I85PREP
⌘ K
CyberArk EPM-DEF study materials
CyberArk EPM-DEF study resources

CyberArk EPM-DEF practice questions

One question at a time. Build your CyberArk EPM-DEF understanding.

First 50 of 190 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Endpoint privilege, application rules and controlled deployment

Which CyberArk component does an EPM administrator use to manage endpoint policies, application groups, and Computer Sets in the SaaS deployment model?

  1. EPM Server (the SaaS Set Management console) Correct answer.
  2. Privileged Access Manager (PAM) Vault
  3. Conjur Secrets Manager
  4. Privileged Threat Analytics (PTA) console

Explanation

In the EPM SaaS deployment, administrators sign in to the EPM Server (the cloud Set Management console) to create and tune policies, manage Application Groups, define Computer Sets, and review events. The EPM agent on each endpoint communicates back to this SaaS portal over HTTPS.

Question 2Endpoint privilege, application rules and controlled deployment

Which installer format is used to deploy the EPM agent on a Windows endpoint?

  1. DEB package
  2. RPM package
  3. MSI package Correct answer.
  4. PKG bundle

Explanation

The Windows EPM agent ships as an MSI installer, which can be deployed silently through GPO, SCCM, Intune, or any standard Windows software-distribution tool. The MSI registers the EPM service that enforces policies and reports events to the SaaS console.

Question 3Endpoint privilege, application rules and controlled deployment

Which installer format is used to deploy the EPM agent on macOS endpoints?

  1. .pkg installer Correct answer.
  2. .msi installer
  3. .rpm installer
  4. .dmg disk image only

Explanation

The macOS EPM agent is distributed as a .pkg installer, which can be pushed through MDM platforms such as Jamf or Workspace ONE. Once installed, the agent loads its system extension and begins enforcing the policies assigned to its Computer Set.

Question 4Endpoint privilege, application rules and controlled deployment

On which Linux package families is the EPM Linux agent supported?

  1. Only Alpine .apk packages
  2. Only Slackware .tgz packages
  3. DEB packages for Debian/Ubuntu and RPM packages for Red Hat/CentOS/RHEL Correct answer.
  4. TAR archives for any distribution

Explanation

EPM provides a Linux agent shipped as DEB packages (for Debian and Ubuntu) and RPM packages (for Red Hat, CentOS, RHEL, Oracle Linux). The Linux agent extends EPM's privilege-elevation and application-control coverage to Linux endpoints and can replace ad-hoc sudoers configurations with policy-driven elevation.

Question 5Endpoint privilege, application rules and controlled deployment

Which network protocol and direction does the EPM agent use to communicate with the EPM SaaS Server?

  1. Outbound HTTPS (TCP 443) from the agent to the SaaS portal Correct answer.
  2. Inbound LDAP from the SaaS portal to each endpoint
  3. Outbound SMB on TCP 445 from the agent
  4. Inbound RDP from the SaaS portal

Explanation

The EPM agent initiates outbound HTTPS (TCP 443) connections to the SaaS Set Manager URL. Because the agent always initiates the session, no inbound firewall rules toward the endpoint are needed, which dramatically simplifies network design for remote workers.

Question 6Endpoint privilege, application rules and controlled deployment

What is the primary purpose of a Computer Set in EPM?

  1. It is a tag used only for billing per endpoint
  2. It is a logical grouping of endpoints that share a single set of policies Correct answer.
  3. It is a static IP-address whitelist for the firewall
  4. It is a backup container for vault credentials

Explanation

A Computer Set is the unit of policy assignment in EPM. You group endpoints (for example, by OS, business unit, or risk tier) into a Computer Set and then assign policies (Privilege Elevation, Application Control, Threat Protection, Trusted Sources) to that Set. The same EPM tenant can host many Computer Sets each with its own policy stack.

Question 7Endpoint privilege, application rules and controlled deployment

After an admin changes a policy in the EPM SaaS console, how does the change reach an endpoint?

