CyberArk CAU201 Defender Exam Prep Spring 2023 with
complete solution
Can the "Connect" button be used to initiate a SSH connection, as root, to a Unix
system when SSH access for root is denied?
Yes, only if a logon account is associated with the root account and the user connects
through the PSM-SSH connecting component.
The password upload utility must be run from the CPM server.
False
When managing SSH keys, the CPM stores the Public Key. . .
on the target server
Which Master Policy Setting must be active in order to have an account checked-
out by one user for a pre-determined amount of time?
Enforce check-in/check-out and exclusive access
Vault admins must manually add the auditors groups to newly created safes so
auditors will have sufficient access to run reports.
False
You have associated a logon account to one of your Unix accounts in the Vault.
When attempting to change the root account's password, the CPM will. . .
Login to the system as the logon account, run the SU command to login as root, and
then change the root's password.
What is the primary purpose of One Time passwords?
Reduced risk of credential theft.
Accounts Discovery allows secure connections to domain controllers.
False
___________________ is NOT true when enabling PSM recording for a target
WIndows Server. . .
- The PSM software must be installed on the target server.
- PSMConnect must be added as a local user on the target server
According to DEFAULT Web Options settings, which group grants access to the
REPORTS page?
Auditors
Time of day/day of week restrictions on when password verifications an occur are
configured in. . .
Platform settings
As long as you are a member of the Vault Admins group, you can grant any
permissions to any safe that you have access to.
False: being in the Vault Admins group will only give you access to safes that are
created during installation.
PSM for Windows (previously known as RDP Proxy) supports connections to
which target systems?
Windows
A logon account can be specified in the Master Policy.
False
, A user with administrative privileges to the Vault can only grant other users
privileges that they have been granted.
False
The primary purpose of exclusive accounts is to ensure non-repudiation
(individual accountability).
True
All of your Unix root passwords are stored in the safe UnixRoot. Dual control is
enabled for SOME of the accounts in that safe.
The members of the AD group UnixAdmins need to be able to use the SHOW,
COPY, and CONNECT buttons on those passwords at any time without
confirmation.
The members of the AD group Operations Staff need to be able to use the SHOW,
COPY, and CONNECT buttons on those passwords on an emergency basis - but
only with the approval of a member of Operations Managers.
The members of the AD group Operations Managers never need to be able to use
the SHOW, COPY, or CONNECT buttons.
Which safe permissions need to be granted to Operations Staff?
- Use Accounts
- List accounts
- Retrieve Accounts
When managing SSH keys, the CPM stores the Private Key. . .
In the Vault
Platform settings are applied to. . .
Individual accounts
What files must be created/configured in order to run the Password Upload
Utility?
- Vault.ini
- Conf.ini
- A comma delimited upload file
What report cannot be generated in the PVWA?
Safes list
Users who are granted the "Access safe without confirmation" permission on a
safe where accounts are configured for Dual Control still need to request
approval to use accounts in that safe.
False
Which CyberArk components or products can be used to discover Windows
Services or Scheduled Tasks that use privileges accounts?
- Discovery and Audit (DNA)
- Auto Detection (AD)
- Accounts Discovery
A reconcile account can be specified in the Master Policy.
False
complete solution
Can the "Connect" button be used to initiate a SSH connection, as root, to a Unix
system when SSH access for root is denied?
Yes, only if a logon account is associated with the root account and the user connects
through the PSM-SSH connecting component.
The password upload utility must be run from the CPM server.
False
When managing SSH keys, the CPM stores the Public Key. . .
on the target server
Which Master Policy Setting must be active in order to have an account checked-
out by one user for a pre-determined amount of time?
Enforce check-in/check-out and exclusive access
Vault admins must manually add the auditors groups to newly created safes so
auditors will have sufficient access to run reports.
False
You have associated a logon account to one of your Unix accounts in the Vault.
When attempting to change the root account's password, the CPM will. . .
Login to the system as the logon account, run the SU command to login as root, and
then change the root's password.
What is the primary purpose of One Time passwords?
Reduced risk of credential theft.
Accounts Discovery allows secure connections to domain controllers.
False
___________________ is NOT true when enabling PSM recording for a target
WIndows Server. . .
- The PSM software must be installed on the target server.
- PSMConnect must be added as a local user on the target server
According to DEFAULT Web Options settings, which group grants access to the
REPORTS page?
Auditors
Time of day/day of week restrictions on when password verifications an occur are
configured in. . .
Platform settings
As long as you are a member of the Vault Admins group, you can grant any
permissions to any safe that you have access to.
False: being in the Vault Admins group will only give you access to safes that are
created during installation.
PSM for Windows (previously known as RDP Proxy) supports connections to
which target systems?
Windows
A logon account can be specified in the Master Policy.
False
, A user with administrative privileges to the Vault can only grant other users
privileges that they have been granted.
False
The primary purpose of exclusive accounts is to ensure non-repudiation
(individual accountability).
True
All of your Unix root passwords are stored in the safe UnixRoot. Dual control is
enabled for SOME of the accounts in that safe.
The members of the AD group UnixAdmins need to be able to use the SHOW,
COPY, and CONNECT buttons on those passwords at any time without
confirmation.
The members of the AD group Operations Staff need to be able to use the SHOW,
COPY, and CONNECT buttons on those passwords on an emergency basis - but
only with the approval of a member of Operations Managers.
The members of the AD group Operations Managers never need to be able to use
the SHOW, COPY, or CONNECT buttons.
Which safe permissions need to be granted to Operations Staff?
- Use Accounts
- List accounts
- Retrieve Accounts
When managing SSH keys, the CPM stores the Private Key. . .
In the Vault
Platform settings are applied to. . .
Individual accounts
What files must be created/configured in order to run the Password Upload
Utility?
- Vault.ini
- Conf.ini
- A comma delimited upload file
What report cannot be generated in the PVWA?
Safes list
Users who are granted the "Access safe without confirmation" permission on a
safe where accounts are configured for Dual Control still need to request
approval to use accounts in that safe.
False
Which CyberArk components or products can be used to discover Windows
Services or Scheduled Tasks that use privileges accounts?
- Discovery and Audit (DNA)
- Auto Detection (AD)
- Accounts Discovery
A reconcile account can be specified in the Master Policy.
False
