39 free CyberArk PAM-SEN practice questions from the CertStash pack of 155, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 39 free here, all 155 in the pack, and each step includes the one before it.
Get all 155 questions (US$39) · Download the first 10 as a PDF
Question 1
You are installing a CPM.
In addition to Add Safes, Add/Update Users, Reset Users’ Passwords and Manage Server File Categories, which Vault authorization(s) does a CyberArk user need to install the CPM?
Show answer and explanation
Correct answer: B. Activate Users
The CPM installation creates its own Vault user and Safes, and registers the CPM in the Vault, so the installing user needs a specific set of Vault authorizations. CyberArk lists them as Add Safes, Add/Update Users, Reset Users' Passwords, Activate Users and Manage Server File Categories. Activate Users is required because the installer must be able to activate the component user it creates. Without it, the installation cannot complete the creation of the CPM user. None of the other authorizations offered are part of the CPM installation requirements.
Why the other options are wrong
- A. Manage Directory Mapping governs LDAP directory mappings and is not needed to install the CPM.
- C. Backup All Safes and Restore All Safes relate to backup operations and are not required for the CPM installation.
- D. Audit Users and Add Network Areas are not among the authorizations needed to install the CPM.
Question 2
In which configuration file do you add LoadBalancerClientAddressHeader when you enable x-forwarding on the PVWA load balancer?
Show answer and explanation
Correct answer: B. web.config
When the PVWA servers sit behind a load balancer that inserts an X-Forwarded-For header, the PVWA must be told which header carries the real client address. This is done with the LoadBalancerClientAddressHeader parameter, which is added to the appSettings section of the web.config file on each PVWA server. With this setting in place, the PVWA passes the original client IP address to the Vault, so audit records and IP-based restrictions reflect the end user rather than the load balancer address.
Why the other options are wrong
- A. PVConfiguration.xml holds PVWA configuration stored in the Vault and does not contain the load balancer client address header setting.
- C. apigw.ini is not the file used to configure the PVWA load balancer client address header.
- D. CyberArkScheduledTasks.exe.config configures the PVWA scheduled tasks service, not web request handling.
Question 3
You are configuring SNMP remote monitoring for your organization’s Vault servers.
In the PARAgent.ini, which parameter specifies the destination of the Vault SNMP traps?
Show answer and explanation
Correct answer: A. SNMPHostIP
Remote monitoring of the Vault is configured in PARAgent.ini, the parameter file of the PrivateArk Remote Control Agent. The SNMPHostIP parameter specifies the IP address of the remote computer that receives the SNMP traps sent by the Vault, so it defines the destination of the traps. The other SNMP parameters in the same file refine how traps are sent, such as the port, the community string and the SNMP version, but they do not identify where the traps go.
Why the other options are wrong
- B. SNMPTrapPort sets the port used for the traps, not the destination host.
- C. SNMPCommunity sets the community string used with the traps, not their destination.
- D. SNMPVersion selects the SNMP protocol version, not where the traps are sent.
Question 4
You want to improve performance on the CPM by restricting accounts for the CYBRWINDAD platform to only the WINDEMEA and WINDEMEA_Admin safes.
How do you set this in CyberArk?
Show answer and explanation
Correct answer: A. In the CYBRWINDAD platform, under Automatic Password Management/General, configure AllowedSafes and set to (WINDEMEA)|(WINDEMEA_ADMIN).
A platform can be restricted to specific Safes with the AllowedSafes parameter, found in the platform settings under Automatic Password Management, General. By default the value is a regular expression that matches all Safes. Setting it to an expression that matches only WINDEMEA and WINDEMEA_Admin means the CPM manages accounts of the CYBRWINDAD platform only in those Safes, which reduces the number of accounts the CPM evaluates and improves its performance.
Why the other options are wrong
- B. AllowedSafes is a platform parameter, not a setting of the CPM assigned to the Safes.
- C. UI and Workflows controls user interface behavior and does not hold the AllowedSafes parameter.
- D. There is no AllowedSafes setting in a cpm.ini file, because Safe restrictions are defined on the platform.
Question 5
Before the hardening process, your customer identified a PSM Universal Connector executable that will be required to run on the PSM.
Which file should you update to allow this to run?
Show answer and explanation
Correct answer: A. PSMConfigureAppLocker.xml
PSM hardening applies AppLocker rules that allow only approved executables to run on the PSM server. These rules are defined in PSMConfigureAppLocker.xml, which is read by the PSMConfigureAppLocker.ps1 script during hardening. When a customer needs an additional application, such as the executable used by a PSM Universal Connector, an entry for it is added to PSMConfigureAppLocker.xml and the script is run so the new rule takes effect and the application can be launched in PSM sessions.
