CyberArk PAM-DEF-SEN Practice Exams
Last updated on Oct 22,2026- Exam Code: PAM-DEF-SEN
- Exam Name: CyberArk Defender – PAM & Sentry – PAM
- Certification Provider: CyberArk
- Latest update: Oct 22,2026
Question #31
As long as you are a member of the Vault Admins group, you can grant any permission on any safe that you have access to.
- A . TRUE
- B . FALSE
Correct Answer: B
B
Explanation:
Being a member of the Vault Admins group does not automatically grant you any permission on any safe that you have access to. The Vault Admins group is a predefined group that is created during the installation or upgrade of the vault. This group has the Vault Admin authorization, which allows its members to perform administrative tasks on the vault, such as managing users, groups, platforms, policies, and safes1. However, this authorization does not include any safe member authorizations, such as View, Retrieve, Use, or Manage Safe2. Therefore, to grant any permission on a safe, you need to be added as a safe member with the appropriate authorizations, either directly or through another group. The Vault Admins group can be added to safes with all safe member authorizations, but this is not done automatically for all safes. By default, this group is only added to a number of system safes, such as the Password Manager Safe, the PVWAConfig Safe, and the Notification Methods Safe3. For other safes, the Vault Admins group can be added manually by the safe owner or another user with the Manage Safe authorization4.
Reference: 1: Predefined users and groups, Predefined groups subsection
2: [CyberArk Privileged Access Security Implementation Guide], Chapter 3: Managing Safes, Section:
Safe Authorizations, Table 2-1: Safe Authorizations
3: What default groups can be automatically added to Safes when they are created?
4: [CyberArk Privileged Access Security Administration Guide], Chapter 3: Managing Safes, Section:
Adding Safe Members
B
Explanation:
Being a member of the Vault Admins group does not automatically grant you any permission on any safe that you have access to. The Vault Admins group is a predefined group that is created during the installation or upgrade of the vault. This group has the Vault Admin authorization, which allows its members to perform administrative tasks on the vault, such as managing users, groups, platforms, policies, and safes1. However, this authorization does not include any safe member authorizations, such as View, Retrieve, Use, or Manage Safe2. Therefore, to grant any permission on a safe, you need to be added as a safe member with the appropriate authorizations, either directly or through another group. The Vault Admins group can be added to safes with all safe member authorizations, but this is not done automatically for all safes. By default, this group is only added to a number of system safes, such as the Password Manager Safe, the PVWAConfig Safe, and the Notification Methods Safe3. For other safes, the Vault Admins group can be added manually by the safe owner or another user with the Manage Safe authorization4.
Reference: 1: Predefined users and groups, Predefined groups subsection
2: [CyberArk Privileged Access Security Implementation Guide], Chapter 3: Managing Safes, Section:
Safe Authorizations, Table 2-1: Safe Authorizations
3: What default groups can be automatically added to Safes when they are created?
4: [CyberArk Privileged Access Security Administration Guide], Chapter 3: Managing Safes, Section:
Adding Safe Members
Question #32
How much disk space do you need on a server to run a full replication with PAReplicate?
- A . 500 GB
- B . 1TB
- C . same as disk size on Satellite Vault
- D . at least the same disk size as the Primary Vault
Correct Answer: D
D
Explanation:
When running a full replication with PAReplicate, it is essential to have at least the same amount of disk space on the server as the disk size of the Primary Vault. This ensures that there is sufficient space to replicate all the data from the Primary Vault without any issues. The disk space should be equal to or larger than the total size of the data being replicated to accommodate the full backup1.
Reference: CyberArk Docs: Install the Vault Backup Utility
D
Explanation:
When running a full replication with PAReplicate, it is essential to have at least the same amount of disk space on the server as the disk size of the Primary Vault. This ensures that there is sufficient space to replicate all the data from the Primary Vault without any issues. The disk space should be equal to or larger than the total size of the data being replicated to accommodate the full backup1.
Reference: CyberArk Docs: Install the Vault Backup Utility
Question #33
When the CPM connects to a database, which interface is most commonly used?
- A . Kerberos
- B . ODBC
- C . VBScript
- D . Sybase
Correct Answer: B
B
Explanation:
The Central Policy Manager (CPM) in CyberArk most commonly uses the ODBC (Open Database Connectivity) interface when connecting to a database. ODBC is a standard API for accessing database management systems (DBMS). The CPM supports remote password management on all databases that support ODBC connections, and the machine running the CPM must support ODBC, version 2.7 and higher1.
Reference: CyberArk Docs: Databases that support ODBC connections1
B
Explanation:
The Central Policy Manager (CPM) in CyberArk most commonly uses the ODBC (Open Database Connectivity) interface when connecting to a database. ODBC is a standard API for accessing database management systems (DBMS). The CPM supports remote password management on all databases that support ODBC connections, and the machine running the CPM must support ODBC, version 2.7 and higher1.
