I85PREP
⌘ K
CyberArk PAM-DEF study materials
CyberArk PAM-DEF study resources

CyberArk PAM-DEF practice questions

One question at a time. Build your CyberArk PAM-DEF understanding.

First 50 of 199 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Privileged Access Management (PAM)

In CyberArk PAM, what is the primary purpose of the Digital Vault?

  1. To broker RDP sessions between users and target servers
  2. To synchronize passwords with Active Directory
  3. To record keystroke logs of privileged sessions
  4. To store and protect privileged account credentials in an encrypted repository Correct answer.

Explanation

The Digital Vault is the hardened, encrypted storage layer that holds privileged account objects, files, and their metadata. Session brokering, recording, and directory synchronization are handled by other PAM components that interact with the Vault.

Question 2Privileged Access Management (PAM)

Which CyberArk component is responsible for automatically changing and verifying privileged account passwords according to policy?

  1. CyberArk Password Vault
  2. Central Policy Manager Correct answer.
  3. Privileged Session Manager
  4. Password Vault Web Access

Explanation

The Central Policy Manager (CPM) executes password management policies, rotating and reconciling credentials on target systems. It applies the platform settings defined for each managed account.

Question 3Privileged Access Management (PAM)

A security team wants administrators to connect to Unix servers through CyberArk without exposing the target's root password. Which capability enables this?

  1. Central Policy Manager password rotation
  2. Automatic detection of privileged accounts
  3. Privileged Session Manager with connection components Correct answer.
  4. Dual control authorization on the safe

Explanation

PSM can inject credentials on behalf of the user so the actual password is never revealed, using connection components to launch the session. This provides privileged access without disclosing secrets.

Question 4Privileged Access Management (PAM)

In CyberArk, what is a Safe?

  1. A logical container that holds accounts and defines who may access them Correct answer.
  2. A network segment isolating the Vault server
  3. A physical hardware security module storing vault keys
  4. A backup file of the vault database

Explanation

A Safe is an authorization container in the Vault that groups privileged accounts and objects and carries the permissions assigned to users and groups. Access to accounts is granted through Safe membership and authorization levels.

Question 5Privileged Access Management (PAM)

Which authorization level on a Safe allows a user to retrieve and use the password of an account stored there?

  1. Use accounts
  2. Manage Safe
  3. List accounts
  4. Retrieve accounts Correct answer.

Explanation

The Retrieve accounts authorization permits a user to view and retrieve the credentials of accounts in the Safe. Use accounts allows connecting through PSM without seeing the password, while List accounts only shows account names.

Question 6Privileged Access Management (PAM)

What does the Master Policy in CyberArk primarily govern?

  1. The layout of the PVWA dashboard for each user
  2. The naming convention for newly discovered accounts
  3. The network ports used by the CPM to reach targets
  4. Vault-wide rules such as password change and dual control requirements Correct answer.

Explanation

The Master Policy defines enterprise-wide rules applied across Safes, including password management, dual control, and session recording requirements. Individual Safes cannot weaken these enforced settings.

Question 7Privileged Access Management (PAM)

An administrator needs to require that two authorized users approve a password retrieval before it is released. Which feature accomplishes this?

  1. One-time password access
  2. Exclusive access
  3. Dual control Correct answer.
  4. Ticketing integration

Explanation

Dual control requires a second authorized approver to confirm a request before the credential is released to the requester. It is configured through the Master Policy and Safe settings.

Question 8Privileged Access Management (PAM)

Which platform setting determines how often the CPM attempts to change an account's password?

  1. Password change interval defined in the platform policy Correct answer.
  2. Safe membership refresh rate
  3. PVWA idle timeout
  4. Session recording retention period

Explanation

Password management behavior, including the rotation interval, is defined in the platform's password management settings. The CPM applies these settings to accounts associated with the platform.

Question 9Privileged Access Management (PAM)

A user connects to a Windows server through PSM. Where is the recorded session typically stored?

