CyberArk PAM-DEF-SEN Practice Exams
Last updated on Oct 22,2026- Exam Code: PAM-DEF-SEN
- Exam Name: CyberArk Defender – PAM & Sentry – PAM
- Certification Provider: CyberArk
- Latest update: Oct 22,2026
Question #41
Which report provides a list of account stored in the vault.
- A . Privileged Accounts Inventory
- B . Privileged Accounts Compliance Status
- C . Entitlement Report
- D . Active Log
Correct Answer: A
A
Explanation:
The report that provides a list of accounts stored in the vault is the Privileged Accounts Inventory report. This report can be generated in the Reports page in the PVWA by users who belong to the group that is specified in the ManageReportsGroup parameter in the Reports section of the Web Access Options in the System Configuration page1. The Privileged Accounts Inventory report contains information such as the safe, folder, name, platform ID, username, address, group, last accessed date, last accessed by, last modified date, last modified by, verification date, checkout date, checked out by, age, change failure, verification failure, master pass folder, master pass name, disabled by, and disabled reason of each account stored in the vault2.
Reference: 1: Reports in PVWA
2: Users List Report
A
Explanation:
The report that provides a list of accounts stored in the vault is the Privileged Accounts Inventory report. This report can be generated in the Reports page in the PVWA by users who belong to the group that is specified in the ManageReportsGroup parameter in the Reports section of the Web Access Options in the System Configuration page1. The Privileged Accounts Inventory report contains information such as the safe, folder, name, platform ID, username, address, group, last accessed date, last accessed by, last modified date, last modified by, verification date, checkout date, checked out by, age, change failure, verification failure, master pass folder, master pass name, disabled by, and disabled reason of each account stored in the vault2.
Reference: 1: Reports in PVWA
2: Users List Report
Question #42
You have been given the requirement that certain accounts cannot have their passwords updated during business hours.
How can you set up a configuration to meet this requirement?
- A . Change settings on the CPM configuration safe so that access is permitted after business hours only.
- B . Update the password change parameters of the platform to match the permitted time frame.
- C . Disable automatic CPM management for all accounts that are assigned to this platform.
- D . Add an exception to the Master Policy to allow the action for this platform during the permitted time.
Correct Answer: B
B
Explanation:
To ensure that certain accounts do not have their passwords updated during business hours, you can configure the password change parameters within the platform settings to specify the permitted time frame for updates. This involves setting the FromHour and ToHour parameters to define a window outside of business hours during which the CyberArk Central Policy Manager (CPM) will perform automatic password changes1. By doing so, you can control when password changes occur and ensure compliance with the specified requirement.
Reference: CyberArk Community: Discussion on configuring automatic password change parameters
B
Explanation:
To ensure that certain accounts do not have their passwords updated during business hours, you can configure the password change parameters within the platform settings to specify the permitted time frame for updates. This involves setting the FromHour and ToHour parameters to define a window outside of business hours during which the CyberArk Central Policy Manager (CPM) will perform automatic password changes1. By doing so, you can control when password changes occur and ensure compliance with the specified requirement.
Reference: CyberArk Community: Discussion on configuring automatic password change parameters
Question #43
Due to corporate storage constraints, you have been asked to disable session monitoring and recording for 500 testing accounts used for your lab environment.
How do you accomplish this?
- A . Master Policy>select Session Management>add Exceptions to the platform(s)>disable Session Monitoring and Recording policies
- B . Administration>Platform Management>select the platform(s)>disable Session Monitoring and Recording Most Voted
- C . Polices>Access Control (Safes)>select the safe(s)>disable Session Monitoring and Recording policies
- D . Administration>Configuration Options>Options>select Privilege Session Management>disable Session Monitoring and Recording policies
Correct Answer: D
D
Explanation:
To disable session monitoring and recording for a large number of accounts due to storage constraints, you would navigate to the Administration section of the CyberArk Privileged Access Security (PAS) solution, specifically to the Configuration Options. From there, you would select the Privilege Session Management (PSM) options and disable the Session Monitoring and Recording policies. This action would apply the changes to the specified accounts, thus disabling the session monitoring and recording features for them1.
