

Which of the following are secure options for storing the contents of the Operator CD, while still allowing the contents to be accessible upon a planned Vault restart? (Choose three.)

Options:

A.

Store the CD in a physical safe and mount the CD every time Vault maintenance is performed

B.

Copy the entire contents of the CD to the system Safe on the Vault

C.

Copy the entire contents of the CD to a folder on the Vault Server and secure it with NTFS permissions

D.

Store the server key in a Hardware Security Module (HSM) and copy the rest the keys from the CD to a folder on the Vault Server and secure it with NTFS permissions

Buy Now
Questions 15

An auditor needs to login to the PSM in order to live monitor an active session. Which user ID is used to establish the RDP connection to the PSM server?

Options:

A.

PSMConnect

B.

PSMMaster

C.

PSMGwUser

D.

PSMAdminConnect

Buy Now
Questions 16

Which permissions are needed for the Active Directory user required by the Windows Discovery process?

Options:

A.

Domain Admin

B.

LDAP Admin

C.

Read/Write

D.

Read

Buy Now
Questions 17

Match each PTA alert category with the PTA sensors that collect the data for it.

Options:

Buy Now
Questions 18

CyberArk implements license limits by controlling the number and types of users that can be provisioned in the vault.

Options:

A.

TRUE

B.

FALSE

Buy Now
Questions 19

When managing SSH keys, the CPM stored the Private Key

Options:

A.

In the Vault

B.

On the target server

C.

A & B

D.

Nowhere because the private key can always be generated from the public key.

Buy Now
Questions 20

As long as you are a member of the Vault Admins group you can grant any permission on any safe.

Options:

A.

TRUE

B.

FALSE

Buy Now
Questions 21

Which of the following Privileged Session Management (PSM) solutions support live monitoring of active sessions?

Options:

A.

PSM (i.e., launching connections by clicking on the connect button in the Password Vault Web Access (PVWA)

B.

PSM for Windows (previously known as RDP Proxy)

C.

PSM for SSH (previously known as PSM-SSH Proxy)

D.

All of the above

Buy Now
Questions 22

Your organization has a requirement to allow users to “check out passwords” and connect to targets with the same account through the PSM.

What needs to be configured in the Master policy to ensure this will happen?

Options:

A.

Enforce check-in/check-out exclusive access = active; Require privileged session monitoring and isolation = active

B.

Enforce check-in/check-out exclusive access = inactive; Require privileged session monitoring and isolation = inactive

C.

Enforce check-in/check-out exclusive access = inactive; Record and save session activity = active

D.

Enforce check-in/check-out exclusive access = active; Record and save session activity = inactive

Buy Now
Questions 23

A customer's environment three data centers, consisting of 5,000 servers in Germany, 10,000 servers in Canada, 1,500 servers in Singapore. You want to manage target servers and avoid complex firewall rules. How many CPM's should you deploy?

Options:

A.

1

B.

3, total, 1 per data center

C.

15

D.

6, total, 2 per data center

Buy Now
Questions 24

VAULT authorizations may be granted to_____.

Options:

A.

Vault Users

B.

Vault Groups

C.

LDAP Users

D.

LDAP Groups

Buy Now
Questions 25

Which usage can be added as a service account platform?

Options:

A.

Kerberos Tokens

B.

IIS Application Pools

C.

PowerShell Libraries

D.

Loosely Connected Devices

Buy Now
Questions 26

In PVWA, you are attempting to play a recording made of a session by user jsmith, but there is no option to “Fast Forward” within the video. It plays and only allows you to skip between commands instead. You are also unable to download the video.

What could be the cause?

Options:

A.

Recording is of a PSM for SSH session.

B.

The browser you are using is out of date and needs an update to be supported.

C.

You do not have the “View Audit” permission on the safe where the account is stored.

D.

You need to update the recorder settings in the platform to enable screen capture every 10000 ms or less.

Buy Now
Questions 27

When running a “Privileged Accounts Inventory” Report through the Reports page in PVWA on a specific safe, which permission/s are required on that safe to show complete account inventory information?

Options:

A.

List Accounts, View Safe Members

B.

Manage Safe Owners

C.

