CyberArk PAM-DEF-SEN Practice Exams
Last updated on Oct 22,2026- Exam Code: PAM-DEF-SEN
- Exam Name: CyberArk Defender – PAM & Sentry – PAM
- Certification Provider: CyberArk
- Latest update: Oct 22,2026
Question #161
A new HTML5 Gateway has been deployed in your organization.
Where do you configure the PSM to use the HTML5 Gateway?
- A . Administration > Options > Privileged Session Management > Configured PSM Servers > Connection Details > Add PSM Gateway
- B . Administration > Options > Privileged Session Management > Add Configured PSM Gateway Servers
- C . Administration > Options > Privileged Session Management > Configured PSM Servers > Add PSM Gateway
- D . Administration > Options > Privileged Session Management > Configured PSM Servers > Connection Details
Correct Answer: C
C
Explanation:
After deploying a new HTML5 Gateway in your organization, you configure the PSM to use the
HTML5 Gateway by navigating to the Administration section in the PVWA. From there, you go to
Options, then Privileged Session Management, and under Configured PSM Servers, you will find the
option to Add PSM Gateway1. This is where you can specify the details of the newly deployed HTML5
Gateway to ensure that the PSM can utilize it for secure remote access to target machines through an
HTML5-based session.
Reference: CyberArk’s official documentation provides a step-by-step guide on how to install and configure the PSM HTML5 Gateway, including the process of adding the gateway to the PSM configuration1.
For more detailed instructions and best practices on configuring the PSM with an HTML5 Gateway, refer to the CyberArk Defender PAM course materials and study guides
C
Explanation:
After deploying a new HTML5 Gateway in your organization, you configure the PSM to use the
HTML5 Gateway by navigating to the Administration section in the PVWA. From there, you go to
Options, then Privileged Session Management, and under Configured PSM Servers, you will find the
option to Add PSM Gateway1. This is where you can specify the details of the newly deployed HTML5
Gateway to ensure that the PSM can utilize it for secure remote access to target machines through an
HTML5-based session.
Reference: CyberArk’s official documentation provides a step-by-step guide on how to install and configure the PSM HTML5 Gateway, including the process of adding the gateway to the PSM configuration1.
For more detailed instructions and best practices on configuring the PSM with an HTML5 Gateway, refer to the CyberArk Defender PAM course materials and study guides
Question #162
PSM for Windows (previously known as “RDP Proxy”) supports connections to the following target systems
- A . Windows
- B . UNIX
- C . Oracle
- D . All of the above
Correct Answer: D
D
Explanation:
PSM for Windows supports connections to various types of target systems, including Windows, UNIX, Oracle, and others. PSM for Windows uses different connection components to establish and manage the sessions, depending on the type and protocol of the target system. For example, PSM-RDP is used for Windows systems, PSM-SSH and PSM-Telnet are used for UNIX systems, PSM-Toad and PSM-SQLPlus are used for Oracle databases, and so on.
Reference: PSM for Windows
Connect through Privileged Session Manager for Windows Supported connection components
D
Explanation:
PSM for Windows supports connections to various types of target systems, including Windows, UNIX, Oracle, and others. PSM for Windows uses different connection components to establish and manage the sessions, depending on the type and protocol of the target system. For example, PSM-RDP is used for Windows systems, PSM-SSH and PSM-Telnet are used for UNIX systems, PSM-Toad and PSM-SQLPlus are used for Oracle databases, and so on.
Reference: PSM for Windows
Connect through Privileged Session Manager for Windows Supported connection components
Question #163
What is the chief benefit of PSM?
- A . Privileged session isolation
- B . Automatic password management
- C . Privileged session recording
- D . ‘Privileged session isolation’ and ‘Privileged session recording’
Correct Answer: D
D
Explanation:
According to the web search results, the chief benefit of PSM is to provide both privileged session isolation and privileged session recording. Privileged session isolation means that the PSM server acts as a proxy between the user and the target machine, preventing the user from directly accessing the target machine or exposing the privileged account credentials. Privileged session recording means that the PSM server captures and stores a video and a transcript of the user’s activity on the target machine, enabling auditing and monitoring of the privileged session. These benefits help to enhance the security and compliance of the privileged access management solution, as they prevent credential exposure, restrict unauthorized access, detect malicious activity, and provide evidence for forensic analysis
D
Explanation:
According to the web search results, the chief benefit of PSM is to provide both privileged session isolation and privileged session recording. Privileged session isolation means that the PSM server acts as a proxy between the user and the target machine, preventing the user from directly accessing the target machine or exposing the privileged account credentials. Privileged session recording means that the PSM server captures and stores a video and a transcript of the user’s activity on the target machine, enabling auditing and monitoring of the privileged session. These benefits help to enhance the security and compliance of the privileged access management solution, as they prevent credential exposure, restrict unauthorized access, detect malicious activity, and provide evidence for forensic analysis
Question #164
In the Private Ark client, how do you add an LDAP group to a CyberArk group?
