CyberArk Defender+ Sentry CAU302 Real Dumps

dumps2021-12-22T06:32:50+08:00

CyberArk Defender+ Sentry CAU302 real dumps are online, which are valuable in the preparation. In real CyberArk certification CAU302 exam, there are 65 multiple-choice questions. Each candidate has 90 minutes to complete all the questions. The required passing score of CAU302 exam is 70%. The exam fee is $200. Free CyberArk Defender+ Sentry CAU302 real dumps are available below.

Page 1 of 8

1. When planning to load balance at least 2 PSM Servers in an "in-domain" deployment, is it required to move the PSMConnect and PSMAdminConnect users to the domain level?

Yes. but only the PSMConnect user must be moved to the domain.

No. this is the customers decision and will work with local or domain based users.

Yes, both PSMConnect and PSMAdminConnect users should be moved to the domain

No. both accounts must be left as local accounts.

2. Which file is used to integrate the Vault with your Radius server?

radius.ini

paragent ini

ENEConf.ini

dbparm.ini

3. Which keys are required to be present in order to start the PrivateArk Server Service? Select all that apply.

Server Key

Recovery Public Key

Recovery Private Key

Safe Key

4. Where does the Vault administrator configure in Password Vault Web Access (PVWA) the Fully Qualified Domain Name (FQDN) of the domain controller during LDAP/S integration?

PVWA > Platform Management > LDAP Integration

PVWA > Administration > LDAP Integration

PVWA > Administration > Options > LDAP Integration

PVWA > LDAP Integration

5. Where does the Vault administrator configure in Password Vault Web Access (PVWA) the Fully Qualified Domain Name (FQDN) of the target email server during Simple Mail Transfer Protocol (SMTP) integration?

PVWA > Platform Management > Notification Settings

PVWA > Options > Notification Settings

PVWA > Administration > Notification Settings

PVWA > LDAP Integration > Notification Settings

6. What is the purpose of EVD?

To extract vault metadata into an open database platform.

To allow editing of vault metadata.

To create a backup of the MySQL database.

To extract audit data from the vault.

7. When managing SSH keys, the Central Policy Manager (CPM) stores the private key.

in the Vault

on the target server

in the Vault and on the target server

nowhere because the private key can always be generated from the public key

8. Which of the following Privileged Session Management solutions provide a detailed audit log of session activities?

PSM (i.e., launching connections by clicking on the “Connect” button in the PVWA)

PSM for Windows (previously known as RDP Proxy)

PSM for SSH (previously known as PSM SSH Proxy)

All of the above

9. During ENE integration you should specify the Fully-Qualified Domain Name (FQDN) of the SMTP Gateway server.

TRUE

FALSE

10. The vault supports Subnet Based Access Control.

TRUE

FALSE

Page 2 of 8

11. dbparm.ini is the main configuration file for the vault.

TRUE

FALSE

12. A Logon Account can be specified in the platform settings

TRUE

FALSE

13. In accordance with best practice. SSH access is denied for root accounts on UNIX/LINUX systems.

What is the BEST way to allow CPM to manage root accounts?

Create a privileged account on the target server Allow this account the ability to SSH directly from the CPM machine Configure this account as the Reconcile account of the target server's root account.

Create a non-privileged account on the target server Allow this account the ability to SSH directly from the CPM machine. Configure this account as the Logon account of the target server's root account

Configure the Unix system to allow SSH logins.

Configure the CPM to allow SSH logins

14. All of your Unix root passwords are stored in the safe UnixRoot. Dual control is enabled for some of the accounts in that safe. The members of the AD group UnixAdmins need to be able to use the show, copy, and connect buttons on those passwords at any time without confirmation. The members of the AD group OperationsStaff need to be able to use the show, copy and connect buttons on those passwords on an emergency basis, but only with the approval of a member of OperationsManagers. The members of OperationsManagers never need to be able to use the show, copy or connect buttons themselves.

Which safe permissions do you need to grant to OperationsManagers? (Choose all that apply.)

Use Accounts

Retrieve Accounts

List Accounts

Authorize Password Requests

Access Safe without Authorization

15. When working with the CyberArk Cluster, which service is considered Optional (i.e., failure of the service does not mandate a failover)?