  1. In the user's local browser cache
  2. In the CPM's temporary working directory
  3. In the Vault as a PSM recording object Correct answer.
  4. On the target server's event log

Explanation

PSM recordings are saved as objects within the Vault, where they can be retrieved and reviewed by authorized auditors. They are not stored on the target or client machine.

Question 10Privileged Access Management (PAM)

What is the role of the Password Vault Web Access (PVWA) in a CyberArk deployment?

  1. It provides the browser-based interface for requesting, approving, and connecting to accounts Correct answer.
  2. It performs automatic discovery of privileged accounts
  3. It rotates credentials on target systems
  4. It stores the encrypted credentials on disk

Explanation

PVWA is the web front end through which users request access, approve workflows, and launch PSM connections. The underlying storage and rotation are handled by the Vault and CPM.

Question 11Privileged Access Management (PAM)

Which CyberArk concept links an account to the set of rules that define how it is managed, including connection and rotation behavior?

  1. Platform Correct answer.
  2. Vault tier
  3. User group
  4. Safe

Explanation

A platform bundles the policies and settings that govern how accounts of a given type are managed, such as password rotation and connection components. Each managed account is associated with one platform.

Question 12Privileged Access Management (PAM)

An organization wants to onboard privileged accounts discovered on a network segment automatically. Which CyberArk capability supports this?

  1. Session isolation
  2. Dual control approval
  3. Account discovery and automatic onboarding Correct answer.
  4. Password reconciliation

Explanation

CyberArk discovery scans specified systems for privileged accounts and can automatically onboard them into Safes with an assigned platform. This reduces manual account creation.

Question 13Privileged Access Management (PAM)

What does password reconciliation accomplish in CyberArk?

  1. It synchronizes the account password with a ticketing system
  2. It verifies whether the password stored in the Vault matches the actual password on the target Correct answer.
  3. It resets the account to a default password
  4. It forces a password change on the next login

Explanation

Reconciliation checks the stored credential against the target system and flags or corrects drift. This ensures the Vault's copy remains usable for automated and brokered access.

Question 14Privileged Access Management (PAM)

Which feature allows a user to check out an account so that no other user can access it until it is checked back in?

  1. Dual control
  2. Session recording
  3. One-time password
  4. Exclusive access Correct answer.

Explanation

Exclusive access locks the account to a single user for the duration of the checkout, preventing concurrent use. The lock is released when the account is checked back in.

Question 15Privileged Access Management (PAM)

What is the purpose of a Vault's server key in CyberArk?

  1. It authenticates PVWA users against Active Directory
  2. It authorizes CPM connections to targets
  3. It encrypts the Vault data and must be protected during backup and recovery Correct answer.
  4. It signs PSM session recordings

Explanation

The server key protects the encrypted Vault data and is required to restore or recover the Vault. Loss of the server key renders backups unusable.

Question 16Privileged Access Management (PAM)

Which CyberArk component or configuration is required for users to connect through PSM to target systems without ever seeing the password?

  1. A CPM plugin for the target platform
  2. A directory mapping rule
  3. A Safe with the Retrieve accounts authorization
  4. A PSM connection component configured for the target platform Correct answer.

Explanation

Connection components define how PSM launches sessions to a given platform and inject credentials. They enable brokered access without disclosing the password to the user.

Question 17Privileged Access Management (PAM)

An auditor needs to review a recorded privileged session. Which authorization on the relevant Safe or recording location would allow viewing the recording?

  1. Use accounts
  2. Manage Safe
  3. Audit Safe permissions for the recording Correct answer.
  4. List accounts

Explanation

Reviewing recordings requires audit-level access to the Safe or location where recordings are stored. This is separate from the permissions needed to use the underlying account.

Question 18Privileged Access Management (PAM)

What is the primary function of a CPM in relation to platforms?