- A . Select Update on the CyberArk group, and then click Add > LDAP Group
- B . Select Update on the LDAP Group, and then click Add > LDAP Group
- C . Select Member Of on the CyberArk group, and then click Add > LDAP Group
- D . Select Member Of on the LDAP group, and then click Add > LDAP Group
Correct Answer: C
C
Explanation:
To add an LDAP group to a CyberArk group, you need to use the Private Ark client and follow these steps1:
In the Users and Groups tree, select the CyberArk group that you want to add the LDAP group to.
In the Properties pane, click Member Of.
Click Add > LDAP Group.
In the LDAP Group dialog box, enter the name of the LDAP group and click OK.
Reference: Add an LDAP group to a Vault group
C
Explanation:
To add an LDAP group to a CyberArk group, you need to use the Private Ark client and follow these steps1:
In the Users and Groups tree, select the CyberArk group that you want to add the LDAP group to.
In the Properties pane, click Member Of.
Click Add > LDAP Group.
In the LDAP Group dialog box, enter the name of the LDAP group and click OK.
Reference: Add an LDAP group to a Vault group
Question #165
Which permissions are needed for the Active Directory user required by the Windows Discovery
process?
- A . Domain Admin
- B . LDAP Admin
- C . Read/Write
- D . Read
Correct Answer: D
D
Explanation:
The Active Directory user required by the Windows Discovery process needs to
have Read permissions in the OU to scan and all sub-OUs1. This allows the Discovery process to scan
predefined machines for new and modified accounts and their dependencies without requiring
elevated privileges such as Domain Admin or LDAP Admin rights. The Read permission is sufficient
for the Discovery process to retrieve the necessary information about the accounts that should be
onboarded into the Vault.
Reference: CyberArk’s official documentation on managing discovery processes outlines the permissions required for the Discovery process, including the need for Read permissions for the Active Directory user performing the discovery1.
Additional details on the required credentials for scanning and the Discovery process can be found in the supported target machines section of CyberArk’s documentation2.
D
Explanation:
The Active Directory user required by the Windows Discovery process needs to
have Read permissions in the OU to scan and all sub-OUs1. This allows the Discovery process to scan
predefined machines for new and modified accounts and their dependencies without requiring
elevated privileges such as Domain Admin or LDAP Admin rights. The Read permission is sufficient
for the Discovery process to retrieve the necessary information about the accounts that should be
onboarded into the Vault.
Reference: CyberArk’s official documentation on managing discovery processes outlines the permissions required for the Discovery process, including the need for Read permissions for the Active Directory user performing the discovery1.
Additional details on the required credentials for scanning and the Discovery process can be found in the supported target machines section of CyberArk’s documentation2.
Question #166
Which processes reduce the risk of credential theft? (Choose two.)
- A . require dual control password access approval
- B . require password change every X days
- C . enforce check-in/check-out exclusive access
- D . enforce one-time password access
Correct Answer: B, D
B, D
Explanation:
B, D
Explanation:
Question #167
Users who have the ‘Access Safe without confirmation’ safe permission on a safe where accounts are configured for Dual control, still need to request approval to use the account.
- A . TRUE
- B . FALSE
Correct Answer: B
B
Explanation:
Users who have the ‘Access Safe without confirmation’ safe permission on a safe where accounts are configured for Dual control, do not need to request approval to use the account. The ‘Access Safe without confirmation’ safe permission is a special permission that allows a user to bypass the Dual control mechanism and access the accounts in the safe without requiring confirmation from other authorized users. This permission can be useful for emergency situations or trusted users who need immediate access to the accounts. However, this permission also increases the risk of unauthorized or malicious access, so it should be granted with caution and monitored closely1.
Reference: 1: Access without confirmation
B
Explanation:
Users who have the ‘Access Safe without confirmation’ safe permission on a safe where accounts are configured for Dual control, do not need to request approval to use the account. The ‘Access Safe without confirmation’ safe permission is a special permission that allows a user to bypass the Dual control mechanism and access the accounts in the safe without requiring confirmation from other authorized users. This permission can be useful for emergency situations or trusted users who need immediate access to the accounts. However, this permission also increases the risk of unauthorized or malicious access, so it should be granted with caution and monitored closely1.
Reference: 1: Access without confirmation
Question #168
A new domain controller has been added to your domain. You need to ensure the CyberArk infrastructure can use the new domain controller for authentication.
Which locations must you update?
