CyberArk PAM-DEF-SEN Practice Exams
Last updated on Oct 21,2026- Exam Code: PAM-DEF-SEN
- Exam Name: CyberArk Defender – PAM & Sentry – PAM
- Certification Provider: CyberArk
- Latest update: Oct 21,2026
Question #21
Which user is automatically added to all Safes and cannot be removed?
- A . Auditor
- B . Administrator
- C . Master
- D . Operator
Correct Answer: C
C
Explanation:
The user that is automatically added to all Safes and cannot be removed is the Master user. The Master user is a predefined user that is created during the Vault installation and has full permissions on all Safes and accounts. The Master user is the only user that can perform certain tasks, such as creating other predefined users, managing the Vault configuration, and restoring the Vault from a backup. The Master user cannot be deleted or modified by any other user, and is always a member of every Safe12.
Reference: Predefined users and groups – CyberArk, section “Master”
Safes and Safe members – CyberArk, section “Safe members overview”
C
Explanation:
The user that is automatically added to all Safes and cannot be removed is the Master user. The Master user is a predefined user that is created during the Vault installation and has full permissions on all Safes and accounts. The Master user is the only user that can perform certain tasks, such as creating other predefined users, managing the Vault configuration, and restoring the Vault from a backup. The Master user cannot be deleted or modified by any other user, and is always a member of every Safe12.
Reference: Predefined users and groups – CyberArk, section “Master”
Safes and Safe members – CyberArk, section “Safe members overview”
Question #22
PSM captures a record of each command that was executed in Unix.
- A . TRIE
- B . FALSE
Correct Answer: A
A
Explanation:
PSM captures a record of each command that was executed in Unix by using the SSH text recorder. This is a feature that enables PSM to record all the keystrokes that are typed during privileged sessions on SSH connections, including Unix systems. The SSH text recorder can be configured in the Platform Management settings for each platform that uses the SSH protocol. The text recordings are stored and protected in the Vault server and are accessible to authorized auditors. The text recordings can also be used for auditing and compliance purposes, as they provide a detailed trace of the actions performed by the users on the target systems1.
Reference: 1: Introduction to PSM for SSH, How it works subsection, Text recordings paragraph
A
Explanation:
PSM captures a record of each command that was executed in Unix by using the SSH text recorder. This is a feature that enables PSM to record all the keystrokes that are typed during privileged sessions on SSH connections, including Unix systems. The SSH text recorder can be configured in the Platform Management settings for each platform that uses the SSH protocol. The text recordings are stored and protected in the Vault server and are accessible to authorized auditors. The text recordings can also be used for auditing and compliance purposes, as they provide a detailed trace of the actions performed by the users on the target systems1.
Reference: 1: Introduction to PSM for SSH, How it works subsection, Text recordings paragraph
Question #23
You are creating a new Rest API user that utilizes CyberArk Authentication.
What is a correct process to provision this user?
- A . Private Ark Client > Tools > Administrative Tools > Users and Groups > New > User
- B . Private Ark Client > Tools > Administrative Tools > Directory Mapping > Add
- C . PVWA > User Provisioning > LDAP Integration > Add Mapping
- D . PVWA > User Provisioning > Users and Groups > New > User
Correct Answer: D
D
Explanation:
To provision a new Rest API user that utilizes CyberArk Authentication, the correct process involves using the PVWA (Password Vault Web Access). You would navigate to the User Provisioning section, then to Users and Groups, and select New > User. This allows you to create a new user that can be configured for Rest API access with the appropriate authentication method1.
Reference: CyberArk’s official documentation on implementing Privileged Account Security Web Services provides information on using REST APIs to create, list, modify, and delete entities in PAM – Self-Hosted from within programs and scripts, which includes user provisioning1.
Additional details on the process and best practices for creating Rest API users can be found in the CyberArk Privileged Access Manager documentation and training resources
D
Explanation:
To provision a new Rest API user that utilizes CyberArk Authentication, the correct process involves using the PVWA (Password Vault Web Access). You would navigate to the User Provisioning section, then to Users and Groups, and select New > User. This allows you to create a new user that can be configured for Rest API access with the appropriate authentication method1.
Reference: CyberArk’s official documentation on implementing Privileged Account Security Web Services provides information on using REST APIs to create, list, modify, and delete entities in PAM – Self-Hosted from within programs and scripts, which includes user provisioning1.
Additional details on the process and best practices for creating Rest API users can be found in the CyberArk Privileged Access Manager documentation and training resources
Question #24
Which certificate type do you need to configure the vault for LDAP over SSL?
- A . the CA Certificate that signed the certificate used by the External Directory
- B . a CA signed Certificate for the Vault server
- C . a CA signed Certificate for the PVWA server
- D . a self-signed Certificate for the Vault
Correct Answer: A
A
Explanation:
To enable SSL-based encryption for LDAP integration, the Vault machine and the PVWA machine need to trust the certificate used by the External Directory. This can be achieved by importing the CA Certificate that signed the certificate used by the External Directory into the Windows certificate store on both the Vault and PVWA machines. This will facilitate an SSL connection between the Vault and the External Directory.