  1. It provides the web interface to edit platforms
  2. It stores platform definitions in the Vault
  3. It defines the connection components for each platform
  4. It executes the password management settings defined in each platform Correct answer.

Explanation

The CPM reads platform settings and performs the resulting actions, such as changing and verifying passwords. Platform definitions themselves are configured and stored separately.

Question 19Privileged Access Management (PAM)

Which of the following best describes the difference between 'Use accounts' and 'Retrieve accounts' authorizations?

  1. Both allow viewing the password but differ in audit logging
  2. Use accounts applies to Safes; Retrieve accounts applies to platforms
  3. Use accounts allows connecting without viewing the password; Retrieve accounts allows viewing it Correct answer.
  4. Use accounts allows viewing the password; Retrieve accounts allows connecting only

Explanation

Use accounts permits launching a session through PSM without revealing the credential, while Retrieve accounts permits displaying the password to the user. This distinction supports least-privilege access design.

Question 20Privileged Access Management (PAM)

What does the CyberArk Master Policy's 'dual control' setting enforce when enabled for a Safe?

  1. The password must be changed after every retrieval
  2. Accounts must be checked out exclusively
  3. A second authorized user must approve a request before access is granted Correct answer.
  4. Sessions must be recorded for all users

Explanation

Dual control enforces a second-person approval step for access requests governed by the policy. It is designed to prevent unilateral access to sensitive credentials.

Question 21Privileged Access Management (PAM)

A CyberArk deployment uses a Primary Vault and a Disaster Recovery Vault. What is the primary purpose of the DR Vault?

  1. To provide a replicated copy of Vault data for recovery if the Primary fails Correct answer.
  2. To rotate passwords when the CPM is offline
  3. To load-balance PVWA user sessions
  4. To store PSM recordings separately from credentials

Explanation

The DR Vault maintains a replicated copy of the Vault data so operations can be restored if the Primary Vault becomes unavailable. It is a resilience measure, not a performance or rotation component.

Question 22Privileged Access Management (PAM)

Which statement best describes how CyberArk enforces least privilege for privileged account access?

  1. Users receive access only to the Safes and accounts their role requires, with authorizations scoped accordingly Correct answer.
  2. Passwords are emailed to users on request
  3. All administrators share a single master account for simplicity
  4. Access is granted by default and audited afterward

Explanation

CyberArk grants access through Safe membership and specific authorizations, so users only reach the accounts their role needs. This scoping, combined with approval and auditing, supports least privilege.

Question 23Privileged Access Management (PAM)

What is the purpose of a directory mapping in CyberArk?

  1. To map target servers to CPM plugins
  2. To link platforms to connection components
  3. To map recordings to retention policies
  4. To associate directory users or groups with Vault users or Safes for authentication and access Correct answer.

Explanation

Directory mappings link identities from an external directory to Vault users and Safe memberships, enabling centralized authentication and authorization. This lets organizations manage access through their existing directory groups.

Question 24Privileged Access Management (PAM)

An account is configured with a platform whose password change fails repeatedly. Which component's logs would an administrator most likely review first to diagnose the rotation failure?

  1. The PVWA web server access logs
  2. The CPM logs for the relevant platform Correct answer.
  3. The directory synchronization logs
  4. The PSM session recording index

Explanation

The CPM performs password changes, so its logs record the attempts and errors for rotation failures. Reviewing them reveals connectivity, permission, or plugin issues on the target.

Question 25Privileged Access Management (PAM)

Which of the following is a valid reason to use a one-time password in CyberArk?

  1. To require a second approver for access
  2. To ensure a credential cannot be reused after a checkout Correct answer.
  3. To synchronize the account with a directory
  4. To record the session for audit

Explanation

One-time password mode changes the credential after use so the checked-out value cannot be reused later. This limits the window in which an exposed password is useful.

Question 26Privileged Access Management (PAM)

Which CyberArk component is responsible for automatically changing passwords of privileged accounts according to a defined schedule?