PrivateArk Server

PrivateArk Database

Event Notification Engine

Logic Container

16. CyberArk recommends implementing object level access control on all Safes.

True

False

17. The Remote Desktop Services role must be property licensed by Microsoft.

TRUE

FALSE

18. What is the purpose of the CyberArk Event Notification Engine service.

sends email messages from the vault.

sends email messages from the CP

processes audit reports.

make vault data available to components

19. What values are acceptable in the address field on the Accounts Details.

It must be a fully qualified domain name (FQDN)

It must be an IP address

It must be NetBIOS name

Any name that is resolvable on the CPM server is acceptable

20. After the Vault Server is installed, the Microsoft Windows Firewall is now commandeered by the Vault Can the administrator change these firewall rules?

Yes, but the administrator can only modify the firewall rules by editing the dbparm.ini file and the restarting the vault

Yes, the administrator can still modify Firewall rules via the Windows Firewall interface

No, the Vault does not permit any changes to the Firewall due to security requirements

Yes, but the administrator can only modify the firewall rules by editing the FirewallRuIes mi file and the restarting the vault

Page 3 of 8

21. When managing SSH keys. CPM automatically pushes the Public Key to the target system.

TRUE

FALSE

22. When working with the CyberArk Disaster Recovery (DR) solution, which services should be running on the DR Vault?

CyberArk Vault Disaster Recovery (DR), PrivateArk Database

CyberArk Vault Disaster Recovery

CyberArk Vault Disaster Recovery, PrivateArk Database, PrivateArk Server

CyberArk Vault Disaster Recovery, PrivateArk Database, CyberArk Event Notification Engine

23. The Vault Internal safe contains all of the configuration for the vault.

TRUE

FALSE

24. Customers who have the 'Access Safe without confirmation' safe permission on a safe where accounts are configured for Dual control, still need to request approval to use the account.

TRUE

FALSE

25. Which is the purpose of the HeadStartInterval setting in a platform?

It determines how far in advance audit data is collected for reports.

It instructs the CPM to initiate the password change process certain number of days before expiration.

It instructs the AIM provider to 'skip the cache' during the defined time period.

It alerts users of upcoming password changes a certain number of days before expiration.

26. It is possible to control the hours of the day during which a safe may be used.

TRUE

FALSE

27. When creating an onboarding rule, it will be executed upon.

All accounts in the pending accounts list.

Any future accounts discovered by a discovery process.

All accounts in the pending accounts list and any future accounts discovered by a discovery process.

28. The Accounts Feed contains:

Accounts that were discovered by CyberArk in the last 30 days

Accounts that were discovered by CyberArk that have not yet been onboarded

All accounts added to the vault in the last 30 days

All users added to CyberArk in the last 30 days

29. It is possible to leverage DNA to provide discovery functions that are not available with auto-detection.

TRUE

FALSE

30. When using multiple Central Policy Managers (CPM), which one of the following Safes is shared by all CPMs?

PasswordManagerSharedSafe

PasswordManager_Pending

PasswordManager_workspace

PasswordManager_ADInternal

Page 4 of 8

31. All of your Unix root passwords are stored in the safe UnixRoot. Dual control is enabled for some of the accounts in that safe The members of the AD group UnixAdmms need to be able to use the show, copy, and connect buttons on those passwords at any time without confirmation The members of the AD group OperationsStaff need to be able to use the show, copy and connect buttons on those passwords on an emergency basis, but only with the approval of a member of OperationsManagers The members of OperationsManagers never need to be able to use the show, copy or connect buttons themselves.

Which safe permissions do you need to grant to UnixAdmins? Check all that apply

Use Accounts

Retrieve Accounts

List Accounts

Authorize Password Requests

Access Safe without Authorization

32. Assuming a safe has been configured to be accessible during certain hours of the day, a Vault Admin may still access that safe outside of those hours.

TRUE

FALSE

33. It is possible to restrict the time of day. or day of week that a change process can occur

TRUE

FALSE

34. 1.To support a fault tolerant and high-availability architecture, the Password Vault Web Access (PVWA) servers need to be configured to communicate with the Primary Vault and Satellite Vaults.