Reference: Configure the Vault for LDAP, Configure LDAPS in CyberArk.
What certificate I need to use?
A
Explanation:
To enable SSL-based encryption for LDAP integration, the Vault machine and the PVWA machine need to trust the certificate used by the External Directory. This can be achieved by importing the CA Certificate that signed the certificate used by the External Directory into the Windows certificate store on both the Vault and PVWA machines. This will facilitate an SSL connection between the Vault and the External Directory.
Reference: Configure the Vault for LDAP, Configure LDAPS in CyberArk.
What certificate I need to use?
Question #25
Which Vault authorization does a user need to have assigned to able to generate the "Entitlement Report" from the reports page in PVWA? (Choose two.)
- A . Manage Users
- B . Audit Users
- C . Read Activity
- D . View Entitlements
- E . List Accounts
Correct Answer: D, B
D, B
Explanation:
D. View Entitlements: This authorization allows the user to view the entitlements, which is essential for generating reports that include access control and authorization levels on accounts.
B. Audit Users: Having ‘Audit Users’ permission is crucial as it enables the user to perform audit-related activities, which are typically part of generating entitlement reports12.
These authorizations ensure that the user has the necessary permissions to access and compile the data required for the Entitlement Report within the CyberArk PVWA.
D, B
Explanation:
D. View Entitlements: This authorization allows the user to view the entitlements, which is essential for generating reports that include access control and authorization levels on accounts.
B. Audit Users: Having ‘Audit Users’ permission is crucial as it enables the user to perform audit-related activities, which are typically part of generating entitlement reports12.
These authorizations ensure that the user has the necessary permissions to access and compile the data required for the Entitlement Report within the CyberArk PVWA.
Question #26
If a password is changed manually on a server, bypassing the CPM, how would you configure the account so that the CPM could resume management automatically?
- A . Configure the Provider to change the password to match the Vault’s Password
- B . Associate a reconcile account and configure the platform to reconcile automatically
- C . Associate a logon account and configure the platform to reconcile automatically
- D . Run the correct auto detection process to rediscover the password
Correct Answer: B
B
Explanation:
A reconcile account is a privileged account that has the permission to reset the password of another account on the target system. By associating a reconcile account with the account that has been changed manually, the CPM can use the reconcile account to restore the password of the account to the value that is stored in the Vault, in case it is changed or out of sync. This process is called password reconciliation and it ensures that the passwords are synchronized and available for use. To configure the account so that the CPM can resume management automatically, the platform that the account belongs to must have the following parameters set1: RCAutomaticReconcileWhenUnsynched: This parameter determines whether passwords will be reconciled automatically after the CPM detects a password on a remote machine that is not synchronized with its corresponding password in the Vault. The acceptable values are Yes or No. RCReconcileReasons: This parameter determines the codes that represent the CPM plugin errors that will launch a reconciliation process. The acceptable values are plug-in return codes separated by a comma.
RCFromHour, RCToHour: These parameters determine the time frame in hours during which the CPM can reconcile passwords, either manually or automatically. The acceptable values are 0-23 or -1 for none.
RCExecutionDays: This parameter determines the days of the week when the CPM will reconcile passwords. The acceptable values are days of the week, separated by commas.
Reference: 1: Password Reconciliation
B
Explanation:
A reconcile account is a privileged account that has the permission to reset the password of another account on the target system. By associating a reconcile account with the account that has been changed manually, the CPM can use the reconcile account to restore the password of the account to the value that is stored in the Vault, in case it is changed or out of sync. This process is called password reconciliation and it ensures that the passwords are synchronized and available for use. To configure the account so that the CPM can resume management automatically, the platform that the account belongs to must have the following parameters set1: RCAutomaticReconcileWhenUnsynched: This parameter determines whether passwords will be reconciled automatically after the CPM detects a password on a remote machine that is not synchronized with its corresponding password in the Vault. The acceptable values are Yes or No. RCReconcileReasons: This parameter determines the codes that represent the CPM plugin errors that will launch a reconciliation process. The acceptable values are plug-in return codes separated by a comma.
RCFromHour, RCToHour: These parameters determine the time frame in hours during which the CPM can reconcile passwords, either manually or automatically. The acceptable values are 0-23 or -1 for none.
RCExecutionDays: This parameter determines the days of the week when the CPM will reconcile passwords. The acceptable values are days of the week, separated by commas.
Reference: 1: Password Reconciliation
Question #27
When on-boarding account using Accounts Feed, Which of the following is true?
- A . You must specify an existing Safe where are account will be stored when it is on boarded to the Vault
- B . You can specify the name of a new sale that will be created where the account will be stored when it is on-boarded to the Vault.
