28 free CyberArk PAM-DEF practice questions from the CertStash pack of 113, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 28 free here, all 113 in the pack, and each step includes the one before it.
Get all 113 questions (US$39) · Download the first 10 as a PDF
Question 1
What do you need on the Vault to support LDAP over SSL?
Show answer and explanation
Correct answer: A. CA Certificate(s) used to sign the External Directory certificate
When the Vault connects to an external directory over LDAPS, it acts as an SSL client and must be able to validate the certificate that the directory server presents. CyberArk therefore instructs you to import the CA certificate that signed the external directory's certificate into the Windows certificate store on the Vault machine (the Trusted Root store for a root CA). With that trust chain in place, the Vault can complete the SSL handshake and the directory traffic, including user authentication and group lookups, is encrypted. No private keys are exchanged, and the Vault does not need a certificate of its own for this outbound connection.
Why the other options are wrong
- B. RECPRV.key is the private recovery key used for Master logon and Vault recovery, and it plays no part in LDAP connections.
- C. The private key of the directory server must stay on that server; the Vault only needs to trust the CA that issued its certificate.
- D. A self-signed Vault certificate does nothing to let the Vault validate the directory server's certificate.
Question 2
You are troubleshooting a PVWA slow response.
Which log files should you analyze first? (Choose two.)
Show answer and explanation
Correct answer: C, D. CyberArk.WebApplication.log; CyberArk.WebConsole.log
PVWA problems, including slow responses, are investigated in the PVWA's own log files, which are written on the web server to the folder set by the LogFolder parameter in web.config (by default %windir%\temp). CyberArk.WebApplication.log records the application's processing of requests, errors and warnings, and CyberArk.WebConsole.log records the console messages of the web application. Together they show where requests are failing or stalling. In current versions the same information is also written to the newer PVWA.App.log and PVWA.Console.log files, which will replace these two logs in a future version.
Why the other options are wrong
- A. ITALog.log is the Vault server log and records Vault activity, not the PVWA web application's request handling.
- B. web.config is the PVWA configuration file, not a log, so it records no activity to analyze.
Question 3
What is the easiest way to duplicate an existing platform?
Show answer and explanation
Correct answer: B. From the PVWA, navigate to the platforms page, select an existing platform that is similar to the new target account platform and then click Duplicate; name the new platform.
The PVWA platform management page has a built-in Duplicate action designed for this purpose. You select an existing platform that is similar to the new target account platform, click Duplicate, and enter a name and description for the new platform in the Duplicate Platform window. The copy inherits every setting of the original, so you only adjust the parameters that differ. Because the PVWA writes the new platform to the Vault for you, there is no need to handle the underlying policy files or the PVConfiguration.xml file by hand, which makes this the quickest and safest method.
Why the other options are wrong
- A. Copying policy files through the PrivateArk Client is a manual, error-prone process and does not register the new platform properly in the PVWA.
- C. Hand-editing PVConfiguration.xml is risky and far more complex than the built-in Duplicate action.
- D. The platform editor offers no Save as option; a new platform is created from an existing one with the Duplicate action.
Question 4
Due to corporate storage constraints, you have been asked to disable session monitoring and recording for 500 testing accounts used for your lab environment.
How do you accomplish this?
Show answer and explanation
Correct answer: A. Master Policy>select Session Management>add Exceptions to the platform(s)>disable Session Monitoring and Recording policies
Session monitoring and recording are governed by the Privileged Session Management rules of the Master Policy, such as Require privileged session monitoring and isolation and Record and save session activity. The Master Policy applies these rules to all platforms, and the supported way to change them for a subset of accounts is to add an exception for specific platforms. Assigning the 500 lab accounts to a dedicated platform and adding an exception that turns these rules off for that platform stops recording for those accounts only, saving storage while production accounts remain recorded.
Why the other options are wrong
- B. Platform Management is not where the Master Policy session monitoring and recording rules are switched off; that is done through a Master Policy exception.
- C. Safe settings under Access Control control membership and authorizations, not session monitoring and recording rules.
- D. Configuration Options holds system-wide PSM settings and offers no way to disable recording for only a set of lab accounts.
Question 5
A user requested access to view a password secured by dual-control and is unsure who to contact to expedite the approval process. The Vault Admin has been asked to look at the account and identify who can approve their request.
What is the correct location to identify users or groups who can approve?