Reference: CyberArk Docs: Databases that support ODBC connections1
Question #34
The Vault administrator can change the Vault license by uploading the new license to the system Safe.
- A . True
- B . False
Correct Answer: A
A
Explanation:
According to the web search results, the Vault administrator can change the Vault license by uploading the new license to the system Safe123. This can be done either from the Vault machine or from a remote machine using the PrivateArk client. The new license file should be named license.xml and replace the current one in the system Safe. This can be done without having to reinstall the Vault or restart the service.
A
Explanation:
According to the web search results, the Vault administrator can change the Vault license by uploading the new license to the system Safe123. This can be done either from the Vault machine or from a remote machine using the PrivateArk client. The new license file should be named license.xml and replace the current one in the system Safe. This can be done without having to reinstall the Vault or restart the service.
Question #35
You are concerned about the Windows Domain password changes occurring during business hours.
Which settings must be updated to ensure passwords are only rotated outside of business hours?
- A . In the platform policy –
Automatic Password Management > Password Change > ToHour & FromHour - B . in the Master Policy
Account Change Window > ToHour & From Hour - C . Administration Settings –
CPM Settings > ToHour & FromHour - D . On each individual account –
Edit > Advanced > ToHour & FromHour
Correct Answer: B
B
Explanation:
To ensure that Windows Domain password changes occur outside of business hours, the settings that must be updated are found in the Master Policy under the Account Change Window section. Here, you can specify the ToHour and FromHour to define the time frame outside of which the passwords should be rotated. This setting allows you to control when password changes can occur, ensuring that they do not interfere with business operations by taking place during non-business hours1.
Reference: CyberArk Docs – Set password policies
B
Explanation:
To ensure that Windows Domain password changes occur outside of business hours, the settings that must be updated are found in the Master Policy under the Account Change Window section. Here, you can specify the ToHour and FromHour to define the time frame outside of which the passwords should be rotated. This setting allows you to control when password changes can occur, ensuring that they do not interfere with business operations by taking place during non-business hours1.
Reference: CyberArk Docs – Set password policies
Question #36
Target account platforms can be restricted to accounts that are stored m specific Safes using the Allowed Safes property.
- A . TRUE
- B . FALSE
Correct Answer: A
A
Explanation:
Target account platforms can be restricted to accounts that are stored in specific Safes using the Allowed Safes property. This property is a parameter that can be configured in the Platform Management settings for each platform. The Allowed Safes property specifies the name or names of the Safes where the platform can be applied. The default value is .*, which means that the platform can be used in any Safe. However, if you want to limit the platform to certain Safes, you can enter the name or names of the Safes, separated by a pipe (|) character. For example, if you want to restrict the platform to Safes called WindowsPasswords and LinuxPasswords, you can enter AllowedSafes=(WindowsPasswords)|(LinuxPasswords). This feature is useful for preventing unauthorized users from accessing passwords, especially if you implement the reconciliation functionality. It also helps the CPM to focus its search operations on specific Safes, instead of scanning all Safes it can see in the Vault1.
Reference: 1: Limit Platforms to Specific Safes
A
Explanation:
Target account platforms can be restricted to accounts that are stored in specific Safes using the Allowed Safes property. This property is a parameter that can be configured in the Platform Management settings for each platform. The Allowed Safes property specifies the name or names of the Safes where the platform can be applied. The default value is .*, which means that the platform can be used in any Safe. However, if you want to limit the platform to certain Safes, you can enter the name or names of the Safes, separated by a pipe (|) character. For example, if you want to restrict the platform to Safes called WindowsPasswords and LinuxPasswords, you can enter AllowedSafes=(WindowsPasswords)|(LinuxPasswords). This feature is useful for preventing unauthorized users from accessing passwords, especially if you implement the reconciliation functionality. It also helps the CPM to focus its search operations on specific Safes, instead of scanning all Safes it can see in the Vault1.
Reference: 1: Limit Platforms to Specific Safes
Question #37
Assuming a safe has been configured to be accessible during certain hours of the day, a Vault Admin may still access that safe outside of those hours.
- A . TRUE
- B . FALSE
Correct Answer: A
A
Explanation:
A Vault Admin may still access a safe outside of the hours that it has been configured to be accessible, as long as he has the Bypass Safe Time Restrictions authorization on the Vault. The Bypass Safe Time Restrictions authorization enables a user to access any safe in the Vault, regardless of the time restrictions that are defined for that safe. This authorization is useful for emergency situations or maintenance tasks that require access to safes outside of the normal working hours. By default, the Vault Admins group has this authorization, as well as other administrative authorizations on the Vault1.
Reference: 1: Vault Member Authorizations
A
Explanation:
A Vault Admin may still access a safe outside of the hours that it has been configured to be accessible, as long as he has the Bypass Safe Time Restrictions authorization on the Vault. The Bypass Safe Time Restrictions authorization enables a user to access any safe in the Vault, regardless of the time restrictions that are defined for that safe. This authorization is useful for emergency situations or maintenance tasks that require access to safes outside of the normal working hours. By default, the Vault Admins group has this authorization, as well as other administrative authorizations on the Vault1.