List Accounts, Access Safe without confirmation

D.

Manage Safe, View Audit

Buy Now
Questions 28

A user requested access to view a password secured by dual-control and is unsure who to contact to expedite the approval process. The Vault Admin has been asked to look at the account and identify who can approve their request.

What is the correct location to identify users or groups who can approve?

Options:

A.

PVWA> Administration > Platform Configuration > Edit Platform > UI & Workflow > Dual Control> Approvers

B.

PVWA> Policies > Access Control (Safes) > Safe Members > Workflow > Authorize Password Requests

C.

PVWA> Account List > Edit > Show Advanced Settings > Dual Control > Direct Managers

D.

PrivateArk > Admin Tools > Users and Groups > Auditors (Group Membership)

Buy Now
Questions 29

A customer is deploying PVWAs in the Amazon Web Services Public Cloud. Which load balancing option does CyberArk recommend?

Options:

A.

Network Load Balancer

B.

Classic Load Balancer

C.

HTTPS load balancer

D.

Public standard load balancer

Buy Now
Questions 30

Target account platforms can be restricted to accounts that are stored m specific Safes using the Allowed Safes property.

Options:

A.

TRUE

B.

FALSE

Buy Now
Questions 31

Which of the following files must be created or configured m order to run Password Upload Utility? Select all that apply.

Options:

A.

PACli.ini

B.

Vault.ini

C.

conf.ini

D.

A comma delimited upload file

Buy Now
Questions 32

Within the Vault each password is encrypted by:

Options:

A.

the server key

B.

the recovery public key

C.

the recovery private key

D.

its own unique key

Buy Now
Questions 33

You are responsible for installing a CPM.

Which Vault authorizations will your CyberArk user need to install the CPM?

Options:

A.

Add Safes. Add/Update Users Manage Directory Mapping

B.

Add Safes. Add/Update Users. Reset Users' Passwords, Activate Users, Manage Server File Categories

C.

Manage Directory Mapping Backup All Safes. Restore Ail Safes

D.

Audit Users Activate Users Add Network Areas Manage Directory Mapping

Buy Now
Questions 34

Which SMTP address can be set on the Notification Settings page to re-invoke the ENE setup wizard after the initial Vault installation.

Options:

A.

255.255.255.255

B.

8.8.8.8

C.

192.168.1.1

D.

1.1.1.1

Buy Now
Questions 35

What is the purpose of the PrivateArk Server service?

Options:

A.

Executes password changes

B.

Maintains Vault metadata

C.

Makes Vault data accessible to components

D.

Sends email alerts from the Vault

Buy Now
Questions 36

Which Cyber Are components or products can be used to discover Windows Services or Scheduled Tasks that use privileged accounts? Select all that apply.

Options:

A.

Discovery and Audit (DMA)

B.

Auto Detection (AD)

C.

Export Vault Data (EVD)

D.

On Demand Privileges Manager (OPM)

E.

Accounts Discovery

Buy Now
Questions 37

A Vault administrator have associated a logon account to one of their Unix root accounts in the vault. When attempting to verify the root account’s password the Central Policy Manager (CPM) will:

Options:

A.

ignore the logon account and attempt to log in as root

B.

prompt the end user with a dialog box asking for the login account to use

C.

log in first with the logon account, then run the SU command to log in as root using the password in the Vault

D.

none of these

Buy Now
Questions 38

You are installing PSM for SSH with AD-Bridge in CyberArkSSHD mode for your customer. ACME Corp What do you need to install to meet your customer's needs? (Choose 2)

Options:

A.

libssh

B.

CARKpsmp-mfra

C.

CARKpsmp

D.

CARKpsmp-AD Bridge

Buy Now
Questions 39

What is the primary purpose of One Time Passwords?

Options:

A.

Reduced risk of credential theft

B.

More frequent password changes

C.

Non-repudiation (individual accountability)

D.

To force a 'collusion to commit' fraud ensuring no single actor may use a password without authorization.

Buy Now
Questions 40

When creating Distributed Vault environment architecture, what is the maximum number of Vault servers that can be deployed''

Options:

A.