Why the other options are wrong
- B. PSMHardening.xml is not the file that defines the AppLocker rules for allowed applications.
- C. PSMAppConfig.xml is not the file used to allow additional executables on the PSM.
- D. PSMConfigureHardening.xml is not the file that controls which applications AppLocker permits.
Question 6
How should you configure PSM for SSH to support load balancing?
Show answer and explanation
Correct answer: A. by using a network load balancer
PSM for SSH does not include a built-in load balancing mechanism. To distribute SSH connections across multiple PSM for SSH servers, an external network load balancer is placed in front of them, and users connect to the load balancer address. The load balancer then forwards each SSH session to one of the PSM for SSH servers, which provides both load distribution and availability without any special configuration in the PVWA.
Why the other options are wrong
- B. The PVWA options do not provide a servers setting that load balances PSM for SSH.
- C. There is no VIP setting in the PVWA options for PSM for SSH load balancing.
- D. Editing the SSH daemon configuration on each server does not distribute connections between servers.
Question 7
In which configuration file on the Vault can filters be configured to either include or exclude log messages that are sent through SNMP?
Show answer and explanation
Correct answer: A. PARAgent.ini
SNMP traps from the Vault are generated by the PrivateArk Remote Control Agent, whose settings are stored in PARAgent.ini. Besides the trap destination and connection settings, this file contains parameters that filter which log messages are sent as traps, allowing specific messages to be included or excluded. Filtering keeps the monitoring system focused on relevant Vault events and reduces noise from routine messages.
Why the other options are wrong
- B. DBParm.ini holds the main Vault server parameters and does not filter SNMP trap messages.
- C. TSParm.ini defines Safe storage locations and has no SNMP settings.
- D. The MIB file describes the traps to the monitoring system and is not where filters are configured.
Question 8
A first PSM server has been installed.
What should you confirm before installing any additional PSM servers?
Show answer and explanation
Correct answer: C. The user performing the installation is not a direct owner in the PSMUnmanagedSessionAccounts Safe.
Installing the first PSM server creates the PSMUnmanagedSessionAccounts Safe. Before installing additional PSM servers, CyberArk requires confirming that the user performing the installation is not a direct owner of the PSMUnmanagedSessionAccounts Safe. If the installing user is already a direct owner, the installation of the additional PSM server can fail when it tries to configure that Safe. Checking this membership in advance allows each additional PSM server to register cleanly.
Why the other options are wrong
- A. Each PSM server needs its own unique PSM ID, so sharing an ID is not a requirement.
- B. The requirement is that the installer is not a direct owner of the PSMUnmanagedSessionAccounts Safe, the opposite of this statement.
- D. There is no requirement that each PSM installation use a different recordings folder path.
Question 9
During the PSM installation process, Safes and a User are created.
In addition to Add Safes, Add/Update Users, Reset Users’ Passwords, and Activate Users, which authorization(s) does the Vault user installing the PSM need to enable them to be successfully created?
Show answer and explanation
Correct answer: A. Manage Vault File Categories
The PSM installation creates Safes and a component user in the Vault, so the installing user needs a defined set of Vault authorizations. CyberArk's PSM installation requirements list Add Safes, Add/Update Users, Reset Users' Passwords, Activate Users and Manage Vault File Categories. The file categories authorization allows the installer to define the file categories that the PSM objects use. Directory mapping management is not part of the PSM installation requirements.
Why the other options are wrong
- B. Manage Server File Categories is not the file categories authorization listed in the PSM installation requirements.
- C. Manage Directory Mapping is not needed for the PSM installation, and the listed file categories authorization does not match the requirements.
- D. Manage Directory Mapping is not part of the authorizations required to install the PSM.
Question 10
Your customer wants to store the Safes Data on Vault Drive D instead of Drive C.
Which file should you edit?
Show answer and explanation
Correct answer: A. TSParm.ini
TSParm.ini is the Vault parameter file that defines the directories in which the Vault stores Safes data. To place Safes on drive D instead of drive C, the directory entry in TSParm.ini is changed to point to the required location on drive D. Other Vault settings, such as server behavior, logging and syslog, are held in DBParm.ini, which does not determine where Safes data is stored.
Why the other options are wrong
- B. Vault.ini is used by client components to locate the Vault and does not control Safe storage on the server.