Show answer and explanation
Correct answer: B. PVWA > Policies > Access Control (Safes) > Select the safe > Safe Members > Workflow > Authorize Password Requests
Dual control is switched on by the Master Policy, but the people who may approve a request are defined per Safe. A Safe member who holds the Authorize password requests authorization (shown in the Workflow group of Safe member authorizations) receives and can confirm or reject access requests for accounts in that Safe. To find out who can approve, the Vault Admin opens Policies, Access Control (Safes), selects the Safe that holds the account and reviews the Safe members whose Workflow authorizations include Authorize password requests. The requesting user can then contact one of them.
Why the other options are wrong
- A. The platform defines how accounts behave, but it holds no list of named approvers for dual control.
- C. Account properties have no Direct Managers setting; approvers come from Safe member authorizations.
- D. The Auditors group grants audit visibility and has nothing to do with approving password requests.
Question 6
What must you specify when configuring a discovery scan for UNIX? (Choose two.)
Show answer and explanation
Correct answer: B, D. CPM Scanner; list of machines to scan
A UNIX Accounts Discovery process needs to know which component performs the scan and which hosts to scan. You select the CPM Scanner, the CPM instance that runs the discovery and connects to the target machines, and you provide the list of machines to scan, loaded from a CSV file. You also specify the user that scans the machines; the system looks up that user's password in the Vault for each machine in the list and uses a default password that you enter when no matching account is found. Accounts that the scan finds are placed in the Pending Accounts list or onboarded by onboarding rules, so no target Safe is entered in the discovery definition.
Why the other options are wrong
- A. The discovery process does not ask for a Vault Administrator; it runs with the scanning credentials you supply on the target machines.
- C. Discovery asks only for the user that scans the machines and looks up its passwords in the Vault, so you do not enter a root password for every machine.
- E. Discovered accounts go to the Pending Accounts list or are onboarded by onboarding rules, so no target Safe is set in the scan.
Question 7
To change the safe where recordings are kept for a specific platform, which setting must you update in the platform configuration?
Show answer and explanation
Correct answer: A. SessionRecorderSafe
The Safe that receives PSM session recordings is defined per platform in the Privileged Session Management settings of the platform's UI and Workflows section. The SessionRecorderSafe parameter specifies the name of the Safe where recordings of activities for accounts associated with that platform are stored. Changing this value redirects future recordings for every account that uses the platform to the new Safe, without affecting other platforms. The PSM server must have the required authorizations in the new Safe so that it can upload the recordings.
Why the other options are wrong
- B. SessionSafe is not a platform parameter; the recording Safe is set by SessionRecorderSafe.
- C. RecordingsPath is not the platform parameter that names the Vault Safe for recordings.
- D. RecordingLocation is not a platform parameter; the Safe for recordings is set by SessionRecorderSafe.
Question 8
Which processes reduce the risk of credential theft? (Choose two.)
Show answer and explanation
Correct answer: B, D. require password change every X days; enforce one-time password access
Credential theft is countered by limiting how long a stolen password remains useful. Requiring a password change every X days means the CPM rotates the credential on a fixed schedule, so any copy an attacker obtains soon becomes invalid. Enforcing one-time password access goes further: after a user retrieves a password, the CPM changes it once the usage period ends, so each released password is valid for a single use only. Both rules shrink the window in which a stolen credential can be exploited, which is the risk the question targets.
Why the other options are wrong
- A. Dual control requires approval before access, which means that misuse would require collusion but does not invalidate a credential once it is stolen.
- C. Exclusive access ensures only one user holds an account at a time, which provides individual accountability rather than protection against theft.
Question 9
You are onboarding 5,000 UNIX root accounts for rotation by the CPM. You discover that the CPM is unable to log in directly with the root account and will need to use a secondary account.
How can this be configured to allow for password management using least privilege?
Show answer and explanation
Correct answer: C. Configure the UNIX platform to use the correct logon account.
When the CPM cannot log on directly as root, it uses a logon account: a non-privileged UNIX account that it connects with first, before switching to root to change the password. Logon accounts are linked to target accounts, and the UNIX platform defines how that linked logon account is used for password management. Configuring the logon account through the platform applies the same least-privilege behavior consistently to all 5,000 root accounts that share the platform, with no change to the CPM servers themselves.
Why the other options are wrong
- A. Logon accounts are linked through platforms and accounts, not configured on individual CPM servers.
- B. CPM servers do not hold account-specific credentials, and a reconcile account is used only to reset unsynchronized passwords.