Reference: 1: Vault Member Authorizations
Question #38
VAULT authorizations may be granted to_____.
- A . Vault Users
- B . Vault Groups
- C . LDAP Users
- D . LDAP Groups
Correct Answer: AC
AC
Explanation:
Vault Authorizations
• Can be assigned only to users (not groups).
• Cannot be inherited via group membership.
• Defined only via the Private Ark Client. Safe Auth
• Assigned to users and/or groups.
• Can be inherited via group membership.
• Can be defined in the Private Ark Client or PVWA
AC
Explanation:
Vault Authorizations
• Can be assigned only to users (not groups).
• Cannot be inherited via group membership.
• Defined only via the Private Ark Client. Safe Auth
• Assigned to users and/or groups.
• Can be inherited via group membership.
• Can be defined in the Private Ark Client or PVWA
Question #39
In accordance with best practice, SSH access is denied for root accounts on UNIX/LINUX system.
What is the BEST way to allow CPM to manage root accounts.
- A . Create a privileged account on the target server. Allow this account the ability to SSH directly from the CPM machine. Configure this account as the Reconcile account of the target server’s root account.
- B . Create a non-privileged account on the target server. Allow this account the ability to SSH directly from the CPM machine. Configure this account as the Logon account of the target server’s root account.
- C . Configure the Unix system to allow SSH logins.
- D . Configure the CPM to allow SSH logins.
Correct Answer: B
B
Explanation:
https://docs.cyberark.com/Product-Doc/OnlineHelp/PAS/Latest/en/Content/PASIMP/Using-Logon-Accounts-for-SSH-and-Telnet-Connections.htm?Highlight=logon%20account
B
Explanation:
https://docs.cyberark.com/Product-Doc/OnlineHelp/PAS/Latest/en/Content/PASIMP/Using-Logon-Accounts-for-SSH-and-Telnet-Connections.htm?Highlight=logon%20account
Question #40
Select the best practice for storing the Master CD.
- A . Copy the files to the Vault server and discard the CD
- B . Copy the contents of the CD to a Hardware Security Module (HSM) and discard the CD
- C . Store the CD in a secure location, such as a physical safe
- D . Store the CD in a secure location, such as a physical safe, and copy the contents of the CD to a folder secured with NTFS permissions on the Vault
Correct Answer: C
C
Explanation:
The best practice for storing the Master CD is to store it in a secure location, such as a physical safe. The Master CD contains the server key, the public recovery key, and the private recovery key, which are essential for starting, operating, and recovering the Vault. These keys are sensitive and should be protected from unauthorized access, loss, or damage. Therefore, storing the CD in a physical safe ensures that the keys are kept in a secure location when not in use, and that they are available when needed. This is the recommended option by CyberArk1.
The other options are not best practices and should be avoided, as they expose the keys to potential risks, such as theft, corruption, or deletion. Copying the files to the Vault server and discarding the CD is not secure, as it makes the keys accessible to anyone who can access the Vault server or compromise its security. Copying the contents of the CD to a Hardware Security Module (HSM) and discarding the CD is not feasible, as the HSM can only store the server key, not the recovery keys2. Storing the CD in a secure location, such as a physical safe, and copying the contents of the CD to a folder secured with NTFS permissions on the Vault is not necessary, as it creates redundant copies of the keys that may not be synchronized or updated. Moreover, NTFS permissions are not sufficient to protect the keys from malicious or accidental actions.
Reference: Server Keys – CyberArk, section “Server Keys”
Store the Server Key in an HSM – CyberArk, section “Store the Server Key in an HSM”
C
Explanation:
The best practice for storing the Master CD is to store it in a secure location, such as a physical safe. The Master CD contains the server key, the public recovery key, and the private recovery key, which are essential for starting, operating, and recovering the Vault. These keys are sensitive and should be protected from unauthorized access, loss, or damage. Therefore, storing the CD in a physical safe ensures that the keys are kept in a secure location when not in use, and that they are available when needed. This is the recommended option by CyberArk1.
The other options are not best practices and should be avoided, as they expose the keys to potential risks, such as theft, corruption, or deletion. Copying the files to the Vault server and discarding the CD is not secure, as it makes the keys accessible to anyone who can access the Vault server or compromise its security. Copying the contents of the CD to a Hardware Security Module (HSM) and discarding the CD is not feasible, as the HSM can only store the server key, not the recovery keys2. Storing the CD in a secure location, such as a physical safe, and copying the contents of the CD to a folder secured with NTFS permissions on the Vault is not necessary, as it creates redundant copies of the keys that may not be synchronized or updated. Moreover, NTFS permissions are not sufficient to protect the keys from malicious or accidental actions.
Reference: Server Keys – CyberArk, section “Server Keys”
Store the Server Key in an HSM – CyberArk, section “Store the Server Key in an HSM”