  1. Password Vault Web Access (PVWA)
  2. Privileged Session Manager (PSM)
  3. Central Policy Manager (CPM) Correct answer.
  4. Vault

Explanation

The CPM enforces password rotation and reconciliation based on platform settings and Master Policy. It runs automated tasks to change credentials on target systems. The PVWA is the web interface, PSM proxies sessions, and the Vault stores secrets.

Question 27Privileged Access Management (PAM)

What is the primary purpose of a Safe in CyberArk?

  1. To provide a web interface for users
  2. To record privileged sessions
  3. To serve as a logical container for privileged accounts and their permissions Correct answer.
  4. To define the password policy for all accounts

Explanation

A Safe is a container that holds accounts, files, and other objects, and it is where authorizations are assigned to users and groups. It does not define global password policy; that is done via platforms and the Master Policy. Session recording is a PSM function, and the web interface is PVWA.

Question 28Privileged Access Management (PAM)

Which authorization allows a user to initiate a connection through PSM to a target system using an account stored in a Safe?

  1. Retrieve accounts
  2. Use accounts Correct answer.
  3. List accounts
  4. Connect

Explanation

The 'Use accounts' authorization permits a user to connect to a target system through PSM without seeing the password. 'Retrieve accounts' allows viewing the password, and 'List accounts' only shows the account exists. 'Connect' is not a standard Safe authorization.

Question 29Privileged Access Management (PAM)

What does the Master Policy determine in a CyberArk environment?

  1. The set of rules that govern privileged account management, such as dual control and exclusive access Correct answer.
  2. The network ports used by the Vault
  3. The schedule for CPM password changes
  4. The layout of the PVWA dashboard

Explanation

The Master Policy defines global rules like dual control, exclusive access, and session recording requirements. It does not set CPM schedules (those are in platform settings) or network or UI configurations.

Question 30Privileged Access Management (PAM)

Which CyberArk component stores and encrypts the digital secrets in a deployment?

  1. Privileged Session Manager (PSM)
  2. Password Vault Web Access (PVWA)
  3. Central Policy Manager (CPM)
  4. Vault Correct answer.

Explanation

The Vault is the secure repository that stores and encrypts all secrets. PVWA is the web interface, CPM manages password changes, and PSM handles session brokering.

Question 31Privileged Access Management (PAM)

What is the function of a platform in CyberArk?

  1. To define how a specific type of account is managed, including password rotation and connection settings Correct answer.
  2. To store audit logs of user activities
  3. To provide a graphical user interface for administrators
  4. To enable high availability of the Vault

Explanation

A platform is a set of policies and settings that tell CyberArk how to manage accounts of a particular type, such as Windows domain admin or Oracle database. It includes password change methods, connection components, and other parameters. It does not provide UI, store logs, or ensure Vault HA.

Question 32Privileged Access Management (PAM)

Which of the following best describes the purpose of a one-time password in CyberArk?

  1. To automatically rotate the password after each use
  2. To provide a temporary password that is valid for a single session or use Correct answer.
  3. To allow a user to log in to the PVWA without a password
  4. To enable dual control for password retrieval

Explanation

A one-time password is a temporary credential that can be used only once, often for a specific session or retrieval. It reduces the risk of password exposure. It is not used for PVWA login, dual control, or automatic rotation.

Question 33Privileged Access Management (PAM)

What is the primary role of the Password Vault Web Access (PVWA) in a CyberArk deployment?

  1. To record and audit privileged sessions
  2. To automatically change passwords on target systems
  3. To provide a web interface for users to manage and access privileged accounts Correct answer.
  4. To store and encrypt the digital vault

Explanation

PVWA is the web-based user interface that allows users to request, retrieve, and manage accounts according to their permissions. It does not perform automated password changes (CPM), record sessions (PSM), or store the vault (Vault).