- A . on the Vault server in WindowsSystem32EtcHosts and in the PVWA Application under Administration > LDAP Integration > Directories > Hosts
- B . on the Vault server in WindowsSystem32EtcHosts and on the PVWA server in WindowsSystem32EtcHosts
- C . in the Private Ark client under Tools > Administrative Tools > Directory Mapping
- D . on the Vault server in the certificate store and on the PVWA server in the certificate store
Correct Answer: A
A
Explanation:
When a new domain controller is added to a domain, it is necessary to update the CyberArk
infrastructure to ensure it can use the new domain controller for authentication. This involves
updating the hosts file on the Vault server located at WindowsSystem32EtcHosts to include the
new domain controller’s details. Additionally, within the PVWA Application, you need to navigate
to Administration > LDAP Integration > Directories > Hosts and update the information there as
well. This ensures that both the Vault server and the PVWA Application are aware of the new domain
controller and can authenticate against it1.
Reference: CyberArk’s official documentation on configuring Active Directory integration, which includes details on setting up domain controllers for authentication2.
Information on adding Active Directory as a directory service in CyberArk Identity, which discusses the integration of domain controllers3.
A
Explanation:
When a new domain controller is added to a domain, it is necessary to update the CyberArk
infrastructure to ensure it can use the new domain controller for authentication. This involves
updating the hosts file on the Vault server located at WindowsSystem32EtcHosts to include the
new domain controller’s details. Additionally, within the PVWA Application, you need to navigate
to Administration > LDAP Integration > Directories > Hosts and update the information there as
well. This ensures that both the Vault server and the PVWA Application are aware of the new domain
controller and can authenticate against it1.
Reference: CyberArk’s official documentation on configuring Active Directory integration, which includes details on setting up domain controllers for authentication2.
Information on adding Active Directory as a directory service in CyberArk Identity, which discusses the integration of domain controllers3.
Question #169
You notice an authentication failure entry for the DR user in the ITALog.
What is the correct process to fix this error? (Choose two.)
- A . PrivateArk Client > Tools > Administrative Tools > Users and Groups > DR User > Update > Authentication > Update Password.
- B . Create a new credential file, on the DR Vault, using the CreateCredFile utility and the newly set password.
С. Create a new credential file, on the Primary Vault, using the CreateCredFile utility and the newly set password. - C . PVWA > User Provisioning > Users and Groups > DR User > Update Password.
- D . PrivateArk Client > Tools > Administrative Tools > Users and Groups > PAReplicate User > Update >
Authentication > Update Password.
Correct Answer: A, B
A, B
Explanation:
When an authentication failure for the DR user is noticed in the ITALog, the correct process to fix this
error involves two steps. First, you need to update the password for the DR user. This is done through
the PrivateArk Client by navigating to Tools > Administrative Tools > Users and Groups > DR User >
Update > Authentication > Update Password. After updating the password, the next step is to create
a new credential file on the DR Vault using the CreateCredFile utility with the newly set
password. This ensures that the DR Vault has the updated credentials necessary for the DR user to
authenticate successfully12.
Reference: CyberArk’s official documentation on troubleshooting authentication issues, which includes steps on updating user passwords and creating new credential files1.
Community discussions and support articles on resolving DR user authentication failures, which provide practical insights and recommended actions2
A, B
Explanation:
When an authentication failure for the DR user is noticed in the ITALog, the correct process to fix this
error involves two steps. First, you need to update the password for the DR user. This is done through
the PrivateArk Client by navigating to Tools > Administrative Tools > Users and Groups > DR User >
Update > Authentication > Update Password. After updating the password, the next step is to create
a new credential file on the DR Vault using the CreateCredFile utility with the newly set
password. This ensures that the DR Vault has the updated credentials necessary for the DR user to
authenticate successfully12.
Reference: CyberArk’s official documentation on troubleshooting authentication issues, which includes steps on updating user passwords and creating new credential files1.
Community discussions and support articles on resolving DR user authentication failures, which provide practical insights and recommended actions2
Question #170
Platform settings are applied to _________.
- A . The entire vault.
- B . Network Areas
- C . Safes
- D . Individual Accounts
Correct Answer: D
D
Explanation:
Platform settings are applied to individual accounts. A platform is a set of parameters that defines how the Vault manages the passwords of accounts that belong to a certain operating system or application. Each account in the Vault is attached to a platform that determines how the account password is changed, verified, reconciled, and accessed. Platform settings can be customized to meet the specific requirements of each account type. For example, you can define the password complexity, rotation frequency, verification method, and access policy for each platform.
Reference: [Defender PAM Sample Items Study Guide], page 15; [CyberArk Privileged Access Security Documentation], Platforms Overview.
D
Explanation:
Platform settings are applied to individual accounts. A platform is a set of parameters that defines how the Vault manages the passwords of accounts that belong to a certain operating system or application. Each account in the Vault is attached to a platform that determines how the account password is changed, verified, reconciled, and accessed. Platform settings can be customized to meet the specific requirements of each account type. For example, you can define the password complexity, rotation frequency, verification method, and access policy for each platform.
Reference: [Defender PAM Sample Items Study Guide], page 15; [CyberArk Privileged Access Security Documentation], Platforms Overview.