CAU201 CyberArk Defender Exam Questions have been Updated

dumps2022-01-18T06:01:50+08:00

CAU201 CyberArk Defender exam questions have been updated, which are the big helper in your preparation. CyberArk certification CAU201 exam is for IT Personnel who work with the CyberArk Privileged Account Security Solution daily. Our online updated CyberArk CAU201 exam questions can guarantee you success. Free updated CyberArk Defender CAU201 exam questions are available below.

Page 1 of 6

1. When Dual Control is enabled a user must first submit a request in the Password Vault Web Access (PVWA) and receive approval before being able to launch a secure connection via PSM for Windows (previously known as RDP Proxy).

True

False, a user can submit the request after the connection has already been initiated via the PSM for Windows

2. Which certificate type do you need to configure the vault for LDAP over SSL?

the CA Certificate that signed the certificate used by the External Directory

a CA signed Certificate for the Vault server

a CA signed Certificate for the PVWA server

a self-signed Certificate for the Vault

3. DRAG DROP

Match the connection component to the corresponding OS/Function.

4. Which Master Policy Setting must be active in order to have an account checked-out by one user for a pre-determined amount of time?

Require dual control password access Approval

Enforce check-in/check-out exclusive access

Enforce one-time password access

Enforce check-in/check-out exclusive access & Enforce one-time password access

5. A user with administrative privileges to the vault can only grant other users privileges that he himself has.

TRUE

FALSE

6. Which keys are required to be present in order to start the PrivateArk Server service?

Recovery public key

Recovery private key

Server key

Safe key

7. In your organization the “click to connect” button is not active by default.

How can this feature be activated?

Policies > Master Policy > Allow EPV transparent connections > Inactive

Policies > Master Policy > Session Management > Require privileged session monitoring and isolation > Add Exception

Policies > Master Policy > Allow EPV transparent connections > Active

Policies > Master Policy > Password Management

8. All of your Unix root passwords are stored in the safe UnixRoot. Dual control is enabled for some of the accounts in that safe. The members of the AD group UnixAdmins need to be able to use the show, copy, and connect buttons on those passwords at any time without confirmation. The members of the AD group Operations Staff need to be able to use the show, copy and connect buttons on those passwords on an emergency basis, but only with the approval of a member of Operations Managers never need to be able to use the show, copy or connect buttons themselves.

Which safe permission do you need to grant Operations Staff? Check all that apply.

Use Accounts

Retrieve Accounts

Authorize Password Requests

Access Safe without Authorization

9. Which values are acceptable in the address field of an Account?

It must be a Fully Qualified Domain Name (FQDN)

It must be an IP address

It must be NetBIOS name

Any name that is resolvable on the Central Policy Manager (CPM) server is acceptable

10. If a user is a member of more than one group that has authorizations on a safe, by default that user is granted________.

the vault will not allow this situation to occur.

only those permissions that exist on the group added to the safe first.

only those permissions that exist in all groups to which the user belongs.

the cumulative permissions of all groups to which that user belongs.

Page 2 of 6

11. Time of day or day of week restrictions on when password verifications can occur configured in ____________________.

The Master Policy

The Platform settings

The Safe settings

The Account Details

12. The Accounts Feed contains:

Accounts that were discovered by CyberArk in the last 30 days

Accounts that were discovered by CyberArk that have not yet been onboarded

All accounts added to the vault in the last 30 days

All users added to CyberArk in the last 30 days

13. Which user is automatically added to all Safes and cannot be removed?

Auditor

Administrator

Master

Operator

14. Which of the following components can be used to create a tape backup of the Vault?

Disaster Recovery

Distributed Vaults

Replicate

High Availability

15. When managing SSH keys, the CPM stores the Public Key

In the Vault

On the target server

A & B

Nowhere because the public key can always be generated from the private key.

16. In the screenshot displayed, you just configured the usage in CyberArk and want to update its password.

What is the least intrusive way to accomplish this?

Use the “change” button on the usage’s details page.

Use the “change” button on the parent account’s details page.

Use the “sync” button on the usage’s details page.

Use the “reconcile” button on the parent account’s details page.

17. DRAG DROP

Arrange the steps to restore a Vault using PARestore for a Backup in the correct sequence.

18. For a safe with Object Level Access enabled you can turn off Object Level Access Control when it no longer needed on the safe.

TRUE

FALSE

19. Your organization has a requirement to allow users to “check out passwords” and connect to targets with the same account through the PSM.

What needs to be configured in the Master policy to ensure this will happen?

Enforce check-in/check-out exclusive access = active; Require privileged session monitoring and isolation = active

Enforce check-in/check-out exclusive access = inactive; Require privileged session monitoring and isolation = inactive

Enforce check-in/check-out exclusive access = inactive; Record and save session activity = active

Enforce check-in/check-out exclusive access = active; Record and save session activity = inactive

20. Which CyberArk utility allows you to create lists of Master Policy Settings, owners and safes for output to text files or MSSQL databases?