Question 34Privileged Access Management (PAM)

Which CyberArk feature allows an administrator to define which users can access specific accounts based on their role in Active Directory groups?

  1. Dual control
  2. Password reconciliation
  3. Directory mapping Correct answer.
  4. Exclusive access

Explanation

Directory mapping links CyberArk Safe authorizations to existing directory groups, so users inherit permissions based on their group membership. Dual control and exclusive access are Master Policy rules, and reconciliation ensures password consistency.

Question 35Privileged Access Management (PAM)

An organization wants to ensure that a privileged account's password is changed immediately after a user checks it in. Which configuration should they adjust?

  1. The Safe's authorized users list
  2. The platform's password change schedule Correct answer.
  3. The Vault's server key rotation period
  4. The Master Policy's dual control setting

Explanation

The platform settings include the CPM password change schedule, which can be set to trigger a change upon check-in. Dual control affects approvals, Safe users affect access, and server key rotation is unrelated.

Question 36Privileged Access Management (PAM)

What is the effect of enabling the 'Exclusive access' setting in the Master Policy?

  1. It automatically changes the password after each use.
  2. It requires two users to approve access to an account.
  3. It prevents a user from accessing an account if another user is currently connected. Correct answer.
  4. It logs all sessions for auditing.

Explanation

Exclusive access ensures that only one user can use an account at a time, preventing concurrent sessions. Dual control requires approvals, password changes are handled by CPM, and session logging is a PSM feature.

Question 37Privileged Access Management (PAM)

An administrator needs to ensure that all privileged sessions to a Windows server are recorded. Which CyberArk component must be configured?

  1. Password Vault Web Access (PVWA)
  2. Vault
  3. Privileged Session Manager (PSM) Correct answer.
  4. Central Policy Manager (CPM)

Explanation

PSM is responsible for brokering and recording privileged sessions. The CPM manages passwords, PVWA is the interface, and the Vault stores data.

Question 38Privileged Access Management (PAM)

Which of the following best describes the difference between 'List accounts' and 'Retrieve accounts' authorizations?

  1. List accounts allows viewing the password; Retrieve accounts allows connecting via PSM.
  2. List accounts allows editing account properties; Retrieve accounts allows deleting the account.
  3. List accounts allows connecting via PSM; Retrieve accounts allows viewing the password.
  4. List accounts allows viewing account properties; Retrieve accounts allows viewing the password. Correct answer.

Explanation

'List accounts' permits a user to see that an account exists and view its properties, while 'Retrieve accounts' permits viewing the actual password. Connecting via PSM requires 'Use accounts', and editing/deleting are separate authorizations.

Question 39Privileged Access Management (PAM)

An organization wants to automatically onboard privileged accounts discovered on a network segment. Which CyberArk capability should they use?

  1. Automatic discovery and onboarding Correct answer.
  2. Password Vault Web Access (PVWA)
  3. Privileged Session Manager (PSM)
  4. Central Policy Manager (CPM)

Explanation

CyberArk's discovery and onboarding feature scans the network for privileged accounts and can automatically onboard them into the Vault. PSM, PVWA, and CPM do not perform discovery.

Question 40Privileged Access Management (PAM)

Which authorization is required for a user to view the password of an account in a Safe?

  1. List accounts
  2. Connect
  3. Retrieve accounts Correct answer.
  4. Use accounts

Explanation

'Retrieve accounts' allows a user to view the password. 'Use accounts' allows connecting via PSM without viewing, 'List accounts' only shows the account exists, and 'Connect' is not a standard authorization.

Question 41Privileged Access Management (PAM)

What is the primary purpose of a Disaster Recovery (DR) Vault in a CyberArk deployment?

  1. To store session recordings
  2. To perform password changes when the Primary Vault is unavailable
  3. To provide a backup Vault that can be used if the Primary Vault fails Correct answer.
  4. To provide a web interface for users

Explanation

A DR Vault is a replica of the Primary Vault that can be activated in case of failure, ensuring high availability. It does not store session recordings (that's the Vault's role), perform password changes (CPM), or provide a web interface (PVWA).