  1. The admin must SSH/RDP into the endpoint and re-run the installer
  2. The agent polls the SaaS server (or receives a push) and downloads the updated policy automatically Correct answer.
  3. Endpoints must reboot before any policy change takes effect
  4. Policy changes only apply to brand-new installs

Explanation

EPM agents automatically check in with the SaaS server on a regular schedule and pull updated policies. There is no need to push installers or to log into individual endpoints - the design assumes mobile workers behind home internet and just needs outbound HTTPS reachability.

Question 8Endpoint privilege, application rules and controlled deployment

An EPM admin needs to assign a stricter Threat Protection stack to a fleet of finance laptops while keeping a lighter policy on developer workstations. What is the cleanest way to accomplish this?

  1. Edit each laptop locally
  2. Place finance laptops in one Computer Set and developer workstations in another, then assign different policies to each Set Correct answer.
  3. Reinstall the agent with different MSI parameters per group
  4. Use Trusted Sources to override the policies

Explanation

Different policy stacks for different audiences is exactly what Computer Sets are designed for. Group endpoints by Set (finance, developers, kiosks, etc.) and assign distinct policy bundles to each Set in the SaaS console. No local edits or per-host installers are required.

Question 9Endpoint privilege, application rules and controlled deployment

Which statement about the EPM SaaS Set Manager URL is correct?

  1. Each tenant has a dedicated SaaS URL that the agent contacts over HTTPS to pull policies and report events Correct answer.
  2. All tenants share a single global URL with no tenant identifier
  3. Agents talk to each other peer-to-peer instead of the URL
  4. The Set Manager URL only accepts inbound SSH connections

Explanation

Every EPM SaaS tenant gets a unique Set Manager URL. The agent installer is configured with that URL and the agent makes outbound HTTPS calls to it for policy retrieval, telemetry upload, and command/response. No agent-to-agent traffic and no inbound SSH is involved.

Question 10Endpoint privilege, application rules and controlled deployment

Which best describes the relationship between EPM and CyberArk PAM?

  1. EPM and PAM are the same product, just renamed
  2. EPM secures privilege at the endpoint (workstations/servers) while PAM secures privileged credentials in a central Vault - they are complementary Correct answer.
  3. EPM is a license tier of PAM
  4. PAM is required to install the EPM agent

Explanation

EPM and PAM are complementary products. PAM (Privileged Access Manager) secures and rotates privileged credentials in a central Vault and brokers session access. EPM (Endpoint Privilege Manager) enforces least privilege and application control directly on workstations and servers. Together they cover credentials and endpoints.

Question 11Endpoint privilege, application rules and controlled deployment

Which is TRUE about EPM agent and SaaS communication for a remote (work-from-home) Windows laptop?

  1. The laptop must be on the corporate VPN to receive policy updates
  2. Outbound HTTPS to the SaaS URL is sufficient - no VPN required Correct answer.
  3. EPM only works on hard-wired LAN
  4. The agent installs nothing if the laptop is offline at install time

Explanation

Because the agent always initiates an outbound HTTPS session to the SaaS Set Manager URL, a remote laptop only needs internet access - no VPN required. This is one of the main reasons EPM is friendly to work-from-home and BYOD-adjacent deployments.

Question 12Endpoint privilege, application rules and controlled deployment

Which EPM behavior best supports a secure macOS deployment?

  1. Run macOS endpoints with the user as a permanent local admin
  2. Install the EPM .pkg via MDM, remove the user from the admin group, and use Privilege Elevation policies to grant rights when needed Correct answer.
  3. Disable Gatekeeper
  4. Skip System Extension approval

Explanation

On macOS, the secure pattern mirrors Windows: deploy the EPM .pkg via MDM (Jamf, Workspace ONE), approve the System Extension and Privacy Preferences via configuration profiles, remove the user from the local admin group, and use EPM Privilege Elevation policies to grant just-in-time admin for trusted apps.