- D. A reconcile account is a highly privileged account for resetting passwords, so using it for routine logon breaks least privilege.
Question 10
Which methods can you use to add a user directly to the Vault Admin Group? (Choose three.)
Show answer and explanation
Correct answer: A, B, C. REST API; PrivateArk Client; PACLI
Adding a user directly to the built-in Vault Admins group means writing the membership to the Vault itself. The PrivateArk Client does this through the Users and Groups tools, where an administrator adds the user as a member of the group. PACLI, the command-line interface, provides the ADDGROUPMEMBER command, which adds a member to a specified Vault group. The REST API exposes an equivalent operation for adding a member to a Vault group programmatically. All three act on the Vault group membership directly rather than relying on an external directory.
Why the other options are wrong
- D. The PVWA is built for account, Safe and platform administration, and adding a member directly to the built-in Vault Admins group has traditionally been done in the PrivateArk Client, with PACLI or with the REST API.
- E. Active Directory can only add a user to a directory group that is mapped into the Vault, which is indirect membership.
- F. SailPoint is a third-party identity governance product and does not add users to the Vault Admins group directly.
What people say about the full PAM-DEF pack 5.0 from 1
I didn’t have much time to study, but Cert Stash’s dumps covered all key topics of the PAM-DEF exam. Passed on the first try; so happy and in awe. Thanks guys for such valuable exam material.
Question 11
Where can PTA be configured to send alerts? (Choose two.)
Show answer and explanation
Correct answer: A, B. SIEM; Email
PTA can forward its alerts to a SIEM solution as syslog records, so security events appear alongside other data in the organization's monitoring tools. PTA can also send alerts by email to configured recipients, so security teams are notified directly when a suspicious event is detected. These two outbound channels are the alert destinations among the listed options.
Why the other options are wrong
- C. Google Analytics is a web analytics service and is not an alert destination for PTA.
- D. EVD is the Export Vault Data utility, which exports Vault data and does not receive PTA alerts.
- E. PAReplicate is the Vault backup utility and does not receive PTA alerts.
Question 12
Where can a user with the appropriate permissions generate a report? (Choose two.)
Show answer and explanation
Correct answer: A, B. PVWA > Reports; PrivateArk Client
Users with the required authorizations, such as auditors, can produce reports from two interfaces. In the PVWA, the Reports page generates reports such as Privileged Accounts Inventory, Activity Log and Applications Inventory, which can be run immediately or scheduled. The PrivateArk Client, the Vault's Windows client, also provides reports on Safe activities, user activities and the Vault's Users List. Both use the user's own authorizations to decide which data appears in the report.
Why the other options are wrong
- C. The Cluster Vault Manager controls cluster nodes and services and produces no reports.
- D. The PrivateArk Server Monitor shows the status of the Vault server and does not generate reports.
- E. PARClient is the client for the Remote Control Agent, used to check and control Vault services remotely, not to generate reports.
Question 13
According to CyberArk, which issues most commonly cause installed components to display as disconnected in the System Health Dashboard? (Choose two.)
Show answer and explanation
Correct answer: A, C. network instabilities/outages; credential de-sync
CyberArk names two common causes when a component shows a Connectivity Status of Disconnected in the System Health dashboard. Network instabilities or outages interrupt communication between the component and the Vault, so the network should be checked first. If the network is healthy, the next cause is a credential de-sync, in which the component can no longer authenticate to the Vault. The fix is to restore connectivity by resetting the component user credentials in the PVWA and then creating or replacing the credential file on the component machine.
Why the other options are wrong
- B. Vault license expiry is not listed as a common reason for components to appear disconnected in the dashboard.
- D. Browser compatibility affects how a user views the PVWA, not whether installed components are connected to the Vault.
- E. File corruption in the installation folder is not one of the typical causes CyberArk lists for disconnected components.
Question 14
You created a new platform by duplicating the out-of-box Linux through the SSH platform.
Without any change, which Text Recorder Type(s) will the new platform support? (Choose two.)
Show answer and explanation
Correct answer: A, B. SSH Text Recorder; Universal Keystrokes Text Recorder
A duplicated platform keeps all of the settings of the platform it was copied from. The out-of-the-box Linux through SSH platform (Unix via SSH) uses the PSM-SSH connection component and supports the SSH Text Recorder, which captures SSH text recordings and is enabled by default for SSH connections, and the Universal Keystrokes Text Recorder, which can be added under the platform Recorder Settings and records keystrokes typed during the session. Without any change, the new platform therefore supports these same two text recorder types.
