Important CyberArk PAM-DEF Exam Questions

Answer: B

Explanation:

The Central Policy Manager (CPM) in CyberArk most commonly uses theODBC(Open Database Connectivity) interface when connecting to a database. ODBC is a standard API for accessing database management systems (DBMS).The CPM supports remote password management on all databases that support ODBC connections, and the machine running the CPM must support ODBC, version 2.7 and higher1.Reference:

CyberArk Docs: Databases that support ODBC connections1

Answer: A, B

Explanation:

To use the show, copy, and connect buttons on the accounts in the safe UnixRoot, the Operations Staff need to have theUse Accountspermission, which allows them to request access to the accounts and perform actions on them. However, since dual control is enabled for some of the accounts, they also need to have theRetrieve Accountspermission, which allows them to view the password of the account after it is authorized by another user. TheAuthorize Password Requestspermission is not needed, as it is only required for the users who can approve the requests, not the ones who make them. TheAccess Safe without Authorizationpermission is not needed, as it would bypass the dual control mechanism and allow the Operations Staff to access the accounts without approval.Reference:

[Defender PAM Sample Items Study Guide], page 10, question 5

[CyberArk Privileged Access Security Implementation Guide], page 30, table 2-1

[CyberArk Privileged Access Security Administration Guide], page 43, section 3.2.2.1

Answer: A, B, C, H

Explanation:

The Master Policy is a centralized overview of the security and compliance policy of privileged accounts in the organization. It allows the administrator to configure compliance driven rules that are defined as the baseline for the enterprise.The Master Policy includes the following main concepts1:

Basic policy rules: These rules allow the administrator to define specific aspects of privileged account management, such as privileged access workflows, password management, session monitoring and auditing.

Advanced policy rules: Some basic policy rules have related advanced settings that provide more granular control over the policy enforcement.

Exceptions: These are policy rules that differ from the overall Master Policy for a specific scope of accounts, such as accounts associated with a specific platform.

The Master Policy rules are divided into four sections2:

Privileged Access Workflows: These rules define how the organization manages access to privileged accounts, such as requiring dual control, one-time passwords, exclusive passwords, transparent connections, reason for access, etc.

Password Management: These rules determine how passwords are managed, such as requiring password change, password verification, password reconciliation, ticketing integration, required properties, custom connection components, etc.

Session Management: These rules determine whether or not privileged sessions are recorded and how they are monitored, such as requiring session isolation, session recording, session audit, etc.

Audit: This rule determines how Safe audits are retained, such as specifying the audit retention period.

Based on the above information, the following options can be configured in the Master Policy:

A .Dual Control: This is a basic policy rule in the Privileged Access Workflows section that determines whether users need to get approval from authorized users before accessing a privileged account2.

B .One Time Passwords: This is a basic policy rule in the Privileged Access Workflows section that determines whether users can only use a password once before it is changed2.

C .Exclusive Passwords: This is a basic policy rule in the Privileged Access Workflows section that determines whether users need to check out a password and prevent other users from accessing it until it is checked in2.

H .Password Aging Rules: This is a basic policy rule in the Password Management section that determines how often passwords need to be changed2.

The following options cannot be configured in the Master Policy:

D .Password Reconciliation: This is not a policy rule, but a process that restores the password of a privileged account to the value that is stored in the Vault, in case it is changed or out of sync3.

E . Ticketing Integration: This is not a policy rule, but a feature that enables the integration of the Vault with external ticketing systems, such as ServiceNow, Jira, etc.

F . Required Properties: This is not a policy rule, but a platform setting that determines which properties are mandatory for adding accounts to a platform.

G . Custom Connection Components: This is not a policy rule, but a platform setting that determines which connection components are used to connect to target systems, such as PVWA, PSM, PSMP, etc.

1:The Master Policy

2:Master Policy Rules

3: Password Reconciliation

: Ticketing Integration

: Required Properties

: Custom Connection Components

Answer: B

Explanation:

According to the CyberArk documentation1, once Object Level Access Control is enabled for a Safe, it cannot be disabled.This feature allows granular control over user access to passwords and files in the Safe, regardless of their Safe level member authorizations2.To enable Object Level Access Control, users need to have the Manage Safe authorization in the Vault1.

Answer: A, C, D

Explanation:

: To run the Password Upload Utility, you need to create or configure the following files:

A comma delimited upload file: This is a text file that contains the passwords and their properties that will be uploaded to the Vault. The file must have a .csv extension and follow a specific format. The first line in the file defines the names of the password properties as specified in the Password Vault.Every other line represents a single password object and its property values, according to the properties specified in the first line1.

PACli.ini: This is a configuration file that stores the parameters for the PACli, which is a command-line interface that enables communication between the Password Upload Utility and the Vault. The PACli.ini file must be located in the same folder as the Password Upload Utility executable file.The file must contain the following parameters: Vault, User, Password, and LogFile2.

conf.ini: This is a configuration file that stores the parameters for the Password Upload Utility. The conf.ini file must be located in the same folder as the Password Upload Utility executable file.The file must contain the following parameters: InputFile, LogFile, and ErrorFile3.

You do not need to create or configure the following file to run the Password Upload Utility:

Vault.ini: This is a configuration file that stores the parameters for the Vault server, such as the database name, port, and password. This file is not used by the Password Upload Utility, and it is not located in the same folder as the Password Upload Utility executable file.The Vault.ini file is located in the Vault installation folder, and it is used by the Vault service and the PrivateArk Client4.Reference:

1:Create the Password File

2:PACli.ini

3:Password Upload Utility Parameter File (conf.ini)

4: [CyberArk Privileged Access Security Implementation Guide], Chapter 2: Installing the Vault, Section: Configuring the Vault, Subsection: Vault.ini