New Year Special Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: 70special

CyberArk PAM-SEN CyberArk Sentry PAM Exam Practice Test

Page: 1 / 14
Total 136 questions

CyberArk Sentry PAM Questions and Answers

Testing Engine

  • Product Type: Testing Engine
$37.5  $124.99

PDF Study Guide

  • Product Type: PDF Study Guide
$33  $109.99
Question 1

Arrange the steps to failover to the DR CPM in the correct sequence.

Options:

Question 2

To enable LDAP over SSL for a Vault when DNS lookups are blocked, which step must be completed?

Options:

A.

Add the FQDN & IP details for each LDAP host into the local hosts file of the Vault server. Most Voted

B.

Configure an AllowNonStandardFWAddresses rule in DBParm.ini on the Vault to allow outbound TCP 53 to the organization’s DNS servers.

C.

Ensure LDAP hosts added to the directory mapping configuration are defined using only IP addresses.

D.

Set the ReferralsDNSLookup parameter value to “No” in the directory configuration.

Question 3

What must you do to prepare a Windows server for PVWA installation?

Options:

A.

In the InstallationAutomation folder, run the PVWA_Prerequisites.ps1 file as an administrator in Powershell. Most Voted

B.

Install the PrivateArk client.

C.

Verify the user performing the installation is Domain Administrator and has logon access to the Vault server.

D.

Enable IPv6.

Question 4

What is a prerequisite step before CyberArk can be configured to support RADIUS authentication?

Options:

A.

Log on to the PrivateArk Client, display the User properties of the user to configure, run the Authentication method drop-down list, and select RADIUS authentication.

B.

In the RADIUS server, define the CyberArk Vault as a RADIUS client/agent. Most Voted

C.

In the Vault installation folder, run CAVaultManager as administrator with the SecureSecretFiles command.

D.

Navigate to /Server/Conf and open DBParm.ini and set the RadiusServersInfo parameter.

Question 5

The RemoteApp feature of PSM allows seamless Application windows (i e the Desktop of the PSM server will not be visible)

Options:

A.

TRUE

B.

FALSE

Question 6

What is the purpose of the CPM_Preinstallation.ps1 script included with the CPM installation package?

Options:

A.

It prompts for input parameters that will be used to pre-populate form fields in the installation wizard.

B.

It automatically installs the CPM, requiring no additional user input.

C.

It allows you to install the CPM using a command line approach rather than using the installation wizard.

D.

It verifies the NET version installed on the server and sets the IIS SSL TLS server configuration.

Question 7

Your customer wants to store the Safes Data on Vault Drive D instead of Drive C.

Which file should you edit?

Options:

A.

TSparm.ini Most Voted

B.

Vault.ini

C.

DBparm.ini

D.

user.ini

Question 8

You are installing a CPM.

In addition to Add Safes, Add/Update Users, Reset Users’ Passwords and Manage Server File Categories, which Vault authorization(s) does a CyberArk user need to install the CPM?

Options:

A.

Manage Directory Mapping

B.

Activate Users

C.

Backup All Safes, Restore All Safes

D.

Audit Users, Add Network Areas

Question 9

By default, the vault secure protocol uses which IP port and protocol.

Options:

A.

TCP/1858

B.

TCP/443

C.

UDP/1858

D.

TCP/80

Question 10

Which file would you modify to configure the vault to send SNMP traps to your monitoring solution?

Options:

A.

dbparm ini

B.

paragent.ini

C.

ENEConf.ini I

D.

padr ini

Question 11

Arrange the steps to install the Password Vault Web Access (PVWA) in the correct sequence.

Options:

Question 12

When performing “In Domain” hardening of a PSM server, which steps must be performed? (Choose two.)

Options:

A.

Import CyberArk policy settings from the provided file into a new GPO. Most Voted

B.

Apply advanced audit on the PSM server.

C.

Link GPO to a dedicated OU containing CyberArk PSM servers. Most Voted

D.

Import an INF file to the local machine.

E.

Configure AppLocker rules to block running unknown executables.

Question 13

You are configuring SNMP remote monitoring for your organization’s Vault servers.

In the PARAgent.ini, which parameter specifies the destination of the Vault SNMP traps?

Options:

A.

SNMPHostIP Most Voted

B.

SNMPTrapPort

C.

SNMPCommunity

D.

SNMPVersion

Question 14

To apply a new license file you must:

Options:

A.

Upload the license.xml file to the System Safe

B.

Upload the license.xml file to the Vaultlnternal Safe.

C.

Upload the license.xml file to the System Safe and restart the PrivateArk Server service.

D.

Upload the license.xml file to the Vaultlnternal Safe and restart the PrivateArk Server service.

Question 15

After installing the Vault, you need to allow Firewall Access for Windows Time service to sync with NTP servers 10.1.1.1 and 10.2.2.2.

What should you do?

Options:

A.

Edit DBParm.ini to add: AllowNonStandardFWAddresses=[10.1.1.1,10.2.2.2],Yes,123:outbound/udp. Most Voted

B.