Reference: The answer is based on general knowledge of CyberArk PAS and best practices for managing session policies within the system. For specific steps and detailed procedures, please refer to the official CyberArk Defender PAM course materials and documentation
D
Explanation:
To disable session monitoring and recording for a large number of accounts due to storage constraints, you would navigate to the Administration section of the CyberArk Privileged Access Security (PAS) solution, specifically to the Configuration Options. From there, you would select the Privilege Session Management (PSM) options and disable the Session Monitoring and Recording policies. This action would apply the changes to the specified accounts, thus disabling the session monitoring and recording features for them1.
Reference: The answer is based on general knowledge of CyberArk PAS and best practices for managing session policies within the system. For specific steps and detailed procedures, please refer to the official CyberArk Defender PAM course materials and documentation
Question #44
Due to network activity, ACME Corp’s PrivateArk Server became active on the OR Vault while the Primary Vault was also running normally. All the components continued to point to the Primary Vault.
Which steps should you perform to restore DR replication to normal?
- A . Replicate data from DR Vault to Primary Vault > Shutdown PrivateArk Server on DR Vault > Start replication on DR vault
- B . Shutdown PrivateArk Server on DR Vault > Start replication on DR vault
- C . Shutdown PrivateArk Server on Primary Vault > Replicate data from DR Vault to Primary Vault > Shutdown PrivateArk Server on DR Vault > Start replication on DR vault
- D . Shutdown PrivateArk Server on DR Vault > Replicate data from DR Vault to Primary Vault > Shutdown PrivateArk Server on DR Vault > Start replication on DR vault
Correct Answer: B
B
Explanation:
To restore DR replication to normal after network activity caused the PrivateArk Server on the DR Vault to become active while the Primary Vault was also running, you should first shut down the PrivateArk Server on the DR Vault. This ensures that the DR Vault is no longer active and can be prepared for replication. After shutting down the server, you should then start the replication process on the DR Vault to synchronize the data from the Primary Vault1.
Reference: CyberArk’s official documentation on initiating a DR failback to the Production Vault provides a detailed procedure for restoring DR replication to normal1.
Additional information on monitoring backup and DR replications can be found in CyberArk’s documentation2.
For further study and understanding of the CyberArk Defender PAM course objectives and documents, the official CyberArk training resources and study guides are recommended3.
B
Explanation:
To restore DR replication to normal after network activity caused the PrivateArk Server on the DR Vault to become active while the Primary Vault was also running, you should first shut down the PrivateArk Server on the DR Vault. This ensures that the DR Vault is no longer active and can be prepared for replication. After shutting down the server, you should then start the replication process on the DR Vault to synchronize the data from the Primary Vault1.
Reference: CyberArk’s official documentation on initiating a DR failback to the Production Vault provides a detailed procedure for restoring DR replication to normal1.
Additional information on monitoring backup and DR replications can be found in CyberArk’s documentation2.
For further study and understanding of the CyberArk Defender PAM course objectives and documents, the official CyberArk training resources and study guides are recommended3.
Question #45
When are external vault users and groups synchronized by default?
- A . They are synchronized once every 24 hours between 1 AM and 5 AM. Most Voted
- B . They are synchronized once every 24 hours between 7 PM and 12 AM.
- C . They are synchronized every 2 hours.
- D . They are not synchronized according to a specific schedule.
Correct Answer: A
A
Explanation:
By default, external vault users and groups are synchronized once every 24 hours between 1 AM and 5 AM. This synchronization schedule is determined by the AutoSyncExternalObjects parameter in the DBParm.ini file, which specifies that the Vault’s external users and groups will be synchronized with the External Directory during this time frame1.
Reference: CyberArk Docs – Synchronize External Users and Groups in the Vault with the External Directory
A
Explanation:
By default, external vault users and groups are synchronized once every 24 hours between 1 AM and 5 AM. This synchronization schedule is determined by the AutoSyncExternalObjects parameter in the DBParm.ini file, which specifies that the Vault’s external users and groups will be synchronized with the External Directory during this time frame1.
