2 packs: 15% off with code BUY2. 3 or more: 20% off with code BUY3.

Free CyberArk EPM-DEF Practice Questions

38 free CyberArk EPM-DEF practice questions from the CertStash pack of 154, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 38 free here, all 154 in the pack, and each step includes the one before it.

Get all 154 questions (US$39) · Download the first 10 as a PDF

Question 1

A Helpdesk technician needs to provide remote assistance to a user whose laptop cannot connect to the Internet to pull EPM policies.

What CyberArk EPM feature should the Helpdesk technician use to allow the user elevation capabilities?

  1. Offline Policy Authorization Generator
  2. Elevate Trusted Application If Necessary
  3. Just In Time Access and Elevation
  4. Loosely Connected Devices Credential Management
Show answer and explanation

Correct answer: A. Offline Policy Authorization Generator

The Offline Policy Authorization Generator (OPAG) is built for endpoints that cannot reach the EPM server. The Helpdesk technician runs the OPAG utility, enters the Request ID supplied by the end user, and generates an authorization token that grants a time-limited elevate or run permission for a specific application. The user applies the token on the disconnected computer, so elevation works without any new policy being downloaded. This makes OPAG the correct tool for remote assistance to a laptop with no Internet connection.

Why the other options are wrong

  • B. An Elevate If Necessary policy must already be delivered to the endpoint and cannot be granted ad hoc to a disconnected machine.
  • C. Just In Time (JIT) access and elevation is granted through a policy that the agent must receive from the EPM server, which an offline laptop cannot do.
  • D. Loosely Connected Devices credential management rotates local account passwords through PVWA and does not grant application elevation.

Question 2

Which user or group will not be removed as part of CyberArk EPM's Remove Local Administrators feature?

  1. Built-in Local Administrator
  2. Domain Users
  3. Admin Users
  4. Power Users
Show answer and explanation

Correct answer: A. Built-in Local Administrator

The Remove local administrators policy strips users and groups from the local Administrators group on targeted endpoints, except for the built-in administrator accounts and any users or groups that the EPM administrator explicitly excludes in the policy scope. The built-in Local Administrator therefore always retains its membership, which preserves a recovery path on the machine. Every other account in the group, including domain and power user accounts, is eligible for removal unless the administrator adds it to the exclusion list.

Why the other options are wrong

  • B. Domain Users is removed from the local Administrators group unless it is explicitly excluded in the policy.
  • C. Ordinary admin users are exactly the accounts that the policy is designed to remove.
  • D. Power Users members are removed like any other non-built-in member unless they are excluded.

Question 3

An end user is reporting that an application that needs administrative rights is crashing when selecting a certain option menu item. The Application is part of an advanced elevate policy and is working correctly except when using that menu item.

What could be the EPM cause of the error?

  1. The Users defined in the advanced policy do not include the end user running the application.
  2. The Advanced: Time options are not set correctly to include the time that the user is running the application at.
  3. The Elevate Child Processes option is not enabled.
  4. The Specify permissions to be set for selected Services on End-user Computers is set to Allow Start/Stop
Show answer and explanation

Correct answer: C. The Elevate Child Processes option is not enabled.

When an elevate policy matches an application, only the main process is elevated unless the policy also elevates child processes. A menu option that launches a separate helper executable or process starts a child process, and if Elevate Child Processes is not enabled, that child runs with standard rights and fails or crashes when it needs administrative access. The application works normally everywhere else because the parent process is elevated. Enabling the child process option in the advanced policy resolves the behavior.

Why the other options are wrong

  • A. If the user were outside the policy targets, the application would not be elevated at all, not just fail on one menu item.
  • B. A time restriction would stop the whole policy from applying, not only one menu action.
  • D. Service permission settings govern Windows services, not an application menu that spawns a process.

Question 4

Which setting in the agent configuration controls how often the agent sends events to the EPM Server?

  1. Event Queue Flush Period
  2. Heartbeat Timeout
  3. Condition Timeout
  4. Policy Update Rate
Show answer and explanation

Correct answer: A. Event Queue Flush Period

Event Queue Flush Period is the agent configuration parameter that defines how often the agent sends collected events, such as events of unhandled applications managed by Default Policies, to the EPM server. The value is expressed in seconds, with a range from 30 seconds to 24 hours and a default of 1800 seconds (30 minutes). Lowering the value delivers events to the Events Management page sooner at the cost of more frequent communication with the server.

Why the other options are wrong

  • B. Heartbeat Timeout defines how frequently EPM checks script and network policy conditions, not how often events are sent.
  • C. Condition Timeout is the script or network policy condition timeout after which the agent resumes checking the policy condition, and it does not schedule event uploads.
  • D. Policy Update Rate controls how often policies are pushed to endpoints, not how often the agent sends events.

Question 5

Which of the following application options can be used when defining trusted sources?