Edit DBParm.ini to add: NTPServer=[10.1.1.1:123/UDP,10.2.2.2:123/UDP].

C.

Edit DBParm.ini to add: AllowNonStandardFWAddresses=[10.1.1.1,10.2.2.2],Yes,123:outbound/udp,123:inbound/udp.

D.

Edit the Windows Firewall configuration to add a rule for Port 123/udp outbound to 10.1.1.1 and 10.2.2.2.

Question 16

How should you configure PSM for SSH to support load balancing?

Options:

A.

by using a network load balancer Most Voted

B.

in PVWA > Options > PSM for SSH Proxy > Servers

C.

in PVWA > Options > PSM for SSH Proxy > Servers > VIP

D.

by editing sshd.config on the all the PSM for SSH servers

Question 17

A customer is moving from an on-premises to a public cloud deployment.

What is the best and most cost-effective option to secure the server key?

Options:

A.

Install the Vault in the cloud the same way you would in an on-premises environment. Place the server key in a password protected folder on the operating system.

B.

Install the Vault in the cloud the same way you would in an on-premises environment. Purchase a Hardware Security Module to secure the server key.

C.

Install the Vault using the native cloud images and secure the server key using native cloud Key Management Systems.

D.

Install the Vault using the native cloud images and secure the server key with a Hardware Security Module.

Question 18

The vault server uses a modified version of the Microsoft Windows firewall.

Options:

A.

TRUE

B.

FALSE

Question 19

What is a valid combination of primary and secondary layers of authentication to a company's two-factor authentication policy?

Options:

A.

RSA SecurID Authentication (in PVWA) and LDAP Authentication

B.

CyberArk Authentication and RADIUS Authentication

C.

Oracle SSO (in PVWA) and SAML Authentication

D.

LDAP Authentication and RADIUS Authentication

Question 20

You are installing multiple PVWAs behind a load balancer.

Which statement is correct?

Options:

A.

Port 1858 must be opened between the load balancer and the PVWAs.

B.

The load balancer must be configured in DNS round robin.

C.

The load balancer must support "sticky sessions".

D.

The LoadBalancerClientAddressHeader parameter in the PVWA.ini file must be set.

Question 21

There is a requirement for a password to change between 01:00 and 03:00 on Saturdays and Sundays; however, this does not work consistently.

Which platform setting may be the cause?

Options:

A.

The Interval setting for the platform is incorrect and must be less than 120.

B.

The ImmediateInterval setting for the platform is incorrect and must be greater than or equal to 1.

C.

The DaysToRun setting for the platform is incorrect and must be set to Sat,Sun.

D.

The HeadStartInterval setting for the platform is incorrect and must be set to 0.

Question 22

What is the default username for the PSM for SSH maintenance user when InstallCyberarkSSHD is set to yes?

Options:

A.

proxymng

B.

psmp_maintenance

C.

psmpmaintenanceuser

D.

psmpmnguser

Question 23

When integrating a Vault with HSM, which file is uploaded to the HSM device?

Options:

A.

server.key

B.

recpub.key

C.

recprv.key

D.

mdbase.dat

Question 24

Which parameter must be identical for both the Identity Provider (IdP) and the PVWA?

Options:

A.

IdP “EntityID” and “PartnerIdentityProvider Name” in PVWA saml.config file

B.

IdP “User name” and “SingleSignOnServiceUrl” in PVWA saml.config file

C.

IdP “Audience” and “ServiceProviderName” in the PVWA saml.config file

D.

IdP “Secure hash algorithm” and “Certificate” in the PVWA saml.config file

Question 25

Which statement is correct about CPM behavior in a distributed Vault environment?

Options:

A.

CPMs should only access the primary Vault. When it is unavailable, CPM cannot access any Vault until another Vault is promoted as the new primary Vault.

B.

CPMs should access only the satellite Vaults.

C.

CPMs should only access the primary Vault. When it is unavailable, CPM cannot access any Vault until the original primary Vault is operational again.

D.

CPM should access all Vaults - primary and the satellite.

Question 26

What is the best practice for storing the Master CD?

Options:

A.

Copy the files to the Vault server and discard the CD.

B.

Copy the contents of the CD to a Hardware Security Module and discard the CD.

C.

Store the CD in a secure location, such as a physical safe.

D.

Store the CD in a secure location, such as a physical safe, and copy the contents of the CD to a folder (secured with NTFS permissions} on the vault.

Question 27

Which component must be installed before the first CPM installation?

Options:

A.

PTA

B.

PSM

C.

PVWA

D.

EPM

Question 28

In addition to disabling Windows services or features not needed for PVWA operations, which tasks does PVWA_Hardening.ps1 perform when run? (Choose two.)

Options:

A.

performs IIS hardening

B.

configures all group policy settings

C.

renames the local Administrator Account

D.

configures Windows Firewall

E.

imports the CyberArk INF configuration

Question 29

What would be a good use case for the Replicate module?