- C . You can specify the name of a new Platform that will be created and associated with the account
- D . Any account that is on boarded can be automatically reconciled regardless of the platform it is associated with.
Correct Answer: B
B
Explanation:
When on-boarding accounts using Accounts Feed, you can either select an existing safe or create a new one to store the accounts. You can also specify the platform, policy, and owner for each account. However, you cannot create a new platform using Accounts Feed, and not all platforms support automatic reconciliation.
Reference: Accounts Feed – CyberArk
CyberArk University
[Defender-PAM Sample Items Study Guide]
B
Explanation:
When on-boarding accounts using Accounts Feed, you can either select an existing safe or create a new one to store the accounts. You can also specify the platform, policy, and owner for each account. However, you cannot create a new platform using Accounts Feed, and not all platforms support automatic reconciliation.
Reference: Accounts Feed – CyberArk
CyberArk University
[Defender-PAM Sample Items Study Guide]
Question #28
A new colleague created a directory mapping between the Active Directory groups and the Vault. Where can the newly Configured directory mapping be tested?
- A . Connect to the Active Directory and ensure the organizational unit exists.
- B . Connect to Sailpoint (or similar tool) to ensure the organizational unit is correctly named; log in to the PVWA with "Administrator" and confirm authentication succeeds.
- C . Search for members that exist only in the mapping group to grant them safe permissions through the PVWA.
- D . Connect to the PrivateArk Client with the Administrator Account to see if there is a user in the Vault Admin Group.
Correct Answer: C
C
Explanation:
The newly configured directory mapping can be tested by searching for members that exist only in the mapping group to grant them safe permissions through the PVWA (Privileged Vault Web Access). This process allows you to verify that the directory mapping is functioning correctly by ensuring that only the intended users, who are part of the specific Active Directory group, are granted access to the safes in the CyberArk Vault12.
Reference: CyberArk Docs – Create directory mapping1
CyberArk Docs – Edit directory mapping3
CyberArk Docs – LDAP Integration in PVWA
C
Explanation:
The newly configured directory mapping can be tested by searching for members that exist only in the mapping group to grant them safe permissions through the PVWA (Privileged Vault Web Access). This process allows you to verify that the directory mapping is functioning correctly by ensuring that only the intended users, who are part of the specific Active Directory group, are granted access to the safes in the CyberArk Vault12.
Reference: CyberArk Docs – Create directory mapping1
CyberArk Docs – Edit directory mapping3
CyberArk Docs – LDAP Integration in PVWA
Question #29
You want to create a new onboarding rule.
Where do you accomplish this?
- A . In PVWA, click Reports > Unmanaged Accounts > Rules
- B . In PVWA, click Options > Platform Management > Onboarding Rules
- C . In PrivateArk, click Tools > Onboarding Rules
- D . In PVWA, click Accounts > Onboarding Rules
Correct Answer: D
D
Explanation:
To create a new onboarding rule, you accomplish this in the Privileged Vault Web Access (PVWA) by
navigating to Accounts > Onboarding Rules. Once there, you can click on Create rule to start the New
onboarding rule wizard and proceed with the configuration of the rule. This process allows you to set
up rules that automatically onboard newly discovered accounts, minimizing manual effort and
reducing the chance of human error1.
Reference: CyberArk Docs – Onboarding rules
D
Explanation:
To create a new onboarding rule, you accomplish this in the Privileged Vault Web Access (PVWA) by
navigating to Accounts > Onboarding Rules. Once there, you can click on Create rule to start the New
onboarding rule wizard and proceed with the configuration of the rule. This process allows you to set
up rules that automatically onboard newly discovered accounts, minimizing manual effort and
reducing the chance of human error1.
Reference: CyberArk Docs – Onboarding rules
Question #30
In addition to add accounts and update account contents, which additional permission on the safe is required to add a single account?
- A . Upload Accounts Properties
- B . Rename Accounts
- C . Update Account Properties
- D . Manage Safe
Correct Answer: C
C
Explanation:
In addition to the permissions to add accounts and update account contents, the permission to Update Account Properties is required to add a single account to a safe in CyberArk. This permission allows the user to modify the properties of an account, which is a necessary step when adding a new account to ensure that all relevant details and configurations are correctly
set1.
Reference: The information provided is based on general knowledge of CyberArk PAM best practices and the permissions required for account management as outlined in CyberArk’s official documentation
C
Explanation:
In addition to the permissions to add accounts and update account contents, the permission to Update Account Properties is required to add a single account to a safe in CyberArk. This permission allows the user to modify the properties of an account, which is a necessary step when adding a new account to ensure that all relevant details and configurations are correctly
set1.
Reference: The information provided is based on general knowledge of CyberArk PAM best practices and the permissions required for account management as outlined in CyberArk’s official documentation