  1. Publisher, Product, Size, URL
  2. Publisher, Name, Size, URI
  3. Product, URL, Machine, Package
  4. Product, Publisher, User/Group, Installation Package
Show answer and explanation

Correct answer: D. Product, Publisher, User/Group, Installation Package

Trusted source policies define where trusted applications come from, so the available source types describe origins rather than file attributes. EPM lets the administrator base a trusted source on the product name, the publisher's signature, a user or group (for example an IT account that performs installations), or an installation package, along with network shares and similar distribution locations. Applications that originate from these defined sources then receive the trust action configured in the policy, which reduces the need to define each application individually.

Why the other options are wrong

  • A. File size is not a trusted source type, so this combination does not describe the trusted source options EPM offers.
  • B. File name and size are file attributes, not trusted source definitions, so this combination does not describe the trusted source options EPM offers.
  • C. Machine and generic package are not trusted source options, so this combination does not describe the trusted source types.

Question 6

What EPM component is responsible for communicating password changes in credential rotation?

  1. EPM Agent
  2. EPM Server
  3. EPM API
  4. EPM Discovery
Show answer and explanation

Correct answer: A. EPM Agent

In credential rotation for Loosely Connected Devices, the EPM agent on the endpoint is the component that performs the work. Based on the configured policy, the agent connects to the CyberArk PVWA at the defined interval, changes the local account password on the endpoint, and communicates the new password so it is stored in the Vault. Because the agent initiates the connection, endpoints that are rarely on the corporate network can still have their privileged local credentials rotated and reported.

Why the other options are wrong

  • B. The EPM server distributes the policy but does not change and report the local password on the device.
  • C. The EPM API is used for automation of EPM objects, not for reporting rotated credentials.
  • D. Discovery identifies applications and accounts and has no role in reporting password changes.

Question 7

An EPM Administrator would like to notify end users whenever the Elevate policy is granting users elevation for their applications.

Where should the EPM Administrator go to enable the end-user dialog?

  1. End-user UI in the left panel of the console
  2. Advanced, Agent Configurations
  3. Default Policies
  4. End-User UI within the policy
Show answer and explanation

Correct answer: D. End-User UI within the policy

End-user notifications for elevation are configured per policy. When creating or editing an Elevate policy, the administrator opens the End-User UI section of that policy and selects the dialog or notification to display when the policy grants elevation. This lets each policy present its own message, so users are informed when a specific application is being elevated. The EPM console also stores dialog templates, but the dialog is enabled and assigned within the policy itself.

Why the other options are wrong

  • A. The End-user UI area of the console holds dialog templates and does not activate notifications for a particular policy.
  • B. Agent configurations control agent behavior parameters, not the dialogs shown by an Elevate policy.
  • C. Default Policies cover unhandled applications and do not configure notifications for a specific Elevate policy.

Question 8

Which of the following is CyberArk's Recommended FIRST roll out strategy?

  1. Implement Application Control
  2. Implement Privilege Management
  3. Implement Threat Detection
  4. Implement Ransomware Protection
Show answer and explanation

Correct answer: B. Implement Privilege Management

CyberArk recommends implementing Privilege Management first. This phase starts with discovery of applications that require administrative rights, then creates elevation policies for them, and finally removes local administrator rights from end users. Removing standing admin rights delivers the largest immediate reduction in attack surface, and the visibility gathered during this phase builds the application inventory that later phases, such as Application Control and Ransomware Protection, depend on.

Why the other options are wrong

  • A. Application Control is a later phase that relies on the application inventory built during Privilege Management.
  • C. Threat detection capabilities are layered on after privileges are under control.
  • D. Ransomware Protection is deployed after the foundational Privilege Management phase.

Question 9

An EPM Administrator would like to include a particular file extension to be monitored and protected under Ransomware Protection.

What setting should the EPM Administrator configure to add the extension?

  1. Authorized Applications (Ransomware Protection)
  2. Files to be Ignored Always
  3. Anti-tampering Protection
  4. Default Policies
Show answer and explanation

Correct answer: D. Default Policies

The files that Ransomware Protection monitors and protects are configured in the Protect against ransomware policy, which lives under Default Policies in the Privilege Management section. Editing the policy settings lets the administrator add file names, locations or wildcard patterns, such as an additional file extension, to determine where the policy applies, and the same policy can be extended to protect Windows registry keys. Changing the protected file list therefore always happens in the Default Policies area.

Why the other options are wrong

  • A. Authorized Applications (Ransomware Protection) is an application group that excludes applications from the policy and does not define protected file types.
  • B. Files To Be Ignored Always excludes files from EPM processing, which is the opposite of protecting them.
  • C. Anti-tampering Protection safeguards the EPM agent itself and does not define protected file extensions.

Question 10

When deploying EPM and in the Privilege Management phase what is the purpose of Discovery?