What file needs to be changed on the PVWA to enable this setup?

Vault.ini

dbparm.ini

pvwa.ini

Satellite.ini

35. A Vault Administrator wants to change the PSM Server ID to comply with a naming standard

What is the process for changing the PSM Server ID?

First, logon to the PrivateArk Client as Administrator and open the PVWAConfig safe. Retrieve and edit the PVConfiguration.xml file. Search for the PSMServer Name and update the ID of the server you want to rename Save the file and copy back to the PVWAConfig safe. Restart the "CyberArk Privileged Session Manager" service on the PSM server.

then change the PSMServer ID in Administration. System Configuration. Options, Privileged Session Management. Configured PSM Servers Run an IISRESET on all PVWA servers.

First, login to the PVW

browse to Administration. System Configuration. Options. Pnvileged Session Management. Configured PSM Servers and select the PSM Server you need to change from the list of servers In the properties pane, set the value of the ID property to the new Server I

click Apply and O

Next, edit the basic_psm.ini file located on the PSM server in the PSM root directory and update the PSMServerlD parameter with the new Server I

save the file and restart the "CyberArk Privileged Session Manager" service on the PSM server

Options A and B above is the correct procedure

36. Any user can monitor live sessions in real time when initiating RDP connection via Secure Connect through PSM.

True

False

37. You are successfully managing passwords in the alpha.cyberark com domain; however when you attempt to manage a password in the beta.cyberark.com domain, you receive the 'network path not found* error.

What should you check first?

That the username and password are correct.

That the CPM can successfully resolve addresses in the beta cyberark com domain

That the end user has the correct permissions on the safe

That an appropriate trust relationship exists between alphaxyberark.com and beta.cyberark.com

38. Which service should NOT be running on the DR Vault when the primary production Vault is up?

PrivateArk Database

PrivateArk Server

CyberArk Vault Disaster Recovery Service

CyberArk Logical Container

39. Which user(s) can access all passwords in the vault

Administrator

Any member of Vault Admins

Any member of Auditors

Master

40. The Application Inventory report is related to AIM.

TRUE

FALSE

Page 5 of 8

41. Two-factor authentication can be implemented by integrating the Vault with a RADIUS server configured to require PIN and token.

True

False

42. Which Master Policy?

Password Expiration Time

Enabling and Disabling of the Connection Through the PSM

Password Complexity

The use of "One-Time-Passwords"

43. The System safe allows access to the Vault configuration files.

TRUE

FALSE

44. To support a fault tolerant and high-availability architecture, the Password Vault Web Access (PVWA) servers must to be configured to communicate with the Primary Vault and Satellite Vaults.

Which file needs to be changed on the PVWA to enable this setup?

Vault.ini

dbparm.ini

pvwa.ini

Satellite.ini

45. Platform settings are applied to_________.

The entire vault.

Network Areas

Safes

Individual Accounts

46. When a group is granted the ‘Authorize Account Requests’ permission on a safe Dual Control requests must be approved by:

Any one person from that group

Every person from that group

The number of persons specified by the Master Policy

That access cannot be granted to groups

47. An SNMP integration allows you to forward audit records from the vault to the SIEM.

TRUE

FALSE

48. The DR module allows an integration with Enterprise Backup software

TRUE

FALSE

49. If a password is changed manually on a server, bypassing the CPM, how would you configure the account so that the CPM could resume management automatically?

Configure the Provider to change the password to match the Vault’s Password

Associate a reconcile account and configure the platform to reconcile automatically

Associate a logon account and configure the platform to reconcile automatically

Run the correct auto detection process to rediscover the password

50. The following applications are pre-configured to work with PSM. but first need to be installed on the PSM server.

SQL Plus

Putty

RDP

WinSCP

Toad

VMWare vSphere Client

Microsoft SQL Management Studio

Page 6 of 8

51. After the Vault administrator configures syslog integration on the Vault, the Vault will be able to.

forward ITALOG records to Security Information and Event Management (SIEM).

send out Simple Network Management Protocol (SNMP) traps.

forward audit records to Security Information and Event Management (SIEM).

forward emails to SIE

52. What is the primary purpose of One Time Passwords?

Reduced risk of credential theft

More frequent password changes

Non-repudiation (individual accountability)

To force a ‘collusion to commit’ fraud ensuring no single actor may use a password without authorization

53. Time of day of week restrictions on when password changes can occur are configured in ________________.

The Master Policy

The Platform settings

The Safe settings

The Account Details

54. Within the Vault each password is encrypted by

The Server Key

The Recovery Public Key

The Recovery Private key

Its own unique key.