- C. DBParm.ini holds general Vault server parameters, not the Safes data directory.
- D. There is no user.ini file that controls where the Vault stores Safes.
What people say about the full PAM-SEN pack 4.5 from 2
Wonderful, I passed my CyberArk Sentry – PAM PAM-SEN exam today. The dumps from Cert Stash were valid, which helped me achieve good scores. Thanks very much!
Question 11
You want to change the name of the PVWAAppUser of the second PVWA server.
Which steps are part of the process? (Choose two.)
Show answer and explanation
Correct answer: D, E. Rename user in PrivateArk; Create new cred file for user
Changing the name of the PVWAAppUser keeps the existing user and its authorizations, so the user is renamed in the Vault through the PrivateArk Client rather than recreated. Because the PVWA authenticates to the Vault with a credential file that stores the user name, a new credential file must then be created for the renamed user with CreateCredFile and placed on that PVWA server. Without the new file, the PVWA would keep trying to log on with the old name.
Why the other options are wrong
- A. There is no PVWA.ini file that stores the application user name.
- B. Vault.ini defines how to reach the Vault and does not hold the application user name.
- C. Creating a new user loses the existing user's memberships and is not part of renaming.
Question 12
HTML5 Gateway can be installed on which supported UNIX OS versions? (Choose two.)
Show answer and explanation
Correct answer: A, B. Red Hat Enterprise Linux 7.x; CentOS 7.x
The PSM HTML5 Gateway is installed from an RPM package on a Linux server in the Red Hat family. For the versions this exam covers, the supported operating systems for this installation were Red Hat Enterprise Linux 7.x and CentOS 7.x. Red Hat Enterprise Linux 7.x is supported as the enterprise Red Hat distribution. CentOS 7.x is supported as its binary-compatible counterpart, so the same RPM installation applies to both.
Why the other options are wrong
- C. Ubuntu does not use RPM packages and was not a supported platform for the RPM installation of the gateway.
- D. AIX 7.x is not a supported operating system for the HTML5 Gateway.
- E. Android is a mobile operating system and cannot host the HTML5 Gateway.
Question 13
What are the basic network requirements to deploy a CPM server?
Show answer and explanation
Correct answer: A. Port 1858 to Vault and Port 443 to PVWA
The CPM communicates with the Vault over TCP port 1858, which is the Vault protocol port that CyberArk components use to communicate with the Vault. The CPM also connects to the PVWA over port 443, using its API key to perform tasks such as accounts discovery. These are the basic connections needed to deploy a CPM server. Additional ports to target systems depend on the platforms being managed.
Why the other options are wrong
- B. Port 1858 alone omits the required HTTPS connection to the PVWA.
- C. The CPM does not need all ports to the Vault, only TCP 1858.
- D. Vault traffic uses TCP, not UDP, on port 1858, and the CPM does not need port 389 to the PSM.
Question 14
A customer has five PVWA servers. Three are located at the primary data center and the remaining two are at a satellite data center.
What is important to consider about the load balancer? (Choose two.)
Show answer and explanation
Correct answer: A, B. It must not alter page content, or should include a mechanism to prevent pages from being altered; It must support “sticky sessions”.
CyberArk lists specific requirements for load balancers in front of multiple PVWA servers. The load balancer must not alter page content, or it must include a mechanism to prevent pages from being altered, because the PVWA relies on the integrity of its pages. It must also support sticky sessions so that each user remains on the same PVWA server for the duration of a session. These requirements apply regardless of how the PVWA servers are distributed between data centers.
Why the other options are wrong
- C. Issuing and signing certificates is the role of a certificate authority, not a load balancer requirement.
- D. The load balancer connects to the PVWA servers, not to the Vault servers.
- E. High availability for the load balancer is a design choice, not one of CyberArk's stated requirements.
Question 15
Your customer upgraded recently to version 12.2 to allow the Linux team to use the new MFA caching feature. The PSM for SSH was installed with default configuration settings. After setting the Authentication to SSH key and enabling MFA Caching from the PVWA interface, the Linux Team cannot connect successfully using the new MFA caching feature.
What is the most probable cause?
Show answer and explanation
Correct answer: A. OpenSSH 7.8 or above is not installed.
MFA caching lets users authenticate once with MFA and then connect through PSM for SSH with an SSH key for a configured period. In Integrated mode (InstallCyberArkSSHD=Integrated), the default installation mode, this feature has an operating system prerequisite: OpenSSH 7.8 or later must be installed on the PSM for SSH machine. Because MFA caching was already enabled in the PVWA and the PSM for SSH uses default installation settings, an older OpenSSH version on the server is the most probable reason the Linux team cannot connect using the cached MFA key.