Question 13Endpoint privilege, application rules and controlled deployment

Which deployment model keeps EPM administrators OUT of the business of patching backend servers and managing certificates?

  1. On-prem self-hosted EPM
  2. EPM SaaS Correct answer.
  3. Air-gapped portable installer
  4. Standalone laptops with no central server

Explanation

EPM SaaS is hosted by CyberArk - patching the backend, scaling the Set Manager, and managing TLS certificates is CyberArk's job. The customer's admins focus on policies, Computer Sets, Application Groups, and end-user experience instead of infrastructure plumbing.

Question 14Endpoint privilege, application rules and controlled deployment

Which is a sensible day-one Computer Set strategy for an organization rolling out EPM to 5,000 endpoints in waves?

  1. One giant Computer Set with all 5,000 endpoints
  2. A small Pilot Set, then progressively larger Wave Sets, each with policies tuned from the previous wave's events Correct answer.
  3. No Computer Sets - everything global
  4. A Computer Set per individual endpoint

Explanation

Wave-based rollout via progressively larger Computer Sets lets the admin tune policies on the small Pilot Set first (Detect mode, Trusted Sources tuning) and then promote into bigger waves with more confidence. One giant Set blunts the ability to learn from data; a Set per endpoint creates unmanageable sprawl.

Question 15Endpoint privilege, application rules and controlled deployment

An EPM admin wants to silently install the Windows agent via SCCM with the SaaS Set Manager URL pre-configured. What deployment artifact should they use?

  1. Windows MSI with installer parameters/transform supplying the Set Manager URL and tenant key Correct answer.
  2. macOS .pkg installer
  3. Linux DEB package
  4. Browser extension

Explanation

On Windows, the EPM agent ships as an MSI that supports silent install with parameters/transforms to supply the Set Manager URL and tenant identification. SCCM, Intune, or any MSI-aware tool can push it to thousands of endpoints with consistent configuration.

Question 16Endpoint privilege, application rules and controlled deployment

Which design choice means the EPM agent continues to enforce existing policies even when an endpoint loses internet connectivity?

  1. Agent caches active policies locally and enforces them while offline; new policies and event uploads sync once connectivity returns Correct answer.
  2. Agent stops enforcing all policies when offline
  3. Agent waits for the user to reboot before any enforcement
  4. Agent calls the help desk over phone

Explanation

EPM agents cache active policies locally and continue to enforce them while disconnected - important because work-from-home laptops are often offline. Once the agent reconnects to the SaaS Set Manager, it pulls the latest policies and uploads cached events.

Question 17Endpoint privilege, application rules and controlled deployment

What does an EPM Application Group represent?

  1. A network share used to push installers
  2. A reusable collection of application definitions (paths, hashes, signatures, publishers, sources, parameters) that policies act upon Correct answer.
  3. A licensed feature pack purchased from CyberArk
  4. A user group that is allowed to administer EPM

Explanation

An Application Group is a reusable definition of one or more applications that policies reference. Apps can be matched by file path, file hash, digital signature, publisher, source (URL/file location), or even command-line parameters. Once defined, the Application Group can be plugged into any number of Privilege Elevation, Application Control, or Threat Protection policies.

Question 18Endpoint privilege, application rules and controlled deployment

Which application identifier provides the strongest cryptographic guarantee that an executable has not been tampered with before being matched by an EPM policy?

  1. File path
  2. File hash (SHA-256) Correct answer.
  3. File name
  4. Last modified date

Explanation

A SHA-256 file hash uniquely identifies the exact bytes of an executable. If a single bit changes, the hash changes, so a hash-based Application Group will not match an attacker's tampered binary that is renamed or moved to the same path. EPM exposes hashes as one of the strongest match criteria in an Application Group.

Question 19Endpoint privilege, application rules and controlled deployment

An organization wants to automatically trust every signed application from a specific software publisher (for example, Adobe Inc.) without listing every binary. Which EPM construct best supports this?