  1. To identify all non-administrative events
  2. To identify all administrative level events
  3. To identify both administrative and non-administrative level events
  4. To identify non-administrative threats
Show answer and explanation

Correct answer: C. To identify both administrative and non-administrative level events

Discovery in the Privilege Management phase gives full visibility of what users run before any restriction is applied. EPM silently monitors the regular applications that run in a standard user context and also records which applications and tasks require administrative rights. CyberArk recommends allocating 10 to 14 days to this stage, after which the collected events are classified by user account type into Standard users and Administrators. The administrator therefore sees both administrative and non-administrative level events and can use them to build elevation policies and plan which activity should remain allowed once local admin rights are removed.

Why the other options are wrong

  • A. Discovery also captures the applications that require administrative rights, so it is not limited to non-administrative events.
  • B. Discovery also monitors regular applications run in a standard user context, so it is not limited to administrative events.
  • D. Discovery collects application activity for policy creation and is not a threat detection function.

Question 11

When adding the EPM agent to a pre-existing security stack on workstation, what two steps are CyberArk recommendations. (Choose two.)

  1. Add any pre-existing security application to the Files to Be Ignored Always.
  2. Add EPM agent to the other security tools exclusions.
  3. EPM agent should never be run with any other security tools.
  4. Create new advanced policies for each security tool.
Show answer and explanation

Correct answer: A, B. Add any pre-existing security application to the Files to Be Ignored Always; Add EPM agent to the other security tools exclusions.

EPM can run alongside other security products when mutual exclusions are configured. Adding the pre-existing security applications to Files To Be Ignored Always in the agent configuration prevents the EPM agent from interfering with their processes. Adding the EPM agent to the exclusion lists of the other security tools prevents those tools from blocking or scanning EPM agent activity. Together these exclusions avoid conflicts and performance problems on the workstation.

Why the other options are wrong

  • C. EPM is designed to coexist with other security tools when exclusions are configured.
  • D. Creating Advanced Policies for each security tool does not prevent conflicts between the products.

Question 12

As part of the IT team, you enabled auditing to record an end user's activities in the cmd application.

When checking for a video file on an end user's computer, you found that it was deleted due to the default retention period. Now, you are trying to set the maximum retention period.

What is the maximum retention period that can be set?

  1. 60 days
  2. 90 days
  3. 1 year
  4. 2 years
Show answer and explanation

Correct answer: C. 1 year

Audit videos recorded by CyberArk Endpoint Privilege Manager (EPM) policies are stored on the endpoint or on a shared network folder, and how long they are kept is controlled by the Video file retention period parameter in the agent configuration. The parameter is set in days with valid values from 1 to 365 and a default of 14 days, which explains why the recording was deleted. The longest retention that can be configured is therefore 365 days, or one year.

Why the other options are wrong

  • A. 60 days is within the allowed range but is not the maximum.
  • B. 90 days is within the allowed range but is not the maximum.
  • D. Two years exceeds the 365-day upper limit of the parameter.

Question 13

Which types of data are collected by CyberArk EPM endpoints? (Choose two.)

  1. computer name
  2. file explorer information
  3. EPM username (email address)
  4. installed programs
  5. administrator's IP address
Show answer and explanation

Correct answer: A, D. computer name; installed programs

The CyberArk Endpoint Privilege Manager (EPM) SaaS technical datasheet lists the data that EPM agents collect from endpoints: the computer name, network connection information such as MAC and IP addresses, local users and groups, the currently logged in user, installed programs, hardware specifications, general system information and launched applications. This data lets EPM apply the configured policies to the right computers and computer groups and audit file and user activity.

Why the other options are wrong

  • B. File explorer information is not part of the data agents collect.
  • C. The EPM username of a console administrator is console account data, not data collected from endpoints.
  • E. Agents report the endpoint's own network addresses, not the IP address of an administrator.

Question 14

An EPM Administrator is looking to enable the Threat Deception feature, under what section should the EPM Administrator go to enable this feature?

  1. Threat Protection Inbox
  2. Policies
  3. Threat Intelligence
  4. Policy Audit
Show answer and explanation

Correct answer: B. Policies

Threat Deception in EPM works through Privilege Deception policies that create credential lures, fake local administrator accounts and browser credentials that attackers might try to use. The feature is enabled under Policies, in the Default Policies page under Privilege Threat Protection, by setting Create credential lures to detect and deceive attackers to Detect or Block. The administrator then chooses the lure types, the lure user names and the target computers.

Why the other options are wrong

  • A. The Threat Protection Inbox displays detected events and is not where policies are enabled.
  • C. Threat Intelligence configures reputation services and does not enable credential lures.
  • D. Policy Audit reviews audit data and does not enable policies.

Question 15

Which statements about the Immediate Enforcement (IE) agent are correct? (Choose two.)

