PAM-SEN CyberArk Sentry – PAM Exam Dumps 2023

Jonnie Karnath2023-08-21T08:01:52+00:00

PAM-SEN CyberArk Sentry – PAM Exam is an exam that focuses on CyberArk’s Privileged Access Security solution. If you are preparing for this exam, Certspots offers free PAM-SEN CyberArk Sentry – PAM Exam Dumps 2023 to help you prepare. These PAM-SEN dumps cover all the important topics and provide a better understanding of the exam format and types of questions that can be expected. By using these PAM-SEN dumps, you can evaluate your knowledge and identify areas that need more attention. With Certspots’ free PAM-SEN CyberArk Sentry – PAM Exam Dumps 2023, you can improve your chances of passing the exam on the first attempt.

Page 1 of 3

1. What is the purpose of the PSM health check hardening?

Remove IIS settings which can be considered security vulnerabilities.

Validate that the PSM is ready to be placed behind a load balancer.

Confirm that the Windows Services for PSM are running on the server.

Ensure that the AppLocker script does not have any syntax errors.

2. A customer has three data centers distributed globally and wants highly-available PSM connections in each segmented zone. In addition, the customer needs a highly-available PSM connection for the CyberArk Admins.

What will best satisfy this customer's needs?

one PSM per zone with a load balancer and two PSMs for Admins with a load balancer

six PSMs in the mam data center with a load balancer and one PSM for Admins

two PSMs per zone with a load balancer and two PSMs for Admins with a dedicated load balancer

three PSMs per zone with CyberArk built-in load balancing

3. You have been asked to limit a platform called “Windows_Servers” to safes called “WindowsDC1” and “WindowsDC2”. The platform must not be assigned to any other safe.

What is the correct way to accomplish this?

Edit the “Windows_Servers” platform, expand “Automatic Password Management”, then select General and modify “AllowedSafes” to be (WindowsDC1)|(WindowsDC2).

Edit the “Windows_Servers” platform, expand “Automatic Password Management”, then select Options and modify “AllowedSafes” to be (Win*).

Edit the “WindowsDC1” and “WindowsDC2” safes through Safe Management, Add “Windows_Servers” to the “AllowedPlatforms”.

Log in to PrivateArk using an Administrative user, Select File, Server File Categories, Locate the category “WindowsServersAllowedSafes” and specify “WindowsDC1,WindowsDC2”.

4. You want to change the name of the PVWAappuser of the second PVWA server.

Which steps are part of the process? (Choose two.)

Update PVW

ini with new user name

Update Vault.ini with new user name

Create new user in PrivateArk

Rename user in PrivateArk

Create new cred file for user

5. Which user is enabled when replicating data between active and stand-by Vaults?

Backup

Operator

Auditor

6. Which statement is correct about a post-install hardening?

The Vault must be hardened during the Vault installation process.

After the Vault server is installed, you must join the server to the Enterprise Domain and reboot the host.

It is executed after Vault installation by running CAVaultHarden.exe and hardening options can be edited by changing the Hardening.ini file.

If it is mandated by an organization’s IT governance, you do not have to execute Vault hardening; however, server hardening cannot be reversed.

7. You are configuring the Vault to send syslog audit data to your organization’s SIEM solution.

What is a valid value for the SyslogServerProtocol parameter in DBPARM.INI file?

TLS

SSH

SMTP

SNMP

8. What is a valid combination of primary and secondary layers of authentication to a company's two-factor authentication policy?

RSA SecurID Authentication (in PVWA) and LDAP Authentication

CyberArk Authentication and RADIUS Authentication

Oracle SSO (in PVWA) and SAML Authentication

LDAP Authentication and RADIUS Authentication

9. HTML5 Gateway can be installed on which supported UNIX OS versions? (Choose two.)

Red Hat Enterprise Linux 7.x

CentOS 7.x

Ubuntu 20.x

AK 7.x

Android 11.x

10. Which components support load balancing? (Choose two.)

CPM

PVWA

PSM

PTA

EPV

Page 2 of 3

11. In addition to bit rate and estimated total duration of recordings per day, what is needed to determine the amount of storage required for PSM recordings?

retention period

number of PSMs

number of users

number of targets

12. What must you do to prepare a Windows server for PVWA installation?

In the InstallationAutomation folder, run the PVWA_Prerequisites.ps1 file as an administrator in Powershell.

Install the PrivateArk client.

Verify the user performing the installation is Domain Administrator and has logon access to the Vault server.

Enable IPv6.

13. What is a prerequisite step before installing the Vault on Windows 2019?

Configure the Kerberos authentication method on the default IIS Application pool

Check that the server IP address is correctly configured and that it is static

In the Network Connection properties, configure Preferred DNS Servers

Install Microsoft Windows patch KB4014998

14. A customer is moving from an on-premises to a public cloud deployment.

What is the best and most cost-effective option to secure the server key?

Install the Vault in the cloud the same way you would in an on-premises environment. Place the server key in a password protected folder on the operating system.

Install the Vault in the cloud the same way you would in an on-premises environment. Purchase a Hardware Security Module to secure the server key.

