10 free CyberArk PAM-SEN practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 155 questions. Work through them, then open each answer to check your reasoning.
Get all 155 questions (US$39) · Download these 10 as a PDF
Question 1
You are installing a CPM.
In addition to Add Safes, Add/Update Users, Reset Users’ Passwords and Manage Server File Categories, which Vault authorization(s) does a CyberArk user need to install the CPM?
Show answer and explanation
Correct answer: B. Activate Users
Installing a CPM requires the Activate Users authorization in addition to the four mentioned permissions. This authorization allows the CPM service account to be activated in the Vault, which is necessary for the CPM to function and communicate with the Vault during installation.
Why the other options are wrong
- A. Manage Directory Mapping is used for LDAP and directory configurations, not CPM installation.
- C. Backup and Restore permissions are administrative functions unrelated to CPM installation requirements.
- D. Audit Users and Add Network Areas are not prerequisites for CPM installation.
Question 2
In which configuration file do you add LoadBalancerClientAddressHeader when you enable x-forwarding on the PVWA loadbalancer?
Show answer and explanation
Correct answer: B. web.config
The LoadBalancerClientAddressHeader parameter is configured in the web.config file on the PVWA server. This setting enables the PVWA to read the client's real IP address from the x-forwarding headers when deployed behind a load balancer.
Why the other options are wrong
- A. PVconfiguration.xml handles Vault connection settings, not load balancer headers.
- C. apigw.ini is used for API gateway configuration, not PVWA web settings.
- D. CyberArkScheduledTasks.exe.config is for scheduled task execution, not web server load balancing.
Question 3
You are configuring SNMP remote monitoring for your organization’s Vault servers.
In the PARAgent.ini, which parameter specifies the destination of the Vault SNMP traps?
Show answer and explanation
Correct answer: A. SNMPHostIP
The SNMPHostIP parameter in PARAgent.ini specifies the IP address of the destination host where SNMP traps will be sent from the Vault server. This is the target SNMP management station that receives trap messages.
Why the other options are wrong
- B. SNMPTrapPort specifies the UDP port used for SNMP traps, not the destination.
- C. SNMPCommunity defines the SNMP community string for authentication, not the destination address.
- D. SNMPVersion specifies which SNMP protocol version to use, not the destination location.
Question 4
You want to improve performance on the CPM by restricting accounts for the CYBRWINDAD platform to only the WINDEMEA and WINDEMEA_Admin safes.
How do you set this in CyberArk?
Show answer and explanation
Correct answer: A. In the CYBRWINDAD platform, under Automatic Password Management/General, configure AllowedSafes and set to (WINDEMEA)| (WINDEMEA_ADMIN).
Password Management/General, configure AllowedSafes and set to (WINDEMEA)| (WINDEMEA_ADMIN). The AllowedSafes parameter is configured within a platform's Automatic Password Management settings under the General section. This restricts accounts associated with that platform to only operate within the specified safes, improving CPM performance by limiting scope.
Why the other options are wrong
- B. Configuration settings are not applied at the CPM/Safe level; they are platform-level restrictions.
- C. The UI&Workflows/Properties/Optional section does not contain the AllowedSafes parameter for this purpose.
- D. While cpm.ini exists, platform-level restrictions are configured through the platform properties in the Vault, not through individual CPM configuration files.
Question 5
Before the hardening process, your customer identified a PSM Universal Connector executable that will be required to run on the PSM.
Which file should you update to allow this to run?
Show answer and explanation
Correct answer: A. PSMConfigureAppLocker.xml
The PSMConfigureAppLocker.xml file is used to whitelist executables that are allowed to run on the PSM during the hardening process. Before hardening is applied, you must update this file to include any required Universal Connector executables.
Why the other options are wrong
- B. PSMHardening.xml manages the overall hardening process but not specific executable whitelisting.
- C. PSMAppConfig.xml contains application configuration settings, not AppLocker rules.
- D. PSMConfigureHardening.xml is not the correct file for managing AppLocker executable permissions.
Question 6
How should you configure PSM for SSH to support load balancing?
Show answer and explanation
Correct answer: A. by using a network load balancer
PSM for SSH load balancing is configured by using a network load balancer at the infrastructure level. The PSM for SSH servers sit behind a network load balancer that distributes SSH connections across multiple PSM instances.
Why the other options are wrong
- B. PVWA options for PSM for SSH Proxy do not provide load balancing configuration.
- C. The VIP configuration in PVWA is not the correct method for implementing PSM SSH load balancing.
- D. Editing sshd.config on individual servers does not configure load balancing; that requires network-level infrastructure.
Question 7
In which configuration file on the Vault can filters be configured to either include or exclude log messages that are sent through SNMP?
Show answer and explanation
Correct answer: A. PARAgent.ini
The PARAgent.ini file on the Vault contains configuration parameters for SNMP including filters that specify which log messages are included or excluded from SNMP trap transmission. This allows administrators to control the verbosity of SNMP notifications.
Why the other options are wrong
- B. DBParm.ini manages database parameters, not SNMP trap filtering.
- C. TSParm.ini contains transaction server parameters, not SNMP configuration.
- D. The MIB file defines SNMP object structures but does not contain filter configuration settings.
Question 8
A first PSM server has been installed.
What should you confirm before installing any additional PSM servers?
Show answer and explanation
Correct answer: C. The user performing the installation is not a direct owner in the PSMUnmanagedSessionAccounts Safe.
Before installing additional PSM servers, you must confirm that the user performing the installation is not a direct owner in the PSMUnmanagedSessionAccounts Safe. Direct ownership by the installer can cause permission conflicts and issues with the PSM's ability to manage accounts properly.
Why the other options are wrong
- A. Each PSM server must have a unique PSM ID; reusing the same ID across servers creates conflicts.
- B. The installer should not be a direct owner; this creates permission and security issues rather than being a requirement.
- D. The Recordings Folder can be configured similarly across PSM installations; different paths are not required.
Question 9
During the PSM installation process, Safes and a User are created.
In addition to Add Safes, Add/Update Users, Reset Users’ Passwords, and Activate Users, which authorization(s) does the Vault user installing the PSM need to enable them to be successfully created?
Show answer and explanation
Correct answer: A. Manage Vault File Categories
During PSM installation, the Vault user must have Manage Vault File Categories authorization in addition to the listed permissions (Add Safes, Add/Update Users, Reset Users' Passwords, and Activate Users) to successfully create the necessary Safes and Users. This authorization is required to manage the file categories within the Vault that support PSM functionality.
Why the other options are wrong
- B. Manage Server File Categories is not required for PSM installation; this relates to server-side file management outside the Vault.
- C. Manage Directory Mapping is not a required authorization for PSM installation, and Server File Categories is incorrect as noted above.
- D. Manage Directory Mapping is not required for PSM installation; only Vault File Categories authorization is needed.
Question 10
Your customer wants to store the Safes Data on Vault Drive D instead of Drive C.
Which file should you edit?
Show answer and explanation
Correct answer: A. TSparm.ini
The TSparm.ini file is the configuration file used to specify storage locations for Vault data. This file contains parameters that direct the Vault to store Safe data on specific drives, allowing the administrator to redirect Safe storage from Drive C to Drive D.
Why the other options are wrong
- B. Vault.ini is a general Vault configuration file but does not control Safe data storage location.
- C. DBparm.ini is used for database parameters, not for Safe data storage location configuration.
- D. user.ini is a user-specific configuration file and has no role in Vault storage location management.
That was 10 of 155.
The full CyberArk PAM-SEN pack has all 155 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.