Why the other options are wrong
- C. Events text recording is not one of the text recorders configured on the SSH platform.
- D. The SQL Text Recorder applies only to platforms that use the PSM-Toad or PSM-SQLPlus connection components.
- E. A Telnet commands recorder is not part of the recorder settings of the SSH platform.
Question 15
In addition to add accounts and update account contents, which additional permission on the safe is required to add a single account?
Show answer and explanation
Correct answer: C. Update Account Properties
Adding a single account in the PVWA creates the account object, stores its password and sets its properties such as address, user name and platform. For this reason, the user needs Add accounts, Update account content and Update account properties in the target Safe. Add accounts creates the object, Update account content stores the password, and Update account properties allows the account properties to be saved. CyberArk also lists these three account permissions, together with Create folders, for creating an account group.
Why the other options are wrong
- A. Upload Accounts Properties is not a Safe member permission.
- B. Rename accounts only changes the name of existing accounts and is not needed to add an account.
- D. Manage Safe controls Safe properties and is not required to add an account.
Question 16
Which file must be edited on the Vault to configure it to send data to PTA?
Show answer and explanation
Correct answer: A. dbparm.ini
PTA receives Vault audit records as syslog messages, so the Vault must be configured to forward them. This is done in DBParm.ini, the Vault's main configuration file: the syslog parameters, such as the syslog server address, port, protocol, message code filter and translator file, are available in dbparm.sample.ini and are copied into DBParm.ini with the PTA server as the destination. After the PrivateArk Server service restarts, the Vault sends its activity to PTA, which uses it to detect suspicious activities.
Why the other options are wrong
- B. PARAgent.ini configures the Remote Control Agent, not syslog forwarding.
- C. my.ini configures the Vault's MySQL database engine, not syslog forwarding to PTA.
- D. padr.ini configures the Disaster Recovery service and replication, not PTA integration.
Question 17
Which dependent accounts does the CPM support out-of-the-box? (Choose three.)
Show answer and explanation
Correct answer: B, C, E. Windows Services; Windows Scheduled Tasks; Windows Registry
Dependent accounts, also called usages or service accounts, represent resources on a target machine that use the same credentials as the target account. When the CPM changes the target password, it synchronizes every occurrence of that password in the linked dependent accounts. CyberArk ships service account plugins out of the box for Windows Services, Windows Scheduled Tasks and the Windows Registry, so these dependent account types can be managed without custom development.
Why the other options are wrong
- A. A Solaris configuration file is not one of the out-of-the-box service account plugins.
- D. Windows DCOM applications are not among the dependent account types the CPM supports out of the box.
- F. Key tab files are not one of the out-of-the-box dependent account types supported by the CPM.
Question 18
When are external vault users and groups synchronized by default?
Show answer and explanation
Correct answer: A. They are synchronized once every 24 hours between 1 AM and 5 AM.
Synchronization of external Vault users and groups with the external directory is controlled by the AutoSyncExternalObjects parameter in DBParm.ini. Its value specifies whether to synchronize, the number of hours in each cycle and the hours during which synchronization may run. The default value, AutoSyncExternalObjects=Yes,24,1,5, synchronizes the Vault's external users and groups once in every 24-hour cycle between 1 AM and 5 AM, a low-activity period. Related DBParm.ini parameters control whether existing users are updated and whether users no longer in the directory are deleted.
Why the other options are wrong
- B. The default synchronization window is 1 AM to 5 AM, not 7 PM to midnight.
- C. The default cycle is 24 hours, not 2 hours.
- D. A default schedule does exist, set by AutoSyncExternalObjects in DBParm.ini.
Question 19
The Privileged Access Management solution provides an out-of-the-box target platform to manage SSH keys, called UNIX Via SSH Keys.
How are these keys managed?
Show answer and explanation
Correct answer: A. CyberArk stores Private keys in the Vault and updates Public keys on target systems.
With the Unix via SSH Keys platform, CyberArk manages an SSH key pair for the account. When the key is rotated, the CPM generates a new random key pair and updates the public key on the target machines, by default in the user's ~/.ssh/authorized_keys file. The new private key is then stored in the Vault, where it benefits from the same access control, auditing and protection as passwords. Users and PSM connections retrieve or use the private key from the Vault, while the targets hold only the public key.
Why the other options are wrong
- B. The private key is what the Vault protects, and targets hold the public key, not the private key.