  1. A path-based application group covering C:\Program Files
  2. A publisher-based application identifier in a Trusted Sources policy Correct answer.
  3. A hash list that the admin uploads weekly
  4. A reboot-required allowlist

Explanation

Trusted Sources policies in EPM let you auto-trust applications signed by an approved publisher (for example, the certificate subject 'Adobe Inc.'). Any signed binary from that publisher is recognized as trusted on first execution, which dramatically reduces day-one allowlisting work and eliminates the need for the admin to maintain a hash list manually.

Question 20Endpoint privilege, application rules and controlled deployment

An admin wants to roll out a new application-control rule but is worried about breaking users on day one. Which EPM mode lets the agent log what would have happened without actually blocking?

  1. Block (Restrict) mode
  2. Detect (Audit) mode Correct answer.
  3. Quarantine mode
  4. Stealth mode

Explanation

Setting the policy to Detect (audit) mode lets EPM log every event the rule would have acted on without blocking the user. Admins use Detect mode during pilot phases to gather data, tune Application Groups, and then flip the policy to Block once they are confident the rule will not break legitimate workflows.

Question 21Endpoint privilege, application rules and controlled deployment

Which EPM permitted action is best suited for an unknown application during a pilot rollout - letting it run while still capturing telemetry for later review?

  1. Block
  2. Allow as admin
  3. Monitor (allow + audit) Correct answer.
  4. Request approval

Explanation

The 'Monitor' (allow + audit) action lets an unknown application run normally while EPM records every execution, parent process, hash, and signer to the event stream. Admins use Monitor during pilots to learn what users actually run before committing to Block, Elevate, or Request-approval rules.

Question 22Endpoint privilege, application rules and controlled deployment

An EPM policy can match an application by its command-line parameters. Why is this useful?

  1. It saves disk space on the endpoint
  2. It allows distinguishing safe vs dangerous uses of the same binary (for example, allowing rundll32.exe to load only specific DLLs) Correct answer.
  3. It is required for the agent to install
  4. It rotates application certificates

Explanation

Many living-off-the-land attacks abuse signed Microsoft binaries (rundll32.exe, regsvr32.exe, mshta.exe) by passing malicious arguments. EPM can match an Application Group on the binary plus its command-line parameters, so the same executable can be allowed for one argument set and blocked for another - closing a major LOLBin gap that simple allowlisting cannot.

Question 23Endpoint privilege, application rules and controlled deployment

Which EPM construct provides a quick out-of-the-box baseline policy that removes local admin rights and protects credentials with minimal configuration?

  1. Default policies (QuickStart): Privilege Threat Protection and Application Control Correct answer.
  2. Manual blank policy
  3. Set Manager backup policy
  4. Linux sudoers default

Explanation

EPM ships default (QuickStart) policies - most notably for Privilege Threat Protection and Application Control - that an admin can activate on a Computer Set with minimal tuning. They immediately remove local admin rights, defend credentials, and protect against ransomware so the organization gets day-one value without weeks of authoring.

Question 24Endpoint privilege, application rules and controlled deployment

Which permitted action will silently allow an application to run as a standard (non-elevated) process while still being recorded in the events stream?

  1. Allow as admin
  2. Allow Correct answer.
  3. Request approval
  4. Block

Explanation

The 'Allow' permitted action lets the application run with the standard user's existing token (no elevation) and records the event. This is the right action when the program does not need admin rights but you still want it explicitly permitted so you can audit who launched it.

Question 25Endpoint privilege, application rules and controlled deployment

Which Application Group identifier should an admin use when they want to allow a software vendor's auto-updater to drop new versions of an application without re-authoring the policy each release?

