ACCESS-DEF sample questions

Question 1

A company's security policy mandates that all administrative access to cloud infrastructure management consoles (like AWS, Azure) requires Multi-Factor Authentication. Which TWO of the following mechanisms in CyberArk Identity can be used to enforce this policy specifically for users in the 'Cloud Admins' role? (Select TWO)

Accepted Answer

Creating a policy set assigned to the 'Cloud Admins' role whose authentication policy requires an MFA authentication profile.

Accepted Answer

Setting an Authentication Policy at the application level for each cloud console app.

Answer

Applying an Authentication Policy to the individual 'Cloud Admins' user accounts.

Answer

Using the 'MFA Unlock' command for all non-admin roles.

Answer

Creating a global password policy that requires MFA for all users.

Question 2

True or False: When using the 'MFA Unlock' command for a user in the CyberArk Identity Admin Portal, the suspension of MFA challenges is permanent until the administrator manually re-enables it.

Accepted Answer

False

Answer

True

Question 3

A manufacturing company is setting up a SAML-based SSO integration for a new cloud-based inventory management system. During testing, users receive a SAML error indicating an 'Invalid NameID Format'. The application vendor has specified that they require the user's UPN (User Principal Name) in the NameID field. Where in the CyberArk Identity application configuration would an administrator modify the SAML response to send the UPN as the NameID?

Accepted Answer

In the 'Account Mapping' section of the application settings.

Answer

In the 'Policy' tab of the application settings.

Answer

In the 'Trust' tab under the 'Identity Provider Configuration' section.

Answer

In the 'Provisioning' tab by mapping the UPN attribute.

Question 4

An administrator is creating a new Authentication Profile for high-risk applications. Users must first enter their password and then complete one additional factor of their choice: a Mobile Authenticator push notification, a security question, or an OATH OTP code. How should the profile be configured?

Accepted Answer

Under Multiple Authentication Mechanisms, select Password for Challenge 1, and select Mobile Authenticator, Security Question(s), and OATH OTP Client for Challenge 2.

Answer

Create three separate authentication profiles, one per mechanism, and select all three in a single authentication rule.

Answer

Select Password, Mobile Authenticator, Security Question(s), and OATH OTP Client in both the Challenge 1 and Challenge 2 columns.

Answer

Select Password, Mobile Authenticator, Security Question(s), and OATH OTP Client under Single Authentication Mechanism.

Question 5

A new CyberArk Identity administrator is reviewing the corporate directory structure. They need to synchronize users from a specific Organizational Unit (OU) in Active Directory called 'Salesforce_Users' to a CyberArk role with the same name. What is the first component that must be deployed and configured in the on-premises environment to enable this synchronization?

Accepted Answer

The CyberArk Identity Connector

Answer

The App Gateway

Answer

A RADIUS server

Answer

The Windows Device Trust Agent

Question 6

During a security audit, an organization is required to produce a report of all users who have successfully authenticated to any application via CyberArk Identity over the last 90 days, including the source IP address for each login. Where in the Admin Portal can this report be generated?

Accepted Answer

In the 'Core Services > Reports' section using a built-in report.

Answer

In the 'Downloads' section of the Admin Portal.

Answer

In the 'Users' tab by exporting user details.

Answer

In the 'Settings > Authentication' section.

Question 7

A company is using the CyberArk App Gateway to provide secure remote access to an internal legacy web application that does not support SAML. The security team wants to ensure that access to this application is logged and audited. Which component is primarily responsible for generating the audit logs for access events through the App Gateway?

Accepted Answer

The CyberArk Identity platform.

Answer

The on-premises CyberArk Identity Connector.

Answer

The user's local machine event logs.

Answer

The legacy web application's internal logging mechanism.

Question 8

An administrator needs to configure automated user provisioning for Salesforce. The goal is to assign different Salesforce license types (e.g., 'Salesforce Platform', 'Chatter Free') to users based on their department attribute in Active Directory. Which CyberArk Identity feature allows for this conditional license assignment during provisioning?

Accepted Answer

Role Mappings in the 'Provisioning' tab.

Answer

The SAML assertion's attribute statements.

Answer

A custom script in the 'Advanced' tab.

Answer

The 'Policy' tab within the Salesforce application settings.

Question 9

A university is setting up self-service password reset (SSPR) for its student population. To minimize help desk calls, they want to provide multiple options for identity verification. Which of the following are valid authentication factors that can be configured for use with the CyberArk Identity SSPR workflow? (Select THREE)

Accepted Answer

Security Questions

Accepted Answer

SMS Confirmation Code

Accepted Answer

Email confirmation code sent to the user's registered email address

Answer

Manager approval through the application access request workflow

Answer

IP Address Geolocation

Question 10

A system administrator is reviewing the following Authentication Policy settings. What is the effect of the 'Continue with additional challenges after failed challenge' option being set to True?
```mermaid
graph TD
A[Start Login] --> B{Challenge 1: Password};
B -->|Success| C{Challenge 2: Email code};
B -->|Fail & Continue=True| C;
B -->|Fail & Continue=False| D[Failure reported immediately];
C -->|All challenges passed| F[Access Granted];
C -->|Any challenge failed| G[Generic failure reported at the end];
```

Accepted Answer

The user is taken through all remaining challenges even after one fails, and is told only at the end that authentication failed, without identifying which challenge failed.

Answer

The system will immediately lock the user's account after the first failed challenge.

Answer

The user will be allowed to bypass the failed challenge and try a different one from their list of enrolled factors.

Answer

The system will automatically trigger the 'MFA Unlock' for the user for 10 minutes.

Free ACCESS-DEF sample questions

True or False: When using the 'MFA Unlock' command for a user in the CyberArk Identity Admin Portal, the suspension of MFA challenges is permanent until the administrator manually re-enables it.

During a security audit, an organization is required to produce a report of all users who have successfully authenticated to any application via CyberArk Identity over the last 90 days, including the source IP address for each login. Where in the Admin Portal can this report be generated?

10 more free samples are waiting