10 free CyberArk PAM-DEF practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 113 questions. Work through them, then open each answer to check your reasoning.
Get all 113 questions (US$39) · Download these 10 as a PDF
Question 1
What do you need on the Vault to support LDAP over SSL?
Show answer and explanation
Correct answer: A. CA Certificate(s) used to sign the External Directory certificate
To support LDAP over SSL on the Vault, you must import the CA certificate(s) that signed the External Directory's SSL certificate. This allows the Vault to verify the authenticity of the LDAP server's certificate during the SSL handshake. The Vault uses these CA certificates to validate the certificate chain presented by the LDAP directory server.
Why the other options are wrong
- B. RECPRV.key is the Vault's private key for its own certificate, not needed for validating an external LDAP server certificate.
- C. A private key for the external directory is not required; only the public CA certificate(s) that signed it are needed for validation.
- D. Self-signed certificates for the Vault itself are not the solution; you need the CA certificate that signed the external directory's certificate.
Question 2
You are troubleshooting a PVWA slow response.
Which log files should you analyze first? (Choose two.)
Show answer and explanation
Correct answer: C, D
C. CyberArk.WebApplication.log D. CyberArk.WebConsole.log When troubleshooting PVWA slow response, CyberArk.WebApplication.log and CyberArk.WebConsole.log are the primary application logs that capture performance issues, errors, and timing information specific to the web application and console. These logs directly record what the PVWA is doing and how long operations take.
Why the other options are wrong
- A. ITALog.log is related to the Identity and Access management components, not PVWA performance diagnostics.
- B. web.config is a configuration file, not a log file; it would not contain runtime performance data needed for troubleshooting slow responses.
Question 3
What is the easiest way to duplicate an existing platform?
Show answer and explanation
Correct answer: B. From the PVWA, navigate to the platforms page, select an existing platform that is similar to the new target account platform and then click Duplicate; name the new platform.
The PVWA provides a built-in Duplicate function on the platforms page that is the easiest and most supported method. You select an existing platform similar to your target and click Duplicate, then rename the new platform. This method is straightforward and preserves all configuration from the source platform automatically.
Why the other options are wrong
- A. Manually copying and renaming Policy.ini files is error-prone and bypasses the application's built-in functionality.
- C. Editing PVConfiguration.xml directly is a low-level approach that is more complex and carries greater risk of misconfiguration than using the PVWA interface.
- D. There is no 'Save as' function for duplicating platforms in the PVWA; this option describes a non-existent workflow.
Question 4
Due to corporate storage constraints, you have been asked to disable session monitoring and recording for 500 testing accounts used for your lab environment.
How do you accomplish this?
Show answer and explanation
Correct answer: A. Master Policy>select Session Management>add Exceptions to the platform(s)>disable Session Monitoring and Recording policies
Exceptions to the platform(s)>disable Session Monitoring and Recording policies Session Monitoring and Recording policies are managed through the Master Policy in CyberArk. You navigate to Master Policy, locate Session Management, and add Exceptions for the specific platforms or accounts where you want to disable these policies. This approach allows granular control over which accounts bypass session monitoring.
Why the other options are wrong
- B. Platform Management handles platform configuration but not the policy exceptions needed to disable monitoring per account.
- C. Safe-level access control policies govern who can access accounts, not session monitoring behavior.
- D. Configuration Options are system-wide settings; per-account or per-platform exceptions for session monitoring are managed through Master Policy instead.
Question 5
A user requested access to view a password secured by dual-control and is unsure who to contact to expedite the approval process. The Vault Admin has been asked to look at the account and identify who can approve their request.
What is the correct location to identify users or groups who can approve?
Show answer and explanation
Correct answer: B. PVWA > Policies > Access Control (Safes) > Select the safe > Safe Members > Workflow > Authorize Password Requests
Dual control approval workflows are configured at the safe level under Access Control policies. Navigating to Policies > Access Control (Safes), selecting the specific safe, and viewing Safe Members > Workflow > Authorize Password Requests shows which users or groups are designated as approvers for password requests on that safe.