  1. Single SHA-256 hash for the current version
  2. Publisher (signing certificate) match with the vendor's subject Correct answer.
  3. File path equal to a temp folder
  4. Last-modified date earlier than today

Explanation

Matching by publisher (the vendor's code-signing certificate subject) automatically covers every signed version the vendor ships, so the policy keeps working when the auto-updater installs a new build. Hash matching would require the admin to add a new hash for every release.

Question 26Endpoint privilege, application rules and controlled deployment

An EPM admin selects 'Detect' for a new Application Control rule. What does the user experience?

  1. The application is blocked silently
  2. The user is prompted for a justification
  3. The application runs as it would have without the rule, but EPM records what would have happened Correct answer.
  4. The endpoint is rebooted

Explanation

In Detect mode the rule is fully evaluated and logged to the EPM events stream, but no enforcement action is taken - the user runs the app normally and never sees a prompt. This lets the admin gather real-world data before flipping the rule to Block or Restrict.

Question 27Endpoint privilege, application rules and controlled deployment

Which signature-related Application Group identifier matches an executable based on its digital code-signing certificate's signer name (e.g., 'Mozilla Corporation')?

  1. Path
  2. Hash
  3. Publisher Correct answer.
  4. Source URL

Explanation

'Publisher' is the Application Group identifier that matches against the subject of the file's code-signing certificate (e.g., 'Mozilla Corporation', 'Microsoft Corporation'). It is one of the most common and durable identifiers because it survives application updates as long as the vendor signs new builds with the same certificate.

Question 28Endpoint privilege, application rules and controlled deployment

What does the Application Group 'Source' identifier let an admin match on?

  1. Source code repository
  2. Where the file was downloaded from (download URL or origin host) Correct answer.
  3. The user who installed the file
  4. The CPU architecture of the file

Explanation

The 'Source' identifier matches files based on the origin from which they were downloaded (browser-tracked URL or origin host). EPM uses this to enforce decisions like 'allow installers downloaded from approved corporate update servers, block ones from random external URLs.'

Question 29Endpoint privilege, application rules and controlled deployment

Why is matching by file path alone considered the WEAKEST Application Group identifier?

  1. Paths are case-sensitive on Windows
  2. An attacker can rename or drop a malicious binary at the same path Correct answer.
  3. Paths consume too much bandwidth
  4. Paths are not supported on macOS

Explanation

A path identifier matches whatever binary happens to live at that location. An attacker who can write to that folder can replace the trusted binary with malware and the policy will still match - leading to silent execution, often as administrator. That is why CyberArk recommends combining path with hash or publisher whenever possible.

Question 30Endpoint privilege, application rules and controlled deployment

Which scenario is an example of EPM Trusted Sources working correctly?

  1. An app downloaded from an unknown phishing site is auto-allowed because the path is C:\Users
  2. A signed Adobe Reader update from Adobe Inc. is auto-trusted because Adobe is configured as a trusted publisher Correct answer.
  3. A user runs cmd.exe and gets local admin permanently
  4. All ZIP files are extracted as administrator

Explanation

Trusted Sources auto-trusts applications signed by an approved publisher (or coming from an approved update channel). A signed Adobe Reader update from 'Adobe Inc.' qualifies, runs without prompts, and avoids manual policy maintenance for every Adobe binary. The other choices show what Trusted Sources is NOT.

Question 31Endpoint privilege, application rules and controlled deployment

Which EPM Application Control posture is generally recommended for high-risk endpoints (like jump hosts) once policies are mature?

  1. Default allow with a small block list
  2. Default deny - only known trusted applications can run; everything else is blocked or requires approval Correct answer.
  3. No policy at all
  4. Detect mode forever

Explanation

On high-risk endpoints, mature EPM deployments move to a default-deny Application Control posture: only trusted applications (matched by hash, publisher, source, etc.) are allowed to execute, and anything else is blocked or routed to an approval queue. This is the strongest defense against unknown malware.

Question 32Endpoint privilege, application rules and controlled deployment

An EPM admin wants to allow installations from the corporate software-distribution share (\\\\sccm\\dist) but block installs from random user-writable folders. Which Application Group identifier is BEST?

