Free PAM-DEF sample questions

Correct answer: Configure a Master Policy exception for 'Require multi-level approval' and set a time-based 'From/To Hour' access window.

The Master Policy is the correct place to manage exceptions to platform-level settings. Creating an exception that overrides the 'Require multi-level approval' rule for a specific time window allows for controlled, temporary emergency access without altering the base platform security for all other accounts. This method is auditable, time-bound, and aligns with the principle of least privilege. Temporarily disabling the platform setting or creating a new safe are less efficient, more disruptive, and harder to audit for a temporary access scenario.

Correct answers: The DR user (`DRUser`) is not a member of the 'DR Users' group in the Vault.; The `padr.ini` file contains an incorrect password for the DR user.

The dedicated DR user must be a member of the built-in 'DR Users' group to have the necessary permissions to initiate and maintain replication. An incorrect password for this user is also a very common cause of failure.

The password for the DR user is stored in the `padr.ini` file on the DR Vault server. If this password does not match the one set in the Vault for the DR user, authentication will fail, and replication cannot start. This is a primary troubleshooting step after confirming network connectivity.

Correct answer: The 'Finance-DB-Admins' platform has an explicitly defined `PSMRecordingsSafe` parameter that overrides the PSM server's default setting.

CyberArk uses a hierarchy for configuration. A parameter set directly on a specific platform will always override the more general setting configured on the PSM server itself (in the `basic_psm.ini` or via PVWA Options). In this case, the specific platform setting is taking precedence, causing recordings to be sent to the default safe instead of the intended custom safe.

Correct answer: False

When using LDAP integration, CyberArk can be configured for transparent user management. An external user object is created automatically in the Vault the first time an LDAP user successfully authenticates. This eliminates the need to manually pre-create local users for each LDAP user.

Correct answer: Within the specific Connection Component's 'Target Settings' parameters.

Connection Components define how PSM establishes and manages a session. The 'Target Settings' section within a specific connection component (e.g., PSM-SSH) allows for customization of the session behavior, including specifying commands to be run automatically upon connection. This is where parameters like `ClientApp` or custom AutoIt scripts are defined to automate interactions.

Correct answer: Set the platform policy for all medical devices to require a 20-character password, then create a new, duplicated platform for the older devices with the password length set to 15.

Platform settings are the most appropriate place to define technical constraints like password length for a specific type of target system. The best practice is to set the general policy on a base platform and then duplicate and modify that platform for exception cases. This allows for granular control over the devices that cannot meet the standard, while the Master Policy can still enforce the 30-day rotation across both platforms. Using Master Policy exceptions for technical password constraints is less scalable than using platforms.

Correct answer: PSM text recording (keystroke logging).

PSM provides two types of session recording: video and text (keystroke logging). To capture the specific commands typed during a session for auditing purposes, text recording must be enabled in the platform settings. This creates a searchable text log of all activity within the session, which is distinct from the video recording of the session.

Correct answer: To define the specific Organizational Unit (OU) in the directory where the mapped users or groups reside.

The 'LDAP Branch' field specifies the starting point within the LDAP directory tree (e.g., an Organizational Unit) from which CyberArk will search for the users or groups being mapped. This allows administrators to limit the scope of the directory mapping to relevant parts of their Active Directory or LDAP structure.

Correct answer: User Account Control (UAC) remote restrictions are enabled on the target server, preventing the CPM's logon user from performing administrative tasks remotely.

The 'Access is denied' error (code 5) for remote operations on Windows servers, especially when credentials and network connectivity are correct, is a classic symptom of User Account Control (UAC) remote restrictions. For non-domain accounts (or even domain accounts under certain conditions), UAC can strip administrative tokens from remote connections. To resolve this, a specific registry key (`LocalAccountTokenFilterPolicy`) must be created and set to '1' on the target server to allow remote administrative tasks.

Correct answer: Define 'Safe Provisioning and Governance' rules that use safe properties (like the safe name) as criteria to automatically add the corresponding regional AD group as a member with predefined permissions.

CyberArk's 'Safe Provisioning and Governance' feature is designed specifically for this use case. It allows administrators to create rules that automatically assign permissions to users and groups based on safe properties, including the safe name. By creating a rule that looks for safes starting with 'EU-' and automatically adds the 'CyberArk-Admins-EU' group, the company can achieve a fully automated, scalable, and policy-driven approach to safe delegation without manual scripting or cumbersome Master Policy exceptions.