Install the Vault using the native cloud images and secure the server key using native cloud Key Management Systems.

Install the Vault using the native cloud images and secure the server key with a Hardware Security Module.

15. A customer asked you to help scope the company's PSM deployment.

What should be included in the scoping conversation?

Recordings file path

Recordings codec

Recordings retention period

Recordings file type

16. You are installing multiple PVWAs behind a load balancer.

Which statement is correct?

Port 1858 must be opened between the load balancer and the PVWAs.

The load balancer must be configured in DNS round robin.

The load balancer must support "sticky sessions".

The Load Balancer Client Address Header parameter in the PVW

ini file must be set.

17. In addition to disabling Windows services or features not needed for PVWA operations, which tasks does PVWA_Hardening.ps1 perform when run? (Choose two.)

performs IIS hardening

configures all group policy settings

renames the local Administrator Account

configures Windows Firewall

imports the CyberArk INF configuration

18. Which file must you edit to ensure the PSM for SSH server is not hardened automatically after installation?

vault.ini

user.cred

psmpparms

psmgw.config

19. A new domain controller has been added to your domain. You need to ensure the CyberArk infrastructure can use the new domain controller for authentication.

Which locations must you update?

on the Vault server in C:WindowsSystem32driversetchosts and in the PVWAApplication under Administration > LDAP Integration > Directories > Hosts

on both the Vault and the PVWA servers in C:WindowsSystem32driversetchosts

in the Private Ark client under Tools > Administrative Tools > Directory Mapping

on the Vault server in the certificate store and on the PVWA server in the certificate store

20. You need to add a new PSM server to an existing CyberArk environment.

What is the best way to determine the sizing of this server?

Review the “Recommended Server Specifications” for PSMs in the CyberArk Documents website.

Use the specifications of any existing PSM and request a server of the same size.

Use the CyberArk Support Knowledgebase, search for “PSM Sizing” and locate the Knowledgebase article related to sizing.

Refer to the Microsoft Windows website, determine the minimum specifications required for the Operating System you are installing, and then add 4 Gb of RAM and 20 GB of disk.

Page 3 of 3

21. When integrating a Vault with HSM, which file is uploaded to the HSM device?

server.key

recpub.key

recprv.key

mdbase.dat

22. Which service must be set to Automatic (delayed start) after the Vault is installed and configured?

Windows Time service

PrivateArk Database

Windows Update service

PrivateArk Server

23. Which component must be installed before the first CPM installation?

PTA

PSM

PVWA

EPM

24. Which browser is supported for PSM Web Connectors developed using the CyberArk Plugin Generator Utility (PGU)?

Internet Explorer

Google Chrome

Opera

Firefox

25. You want to improve performance on the CPM by restricting accounts for the CYBRWINDAD platform to only the WINDEMEA and WINDEMEA_Admin safes.

How do you set this in CyberArk?

In the CYBRWINDAD platform, under Automatic Password Management/General, configure AllowedSafes and set to (WINDEMEA)|(WINDEMEA_ADMIN).

In the settings for Configuration/CPM assigned to the WINDEMEA and WINDEMEAADMIN safes, configure AllowedSafes and set to (WINDEMEA)|(WINDEMEAADMIN).

In the CYBRWINDAD platform, under UI&Workflows/Properties/Optional, configure AllowedSafes and set to (WINDEMEA)|(WINDEMEA_ADMIN).

Modify cpm.ini on the relevant CPM/s and add the setting AllowedSafesCYBRWINDAD and set to (WINDEMEA)|(WINDEMEAADMIN).

26. When configuring RADIUS authentication, which utility is used to create a file containing an encrypted version of the RADIUS secret?

CAVaultManager

CACert

CreateAuthFile

CreateCredFile

27. How should you configure PSM for SSH to support load balancing?

by using a network load balancer

in PVWA > Options > PSM for SSH Proxy > Servers

in PVWA > Options > PSM for SSH Proxy > Servers > VIP

by editing sshd.config on the all the PSM for SSH servers

28. Which components can connect to a satellite Vault in a distributed Vault architecture?

CPM, EPM, PTA

PVWA, PSM

CPM, PVWA, PSM

CPM, PSM

29. Which statement is correct about CPM behavior in a distributed Vault environment?

CPMs should only access the primary Vault. When it is unavailable, CPM cannot access any Vault until another Vault is promoted as the new primary Vault.

CPMs should access only the satellite Vaults.

CPMs should only access the primary Vault. When it is unavailable, CPM cannot access any Vault until the original primary Vault is operational again.

CPM should access all Vaults - primary and the satellite.

30. What is a step to enable NTP synchronization on a stand-alone Vault?

Run Powershell and add the NTP module.

Restart the organization's NTP servers.

Edit dbparm.ini and add a Firewall rule for the NTP address.

Restart the Vault Event Notification Engine service.

By Jonnie Karnath CyberArk Free Dumps CyberArk Sentry – PAM, PAM-SEN, PAM-SEN exam dumps 0 Comments

Facebook Twitter LinkedIn Google + Email