Why the other options are wrong
- A. Platform configuration does not define dual control approvers; this is a safe-level policy setting.
- C. Account-level advanced settings do not contain approver information; dual control is managed at the safe level.
- D. Auditors are users with audit permissions, not necessarily the users configured to approve dual control requests.
Question 6
What must you specify when configuring a discovery scan for UNIX? (Choose two.)
Show answer and explanation
Correct answer: B, D
B. CPM Scanner D. list of machines to scan When configuring a discovery scan for UNIX systems, you must specify the CPM Scanner that will perform the scan and the list of machines to scan. These two elements define which scanner engine conducts the discovery and which target systems will be scanned.
Why the other options are wrong
- A. The Vault Administrator role is not a configuration requirement for discovery scans.
- C. While root access may be needed on target machines, you do not specify individual machine passwords in the discovery scan configuration; credentials are managed separately.
- E. The safe for discovered accounts is typically specified as part of the account onboarding process after discovery, not as a required discovery scan configuration parameter.
Question 7
To change the safe where recordings are kept for a specific platform, which setting must you update in the platform configuration?
Show answer and explanation
Correct answer: A. SessionRecorderSafe
The SessionRecorderSafe parameter in platform configuration specifies which safe will store session recordings for accounts using that platform. Updating this setting allows you to redirect recordings to a different safe without affecting other platform functionality.
Why the other options are wrong
- B. SessionSafe is not the correct parameter name for configuring recording storage location.
- C. RecordingsPath refers to file system paths, not the vault safe where recordings are stored.
- D. RecordingLocation is not a standard platform configuration parameter in CyberArk.
Question 8
Which processes reduce the risk of credential theft? (Choose two.)
Show answer and explanation
Correct answer: B, D
B. require password change every X days D. enforce one-time password access Requiring password change every X days and enforcing one-time password access directly reduce credential theft risk by limiting the window of exposure and preventing password reuse. Regular password rotation limits the utility of a stolen credential, and on-ime passwords eliminate the risk of credential replay attacks.
Why the other options are wrong
- A. While dual control approval adds an authorization layer, it does not specifically reduce credential theft risk; it addresses policy compliance and segregation of duties.
- C. Check-in/check-out exclusive access controls who can use a credential but does not inherently reduce the risk of theft by those with access.
Question 9
You are onboarding 5,000 UNIX root accounts for rotation by the CPM. You discover that the CPM is unable to log in directly with the root account and will need to use a secondary account.
How can this be configured to allow for password management using least privilege?
Show answer and explanation
Correct answer: D. Configure the UNIX platform to use the correct reconcile account.
When the CPM cannot log in directly with the root account, a reconcile account must be configured at the platform level to allow the CPM to authenticate using a secondary account with appropriate privileges. The reconcile account is specifically designed to handle scenarios where direct root login is restricted, enabling password management while maintaining least privilege principles. Configuring this at the platform level ensures it applies to all 5,000 accounts being onboarded.
Why the other options are wrong
- A. Configuring the CPM logon account does not address the root access restriction issue at the platform level.
- B. The reconcile account must be configured on the platform itself, not on individual CPM instances.
- C. The logon account is used for initial authentication, not for scenarios requiring secondary account escalation to root.
Question 10
Which methods can you use to add a user directly to the Vault Admin Group? (Choose three.)
Show answer and explanation
Correct answer: A, B, C
A. REST API B. PrivateArk Client C. PACLI Users can be added directly to the Vault Admin Group through three native CyberArk management interfaces: the REST API provides programmatic access for user management, the PrivateArk Client offers the traditional GUI-based administration console, and PACLI provides command-line interface capabilities. These are the three primary built-in methods for direct Vault administration.
Why the other options are wrong
- D. PVWA is designed for end-user account management and password requests, not for administrative group management.
- E. Active Directory is an external directory service that can be integrated for authentication but cannot directly add users to Vault-specific groups.
- F. Sailpoint is a third-party identity governance platform and is not a native CyberArk administration method.
That was 10 of 113.
The full CyberArk PAM-DEF pack has all 113 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.