Get CyberArk PAM-DEF Exam Practice Questions - Real and Updated

Answer : B, C, E

Dependent accounts are accounts that represent resources such as Windows Services, Windows Scheduled Tasks, and others, which are accessed from a target machine and require the same credentials as the target machine. The CyberArk Privileged Account Security Solution's Central Policy Manager (CPM) supports out-of-the-box dependent accounts for Windows Services, Windows Scheduled Tasks, and Windows Registry. When changing a password, the CPM synchronizes the target account password with all other occurrences of that password in any related dependent accounts.This ensures that all dependent accounts are updated simultaneously to maintain security and functionality12.Reference:

CyberArk Docs: Manage dependent accounts1

CyberArk Docs: Supported dependent accounts

Answer : B

According to the web search results, when a DR Vault Server becomes an active vault, it will not automatically revert back to DR mode once the Primary Vault comes back online.The Vault administrator must manually set the DR Vault to DR mode by setting ''FailoverMode=no'' in the padr.ini file1.This file is located in the /opt/CARKaim/conf directory on the DR Vault machine2.The Vault administrator must also stop the replication process on the DR Vault and restart the PrivateArk Server service1.This procedure is known as a DR failback, which restores the original roles of the Primary Vault and the DR Vault after a failover1.The AllowFailback setting in the padr.ini file does not affect the DR failback process, as it only determines whether the DR Vault can be used as a backup for another DR Vault in a cascading DR scenario3. The dbparm.ini file is not relevant for the DR failback process, as it contains the database parameters for the Vault server.Reference:

Initiate a DR failback to the Production Vault - CyberArk

Install the Disaster Recovery application - CyberArk

Cascading DR - CyberArk

[dbparm.ini file - CyberArk]

Answer : A, B, E

Discovery and Audit (DMA), Auto Detection (AD), and Accounts Discovery are CyberArk components or products that can be used to discover Windows Services or Scheduled Tasks that use privileged accounts.

Discovery and Audit (DMA) is a tool that scans Windows servers and workstations to identify privileged accounts that are used by Windows Services or Scheduled Tasks. DMA can also generate reports on the usage and risks of these accounts.

Auto Detection (AD) is a feature of the CyberArk Privileged Account Security Solution that automatically detects and onboards privileged accounts that are used by Windows Services or Scheduled Tasks. AD can also monitor and rotate the passwords of these accounts.

Accounts Discovery is a feature of the CyberArk Privileged Account Security Solution that scans the network to discover privileged accounts on various platforms, including Windows. Accounts Discovery can also identify accounts that are used by Windows Services or Scheduled Tasks.

: Discovery and Audit (DMA) User Guide

: Auto Detection Implementation Guide

: Accounts Discovery Implementation Guide

Answer : C

When attempting to change the root account's password, the CPM will log in to the system as the logon account, run the su command to log in as root, and then change root's password. This is because the logon account is used to initiate sessions to machines that do not permit direct logon, such as Unix systems that restrict root access. When a logon account is associated with a privileged account, it will be used to log onto the remote machine and then elevate itself to the role of the privileged user. As different types of machines might have different logon prompts or elevation commands, the CPM can use the AutoLogonSequenceWithLogonAccount parameter to define the logon process and the elevation to the privileged account. This parameter contains regular expression prompts and responses that define the logon process and subsequent activities.The regular expressions can include dynamic values that the CPM reads from the account properties, user parameters, or client-specific parameters1. For example, the following is a possible AutoLogonSequenceWithLogonAccount parameter for a Unix platform:

This parameter instructs the CPM to log in to the system as the logon account, enter the logon password, run the su - command to switch to the root user, enter the logon password again, run the change command to change the root password, exit the root session, and exit the logon session1.

The other options are not correct, as follows:

A . Log in to the system as root, then change root's password. This option is not possible, because the root account cannot be used for direct logon.The logon account is associated with the root account to enable the CPM to access the system and change the password1.

B . Log in to the system as the logon account, then change root's password. This option is not effective, because the logon account does not have the permission to change the root's password.The logon account needs to elevate itself to the root user by using the su command before changing the password1.

D . None of these. This option is not valid, because there is a correct answer among the choices.

1:Logon Accounts for SSH and Telnet Connections

Answer : A, B, D

A . Store the CD in a physical safe and mount the CD every time Vault maintenance is performed. This option ensures that the CD is kept in a secure location when not in use, and that the keys are available when needed.This is the default option suggested by CyberArk1.

B . Copy the entire contents of the CD to the system Safe on the Vault. This option allows the Vault to access the keys from the system Safe, which is a special Safe that stores the Vault configuration files and keys.The system Safe is encrypted and protected by the Vault, and can only be accessed by authorized users2.

D . Store the server key in a Hardware Security Module (HSM) and copy the rest the keys from the CD to a folder on the Vault Server and secure it with NTFS permissions. This option provides an additional layer of security for the server key, which is the most critical key for the Vault. An HSM is a physical device that stores and manages cryptographic keys in a tamper-resistant and isolated environment.The Vault can integrate with an HSM to store and retrieve the server key3. The rest of the keys can be stored in a folder on the Vault Server and secured with NTFS permissions, which restrict access to authorized users and groups.

The following option isnotsecure and should be avoided:

C . Copy the entire contents of the CD to a folder on the Vault Server and secure it with NTFS permissions. This option exposes the keys to potential risks, such as unauthorized access, data corruption, or deletion. NTFS permissions are not sufficient to protect the keys from malicious or accidental actions.Moreover, this option does not comply with the CyberArk best practices, which recommend to store the keys on a removable media or an HSM