55. Accounts Discovery allows secure connections to domain controllers.

TRU

FALSE

56. What is the name of the Platform parameter that determines the amount of time a person is allowed to use a One Time Password?

MinValidityPeriod

Interval

ImmediateInterval

Timeout

57. When is the transparent user provisioned initially in the vault?

When a directory mapping matching that user id is created.

When a vault admin completes the LDAP configuration wizard

The first time the user logs in.

During the vault's nightly LDAP refresh.

58. During LDAP/S integration you should specify the Fully Qualified Domain Name (FQDN) of the Domain Controller

TRUE

FALSE

59. CyberArk Logical Container

CPMLOG

CPM_errorlog

pmlog

pm errors log

60. Which of the following are prerequisites for installing PVWA Check all that Apply

Web Services Role

NET 4.5.1 Framework Feature

Remote Desktop Services Role

Windows BitLocker

Page 7 of 8

61. What is the purpose of the password Change process?

To test that CyberArk is storing accurate credentials for accounts

To change the password of an account according to organizationally defined password rules

To allow CyberArk to manage unknown or lost credentials

To generate a new complex password

62. A Simple Mail Transfer Protocol (SMTP) integration is critical for monitoring Vault activity and facilitating workflow processes, such as Dual Control.

True

False

63. The Remote Desktop Services role installed on PSM must be properly licensed by Microsoft.

No, this is not necessary

Yes, this is a must and needs to be scoped and purchased prior to project implementation

Yes, RDS is included as part of Microsoft Operating System License

No, RDS licenses are only required when using the RemoteApp feature

64. What is the chief benefit of PSM?

Privileged session isolation

Automatic password management

Privileged session recording

Privileged session isolation and privileged session recording

65. PSM requires the Remote Desktop Session Host role service.

TRUE

FALSE

66. The vault server uses a modified version of the Microsoft Windows firewall

TRUE

FALSE

67. The password upload utility must run from the CPM server.

TRUE

FALSE

68. After the Vault server is installed, the Microsoft Windows firewall is now commandeered by the Vault. Can the administrator change these firewall rules?

Yes, but the administrator can only modify the firewall rules by editing the dbparm.ini file and the restarting the Vault.

Yes, the administrator can still modify firewall rules via the Windows firewall interface.

No, the Vault does not permit any changes to the firewall due to security requirements.

Yes, but the administrator can only modify the firewall rules by editing the FirewallRules.ini file and the restarting the Vault.

69. Name two ways of viewing the ITAlog:

Log into the vault locally and navigate to the Server folder under the PrivateArk install location.

Log into the PVWA and go to the Reports tab.

Access the System Safe from the PrivateArk client.

Go to the Thirdpary log directory on the CPM

70. What is the purpose of a password group?

To ensure that a particular collection of accounts all have the same password

To ensure a particular set of accounts all change at the same time

To connect the CPM to a target system

To allow more than one account to work together as part of a password management process

Page 8 of 8

71. Which CyberArk components or products can be used to discover Windows Services or Scheduled Tasks that use privileged accounts'? Select all that apply.

Discovery and Audit (DNA)

Auto Detection (AD)

Export Vault Data (EVD)

On Demand Privileges Manager (OPM)

Accounts Discovery

72. Which type of automatic remediation can be performed by the PTA in case of a suspicious password change security event?

Password change

Password reconciliation

Session suspension

Session termination

CyberArk Defender+ Sentry CAU302 Real Dumps

CyberArk Defender+ Sentry CAU302 Real Dumps

Share this post

Leave a Reply Cancel reply

Related Posts