- C. CyberArk stores the private key in the Vault and does not generate keys on demand through a reconcile account.
- D. Targets are updated only with the public key, and the private key is never placed on target systems.
Question 20
Which parameters can be used to harden the Credential Files (CredFiles) while using CreateCredFile Utility? (Choose three.)
Show answer and explanation
Correct answer: A, B, C. OS Username; Current machine IP; Current machine hostname
A credential file holds logon details for a component user, so CreateCredFile can bind it to the environment where it is used, which limits misuse if the file is copied. The /OSUsername option restricts use to a specific operating system user, the /IpAddress option ties the file to the IP address of the current machine, and the /Hostname option ties it to the hostname of the current machine. Additional options such as an executable path, an entropy file and DPAPI protection add further restrictions.
Why the other options are wrong
- D. CreateCredFile has no option that restricts a credential file by operating system type.
- E. The Vault IP address is not a CreateCredFile restriction; the IP restriction applies to the machine using the file.
- F. CreateCredFile offers no time frame restriction for credential files.
Question 21
Users are unable to launch Web Type Connection components from the PSM server. Your manager asked you to open the case with CyberArk Support.
Which logs will be most useful for the CyberArk Support Team to debug the issue? (Choose three.)
Show answer and explanation
Correct answer: A, C, D. PSMConsole.log; PSMTrace.log; <Session_ID>.Component.log
The PSM server writes its activity logs to the Logs folder of the PSM installation, and these are the files CyberArk Support needs for connection component failures. PSMConsole.log contains informational messages and errors about PSM function. PSMTrace.log contains detailed trace messages that show how PSM processed the connection. The <Session_ID>.<connection component>.log files, created in the Components subfolder for each session, record the activity of the specific connection component, such as a web connection component, and usually reveal why it failed to launch.
Why the other options are wrong
- B. PSM does not produce a PSMDebug.log file; debug output is written to PSMTrace.log.
- E. PMconsole.log is a CPM log and records password management activity, not PSM sessions.
- F. ITALog.log is the Vault server log and does not record PSM connection component activity.
Question 22
Which accounts can be selected for use in the Windows discovery process? (Choose two.)
Show answer and explanation
Correct answer: A, B. an account stored in the Vault; an account specified by the user
When a Windows discovery process is created, the administrator selects the user that will perform the scan in one of two ways. The administrator can select an account that is already stored in the Vault, which is recommended for recurring scans because the credentials stay protected and managed. Alternatively, the administrator can manually specify a user name and password for the scan. In both cases the user needs read permissions in the scanned OU and all of its sub-OUs.
Why the other options are wrong
- C. The built-in Vault Administrator is a Vault user and is not used as the domain account that performs the scan.
- D. Membership in the Auditors group grants audit visibility and does not make an account available for discovery scans.
- E. The PasswordManager user is the CPM component user and is not selected to run discovery scans.
Question 23
When an account is unable to change its own password, how can you ensure that password reset with the reconcile account is performed each time instead of a change?
Show answer and explanation
Correct answer: B. Set the parameter ChangePasswordInResetMode to Yes.
The ChangePasswordInResetMode parameter in the Additional Policy settings of a platform defines whether password changes are performed in reset mode using the associated reconciliation account instead of a regular password change operation. It is configured at the platform level and its default value is No. Setting it to Yes is useful when the password policy prevents a user from changing its own password, or when a one-time password is used together with a Directory Services minimum password age restriction. With the parameter enabled, the CPM logs on with the reconcile account and resets the target password every time a change is due.
Why the other options are wrong
- A. RCAllowManualReconciliation only controls whether passwords can be reconciled when a user starts the procedure manually in the PVWA.
- C. IgnoreReconcileOnMissingAccount controls what the CPM does when no reconciliation account is linked to the account, and it does not make changes run in reset mode.
- D. UnlockUserOnReconcile unlocks a locked account during reconciliation and does not replace regular changes with resets.
Question 24
You are running a "Privileged Accounts Inventory" Report through the Reports page in PVWA on a specific safe.
To show complete account inventory information, which permission/s are needed on that safe?
Show answer and explanation
Correct answer: A. List Accounts, View Safe Members
To produce the Privileged Accounts Inventory report for a Safe, CyberArk requires the List accounts and View Safe members permissions on that Safe. List accounts lets the report enumerate the accounts stored in the Safe, and View Safe members lets the report include information about the activities of all users rather than only the user's own activities. Users who do not have View Safe members can only view information about their own activities, so the report would not show the complete inventory. Report generation itself also requires membership in the group named by ManageReportsGroup, which is PVWAMonitor by default.