  1. Threat protection is not available for IE agents.
  2. The agent installation kit for IE agents does not contain the set’s policies.
  3. IE agents are available for Windows, macOS and Linux.
  4. IE agents should be installed in the same set as regular agents
  5. "Download immediate enforcement agent" must be set to ON when deploying an IE agent
Show answer and explanation

Correct answer: A, E. Threat protection is not available for IE agents; "Download immediate enforcement agent" must be set to ON when deploying an IE agent

An Immediate Enforcement (IE) agent installation kit includes the set's policies and begins enforcing them as soon as the agent is installed, even before it connects to the EPM service. Until the agent connects, some functionality is not available, including agent self-defense and threat protection. The IE kit can only be downloaded when the Download immediate enforcement agent parameter in the set configuration is turned on, so that setting must be enabled before deploying an IE agent.

Why the other options are wrong

  • B. The IE installation kit does contain the set's policies, which is why it must be stored securely.
  • C. Immediate enforcement is available for Windows and macOS, not Linux.
  • D. CyberArk recommends a dedicated set for immediate enforcement agent policies.

Question 16

What is required to configure SAML authentication on EPM?

  1. OAuth token
  2. Signed Authentication Request
  3. Encrypted Assertion
  4. Signed SAML Response
Show answer and explanation

Correct answer: B. Signed Authentication Request

When EPM is configured as a SAML service provider, the IdP Server Configuration lists properties that ensure message integrity between EPM and the identity provider. Signed Authentication Request has a default value of true, together with Signed Assertion, so a signed authentication request is expected. Encrypted Assertion and Signed SAML Response have a default value of false, which means they are not required for the integration.

Why the other options are wrong

  • A. EPM SAML integration uses SAML messages and certificates, not an OAuth token.
  • C. Encrypted assertion is optional and adds extra protection only when the environment requires it.
  • D. Signed SAML Response has a default value of false in the IdP Server Configuration properties.

Question 17

What are valid policy options for JIT and elevation policies?

  1. Grant temporary access for all users, Policy name, Restart administrative processes in admin approval mode, Collect audit information
  2. Grant temporary access for, Policy name, Terminate administrative processes when the policy expires, Collect audit information
  3. Grant administrative access, Policy name, Log off to apply policy, Collect policy violation information
  4. Terminate administrative services, Grant policy access for, Policy name, Collect audit reports
Show answer and explanation

Correct answer: B. Grant temporary access for, Policy name, Terminate administrative processes when the policy expires, Collect audit information

When creating a Just In Time (JIT) access and elevation policy, the administrator sets the Policy name, the Grant temporary access for period in hours, whether to Terminate administrative processes when the policy expires, and whether to Collect audit information. The terminate option ends active administrative processes run by the elevated user once the policy ends, and the audit option collects records of the elevated user's activities and displays them on the Policy Audit page.

Why the other options are wrong

  • A. Grant temporary access for all users and Restart administrative processes in admin approval mode are not JIT policy options.
  • C. Grant administrative access, Log off to apply policy and Collect policy violation information are not JIT policy options.
  • D. Terminate administrative services, Grant policy access for and Collect audit reports are not JIT policy options.

Question 18

What are the predefined application groups?

  1. Developer group, Administrator group
  2. Run as Administrator, Run as Developer, Block
  3. Elevate, Allow, Block, Developer Applications
  4. Block Only
Show answer and explanation

Correct answer: C. Elevate, Allow, Block, Developer Applications

EPM ships with predefined application groups that act as containers for its predefined policies. The Elevate, Allow and Block application groups hold the applications managed by the default Elevate, Allow and Block policies, and the Developer Applications application group holds the development tools managed by the Developer Applications policy. Administrators add applications to these groups and can also create custom application groups for their own needs.

Why the other options are wrong

  • A. EPM has no predefined Developer group or Administrator group.
  • B. Run as Administrator and Run as Developer are not predefined application groups.
  • D. Block is only one of several predefined application groups.

Question 19

Which programming interface enables you to perform activities on EPM objects via a REST Web Service?

  1. EPM Web Services SDK
  2. Application Password SDK
  3. Mac Credential Provider SDK
  4. Java password SDK
Show answer and explanation

Correct answer: A. EPM Web Services SDK

The EPM Web Services SDK is the programming interface for EPM. It exposes REST APIs that let administrators and integrations perform activities on EPM objects, such as Sets, policies, application groups, computers, events and agent configurations, without using the console. This enables automation of routine tasks and integration of EPM with other tools such as ticketing or SIEM systems.

Why the other options are wrong

  • B. The Application Password SDK retrieves credentials from the CyberArk Vault and does not manage EPM objects.
  • C. A Mac Credential Provider SDK is not the interface for managing EPM objects through REST.
  • D. The Java password SDK retrieves Vault credentials for Java applications and has no role in managing EPM.

Question 20

If an EPM agent loses connectivity to the EPM SaaS, what will occur?