5 - number of primary and satellite Vaults can be specified during installation

B.

3- all primary

C.

6-1 primary and 5 satellite

D.

10-2 primary and 8 satellite

Buy Now
Questions 41

PSM for Windows (previously known as “RDP Proxy”) supports connections to the following target systems

Options:

A.

Windows

B.

UNIX

C.

Oracle

D.

All of the above

Buy Now
Questions 42

Which PTA sensors are required to detect suspected credential theft?

Options:

A.

Logs, Vault Logs

B.

Logs, Network Sensor, Vault Logs

C.

Logs, PSM Logs, CPM Logs

D.

Logs, Network Sensor, EPM

Buy Now
Questions 43

A user with administrative privileges to the vault can only grant other users privileges that he himself has.

Options:

A.

TRUE

B.

FALSE

Buy Now
Questions 44

You are creating a new Rest API user that utilizes CyberArk Authentication.

What is a correct process to provision this user?

Options:

A.

Private Ark Client > Tools > Administrative Tools > Users and Groups > New > User

B.

Private Ark Client > Tools > Administrative Tools > Directory Mapping > Add

C.

PVWA > User Provisioning > LDAP Integration > Add Mapping

D.

PVWA > User Provisioning > Users and Groups > New > User

Buy Now
Questions 45

What is the configuration file used by the CPM scanner when scanning UNIX/Linux devices?

Options:

A.

UnixPrompts.ini

B.

plink.exe

C.

dbparm.ini

D.

PVConfig.xml

Buy Now
Questions 46

You need to recover an account localadmin02 for target server 10.0.123.73 stored in Safe Team1.

What do you need to recover and decrypt the object? (Choose three.)

Options:

A.

Recovery Private Key

B.

Recover.exe

C.

Vault data

D.

Recovery Public Key

E.

Server Key

F.

Master Password

Buy Now
Questions 47

Which command configures email alerts within PTA if settings need to be changed post install?

Options:

A.

/opt/tomcat/utility/emailConfiguration.sh

B.

/opt/PTA/emailConfiguration.sh

C.

/opt/PTA/utility/emailConfig.sh

D.

/opt/tomcat/utility/emailSetup.sh

Buy Now
Questions 48

You are installing HTML5 gateway on a Linux host using the RPM provided. After installing the Tomcat webapp, what is the next step in the installation process?

Options:

A.

Deploy the HTML5 service (guacd)

B.

Secure the connection between the guacd and the webapp

C.

Secure the webapp and JWT validation endpoint

D.

Configure ASLR

Buy Now
Questions 49

Which report provides a list of account stored in the vault.

Options:

A.

Privileged Accounts Inventory

B.

Privileged Accounts Compliance Status

C.

Entitlement Report

D.

Active Log

Buy Now
Questions 50

An auditor initiates a live monitoring session to PSM server to view an ongoing live session. When the auditor’s machine makes an RDP connection the PSM server, which user will be used?

Options:

A.

PSMAdminConnect

B.

Shadowuser

C.

PSMConnect

D.

Credentials stored in the Vault for the target machine

Buy Now
Questions 51

What is the default username for the PSM for SSH maintenance user?

Options:

A.

proxymng

B.

psmpjnamtenance

C.

psmpma/ntenanceuser

D.

psmpmnguser

Buy Now
Questions 52

In accordance with best practice, SSH access is denied for root accounts on UNIX/LINUX system. What is the BEST way to allow CPM to manage root accounts.

Options:

A.

Create a privileged account on the target server. Allow this account the ability to SSH directly from the CPM machine. Configure this account as the Reconcile account of the target server’s root account.

B.

Create a non-privileged account on the target server. Allow this account the ability to SSH directly from the CPM machine. Configure this account as the Logon account of the target server’s root account.

C.

Configure the Unix system to allow SSH logins.

D.

Configure the CPM to allow SSH logins.

Buy Now
Questions 53

What is a prerequisite step before CyberArk can be configured to support RADIUS authentication?

Options:

A.

Log on to the PrivateArk Client, display the user properties of the user to configure, run the Authentication method drop-down list, and select RADIUS authentication.

B.