  1. Hash of every installer (manual, ongoing)
  2. Path matching the corporate share, paired with publisher matching for the vendors involved Correct answer.
  3. Last-modified date is today
  4. Title bar text

Explanation

Combining a path identifier (the corporate share) with publisher matching (the actual vendor signers) gives both location-based scope and cryptographic confidence. This way an attacker who manages to write to user folders is not auto-trusted, and an attacker who writes to the share but does not have a valid signer cert is also not auto-trusted.

Question 33Endpoint privilege, application rules and controlled deployment

Which is the BEST description of the relationship between Application Groups and Policies in EPM?

  1. Application Groups are policies
  2. Policies define an action (allow, elevate, block, request, monitor) that is taken against members of one or more Application Groups Correct answer.
  3. Application Groups can only be used by Trusted Sources
  4. Policies cannot reference Application Groups

Explanation

Application Groups are the WHAT (which apps), Policies are the action against that what (allow, elevate, block, request approval, monitor). Decoupling the two means the same Application Group can be used by multiple policies on multiple Computer Sets without redefining it.

Question 34Endpoint privilege, application rules and controlled deployment

An EPM admin notices the same legitimate app keeps generating end-user approval prompts. What is the most appropriate tuning step?

  1. Block the app permanently
  2. Move the app from 'Request approval' into a Trusted Sources / auto-elevate rule once verified Correct answer.
  3. Uninstall the EPM agent
  4. Delete all events

Explanation

Repeated prompts for a verified-safe app are a tuning signal. Promote the app from Request Approval into an explicit Allow / Allow as admin or Trusted Sources rule so it runs without further prompting. That preserves productivity and reduces help-desk load while keeping the audit trail intact.

Question 35Endpoint privilege, application rules and controlled deployment

Which Application Group identifier is the WEAKEST against an attacker who can write to any folder where the trusted binary is normally stored?

  1. Path only Correct answer.
  2. SHA-256 hash
  3. Publisher (signer)
  4. Source URL

Explanation

Path-only matching is bypassed the moment an attacker can drop their own binary at the trusted path. Hash, publisher, and source identifiers all add cryptographic or origin checks that are far harder to defeat - which is why CyberArk recommends combining path with at least one of those.

Question 36Endpoint privilege, application rules and controlled deployment

Which is a valid reason to keep an Application Control policy in 'Detect' mode for an extended pilot?

  1. To collect data on legitimate but undocumented applications before flipping the rule to Block Correct answer.
  2. To make the agent stop reporting events
  3. To delete the agent's local cache
  4. To disable the SaaS console

Explanation

Detect mode is the canonical pilot technique: it collects events on what would have been blocked so admins can see the legitimate apps the rule would have caught, build the right exceptions or Trusted Sources entries, and then flip to Block with confidence. Skipping that pilot is a common cause of user-visible breakage on day one.

Question 37Endpoint privilege, application rules and controlled deployment

What is the primary reason EPM exposes a 'Monitor' (allow + audit) action in addition to 'Allow'?

  1. Monitor explicitly marks the event as one to keep visible during tuning, separating intentionally-watched apps from generally-allowed ones Correct answer.
  2. Monitor blocks the application
  3. Monitor uninstalls the application
  4. Monitor prompts for an approver

Explanation

Monitor lets admins explicitly flag certain apps as 'allowed but worth watching closely' during tuning or risk-assessment. The events are surfaced separately from generic allows, which makes review and follow-up tuning easier. Both Monitor and Allow let the app run; Monitor just adds intentional visibility.

Question 38Endpoint privilege, application rules and controlled deployment

Which EPM concept lets a software vendor's installer be auto-trusted when downloaded via the corporate web-update channel but blocked when sourced from a random URL?