Why the other options are wrong
- B. MFA caching is enabled through the PVWA, not through an MFACaching parameter in a psmpparms file.
- C. A passphrase policy is optional and is not required for MFA caching to work.
- D. MFA caching is supported with the default PSM for SSH installation when its prerequisites are met.
Question 16
In addition to bit rate and estimated total duration of recordings per day, what is needed to determine the amount of storage required for PSM recordings?
Show answer and explanation
Correct answer: A. retention period
Recording storage in the Vault is planned from three factors: the bit rate of the recordings, the estimated total duration of recordings created per day and the retention period for which recordings are kept. Multiplying the daily recording volume by the number of days recordings must be retained gives the total storage required. The number of PSM servers, users or targets influences the daily volume indirectly but is not a separate factor in the calculation.
Why the other options are wrong
- B. The number of PSM servers does not change how much recording data must be stored.
- C. The number of users is already reflected in the total daily recording duration.
- D. The number of targets is already reflected in the total daily recording duration.
Question 17
What must you do to prepare a Windows server for PVWA installation?
Show answer and explanation
Correct answer: A. In the InstallationAutomation folder, run the PVWA_Prerequisites.ps1 file as an administrator in PowerShell.
Before installing the PVWA, the Windows server must be prepared with the required roles, features and settings, such as IIS and the related components. CyberArk provides the PVWA_Prerequisites.ps1 script in the InstallationAutomation folder of the installation package for this purpose. Running it in PowerShell as an administrator configures the server automatically, so the PVWA installation can proceed on a correctly prepared machine.
Why the other options are wrong
- B. The PrivateArk Client is not a prerequisite for installing the PVWA.
- C. Domain Administrator rights and logon access to the Vault server are not required to install the PVWA.
- D. Enabling IPv6 is not a PVWA installation prerequisite.
Question 18
Which statement is correct about CPM behavior in a distributed Vault environment?
Show answer and explanation
Correct answer: A. CPMs should only access the primary Vault. When it is unavailable, CPM cannot access any Vault until another Vault is promoted as the new primary Vault.
In a Distributed Vaults environment the Primary Vault is the single source of data, and CPMs can access only the Primary Vault. This prevents password changes from being written to satellite Vaults and avoids data conflicts. If the Primary Vault becomes unavailable, the CPM cannot access any Vault until another Vault is promoted as the new Primary Vault, after which the CPM resumes working against the new primary.
Why the other options are wrong
- B. CPMs do not work with satellite Vaults, because only the Primary Vault holds the writable data.
- C. The CPM resumes once another Vault is promoted to primary, so it does not have to wait for the original Primary Vault.
- D. CPMs connect only to the Primary Vault, not to all Vaults.
Question 19
Which service must be set to Automatic (delayed start) after the Vault is installed and configured?
Show answer and explanation
Correct answer: A. Windows Time service
Accurate time on the Vault is essential for authentication, auditing and replication. After the Vault is installed, time synchronization is configured with NTP settings in the registry. For these settings to take effect reliably, the Windows Time service must be set to Automatic (Delayed start) and then started. The delayed start ensures the service starts after the system has finished booting and network connectivity is available.
Why the other options are wrong
- B. The PrivateArk Database service is not the service that must be set to delayed start.
- C. The Windows Update service is not configured to delayed start as part of Vault setup.
- D. The PrivateArk Server service is not the service that requires Automatic (Delayed start).
Question 20
You want to add an additional maintenance user on the PSM for SSH.
How can you accomplish this if InstallCyberArkSSHD is set to Yes or No?
Show answer and explanation
Correct answer: B. Create a local user called proxymng<number>.
When InstallCyberArkSSHD is set to Yes or No, PSM for SSH recognizes maintenance users by name. The default maintenance user is proxymng, and additional maintenance users are created as local users named proxymng followed by a number, such as proxymng1. Users with these names can log on directly to the PSM for SSH machine for administration instead of being routed through the proxy, so no further configuration is needed.
Why the other options are wrong
- A. There is no PSMMaintenance group that defines maintenance users on PSM for SSH.
- C. Using groups in the SSH daemon configuration applies to the Integrated mode, not to the Yes or No settings.
- D. psmpmng is not the naming convention that PSM for SSH recognizes for maintenance users.
Question 21
What must you do to synchronize a new Vault server with an organization’s NTP server?