In the RADIUS server, define the CyberArk Vault as RADIUS client/agent.

C.

In the Vault Installation folder, run CAVaultManger as Administrator with the SecureSecretFiles command.

D.

Navigate to /Server/Conf and open DBParms.ini and set the RadiusServersInfo parameter.

Buy Now
Questions 54

Which one the following reports is NOT generated by using the PVWA?

Options:

A.

Accounts Inventory

B.

Application Inventory

C.

Sales List

D.

Convince Status

Buy Now
Questions 55

Users can be resulted to using certain CyberArk interfaces (e.g.PVWA or PACLI).

Options:

A.

TRUE

B.

FALS

Buy Now
Questions 56

Which tools are used during a CPM renaming process?

Options:

A.

APIKeyManager Utility

B.

CreateCredFile Utility

C.

CPMinDomain_Hardening.ps1

D.

PMTerminal.exe

E.

Data Execution Prevention

Buy Now
Questions 57

In your organization the “click to connect” button is not active by default.

How can this feature be activated?

Options:

A.

Policies > Master Policy > Allow EPV transparent connections > Inactive

B.

Policies > Master Policy > Session Management > Require privileged session monitoring and isolation > Add Exception

C.

Policies > Master Policy > Allow EPV transparent connections > Active

D.

Policies > Master Policy > Password Management

Buy Now
Questions 58

Which of the Following can be configured in the Master Poky? Choose all that apply.

Options:

A.

Dual Control

B.

One Time Passwords

C.

Exclusive Passwords

D.

Password Reconciliation

E.

Ticketing Integration

F.

Required Properties

G.

Custom Connection Components

Buy Now
Questions 59

You are helping a customer prepare a Windows server for PSM installation. What is required for a successful installation?

Options:

A.

Window 2012 KB4558843

B.

Remote Desktop services (RDS) Session Host Roles

C.

Windows 2016 KB4558843

D.

Remote Desktop services (RDS) Session Broker

Buy Now
Questions 60

You receive this error:

“Error in changepass to user domain\user on domain server(\domain.(winRc=5) Access is denied.”

Which root cause should you investigate?

Options:

A.

The account does not have sufficient permissions to change its own password.

B.

The domain controller is unreachable.

C.

The password has been changed recently and minimum password age is preventing the change.

D.

The CPM service is disabled and will need to be restarted.

Buy Now
Questions 61

If a customer has one data center and requires high availability, how many PVWA's should be deployed.

Options:

A.

Two

B.

One PVWA cluster

C.

One

D.

Two PVWA Cluster

Buy Now
Questions 62

Assuming a safe has been configured to be accessible during certain hours of the day, a Vault Admin may still access that safe outside of those hours.

Options:

A.

TRUE

B.

FALSE

Buy Now
Questions 63

A newly created platform allows users to access a Linux endpoint. When users click to connect, nothing happens.

Which piece of the platform is missing?

Options:

A.

PSM-SSH Connection Component

B.

UnixPrompts.ini

C.

UnixProcess.ini

D.

PSM-RDP Connection Component

Buy Now
Questions 64

Which components can connect to a satellite Vault in distributed Vault architecture?

Options:

A.

CPM, EPM, PTA

B.

PVWA, PSM

C.

CPM,PVWA, PSM

D.

CPM, PSM

Buy Now
Questions 65

Which report could show all accounts that are past their expiration dates?

Options:

A.

Privileged Account Compliance Status report

B.

Activity log

C.

Privileged Account Inventory report

D.

Application Inventory report

Buy Now
Questions 66

Which step is required to register a Vault manually in Amazon Web Services using CAVaultManager?

Options:

A.

Specify Amazon as the cloud vendor using the CloudVendor Flag

B.

After running the postinstall utility, restart the "PrivateArk Server" service

C.

Specify the Cloud region using the /CloudRegion flag

D.

Specify whether the Vault is distributed or stand alone

Buy Now
Exam Code: PAM-CDE-RECERT
Exam Name: CyberArk CDE Recertification
Last Update: Mar 31, 2025
Questions: 221

PDF + Testing Engine

$134.99

Testing Engine

$99.99

PDF (Q&A)

$84.99