Free PAM-CDE-RECERT sample questions

Correct answer: Define the logon script using `pmprerun`, the password change script using `pmpass`, and the logoff script using `pmpostrun`.

This is the correct approach. The `Process.ini` file uses specific commands to define the sequence. `pmprerun` is executed first for logon actions. `pmpass` is executed for the actual password change. `pmpostrun` is executed last for logoff or cleanup actions. This structure allows the CPM to manage each phase of the process correctly.

Correct answers: Windows Security Event Logs from Domain Controllers.; Network traffic captures from a TAP or SPAN port.

PTA requires Windows Security Event Logs, specifically those related to authentication (like Event ID 4624), to detect credential theft attacks such as Pass-the-Hash. It analyzes the authentication type and logon patterns to identify anomalies.

PTA can perform deep packet inspection on network traffic to detect the characteristic signatures of Pass-the-Hash and other attacks. This network-level visibility is a key data source for detecting attacks in real-time.

Correct answer: Run the `CAVaultManager` utility with the `DefragmentDB` command.

The `ITADB323W` and `ITADB324W` warnings indicate that the Vault database is fragmented, which can impact performance. The standard and recommended procedure to resolve this is to perform an offline defragmentation of the database using the `CAVaultManager DefragmentDB` command during a maintenance window. This is the correct first step to address the root cause.

Correct answer: In the PVWA settings, configure a PSM server ID that points to the European PSM and associate it with platforms used by European teams.

This is the correct design. In the PVWA `Administration > Configuration Options`, you can define multiple PSM servers and assign them unique IDs. You can then edit a platform's settings (`UI & Workflows > Privileged Session Management`) to use a specific `ID` for the PSM Server. By associating European platforms with the European PSM server ID, all sessions for those platforms will be routed to the local PSM.

Correct answer: False

This is correct. The PVWA handles the encryption of sensitive parameters like `WebFormFields` automatically upon saving the connection component configuration. The administrator enters the values in plain text during setup.

Correct answer: The 'Server' service is not running on the target Windows machine.

The error code `2114` and message `The service has not been started` directly correspond to the 'Server' service (service name `LanmanServer`) on the target machine being stopped. The CPM relies on this service for remote administration tasks, including password reconciliation for local accounts. This is the most direct cause.

Correct answer: Use Windows Event Forwarding (WEF) with a subscription that filters for specific event IDs required by PTA.

This is the CyberArk recommended best practice. Windows Event Forwarding (WEF) allows administrators to create subscriptions with XPath queries to select only the specific event IDs that PTA needs for its analysis. This filtering happens on the source (Domain Controller), ensuring that only relevant data is sent over the network, thus minimizing bandwidth.

Correct answer: The administrator did not stop the `CyberArk Event Notification Engine` service on the primary Vault.

The `CyberArk Event Notification Engine` (ENE) service is responsible for triggering replication. Even if the main Vault service is stopped, a running ENE can still attempt to initiate replication tasks, which can interfere with the DR promotion process. The documented DR procedure requires stopping both the PrivateArk Server and the ENE services on the primary Vault before promoting the DR Vault.

Correct answer: Use the built-in PSM Universal Connector with a custom AutoIt script to launch the application, pass the required command-line parameters, and handle the login window.

This is the optimal solution. The PSM Universal Connector is designed for this exact scenario. It allows an administrator to use AutoIt, a simple scripting language, to automate the launching of an application. The script can dynamically pull the address, username, and password from the Vault and pass them as command-line parameters or inject them into GUI fields. This meets all technical requirements, provides a seamless user experience, ensures recording, and avoids the need for complex .NET development, thus respecting the budget constraint.

Correct answer: In the `web.config` file in the PVWA installation directory.

The Audience URL for the SAML request is a fundamental parameter that is defined in the `web.config` file located in the PVWA's installation directory (e.g., `C:\inetpub\wwwroot\PasswordVault`). This is the correct location to modify the value to match what is configured in the IdP's relying party trust.