Show answer and explanation
Correct answer: A. Configure an AllowNonStandardFWAddresses rule for the organization’s NTP server in DBParm.ini on the Vault server.
The Vault server runs its own built in firewall, which blocks all traffic that is not explicitly permitted. To let the Windows Time service reach the organization NTP server, an AllowNonStandardFWAddresses entry is added to DBParm.ini that allows the NTP server addresses on port 123 outbound over UDP. After the PrivateArk Server service is restarted, the rule takes effect and the Vault can synchronize its clock. Accurate time on the Vault is essential for audit records and for features such as one time password and session expiration.
Why the other options are wrong
- B. Rules added with the Windows Firewall console are not how the Vault permits traffic, because its own firewall rules are defined in DBParm.ini.
- C. The physical location of the NTP server is irrelevant, because traffic to it is blocked until a firewall rule allows it.
- D. AutoSyncExternalObjects relates to synchronizing external directory objects and has nothing to do with time synchronization.
Question 22
What is a step to enable NTP synchronization on a standalone Vault?
Show answer and explanation
Correct answer: C. Edit dbparm.ini and add a Firewall rule for the NTP address.
The hardened Vault firewall blocks all traffic that is not explicitly allowed, including NTP. To synchronize time on a stand-alone Vault, the Windows time service is configured to point to the NTP server, and DBParm.ini is edited to add a firewall rule, through the AllowNonStandardFWAddresses parameter, that permits UDP port 123 to the NTP server address. After the Vault service is restarted, the Vault can reach the NTP server and keep its clock synchronized.
Why the other options are wrong
- A. No PowerShell NTP module is involved in enabling time synchronization on the Vault.
- B. Restarting the organization's NTP servers does not open the Vault firewall for NTP traffic.
- D. The Event Notification Engine handles notifications and has no role in time synchronization.
Question 23
You want to add an additional maintenance user on the PSM for SSH.
How can you accomplish this if InstallCyberArkSSHD is set to Integrated?
Show answer and explanation
Correct answer: C. Create a local user and add it to group configured for the parameter AllowGroups in the /etc/sshd_config file.
When InstallCyberArkSSHD is set to Integrated, PSM for SSH works with the operating system's own SSH daemon, and access to that daemon is restricted by the AllowGroups parameter in the sshd_config file. To add another maintenance user, create a local user on the PSM for SSH server and add it to a group listed in AllowGroups. The SSH daemon then permits that user to log on directly to the server for maintenance instead of routing the connection as a privileged session.
Why the other options are wrong
- A. There is no PSMMaintenance group that grants maintenance access in Integrated mode.
- B. Naming a user proxymng with a number is not the method for Integrated mode, which relies on AllowGroups membership.
- D. Naming a user psmpmng with a number does not grant maintenance access in Integrated mode.
Question 24
What is required before the first CPM can be installed?
Show answer and explanation
Correct answer: A. The environment must have at least one Vault and one PVWA installed.
The general installation flow for PAM Self-Hosted starts with the Vault, followed by the PVWA, and only then the CPM. The CPM installation registers the CPM with the Vault and also communicates with the PVWA during setup, so at least one Vault and one PVWA must already be installed and reachable before the first CPM is installed. Accounts, platforms from the Marketplace and other components can all be added after the CPM is running.
Why the other options are wrong
- B. Accounts are onboarded after the CPM is installed, so none are needed beforehand.
- C. Custom platforms are optional and can be imported at any time after installation.
- D. The PSM is installed independently and is not a prerequisite for the CPM.
Question 25
What is the purpose of the CPM_Preinstallation.ps1 script included with the CPM installation package?
Show answer and explanation
Correct answer: D. It verifies the .NET version installed on the server and sets the IIS SSL TLS server configuration.
The CPM_PreInstallation.ps1 script is run before the CPM installation to prepare the server. It performs prerequisite tasks such as verifying that the required .NET Framework version is installed and setting the IIS SSL TLS server configuration. Running it ensures the operating system meets CPM requirements before the installation wizard or silent installation is launched. It does not install the CPM itself and does not collect values for the installation wizard.
Why the other options are wrong
- A. The script does not collect input to pre-populate wizard fields.
- B. The script prepares the server and does not install the CPM.
- C. Command line installation of the CPM is done through silent installation, not through the preinstallation script.
Question 26
What is a prerequisite step before CyberArk can be configured to support RADIUS authentication?
Show answer and explanation
Correct answer: B. In the RADIUS server, define the CyberArk Vault as a RADIUS client/agent.