Options:

A.

Recovery Time Objectives or Recovery Point Objectives are at or near zero

B.

Integration with an Enterprise Backup Solution is required.

C.

Off site replication is required.

D.

PSM is used

Question 30

Which file would you modify to configure your Vault Server to forward Activity Logs to a SIEM or SYSLOG server?

Options:

A.

dbparm.ini

B.

PARagent.ini

C.

ENEConf.ini

D.

padr.ini

Question 31

Which method can be used to directly authenticate users to PSM for SSH? (Choose three.)

Options:

A.

CyberArk authentication Most Voted

B.

LDAP authentication Most Voted

C.

RADIUS authentication Most Voted

D.

Windows authentication

E.

SAML authentication

F.

OpenID Connect (OIDC) authentication

Question 32

HTML5 Gateway can be installed on which supported UNIX OS versions? (Choose two.)

Options:

A.

Red Hat Enterprise Linux 7.x

B.

CentOS 7.x

C.

Ubuntu 20.x

D.

AK 7.x

E.

Android 11.x

Question 33

Which components can connect to a satellite Vault in a distributed Vault architecture?

Options:

A.

CPM, EPM, PTA

B.

PVWA, PSM

C.

CPM, PVWA, PSM

D.

CPM, PSM

Question 34

When a DR vault server becomes an active vault, it will automatically fail back to the original state once the primary vault comes back online.

Options:

A.

True, this is the default behavior

B.

False, this is not possible

C.

True, if the 'AllowFailback' setting is set to yes in the PADR.ini file.

D.

True if the 'AllowFailback' setting is set to yes in the dbparm mi file

Question 35

All 80 employees from your satellite Tokyo office are complaining that browsing the PVWA site is very slow; however, your New York headquarters users are not experiencing this. The current PAM solution is:

2 distributed Vaults, the primary one in New York and a satellite in Tokyo

2 PVWA servers, both in New York with load balancing configured

2 PSM servers, both in New York without load balancing configured

1 CPM server in New York

All PVWA, PSM, and CPM servers are connected to the primary Vault

Which proposal optimally resolves the performance issue while minimizing the impact to production?

Options:

A.

Install two new PVWA servers in Tokyo data center, configure load balancing, connect to the local satellite Vault and provide the URL of new PVWA servers to the local employees.

B.

Install two new PVWA servers in New York data center, configure load balancing and have them connect to the satellite Vault in Tokyo.

C.

Install two new PSM servers in the Tokyo data center, configure load balancing, connect to the local satellite vault, and inform the local employees to browse using the same PVWA URL.

D.

Change the current distributed Vaults architecture, migrate back to a Primary-DR architecture, install two new PVWA servers in the Tokyo data center and configure load balancing. Connect to the local DR Vault and provide the URL of new PVWA servers to the local employees.

Question 36

Which statements are correct about the PSM HTML5 gateway? (Choose two.)

Options:

A.

Smart card redirection is supported

B.

It does not support connections to target system where NLA is enabled on the PSM server

C.

SSH sessions cannot be established

D.

Printer redirection cannot be enabled

E.

It does not support session recording capabilities for applications that run outside a web browser

Question 37

If a transparent user matches two different directory mappings, how does the system determine which user template to use?

Options:

A.

The system will use the template for the mapping listed first.

B.

The system will use the template for the mapping listed last.

C.

The system will grant all of the vault authorizations from the two templates.

D.

The system will grant only the vault authorizations that are listed in both templates

Question 38

As a member of a PAM Level-2 support team, you are troubleshooting an issue related to load balancing four PVWA servers at two data centers. You received a note from your Level-1 support team stating “When testing PVWA website from a workstation, we noticed that the “Source IP of last sign-in” was shown as the VIP (Virtual IP address) assigned to the four PVWA servers instead of the workstation IP where the PVWA site was launched from.”

Which step should you take?

Options:

A.

Verify the “LoadBalancerClientAddressHeader” parameter setting in PVWA configuration file Web.config is set to “X-Forwarded-For”.

B.

Add the VIP (Virtual IP address) assigned to the four PVWA servers to the certificates issued for all four PVWA servers, if missing.

C.

Add a firewall rule to allow the testing workstation to connect to the VIP (Virtual IP address) assigned to the four PVWA servers on Port TCP 443.

D.

Edit the dbparm.ini file on the Vault server and add the IP or subnet of the workstation to the whitelist.

Question 39

Which parameter must be provided when registering a primary Vault in Azure, but not in Amazon Web Services?

Options:

A.

/RecPub

B.

/AdminPass

C.

/MasterPass

D.

/RDPGateway

Question 40

Which authentication methods does PSM for SSH support?

Options:

A.

CyberArk password LDAP, RADIUS, SAML

B.

LDAP, Windows Authentication, SSH keys

C.

RADIUS, Oracle SSO, CyberArk Password

D.

CyberArk Password, LDAP, RADIUS

Page: 1 / 14
Total 136 questions