Export Vault Data

Export Vault Information

PrivateArk Client

Privileged Threat Analytics

Page 3 of 6

21. You are creating a Dual Control workflow for a team’s safe.

Which safe permissions must you grant to the Approvers group?

List accounts, Authorize account request

Retrieve accounts, Access Safe without confirmation

Retrieve accounts, Authorize account request

List accounts, Unlock accounts

22. CyberArk recommends implementing object level access control on all Safes.

True

False

23. A Vault administrator have associated a logon account to one of their Unix root accounts in the vault.

When attempting to verify the root account’s password the Central Policy Manager (CPM) will:

ignore the logon account and attempt to log in as root

prompt the end user with a dialog box asking for the login account to use

none of these

24. Which service should NOT be running on the DR Vault when the primary Production Vault is up?

PrivateArk Database

PrivateArk Server

CyberArk Vault Disaster Recovery (DR) service

CyberArk Logical Container

25. Which of the following Privileged Session Management (PSM) solutions support live monitoring of active sessions?

PSM (i.e., launching connections by clicking on the connect button in the Password Vault Web Access (PVWA)

PSM for Windows (previously known as RDP Proxy)

PSM for SSH (previously known as PSM-SSH Proxy)

All of the above

26. What is the primary purpose of One Time Passwords?

Reduced risk of credential theft

More frequent password changes

Non-repudiation (individual accountability)

To force a 'collusion to commit' fraud ensuring no single actor may use a password without authorization.

27. Due to network activity, ACME Corp’s PrivateArk Server became active on the OR Vault while the Primary Vault was also running normally. All the components continued to point to the Primary Vault.

Which steps should you perform to restore DR replication to normal?

Replicate data from DR Vault to Primary Vault > Shutdown PrivateArk Server on DR Vault > Start replication on DR vault

Shutdown PrivateArk Server on DR Vault > Start replication on DR vault

Shutdown PrivateArk Server on Primary Vault > Replicate data from DR Vault to Primary Vault > Shutdown PrivateArk Server on DR Vault > Start replication on DR vault

Shutdown PrivateArk Server on DR Vault > Replicate data from DR Vault to Primary Vault > Shutdown PrivateArk Server on DR Vault > Start replication on DR vault

28. When a group is granted the 'Authorize Account Requests' permission on a safe Dual Control requests must be approved by

Any one person from that group

Every person from that group

The number of persons specified by the Master Policy

That access cannot be granted to groups

29. Platform settings are applied to _________.

The entire vault.

Network Areas

Safes

Individual Accounts

30. Can the 'Connect' button be used to initiate an SSH connection, as root, to a Unix system when SSH access for root is denied?

Yes, when using the connect button, CyberArk uses the PMTerminal.exe process which bypasses the root SSH restriction.

Yes, only if a logon account is associated with the root account and the user connects through the PSM-SSH connection component.

Yes, if a logon account is associated with the root account.

No, it is not possible.

Page 4 of 6

31. In accordance with best practice, SSH access is denied for root accounts on UNIX/LINUX system .

What is the BEST way to allow CPM to manage root accounts?

Create a privileged account on the target server. Allow this account the ability to SSH directly from the CPM machine. Configure this account as the Reconcile account of the target server’s root account.

Create a non-privileged account on the target server. Allow this account the ability to SSH directly from the CPM machine. Configure this account as the Logon account of the target server’s root account.

Configure the Unix system to allow SSH logins.

Configure the CPM to allow SSH logins.

32. When on-boarding account using Accounts Feed, Which of the following is true?

You must specify an existing Safe where are account will be stored when it is on boarded to the Vault

You can specify the name of a new sale that will be created where the account will be stored when it is on-boarded to the Vault.

You can specify the name of a new Platform that will be created and associated with the account

Any account that is on boarded can be automatically reconciled regardless of the platform it is associated with.

33. Which command configures email alerts within PTA if settings need to be changed post install?

/opt/tomcat/utility/emailConfiguration.sh

/opt/PTA/emailConfiguration.sh

/opt/PTA/utility/emailConfig.sh

/opt/tomcat/utility/emailSetup.sh

34. An auditor needs to login to the PSM in order to live monitor an active session .

Which user ID is used to establish the RDP connection to the PSM server?

PSMConnect

PSMMaster

PSMGwUser

PSMAdminConnect

35. You are onboarding an account that is not supported out of the box.

What should you do first to obtain a platform to import?

Create a service ticket in the customer portal explaining the requirements of the custom platform.

Search common community portals like stackoverflow, reddit, github for an existing platform.

From the platforms page, uncheck the “Hide non-supported platforms” checkbox and see if a platform meeting your needs appears.

Visit the CyberArk marketplace and search for a platform that meets your needs.