  1. Source identifier in an Application Group, used in a Trusted Sources / Privilege Elevation policy Correct answer.
  2. Hash identifier only
  3. QualysGuard
  4. Help-desk dialog branding

Explanation

The Source identifier in an Application Group lets the policy condition on origin (download URL or origin host). Combine that with a Trusted Sources / Privilege Elevation policy and the same installer can be auto-trusted from the approved corporate update channel and rejected when downloaded from anywhere else.

Question 39Endpoint privilege, application rules and controlled deployment

An admin needs to be sure a specific build of an internal homegrown installer is treated as trusted. Which Application Group identifier guarantees only that exact build matches?

  1. File path
  2. SHA-256 hash Correct answer.
  3. File extension
  4. Last-modified date

Explanation

A SHA-256 hash uniquely identifies a single build's bytes. Adding that hash to the Application Group ensures only that exact build matches the policy. When a new build is produced, the admin updates the hash entry - preserving cryptographic certainty across releases.

Question 40Endpoint privilege, application rules and controlled deployment

Which control would an admin use FIRST to reduce day-one user friction during EPM rollout while still gathering data?

  1. Default deny everywhere immediately
  2. Detect (audit) mode on Application Control plus Trusted Sources for major signed publishers, with Privilege Elevation only for known legacy apps Correct answer.
  3. Disable the agent
  4. Block all Microsoft binaries

Explanation

A balanced rollout starts with Application Control in Detect mode (so nothing is blocked during the learning phase), Trusted Sources entries for major signed publishers (so common updates run silently), and a small set of Privilege Elevation rules for known legacy apps. This minimizes user disruption while collecting data to tune toward Block later.

Question 41Endpoint privilege, application rules and controlled deployment

Which Application Group identifier combination provides the BEST balance of strength and operational sustainability for a frequently updated, vendor-signed application like Google Chrome?

  1. Publisher (Google LLC) - keeps working across version updates as long as the signing cert is unchanged Correct answer.
  2. Single hash for the current version only
  3. Path C:\Users with no other identifier
  4. Last-modified date filter

Explanation

Frequently-updated vendor apps are best matched by publisher (the signer's certificate subject). The policy keeps working across every signed update without admin intervention. Hash matching forces the admin to update the rule for every Chrome release; path or date alone are insufficient.

Question 42Endpoint privilege, application rules and controlled deployment

In the supplied traditional EPM teaching model, which listed application-policy action concept grants an approved program elevation without requiring the ordinary user to enter an administrator password?

  1. A Threat Protection policy
  2. A Privilege Elevation policy with action 'Allow as admin' (auto-elevate) Correct answer.
  3. A Trusted Sources policy with action 'Detect only'
  4. An Application Control policy with action 'Block'

Explanation

A suitably configured application-elevation policy can allow an approved task to run with the required privilege without disclosing an administrator credential to the ordinary user. Actual action names, prompts and account requirements depend on the version and configuration; this does not assert that no administrator account exists on the endpoint.

Question 43Endpoint privilege, application rules and controlled deployment

Which EPM feature lets a Linux administrator replace a sprawling and risky sudoers file with a centrally managed policy that grants temporary command-level elevation?

  1. EPM Linux agent with policy-driven privilege elevation (sudo replacement) Correct answer.
  2. PAM Vault credential rotation
  3. Conjur secrets retrieval
  4. EPM Set Manager backup

Explanation

On Linux endpoints, the EPM agent enforces command-level privilege elevation policies that effectively replace per-host sudoers files. Admins centrally define which users can run which commands as root (and under which conditions), and the policy is applied uniformly across the Linux fleet - every elevation event is also audited back to the EPM console.

Question 44Endpoint privilege, application rules and controlled deployment

An EPM admin wants to remove permanent local-admin group membership from end users but still allow them to perform admin tasks for short, audited windows. Which capability addresses this?