Reference: CyberArk Docs – Synchronize External Users and Groups in the Vault with the External Directory
Question #46
Secure Connect provides the following. Choose all that apply.
- A . PSM connections to target devices that are not managed by CyberArk.
- B . Session Recording
- C . Real-time live session monitoring.
- D . PSM connections from a terminal without the need to login to the PVWA
Correct Answer: A, B, C
A, B, C
Explanation:
Secure Connect provides the following features:
A, B, C
Explanation:
Secure Connect provides the following features:
Question #47
What is the primary purpose of Dual Control?
- A . Reduced risk of credential theft
- B . More frequent password changes
- C . Non-repudiation (individual accountability)
- D . To force a ‘collusion to commit’ fraud ensuring no single actor may use a password without authorization.
Correct Answer: D
D
Explanation:
Dual control is a feature of CyberArk Defender PAM that enables authorized Safe owners to either grant or deny requests to access accounts. This feature adds an additional measure of protection, in that it enables you to see who wants to access the information in the Safe, when, and for what purpose. The Master Policy enables organizations to ensure that passwords can only be retrieved after permission or ‘confirmation’ has been granted from an authorized Safe Owner (s). This is known as Dual Control. The primary purpose of dual control is to prevent a single user from accessing a sensitive account without authorization, which could lead to fraud or misuse of privileges. By requiring confirmation from another authorized user, dual control ensures that there is a ‘collusion to commit’ fraud, meaning that at least two users are involved in the malicious activity and are accountable for it.
Reference: Dual Control – CyberArk
Dual Control – CyberArk
Dual control in V10 Interface – docs.cyberark.com
D
Explanation:
Dual control is a feature of CyberArk Defender PAM that enables authorized Safe owners to either grant or deny requests to access accounts. This feature adds an additional measure of protection, in that it enables you to see who wants to access the information in the Safe, when, and for what purpose. The Master Policy enables organizations to ensure that passwords can only be retrieved after permission or ‘confirmation’ has been granted from an authorized Safe Owner (s). This is known as Dual Control. The primary purpose of dual control is to prevent a single user from accessing a sensitive account without authorization, which could lead to fraud or misuse of privileges. By requiring confirmation from another authorized user, dual control ensures that there is a ‘collusion to commit’ fraud, meaning that at least two users are involved in the malicious activity and are accountable for it.
Reference: Dual Control – CyberArk
Dual Control – CyberArk
Dual control in V10 Interface – docs.cyberark.com
Question #48
When a DR Vault Server becomes an active vault, it will automatically revert back to DR mode once the Primary Vault comes back online.
- A . True; this is the default behavior
- B . False, the Vault administrator must manually set the DR Vault to DR mode by setting “FailoverMode=no” in the padr.ini file
- C . True, if the AllowFailback setting is set to “yes” in the padr.ini file
- D . False, the Vault administrator must manually set the DR Vault to DR mode by setting “FailoverMode=no” in the dbparm.ini file
Correct Answer: B
B
Explanation:
According to the web search results, when a DR Vault Server becomes an active vault, it will not automatically revert back to DR mode once the Primary Vault comes back online. The Vault administrator must manually set the DR Vault to DR mode by setting “FailoverMode=no” in the padr.ini file1. This file is located in the /opt/CARKaim/conf directory on the DR Vault machine2. The Vault administrator must also stop the replication process on the DR Vault and restart the PrivateArk Server service1. This procedure is known as a DR failback, which restores the original roles of the Primary Vault and the DR Vault after a failover1. The AllowFailback setting in the padr.ini file does not affect the DR failback process, as it only determines whether the DR Vault can be used as a backup for another DR Vault in a cascading DR scenario3. The dbparm.ini file is not relevant for the DR
failback process, as it contains the database parameters for the Vault server.
