Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  2. Home
  3. Exams
  4. CyberArk
  5. PAM-DEF

CyberArk PAM-DEF Exam Questions
CyberArk Defender - PAM (Page 3 )

Updated On: 8-May-2026
Page 3 of 31
PDF with 239 Questions

For an account attached to a platform that requires Dual Control based on a Master Policy exception, how would you configure a group of users to access a password without approval.

  1. Create an exception to the Master Policy to exclude the group from the workflow process.
  2. Edith the master policy rule and modify the advanced' Access safe without approval' rule to include the group.
  3. On the safe in which the account is stored grant the group the' Access safe without audit' authorization.
  4. On the safe in which the account is stored grant the group the' Access safe without confirmation' authorization.

Answer(s): D

Explanation:

Dual Control is a feature that requires the approval of another user before accessing a password. It is based on a Master Policy rule that applies to all accounts attached to platforms that have this rule enabled. However, there may be situations where a group of users needs to access a password without approval, such as in an emergency or for troubleshooting purposes. In this case, an exception can be made by granting the group the `Access safe without confirmation' authorization on the safe in which the account is stored. This authorization bypasses the Dual Control workflow and allows the group to retrieve the password without waiting for approval. However, the password retrieval will still be audited and recorded in the Vault.



As long as you are a member of the Vault Admins group, you can grant any permission on any safe that you have access to.

  1. TRUE
  2. FALSE

Answer(s): B

Explanation:

Being a member of the Vault Admins group does not automatically grant you any permission on any safe that you have access to. The Vault Admins group is a predefined group that is created during the installation or upgrade of the vault. This group has the Vault Admin authorization, which allows its members to perform administrative tasks on the vault, such as managing users, groups, platforms, policies, and safes. However, this authorization does not include any safe member authorizations,

such as View, Retrieve, Use, or Manage Safe. Therefore, to grant any permission on a safe, you need to be added as a safe member with the appropriate authorizations, either directly or through another group. The Vault Admins group can be added to safes with all safe member authorizations, but this is not done automatically for all safes. By default, this group is only added to a number of system safes, such as the Password Manager Safe, the PVWAConfig Safe, and the Notification Methods Safe. For other safes, the Vault Admins group can be added manually by the safe owner or another user with the Manage Safe authorization.


Reference:

1: Predefined users and groups, Predefined groups subsection
2: [CyberArk Privileged Access Security Implementation Guide], Chapter 3: Managing Safes, Section:
Safe Authorizations, Table 2-1: Safe Authorizations
3: What default groups can be automatically added to Safes when they are created?
4: [CyberArk Privileged Access Security Administration Guide], Chapter 3: Managing Safes, Section:
Adding Safe Members



Which report provides a list of account stored in the vault.

  1. Privileged Accounts Inventory
  2. Privileged Accounts Compliance Status
  3. Entitlement Report
  4. Active Log

Answer(s): A

Explanation:

The report that provides a list of accounts stored in the vault is the Privileged Accounts Inventory report. This report can be generated in the Reports page in the PVWA by users who belong to the group that is specified in the ManageReportsGroup parameter in the Reports section of the Web Access Options in the System Configuration page. The Privileged Accounts Inventory report contains information such as the safe, folder, name, platform ID, username, address, group, last accessed date, last accessed by, last modified date, last modified by, verification date, checkout date, checked out by, age, change failure, verification failure, master pass folder, master pass name, disabled by, and disabled reason of each account stored in the vault.


Reference:

1: Reports in PVWA
2: Users List Report



When on-boarding account using Accounts Feed, Which of the following is true?

  1. You must specify an existing Safe where are account will be stored when it is on boarded to the Vault
  2. You can specify the name of a new sale that will be created where the account will be stored when it is on-boarded to the Vault.
  3. You can specify the name of a new Platform that will be created and associated with the account
  4. Any account that is on boarded can be automatically reconciled regardless of the platform it is associated with.

Answer(s): B

Explanation:

When on-boarding accounts using Accounts Feed, you can either select an existing safe or create a new one to store the accounts. You can also specify the platform, policy, and owner for each account. However, you cannot create a new platform using Accounts Feed, and not all platforms support automatic reconciliation.


Reference:

Accounts Feed - CyberArk
CyberArk University
[Defender-PAM Sample Items Study Guide]



Target account platforms can be restricted to accounts that are stored m specific Safes using the Allowed Safes property.

  1. TRUE
  2. FALSE

Answer(s): A

Explanation:

Target account platforms can be restricted to accounts that are stored in specific Safes using the Allowed Safes property. This property is a parameter that can be configured in the Platform Management settings for each platform. The Allowed Safes property specifies the name or names of the Safes where the platform can be applied. The default value is .*, which means that the platform can be used in any Safe. However, if you want to limit the platform to certain Safes, you can enter the name or names of the Safes, separated by a pipe (|) character. For example, if you want to restrict the platform to Safes called WindowsPasswords and LinuxPasswords, you can enter AllowedSafes=(WindowsPasswords)|(LinuxPasswords). This feature is useful for preventing unauthorized users from accessing passwords, especially if you implement the reconciliation functionality. It also helps the CPM to focus its search operations on specific Safes, instead of scanning all Safes it can see in the Vault.


Reference:

1: Limit Platforms to Specific Safes



Which one the following reports is NOT generated by using the PVWA?

  1. Accounts Inventory
  2. Application Inventory
  3. Sales List
  4. Convince Status

Answer(s): C

Explanation:

The PVWA can generate various reports on the privileged accounts and applications in the system, based on different filters and criteria. However, the Safes List report is not one of them. The Safes List report is generated by using the PrivateArk Client, and it provides a list of Safes and their properties according to location.


Reference:

Defender-PAM Study Guide, Reports and Audits



PSM captures a record of each command that was executed in Unix.

  1. TRIE
  2. FALSE

Answer(s): A

Explanation:

PSM captures a record of each command that was executed in Unix by using the SSH text recorder. This is a feature that enables PSM to record all the keystrokes that are typed during privileged sessions on SSH connections, including Unix systems. The SSH text recorder can be configured in the Platform Management settings for each platform that uses the SSH protocol. The text recordings are stored and protected in the Vault server and are accessible to authorized auditors. The text recordings can also be used for auditing and compliance purposes, as they provide a detailed trace of the actions performed by the users on the target systems.


Reference:

1: Introduction to PSM for SSH, How it works subsection, Text recordings paragraph



Platform settings are applied to _________.

  1. The entire vault.
  2. Network Areas
  3. Safes
  4. Individual Accounts

Answer(s): D

Explanation:

Platform settings are applied to individual accounts. A platform is a set of parameters that defines how the Vault manages the passwords of accounts that belong to a certain operating system or application. Each account in the Vault is attached to a platform that determines how the account password is changed, verified, reconciled, and accessed. Platform settings can be customized to meet the specific requirements of each account type. For example, you can define the password complexity, rotation frequency, verification method, and access policy for each platform.


Reference:

[Defender PAM Sample Items Study Guide], page 15; [CyberArk Privileged Access Security Documentation], Platforms Overview.



Viewing page 3 of 31
Viewing questions 17 - 24 out of 239 questions


PAM-DEF Exam Discussions & Posts (Share your experience with others)

AI Tutor AI Tutor 👋 I’m here to help!