  1. Just-In-Time (JIT) elevation Correct answer.
  2. Permanent Trusted Source
  3. Default deny mode
  4. Detection-only mode

Explanation

Just-In-Time (JIT) elevation removes standing local-admin rights and grants admin permissions only for a limited, time-bounded window when the user actually needs them. Every JIT elevation is logged and tied to a specific reason. This shrinks the standing privilege footprint that attackers love to abuse.

Question 45Endpoint privilege, application rules and controlled deployment

Which EPM concept directly enables an admin to grant a single command (for example, 'install Adobe Reader once') as administrator without granting full admin rights to the user?

  1. On-Demand Privileges (per-application elevation token) Correct answer.
  2. Default deny mode
  3. Splunk integration
  4. Set Manager

Explanation

On-Demand Privileges let EPM elevate a specific application or command on demand - the user does not become a local administrator, only the targeted process gets the elevated token for that single execution. This is the day-to-day way to satisfy 'I just need to install this one tool' requests without giving away standing admin rights.

Question 46Endpoint privilege, application rules and controlled deployment

Which approach best implements least privilege for everyday users on Windows endpoints with EPM?

  1. Add every user to the local Administrators group
  2. Remove standing local admin membership and use Privilege Elevation policies to grant rights only when specific trusted apps need them Correct answer.
  3. Disable EPM during installs
  4. Allow all signed apps as admin

Explanation

Least privilege on Windows means standard-user tokens by default, with EPM's Privilege Elevation policies promoting specific trusted apps to admin only when needed. This shrinks the standing privilege footprint dramatically while keeping the user productive - the core EPM value proposition.

Question 47Endpoint privilege, application rules and controlled deployment

Which EPM concept is most directly aligned with the Zero Trust principle of removing standing privilege?

  1. Just-In-Time (JIT) elevation + On-Demand Privileges Correct answer.
  2. Default allow Application Control
  3. Disabled agent on developer workstations
  4. Local administrator group everywhere

Explanation

JIT elevation and On-Demand Privileges shrink standing administrative rights to zero - users only get admin rights for a specific app or window when they actually need them, and the elevation is logged. That maps directly to the Zero Trust mandate to minimize standing privilege.

Question 48Endpoint privilege, application rules and controlled deployment

What can an EPM admin do if a critical legacy application crashes when run with the standard user token but works correctly when run as admin?

  1. Delete the application
  2. Build a Privilege Elevation policy that auto-elevates that application for the affected users Correct answer.
  3. Tell users to install another OS
  4. Permanently grant local admin to all users

Explanation

A targeted Privilege Elevation policy with the 'Allow as admin' action will silently run the legacy app with elevated rights for the impacted users - preserving productivity without granting them standing local-admin rights. This is the canonical EPM answer to 'works only as admin' legacy software.

Question 49Endpoint privilege, application rules and controlled deployment

What does enabling 'On-Demand Privileges' in a policy do for an end user?

  1. Permanently adds the user to local Administrators
  2. Lets the user invoke a specific app/command as administrator from the right-click menu (or CLI), with each invocation logged Correct answer.
  3. Gives the user access to the EPM admin console
  4. Disables Windows Defender

Explanation

On-Demand Privileges expose a 'Run with EPM elevation' style action (often via the right-click menu or a CLI helper) for permitted commands. Each launch is recorded. The user never gains standing admin rights - only the targeted process gets the elevated token.

Question 50Endpoint privilege, application rules and controlled deployment

Which is the BEST practice for managing service accounts that are required to run a legacy app on Windows endpoints?

  1. Use a local admin service account on every endpoint and forget about it
  2. Use EPM to elevate the legacy app via Privilege Elevation policy, while keeping the service account password vaulted/rotated by PAM Correct answer.
  3. Embed the service account password in the application binary
  4. Share the same password across all endpoints with no rotation

Explanation

EPM solves the endpoint half of the problem (the legacy app gets the privilege it needs without making humans local admins) while PAM solves the credential half (the underlying service account is vaulted, rotated, and only released to the app or user when needed). Together they avoid embedded passwords and shared credentials.