  1. The EPM agent continues to apply policies based on the last policies retrieved
  2. The EPM agent automatically disables its agent self-defense
  3. The EPM SaaS attempts to redeploy the agent to the endpoint.
  4. The EPM SaaS redirects the EPM agent to an available EPM SaaS region
Show answer and explanation

Correct answer: A. The EPM agent continues to apply policies based on the last policies retrieved

The EPM agent stores the policies it receives from the CyberArk Endpoint Privilege Manager (EPM) SaaS service locally on the endpoint. If connectivity to the service is lost, the agent keeps enforcing the last policies it retrieved, so protection continues while the endpoint is offline. Events are queued and sent once the connection is restored, and the agent then receives any policy updates made in the meantime.

Why the other options are wrong

  • B. Agent self-defense remains active and is not disabled by a loss of connectivity.
  • C. The service does not redeploy the agent when it stops communicating.
  • D. Agents belong to a set in a specific region and are not redirected to another region.

Question 21

What is default retention period for admin activities on the web console?

  1. 14 days
  2. 30 days
  3. 90 days
  4. 1 year
Show answer and explanation

Correct answer: D. 1 year

The EPM SaaS technical datasheet lists the data retention periods of the service, several of which are not configurable. Admin activities on the web console, such as logins and policy changes, are retained for 1 year and can be reviewed through a report in the console. Other data has shorter periods: event management data is kept for 30 days, policy audit data and video audit metadata for 90 days, and video audit files for 14 days.

Why the other options are wrong

  • A. 14 days is the retention period for video audit files.
  • B. 30 days is the retention period for event management data.
  • C. 90 days is the retention period for policy audit data and video audit metadata.

Question 22

Can the EPM Set Administrator configure Audit Dialog Pop-ups for the Record Audit Video option?

  1. Yes, when Audit Video recording started, when Audit Video recording stopped, and when Audit Recording video reached size limit.
  2. Yes, when Audit Video recording started, when not enough disk space to start the video recording, and when video recording is initializing.
  3. Yes, when Audit Video recording started, when Audit Video recording is uploaded to the EPM server, and when audit recording cannot be initialized.
  4. No, Audit Video is only available without the possibility of having End-User dialog pop-ups.
Show answer and explanation

Correct answer: B. Yes, when Audit Video recording started, when not enough disk space to start the video recording, and when video recording is initializing.

EPM provides end-user dialogs related to the Record Audit Video option, and the Set administrator can configure them. The Audit Video dialog tells the user that EPM is starting to record an audit video of an application, the Audit Video Error dialog reports that there is not enough disk space to start the recording, and the Audit Video Initialization dialog shows that the recording is initializing. These dialogs keep users informed while their activity is recorded.

Why the other options are wrong

  • A. EPM provides no dialogs for a recording that stopped or reached a size limit.
  • C. EPM provides no dialogs for uploading the recording to the EPM server.
  • D. Audit Video has configurable end-user dialogs.

Question 23

CyberArk EPM's Ransomware Protection comes with file types to be protected out of the box. If an EPM Administrator would like to remove a file type from Ransomware Protection, where can this be done?

  1. Policy Scope within Protect Against Ransomware
  2. Authorized Applications (Ransomware Protection) within Application Groups
  3. Set Security Permissions within Advanced Policies
  4. Protected Files within Agent Configurations
Show answer and explanation

Correct answer: A. Policy Scope within Protect Against Ransomware

The file types protected by Ransomware Protection are defined inside the Protect Against Ransomware policy itself. When editing the policy, the administrator manages the list of protected file types and locations in the policy scope settings, and can remove an out-of-the-box file type there. The Authorized Applications (Ransomware Protection) application group is used for applications allowed to access protected files, not for the file types.

Why the other options are wrong

  • B. Authorized Applications lists applications allowed to access protected files and does not define file types.
  • C. Set Security Permissions in Advanced Policies controls access permissions and does not change the ransomware file type list.
  • D. Agent Configurations has no Protected Files list for Ransomware Protection.

Question 24

An end user is experiencing performance issues on their device after the EPM Agent had been installed on their machine.

What should the EPM Administrator do first to help resolve the issue?

  1. Verify any 3rd party security solutions have been added to EPM's Files To Be Ignored Always configuration and CyberArk EPM has also been excluded from the 3rd party security solutions.
  2. Enable the Default Policy's Privilege Management Control, Unhandled Privileged Applications in Elevate mode.
  3. Rerun the agent installation on the user's machine to repair the installation.
  4. Uninstall or disable any antivirus software prohibiting the EPM Agent functionalities.
Show answer and explanation

Correct answer: A. Verify any 3rd party security solutions have been added to EPM's Files To Be Ignored Always configuration and CyberArk EPM has also been excluded from the 3rd party security solutions.

Slowness after an EPM agent installation is most commonly caused by interaction between EPM and other security products that hook the same processes and files. The first step is to configure mutual exclusions: add the third-party security solution's files and processes to EPM's Files To Be Ignored Always configuration, and exclude CyberArk EPM from scanning or monitoring in the third-party products. This removes the conflict while keeping both protections in place.