RADIUS authentication requires a trust relationship between the Vault and the RADIUS server. CyberArk lists as the first preparation step that the Vault must be defined as a RADIUS client, also called an agent, on the RADIUS server, following the RADIUS vendor documentation. Only after that relationship exists can the required details be gathered, such as the RADIUS server address and port, the client host name and the shared secret, which are then used to configure the Vault and the users who authenticate with RADIUS.
Why the other options are wrong
- A. Selecting RADIUS as a user authentication method is a configuration step that comes after the prerequisites are in place.
- C. Running CAVaultManager to secure the RADIUS secret is part of the Vault configuration, not a prerequisite performed beforehand.
- D. Setting RadiusServersInfo in DBParm.ini is part of configuring the Vault for RADIUS, not the prerequisite step.
Question 27
A customer wants to store PSM recordings for 100 days and estimates they will have 10 Windows sessions per day for 100 minutes each.
What is the minimum storage required for the Vault and PAReplicate for the PSM recordings?
Show answer and explanation
Correct answer: A. 25 GB
Storage for PSM recordings is estimated by multiplying the number of sessions, their length, the recording rate and the retention period. CyberArk estimates up to about 250 KB for each minute of a recording. Ten sessions per day of 100 minutes each produce 1,000 recorded minutes per day, and 100 days of retention gives 100,000 minutes. At 250 KB per minute that equals 25,000,000 KB, which is 25 GB. This is the minimum storage that the Vault, and the PAReplicate backup of it, must hold for these recordings.
Why the other options are wrong
- B. 250 GB is ten times the calculated requirement and is not the minimum storage needed.
- C. 500 GB greatly exceeds the 25 GB produced by the documented calculation.
- D. 5 GB is too small to hold 100,000 minutes of recordings at about 250 KB per minute.
Question 28
All 80 employees from your satellite Tokyo office are complaining that browsing the PVWA site is very slow; however, your New York headquarters users are not experiencing this. The current PAM solution is:
• 2 distributed Vaults, the primary one in New York and a satellite in Tokyo
• 2 PVWA servers, both in New York with load balancing configured
• 2 PSM servers, both in New York without load balancing configured
• 1 CPM server in New York
• All PVWA, PSM, and CPM servers are connected to the primary Vault
Which proposal optimally resolves the performance issue while minimizing the impact to production?
Show answer and explanation
Correct answer: A. Install two new PVWA servers in Tokyo data center, configure load balancing, connect to the local satellite Vault and provide the URL of new PVWA servers to the local employees.
The slow browsing affects only Tokyo users because every PVWA request travels to New York and the PVWA servers there communicate with the New York primary Vault. PVWA is a component that can connect to a satellite Vault, so installing two load balanced PVWA servers in the Tokyo data center and connecting them to the local satellite Vault places both the web tier and the Vault close to the users. Giving Tokyo employees the new local URL improves their experience without changing the existing New York servers, which keeps the impact on production minimal.
Why the other options are wrong
- B. PVWA servers in New York would still force Tokyo users across the long network path, and connecting them to a distant Vault adds more latency.
- C. PSM servers handle privileged sessions, not PVWA browsing, so they do nothing for slow web interface performance.
- D. Migrating away from the distributed architecture is a disruptive redesign, and a DR Vault is not meant to serve active PVWA users.
Question 29
A customer is moving from an on-premises to a public cloud deployment.
What is the best and most cost-effective option to secure the server key?
Show answer and explanation
Correct answer: C. Install the Vault using the native cloud images and secure the server key using native cloud Key Management Systems.
For public cloud deployments, CyberArk provides Vault images and procedures designed for the cloud provider, and recommends protecting the server key with the provider's native Key Management Service. The key is held in the cloud KMS rather than on the Vault file system, which gives strong protection without buying and operating dedicated hardware. This combines good security with low cost, which makes it the best and most cost-effective option for securing the server key.
Why the other options are wrong
- A. Storing the server key in a password-protected folder on the operating system does not adequately protect it.
- B. Purchasing a Hardware Security Module adds significant cost and is not the most cost-effective option in the cloud.
- D. A Hardware Security Module adds cost that native cloud key management avoids.
Question 30
What is a valid combination of primary and secondary layers of authentication to a company's two-factor authentication policy?