Why the other options are wrong
- B. Manage Safe owners controls who can change Safe membership and does not provide the listing needed for the inventory.
- C. Access Safe without confirmation bypasses dual control and does not provide the Safe member visibility the report needs.
- D. Manage Safe and View Audit are not the permissions CyberArk lists for the Privileged Accounts Inventory report.
Question 25
If PTA is integrated with a supported SIEM solution, which detection becomes available?
Show answer and explanation
Correct answer: A. unmanaged privileged account
PTA lists the sensor required for each detection. Unmanaged privileged account is raised when a connection to a machine is made with a privileged account that is not stored in the Vault, or when such an account is added to a privileged group, and it depends on SIEM, Unix, AWS or Azure log data together with Vault data. Integrating PTA with a supported SIEM therefore supplies the logon events needed for this detection. The other detections rely on Vault activity, Active Directory scanning or traffic inspection instead of SIEM data.
Why the other options are wrong
- B. Privileged access to the Vault during irregular days relies on Vault data only and does not need a SIEM.
- C. Risky SPN is detected from Active Directory data and does not depend on SIEM integration.
- D. Exposed credentials relies on the Network Sensor or the PTA Windows Agent, not on SIEM integration.
Question 26
A password compliance audit found:
1. One-time password access of 20 domain accounts that are members of Domain Admins group in Active Directory are not being enforced.
2. All the sessions of connecting to domain controllers are not being recorded by CyberArk PSM.
What should you do to address these findings?
Show answer and explanation
Correct answer: A. Edit the Master Policy and add two policy exceptions: enable "Enforce one-time password access", enable "Record and save session activity".
Enforce one-time password access and Record and save session activity are both Master Policy rules. When the global rule should not change for every account, but a specific set of accounts must be treated differently, the administrator adds an exception to the Master Policy for the platform used by those accounts. Adding exceptions that enable one-time password access and session recording for the platform that manages the Domain Admins accounts and the domain controller connections addresses both audit findings while leaving the rest of the policy unchanged.
Why the other options are wrong
- B. Safe properties do not contain Master Policy rules, so these exceptions cannot be created there.
- C. CPM settings control the password manager and do not hold Master Policy rule exceptions.
- D. These are CyberArk policy rules, so Active Directory administrators cannot enforce them in the directory.
Question 27
What does the Export Vault Data (EVD) utility do?
Show answer and explanation
Correct answer: A. exports data from the Vault to TXT or CSV files, or to MSSQL databases
The Export Vault Data (EVD) utility extracts information from the Vault so it can be analyzed or reported on outside CyberArk. It exports data such as the users and groups list, Safes list, files list, the Master Policy, logs of activities and requests to text or CSV files, or directly into MSSQL databases. Organizations use these exports to build custom reports, feed audit tools or keep historical records, while the data in the Vault itself remains unchanged.
Why the other options are wrong
- B. EVD produces reporting data, not a backup set; Vault backups are made with the PAReplicate utility.
- C. EVD does not export passwords for import into another CyberArk instance.
- D. EVD does not synchronize Vaults; replication to a DR Vault is the job of the Disaster Recovery service.
Question 28
Which command generates a full backup of the Vault?
Show answer and explanation
Correct answer: A. PAReplicate.exe Vault.ini /LogonFromFile user.ini /FullBackup
The Vault Backup utility, PAReplicate.exe, copies the Safe files from the Vault to the backup machine in a similar structure to that in the Safes folder and automatically performs the pre-backup procedure first. It takes the Vault parameter file as its first argument, authenticates with a credential file through the /LogonFromFile option, and creates a full backup when the /FullBackup option is added. Running PAReplicate.exe Vault.ini /LogonFromFile user.ini /FullBackup therefore produces a full backup of the Vault.
Why the other options are wrong
- B. PAPreBackup only prepares the metadata for a third-party backup and does not create the backup itself.
- C. PARestore restores Safes from a backup and does not create a full backup.
- D. CAVaultManager RecoverBackupFiles recovers existing backup files and re-encrypts them with a new backup key, and it does not generate a backup.
That was 28 of 113.
The full CyberArk PAM-DEF pack has all 113 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 56 free as one PDF by email. Get the Half Pack →