Reference: Initiate a DR failback to the Production Vault – CyberArk
Install the Disaster Recovery application – CyberArk
Cascading DR – CyberArk
[dbparm.ini file – CyberArk]
B
Explanation:
According to the web search results, when a DR Vault Server becomes an active vault, it will not automatically revert back to DR mode once the Primary Vault comes back online. The Vault administrator must manually set the DR Vault to DR mode by setting “FailoverMode=no” in the padr.ini file1. This file is located in the /opt/CARKaim/conf directory on the DR Vault machine2. The Vault administrator must also stop the replication process on the DR Vault and restart the PrivateArk Server service1. This procedure is known as a DR failback, which restores the original roles of the Primary Vault and the DR Vault after a failover1. The AllowFailback setting in the padr.ini file does not affect the DR failback process, as it only determines whether the DR Vault can be used as a backup for another DR Vault in a cascading DR scenario3. The dbparm.ini file is not relevant for the DR
failback process, as it contains the database parameters for the Vault server.
Reference: Initiate a DR failback to the Production Vault – CyberArk
Install the Disaster Recovery application – CyberArk
Cascading DR – CyberArk
[dbparm.ini file – CyberArk]
Question #49
All of your Unix root passwords are stored in the safe UnixRoot. Dual control is enabled for some of the accounts in that safe. The members of the AD group UnixAdmins need to be able to use the show, copy, and connect buttons on those passwords at any time without confirmation. The members of the AD group Operations Staff need to be able to use the show, copy and connect buttons on those passwords on an emergency basis, but only with the approval of a member of Operations Managers never need to be able to use the show, copy or connect buttons themselves.
Which safe permission do you need to grant Operations Staff? Check all that apply.
- A . Use Accounts
- B . Retrieve Accounts
- C . Authorize Password Requests
- D . Access Safe without Authorization
Correct Answer: A, B
A, B
Explanation:
To use the show, copy, and connect buttons on the accounts in the safe UnixRoot, the Operations Staff need to have the Use Accounts permission, which allows them to request access to the accounts and perform actions on them. However, since dual control is enabled for some of the accounts, they also need to have the Retrieve Accounts permission, which allows them to view the password of the account after it is authorized by another user. The Authorize Password
Requests permission is not needed, as it is only required for the users who can approve the requests, not the ones who make them. The Access Safe without Authorization permission is not needed, as it would bypass the dual control mechanism and allow the Operations Staff to access the accounts without approval.
Reference: [Defender PAM Sample Items Study Guide], page 10, question 5
[CyberArk Privileged Access Security Implementation Guide], page 30, table 2-1 [CyberArk Privileged Access Security Administration Guide], page 43, section 3.2.2.1
A, B
Explanation:
To use the show, copy, and connect buttons on the accounts in the safe UnixRoot, the Operations Staff need to have the Use Accounts permission, which allows them to request access to the accounts and perform actions on them. However, since dual control is enabled for some of the accounts, they also need to have the Retrieve Accounts permission, which allows them to view the password of the account after it is authorized by another user. The Authorize Password
Requests permission is not needed, as it is only required for the users who can approve the requests, not the ones who make them. The Access Safe without Authorization permission is not needed, as it would bypass the dual control mechanism and allow the Operations Staff to access the accounts without approval.
Reference: [Defender PAM Sample Items Study Guide], page 10, question 5
[CyberArk Privileged Access Security Implementation Guide], page 30, table 2-1 [CyberArk Privileged Access Security Administration Guide], page 43, section 3.2.2.1
Question #50
The vault supports Subnet Based Access Control.
- A . TRUE
- B . FALSE
Correct Answer: A
A
Explanation:
According to the web page in the edge browser, the vault supports Subnet Based Access Control. This is a feature that allows you to restrict access to a key vault to a specified virtual network and subnet. You can also use firewall settings to deny internet traffic and allow only specific IP addresses. This way, you can enhance the security and privacy of your key vault data12
A
Explanation:
According to the web page in the edge browser, the vault supports Subnet Based Access Control. This is a feature that allows you to restrict access to a key vault to a specified virtual network and subnet. You can also use firewall settings to deny internet traffic and allow only specific IP addresses. This way, you can enhance the security and privacy of your key vault data12