36. You receive this error: “Error in changepass to user domainuser on domain server(domain. (winRc=5) Access is denied.”

Which root cause should you investigate?

The account does not have sufficient permissions to change its own password.

The domain controller is unreachable.

The password has been changed recently and minimum password age is preventing the change.

The CPM service is disabled and will need to be restarted.

37. If a password is changed manually on a server, bypassing the CPM, how would you configure the account so that the CPM could resume management automatically?

Configure the Provider to change the password to match the Vault’s Password

Associate a reconcile account and configure the platform to reconcile automatically

Associate a logon account and configure the platform to reconcile automatically

Run the correct auto detection process to rediscover the password

38. You have been asked to turn off the time access restrictions for a safe.

Where is this setting found?

PrivateArk

RestAPI

Password Vault Web Access (PVWA)

Vault

39. When creating an onboarding rule, it will be executed upon .

All accounts in the pending accounts list

Any future accounts discovered by a discovery process

Both “All accounts in the pending accounts list” and “Any future accounts discovered by a discovery process”

40. Secure Connect provides the following. Choose all that apply.

PSM connections to target devices that are not managed by CyberArk.

Session Recording

Real-time live session monitoring.

PSM connections from a terminal without the need to login to the PVWA

Page 5 of 6

41. In the Private Ark client, how do you add an LDAP group to a CyberArk group?

Select Update on the CyberArk group, and then click Add > LDAP Group

Select Update on the LDAP Group, and then click Add > LDAP Group

Select Member Of on the CyberArk group, and then click Add > LDAP Group

Select Member Of on the LDAP group, and then click Add > LDAP Group

42. Which of the following properties are mandatory when adding accounts from a file? (Choose three.)

Safe Name

Platform ID

All required properties specified in the Platform

Username

Address

Hostname

43. Users are unable to launch Web Type Connection components from the PSM server. Your manager asked you to open the case with CyberArk Support.

Which logs will help the CyberArk Support Team debug the issue? (Choose three.)

PSMConsole.log

PSMDebug.log

PSMTrace.log

<Session_ID>.Component.log

PMconsole.log

ITAlog.log

44. Ad-Hoc Access (formerly Secure Connect) provides the following features. Choose all that apply.

PSM connections to target devices that are not managed by CyberArk.

Session Recording.

Real-time live session monitoring.

PSM connections from a terminal without the need to login to the PVW

45. Accounts Discovery allows secure connections to domain controllers.

TRUE

FALSE

46. Which report provides a list of account stored in the vault.

Privileged Accounts Inventory

Privileged Accounts Compliance Status

Entitlement Report

Active Log

47. For an account attached to a platform that requires Dual Control based on a Master Policy exception, how would you configure a group of users to access a password without approval.

Create an exception to the Master Policy to exclude the group from the workflow process.

Edith the master policy rule and modify the advanced’ Access safe without approval’ rule to include the group.

On the safe in which the account is stored grant the group the’ Access safe without audit’ authorization.

On the safe in which the account is stored grant the group the’ Access safe without confirmation’ authorization.

48. In a rule using “Privileged Session Analysis and Response” in PTA, which session options are available to configure as responses to activities?

Suspend, Terminate, None

Suspend, Terminate, Lock Account

Pause, Terminate, None

Suspend, Terminate

49. You have been asked to identify the up or down status of Vault services.

Which CyberArk utility can you use to accomplish this task?

Vault Replicator

PAS Reporter

Remote Control Agent

Syslog

50. What is the purpose of the password change process?

To test that CyberArk is storing accurate credentials for accounts

To change the password of an account according to organizationally defined password rules

To allow CyberArk to manage unknown or lost credentials

To generate a new complex password

Page 6 of 6

51. To enable the Automatic response “Add to Pending” within PTA when unmanaged credentials are found, what are the minimum permissions required by PTAUser for the PasswordManager_pending safe?

List Accounts, View Safe members, Add accounts (includes update properties), Update Account content, Update Account properties

List Accounts, Add accounts (includes update properties), Delete Accounts, Manage Safe

Add accounts (includes update properties), Update Account content, Update Account properties, View Audit

View Accounts, Update Account content, Update Account properties, Access Safe without confirmation, Manage Safe, View Audit

52. A logon account can be specified in the platform settings.

True

False

53. A newly created platform allows users to access a Linux endpoint. When users click to connect, nothing happens.

Which piece of the platform is missing?

PSM-SSH Connection Component

UnixPrompts.ini

UnixProcess.ini

PSM-RDP Connection Component

54. What is the purpose of the PrivateArk Database service?

Communicates with components

Sends email alerts from the Vault

Executes password changes

Maintains Vault metadata

CAU201 CyberArk Defender Exam Questions have been Updated

CAU201 CyberArk Defender Exam Questions have been Updated

Share this post

Leave a Reply Cancel reply

Related Posts