Why the other options are wrong

  • B. Elevating unhandled privileged applications is a policy decision and does not address performance conflicts.
  • C. Reinstalling the agent leaves the underlying conflict with other security software in place.
  • D. Removing or disabling antivirus weakens endpoint security and is not the recommended first step.

Question 25

Where can you view CyberArk EPM Credential Lures events?

  1. Application Catalog
  2. Threat Protection Inbox
  3. Events Management
  4. Policy Audit
Show answer and explanation

Correct answer: B. Threat Protection Inbox

Credential lures are created by Privilege Deception policies, which place fake local administrator accounts in LSASS and fake website credentials in browsers and then monitor attempts to use them. These detections are threat events, and the EPM agent sends them to the service immediately when it detects the activity. In the EPM console, events produced by Threat Protection features, including credential lure use, are reviewed in the Threat Protection Inbox, where the administrator examines the details of each detection and decides how to respond.

Why the other options are wrong

  • A. The Application Catalog lists applications detected on endpoints, not credential lure detections.
  • C. Credential lure detections are displayed as attacks in the Threat Protection Inbox, which is the place dedicated to reviewing threat detections.
  • D. Policy Audit shows audited activity for policies with audit enabled, not credential lure detections.

25 questions in. Want the rest? The first half of the pack, free by email · The full pack

Question 26

Which methods does CyberArk EPM SaaS use to secure data? (Choose two.)

  1. data encryption using SSL/TLS and AES-256
  2. regular data backups to external servers
  3. access control through SAML authentication
  4. data segregation to ensure customer data isolation
  5. blockchain technology for data integrity
Show answer and explanation

Correct answer: A, D. data encryption using SSL/TLS and AES-256; data segregation to ensure customer data isolation

CyberArk Endpoint Privilege Manager (EPM) SaaS protects customer data with encryption and data segregation. Agents and administrators reach the service over TLS-encrypted channels, while policy files, cache files and authentication cookies are encrypted with AES-256-GCM and data at rest is encrypted with 256-bit AES keys. The service is also protected by guardrails that include data segregation, so each customer's data stays isolated from other tenants, together with access control policies and procedures.

Why the other options are wrong

  • B. Backups are kept within the same region in a different availability zone, not on external servers.
  • C. SAML provides optional single sign-on to the console and is not one of the methods used to secure stored data.
  • E. EPM SaaS does not use blockchain technology.

Question 27

In EPM, creation of which user type is required to use SAML?

  1. Local CyberArk EPM User
  2. AD User
  3. SQL User
  4. Azure AD User
Show answer and explanation

Correct answer: A. Local CyberArk EPM User

EPM integration with SAML requires that the EPM users who will log in through SAML are first created in EPM itself. The identity provider then maps the authenticated Active Directory users to these EPM users, and the SAML response it sends contains the corresponding EPM user name. EPM verifies the response and logs in that local EPM user. Without a matching local CyberArk EPM user (or automatic SAML user provisioning), SAML authentication cannot complete.

Why the other options are wrong

  • B. AD users are authenticated by the identity provider and mapped to EPM users, so they are not the account created in EPM.
  • C. EPM SaaS has no SQL user type for SAML sign-in.
  • D. The identity provider can be any SAML provider, and SAML sign-in relies on an EPM user, not an Azure AD user.

Question 28

In the CyberArk EPM SaaS console, which feature displays the percentage of detected applications handled?

  1. Application Groups
  2. Policy Recommendations
  3. Application Coverage by Policies
  4. Policy Audit
Show answer and explanation

Correct answer: C. Application Coverage by Policies

Application Coverage by Policies in the CyberArk Endpoint Privilege Manager (EPM) SaaS console shows how much of the application activity detected on endpoints is already handled by policies, expressed as a percentage. Administrators use it to measure progress while removing local administrator rights and building policies, aiming to reduce the share of unhandled applications so that more activity is governed by explicit Allow, Elevate or Block decisions.

Why the other options are wrong

  • A. Application Groups store application definitions for reuse in policies and do not report coverage percentages.
  • B. Policy Recommendations offer recommended policies that can be activated but do not display handled percentages.
  • D. Policy Audit records detailed activity of audited policies rather than a coverage percentage.

Question 29

Which statements are correct about the functions of the Application Catalog? (Choose two.)

  1. It detects applications that are managed by policies and those that are not
  2. Threat analyses can be run on application events.
  3. An event can be deleted before the retention period ends
  4. You can configure the number of displayed events in the Application Catalog up to 1000 events
  5. It detects only events for applications that are not managed by policies.
Show answer and explanation

Correct answer: A, D. It detects applications that are managed by policies and those that are not; You can configure the number of displayed events in the Application Catalog up to 1000 events

The Application Catalog lists the applications that EPM detects on endpoints, whether they were reported because a policy, including a default policy, manages them or because a scan discovered them. It therefore shows both managed applications and unhandled ones. The amount of data shown is also configurable: by default the catalog displays 250 aggregated events at a time, and the administrator can change this in Set configuration, Console, Number of displayed aggregated events, so the number of events displayed in the catalog can be configured.