Show answer and explanation
Correct answer: A. RSA SecurID Authentication (in PVWA) and LDAP Authentication
CyberArk two-factor authentication combines a primary method handled by the PVWA web server with a secondary method handled by the Vault. Primary methods include PKI, Windows authentication and RSA SecurID in the PVWA, while secondary methods include CyberArk password, LDAP and RADIUS. RSA SecurID authentication in the PVWA followed by LDAP authentication pairs one method from each layer, which makes it a valid primary and secondary combination.
Why the other options are wrong
- B. CyberArk and RADIUS are both Vault-side methods, so they do not form a primary and secondary pair.
- C. Oracle SSO and SAML are both front-end methods, so neither acts as the Vault-side secondary layer.
- D. LDAP and RADIUS are both Vault-side methods and cannot be layered as primary and secondary.
Question 31
CyberArk User Neil is trying to connect to the Target Linux server 192.168.1.164 using a domain account ACME/linuxuser01 on domain acme.corp using PSM for SSH server 192.168.65.145.
What is the correct syntax?
Show answer and explanation
Correct answer: B. ssh neil@linuxuser01#acme.corp@192.168.1.164@192.168.65.145
The PSM for SSH connection string is built from the Vault user, the target account, the target address and the PSM for SSH address, separated by @. Required parameters are separated from optional parameters with the hash character, so a domain account is specified by adding # and the domain after the target user name. The correct command is therefore ssh neil@linuxuser01#acme.corp@192.168.1.164@192.168.65.145, which identifies the Vault user, the domain account, the target server and the PSM for SSH server.
Why the other options are wrong
- A. A colon is not the separator used to specify the domain in the PSM for SSH syntax.
- C. This string omits the domain, so it does not identify the domain account.
- D. Using @ before the domain makes the domain appear as a target address, which breaks the syntax.
Question 32
You are configuring the Vault to send syslog audit data to your organization’s SIEM solution.
What is a valid value for the SyslogServerProtocol parameter in DBPARM.INI file?
Show answer and explanation
Correct answer: A. TLS
The SyslogServerProtocol parameter in DBParm.ini sets the transport protocol the Vault uses to send syslog audit records to the SIEM. The supported values are UDP, TCP and TLS. TLS encrypts the syslog stream between the Vault and the SIEM, which protects audit data in transit. The other values offered are different protocols that are not used for syslog forwarding.
Why the other options are wrong
- B. SSH is a remote access protocol and is not a valid syslog transport value.
- C. SMTP is used for email and is not a valid value for this parameter.
- D. SNMP is a separate monitoring protocol configured elsewhere, not a syslog transport.
Question 33
You are installing PSM for SSH with AD-Bridge and CyberArkSSHD mode set to integrated for your customer.
Which additional packages do you need to install to meet the customer’s needs? (Choose two.)
Show answer and explanation
Correct answer: A, B. CARKpsmp-infra; libssh
When InstallCyberArkSSHD is set to Integrated, PSM for SSH works alongside the native OpenSSH daemon of the Linux server instead of replacing it with the CyberArk SSH daemon. This combination needs two additional packages supplied with the installation media. The CARKpsmp-infra package, from the IntegratedMode folder, is required for Integrated mode and connects PSM for SSH to the operating system SSH service. The libssh package, from the Prerequisites folder, is the prerequisite CyberArk requires when PSM for SSH is used with AD Bridge. Both are installed before the main PSM for SSH package.
Why the other options are wrong
- C. Integrated mode uses the OpenSSH that ships with the supported operating system, so a separate OpenSSH package is not one of the additional CyberArk packages.
- D. AD Bridge is provided through the main PSM for SSH installation and its parameters, not through an additional package for Integrated mode.
- E. There is no separate CyberArk SSHD package to add, and Integrated mode specifically relies on the native OpenSSH daemon instead of the CyberArk SSH daemon.
Question 34
What is the default username for the PSM for SSH maintenance user when InstallCyberArkSSHD is set to yes?
Show answer and explanation
Correct answer: A. proxymng
PSM for SSH recognizes specific local Linux users as maintenance users, which allows administrators to log on to the PSM for SSH server itself instead of being proxied to a target. When InstallCyberArkSSHD is set to Yes and the CyberArk SSH daemon replaces the native one, the default maintenance user is proxymng. Administrators create this local user, and additional maintenance users can follow the proxymng naming pattern with a number appended. Connections from these users are treated as direct server logons, so administrators can maintain the server without going through the privileged session flow.
Why the other options are wrong
- B. psmp_maintenance is not the default maintenance user name that PSM for SSH recognizes.
- C. psmpmaintenanceuser is not a user name that PSM for SSH treats as a maintenance user by default.