Why the other options are wrong

  • B. Threat analysis in the catalog is requested for an application file, so running analyses on application events is not a function of the Application Catalog.
  • C. Applications remain in the catalog until the file retention period defined in the system expires.
  • E. The catalog includes applications managed by policies as well as unhandled ones.

Question 30

On the Default Policies page, what are the names of policies that can be set as soon as EPM is deployed?

  1. Privilege Escalation, Privilege Management, Application Management
  2. Privilege Management, Application Control, Threat analysis
  3. Privilege Management, Threat Protection, Application Escalation Control
  4. Privilege Management, Privilege Threat Protection, Local Privileged Accounts Management
Show answer and explanation

Correct answer: D. Privilege Management, Privilege Threat Protection, Local Privileged Accounts Management

The Default Policies page groups the policies available as soon as a Set is deployed into three categories. Privilege Management policies handle unhandled applications and ransomware protection, Privilege Threat Protection policies protect against credential theft and include credential lures, and Local Privileged Accounts Management policies remove local administrators and rotate credentials of local privileged accounts. Each policy can be activated with one click or edited for organizational needs.

Why the other options are wrong

  • A. Privilege Escalation and Application Management are not Default Policies categories.
  • B. Application Control and Threat analysis are not the Default Policies categories.
  • C. Threat Protection and Application Escalation Control are not the Default Policies category names.

Question 31

What feature is designed to exclude applications from CyberArk EPM's Ransomware Protection, without whitelisting the application launch?

  1. Trusted Sources
  2. Authorized Applications (Ransomware Protection)
  3. Threat Intelligence
  4. Policy Recommendations
Show answer and explanation

Correct answer: B. Authorized Applications (Ransomware Protection)

Authorized Applications (Ransomware Protection) is an application group that EPM creates automatically for the Protect against ransomware policy. Applications added to this group are excluded from Ransomware Protection, so they can access protected files without being blocked or restricted. Membership in the group does not create an allow policy, which means the application's launch is still governed by other policies. This is exactly how an application is excluded from Ransomware Protection without whitelisting it.

Why the other options are wrong

  • A. Trusted Sources create policies that trust application launches, which is the whitelisting the scenario wants to avoid.
  • C. Threat Intelligence provides reputation data and does not exclude applications from Ransomware Protection.
  • D. Policy Recommendations suggest policies and do not provide a Ransomware Protection exclusion.

Question 32

Before enabling Ransomware Protection, what should the EPM Administrator do first?

  1. Enable the Privilege Management Inbox in Elevate mode.
  2. Enable the Control Applications Downloaded From The Internet feature in Restrict mode.
  3. Review the Authorized Applications (Ransomware Protection) group and update if necessary.
  4. Enable Threat Protection and Threat Intelligence modules.
Show answer and explanation

Correct answer: C. Review the Authorized Applications (Ransomware Protection) group and update if necessary.

Before activating Ransomware Protection, CyberArk directs administrators to review the application groups the policy relies on. Authorized Applications (Ransomware Protection) is automatically excluded from the Protect against ransomware policy, so legitimate applications that need to modify protected files, such as backup or document management tools, should be added to it. Reviewing and updating this group first prevents business applications from being disrupted once the policy starts restricting access.

Why the other options are wrong

  • A. The Privilege Management Inbox handles unhandled elevation requests and is not a prerequisite for Ransomware Protection.
  • B. Controlling applications downloaded from the internet is a separate policy and is not required first.
  • D. Threat Protection and Threat Intelligence are independent modules and are not prerequisites for Ransomware Protection.

Question 33

An application has been identified by the LSASS Credentials Harvesting Module.

What is the recommended approach to excluding the application?

  1. In Agent Configurations, add the application to the Threat Protection Exclusions.
  2. Add the application to the Files to be Ignored Always in Agent Configurations.
  3. Exclude the application within the LSASS Credentials Harvesting module.
  4. Add the application to an Advanced Policy or Application Group with an Elevate policy action.
Show answer and explanation

Correct answer: A. In Agent Configurations, add the application to the Threat Protection Exclusions.

The Agent configuration contains a Threat protection excluded applications parameter, which holds a global list of applications to exclude from Threat Protection policies, including the LSASS Credentials Harvesting module. When a legitimate application is identified by this module, the recommended approach is to add it to the Threat Protection exclusions in Agent Configurations. The exclusion is maintained in one central place for the Set, it is easy to audit, and it stops the application from being flagged again while EPM continues to apply its other controls to the application.

Why the other options are wrong

  • B. Files To Be Ignored Always removes the application from all EPM processing, which is far broader than a Threat Protection exclusion.
  • C. The Threat protection excluded applications list in the Agent configuration is a global list that covers every Threat Protection policy, which makes it the central place for the exclusion.
  • D. Elevating the application grants it more privileges and does not exclude it from credential theft detection.