- D. psmpmnguser is not the default maintenance user, which is proxymng.
Question 35
Which files does the Vault Installation Wizard prompt you for during the Vault install?
Show answer and explanation
Correct answer: A. Operator CD and License
During a Vault installation, the wizard asks for the destination folder for the server files and the location of the Safes data, and then prompts for the location of the license file and the Operator CD. The license file defines what the installation is permitted to use, and the Operator CD contains the keys the Vault requires to start and operate, including the server key and the recovery public key. The Master password and Administrator password are entered later in the wizard as passwords, not as files.
Why the other options are wrong
- B. The Master CD is not requested during installation; it holds the recovery private key, which is kept offline for emergency recovery of the Vault.
- C. The wizard asks for the license file, not a Vault certificate, alongside the Operator CD.
- D. DBParm.ini is created by the installation itself and the Master CD is not requested.
Question 36
Which parameter must be identical for both the Identity Provider (IdP) and the PVWA?
Show answer and explanation
Correct answer: C. IdP “Audience” and “ServiceProviderName” in the PVWA saml.config file
With SAML authentication the Identity Provider must identify the PVWA as a relying party. CyberArk documents that the IdP Audience value is the value the IdP uses to identify the PVWA, and it must be identical to the ServiceProviderName configured on the PVWA side. When the two values match, the SAML assertion issued by the IdP is accepted by the PVWA as intended for it. A mismatch causes the PVWA to reject the assertion, so users cannot complete the SAML sign in even when the rest of the configuration is correct.
Why the other options are wrong
- A. The pair that CyberArk explicitly specifies as having to be identical on both sides is the IdP Audience and the ServiceProviderName, not the values in this option.
- B. A user name and a sign on URL are different kinds of values and are never required to match each other.
- D. A hash algorithm and a certificate are unrelated settings and cannot be configured with an identical value.
Question 37
A customer's environment has three data centers consisting of 5,000 servers in Germany, 10,000 servers in Canada, and 1,500 servers in Singapore. You want to manage target servers and avoid complex firewall rules.
How many CPMs should you deploy?
Show answer and explanation
Correct answer: B. 3 total, 1 per data center
CyberArk supports multiple CPMs to manage passwords in different networks. Placing a CPM in each data center lets it reach the local target servers directly, so firewall rules between data centers for target management are not needed. With three data centers, deploying one CPM per data center, three in total, meets the goal of managing the targets while avoiding complex firewall rules.
Why the other options are wrong
- A. A single CPM would need firewall access from one site to targets in all three data centers.
- C. Fifteen CPMs is not tied to the network layout and adds needless management overhead.
- D. Two CPMs per site goes beyond what is needed to manage targets locally and avoid firewall complexity.
Question 38
Which tools are used during a CPM renaming process? (Choose two.)
Show answer and explanation
Correct answer: A, B. APIKeyManager Utility; CreateCredFile Utility
Renaming a CPM changes the identity it uses to work with the Vault and the PVWA, so both of its credential files must be regenerated. The CreateCredFile utility creates a new credential file for the renamed CPM user so the CPM can authenticate to the Vault. The APIKeyManager utility creates a new API key credential file, which the CPM uses to authenticate to the PVWA for tasks such as accounts discovery. Without both files the renamed CPM cannot communicate with the rest of the environment.
Why the other options are wrong
- C. CPMInDomain_Hardening.ps1 applies hardening to a domain member CPM and plays no part in renaming.
- D. PMTerminal.exe is the CPM plugin executable for terminal-based password changes and is not used for renaming.
- E. Data Execution Prevention is a Windows memory protection feature, not a CPM renaming tool.
Question 39
Which browser is supported for PSM Web Connectors developed using the CyberArk Plugin Generator Utility (PGU)?
Show answer and explanation
Correct answer: B. Google Chrome
Web application connectors created with the Plugin Generator Utility run through the PSM web applications framework, which automates a browser through Selenium WebDriver. Google Chrome is a prerequisite for installing the PGU, and the PGU package includes ChromeDriver to drive it. Google Chrome is therefore the supported browser among those listed for PSM Web Connectors built with the PGU.
Why the other options are wrong
- A. Internet Explorer is not supported for PGU-based web connectors.
- C. Opera is not a supported browser for PSM web connectors.
- D. Firefox is not a supported browser for PSM web connectors built with the PGU.
That was 39 of 155.
The full CyberArk PAM-SEN pack has all 155 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 77 free as one PDF by email. Get the Half Pack →