Question 34

When enabling Threat Protection policies, what should an EPM Administrator consider? (Choose two.)

  1. Some Threat Protection policies are applicable only for Windows Servers as opposed to Workstations.
  2. Certain Threat Protection policies apply for specific applications not found on all machines.
  3. Threat Protection policies require an additional agent to be installed.
  4. Threat Protection features are not available in all regions.
Show answer and explanation

Correct answer: A, B. Some Threat Protection policies are applicable only for Windows Servers as opposed to Workstations; Certain Threat Protection policies apply for specific applications not found on all machines.

Threat Protection policies are targeted at specific platforms and applications, so administrators must plan which ones to enable. Some policies apply only to Windows servers, for example protections for domain controllers or SolarWinds servers, while others apply to workstations and servers alike. Many policies also protect credentials stored by particular applications, such as specific browsers, FTP clients or management tools, and are relevant only on machines where that software is installed. Reviewing these applicability details avoids enabling policies with no effect.

Why the other options are wrong

  • C. Threat Protection is delivered by the standard EPM agent and needs no additional agent.
  • D. Threat Protection features are not restricted by region.

Question 35

What unauthorized change can CyberArk EPM Ransomware Protection prevent?

  1. Windows Registry Keys
  2. Website Data
  3. Local Administrator Passwords
  4. Certificates in the Certificate Store
Show answer and explanation

Correct answer: A. Windows Registry Keys

Beyond protecting sensitive files, the Protect against ransomware policy can be extended to the Windows registry. In the policy's Extensions section, the administrator selects the option to disable changes to Windows registry keys and adds the registry key paths to protect, which prevents users and applications from changing those values. Ransomware often alters registry settings to persist or weaken defenses, so this extension blocks those unauthorized changes.

Why the other options are wrong

  • B. Website data is not a protected object in Ransomware Protection.
  • C. Local administrator passwords are handled by credential rotation, not Ransomware Protection.
  • D. Certificate store protection is not part of the Ransomware Protection policy.

Question 36

How long can a JIT policy be granted to a user of the target resource?

  1. 10 minutes to 48 hours
  2. 1 to 24 hours
  3. 1 to 72 hours
  4. unlimited time range
Show answer and explanation

Correct answer: C. 1 to 72 hours

In the Just In Time (JIT) access and elevation policy, the Grant temporary access for setting defines how long the user receives administrator access on the target computers. The administrator chooses from timeframes ranging from 1 hour to 72 hours, and the default is one hour. More recent EPM releases extend the upper limit to 120 hours, but the access is always granted in whole hours and is never unlimited.

Why the other options are wrong

  • A. JIT access is granted in hours starting at 1 hour, not from 10 minutes.
  • B. The range extends beyond 24 hours.
  • D. JIT access is always time limited.

Question 37

Which EPM reporting tool provides a comprehensive view of threat detection activity?

  1. Threat Detection Dashboard
  2. Detected Threats
  3. Threat Detection Events
  4. McAfee ePO Reports
Show answer and explanation

Correct answer: A. Threat Detection Dashboard

The Threat Detection Dashboard is the reporting view that summarizes threat detection activity across the environment in one place. It aggregates detections into summaries, giving a comprehensive picture rather than a list of individual records. Administrators then drill down from the dashboard into specific events for investigation.

Why the other options are wrong

  • B. Detected Threats lists individual threats and does not provide the overall summarized view.
  • C. Threat Detection Events shows event-level detail rather than a comprehensive overview.
  • D. McAfee ePO reports belong to a third-party management platform and are not the EPM threat detection reporting tool.

Question 38

What is the main reason to use the custom user access token for Elevate policies?

  1. to provide more privileges of permissions for the user
  2. to implement a less strict set of permissions for the user
  3. to provide least privileges of permissions for the user
  4. to impersonate the user with another set of permissions
Show answer and explanation

Correct answer: D. to impersonate the user with another set of permissions

A Windows access token describes the security context of a process, including the identity and privileges it runs with. In CyberArk Endpoint Privilege Manager (EPM), an Elevate policy can apply a custom user access token, which replaces the token attached to the process. The application then runs as if the user held a different set of permissions, effectively impersonating the user with exactly the privileges the policy defines. This lets a standard user run a specific application or process that would otherwise be denied, without giving that user broader rights.

Why the other options are wrong

  • A. The purpose is not simply to add more privileges but to substitute a defined token for the process.
  • B. The token is not about loosening the user's overall permissions, which remain unchanged outside the targeted process.
  • C. Least privilege for the user comes from removing local administrator rights, while a custom token is chosen to run the elevated process under an alternative set of permissions instead of the default token.

That was 38 of 154.

The full CyberArk EPM-DEF pack has all 154 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.

Get the full pack

Not ready yet? Get the first 77 free as one PDF by email. Get the Half Pack →