Question 42Privileged Access Management (PAM)

An administrator needs to configure a platform to use a specific connection component for PSM sessions. Where is this configured?

  1. In the Master Policy
  2. In the Safe's properties
  3. In the platform's connection settings Correct answer.
  4. In the Vault's server key

Explanation

Connection components are defined in the platform settings, which specify how PSM connects to target systems. The Master Policy, Safe properties, and server key do not control connection components.

Question 43Privileged Access Management (PAM)

What is the purpose of the 'Dual control' setting in the Master Policy?

  1. To require two passwords for account login
  2. To require two authorized users to approve access to an account Correct answer.
  3. To allow two users to access an account simultaneously
  4. To encrypt data with two keys

Explanation

Dual control requires that two authorized users approve a request before an account can be accessed, adding an extra layer of security. It does not allow simultaneous access, require two passwords, or involve encryption keys.

Question 44Privileged Access Management (PAM)

Which of the following is a key benefit of using PSM for privileged access?

  1. It provides session isolation and recording without exposing credentials to the user. Correct answer.
  2. It replaces the need for a Vault.
  3. It eliminates the need for password rotation.
  4. It automatically discovers privileged accounts.

Explanation

PSM isolates sessions, records them, and can inject credentials without revealing them to the user, enhancing security and auditability. It does not eliminate password rotation, discover accounts, or replace the Vault.

Question 45Privileged Access Management (PAM)

An account is configured with a platform whose password change fails repeatedly. Which component's logs would an administrator primarily investigate?

  1. The PSM logs
  2. The PVWA logs
  3. The Vault logs
  4. The CPM logs Correct answer.

Explanation

The CPM is responsible for executing password changes, so its logs contain details about failures. PVWA logs relate to user interface actions, PSM logs to sessions, and Vault logs to Vault operations.

Question 46Privileged Access Management (PAM)

Which configuration ensures that a user cannot see the password when connecting to a target system through PSM?

  1. Granting only 'Use accounts' authorization on the Safe Correct answer.
  2. Granting only 'Retrieve accounts' authorization on the Safe
  3. Enabling dual control in the Master Policy
  4. Configuring exclusive access in the Master Policy

Explanation

'Use accounts' allows connecting via PSM without revealing the password, whereas 'Retrieve accounts' allows viewing the password. Dual control and exclusive access add approval or concurrency controls but do not hide the password.

Question 47Privileged Access Management (PAM)

What is the effect of setting the 'One-time password' property on an account in CyberArk?

  1. The password is automatically changed after each retrieval. Correct answer.
  2. The password can be used only once and then is invalidated.
  3. The password is never changed.
  4. The password is shared among multiple users.

Explanation

When one-time password is enabled, the CPM changes the password after each retrieval or check-in, so the password is valid for only one use. It is not about sharing, never changing, or being invalidated without change.

Question 48Privileged Access Management (PAM)

Which CyberArk authorization controls whether a user may create new accounts and store them inside a specific Safe?

  1. Delete accounts
  2. Manage Safe
  3. Add accounts Correct answer.
  4. Use accounts

Explanation

The Add accounts authorization on a Safe permits a user to create and store new account objects in that Safe. Use accounts governs launching or retrieving credentials for existing accounts, and Manage Safe governs Safe-level administration rather than account creation.

Question 49Privileged Access Management (PAM)

An administrator wants every privileged session to a Linux server to pass through the PSM without the connecting user ever seeing the target password. Which configuration combination accomplishes this?

  1. A PSM-based connection component on the platform plus an account whose password the user cannot retrieve Correct answer.
  2. A PVWA authentication method plus an account with one-time password enabled
  3. A Vault-level backup schedule plus a platform with automatic verification enabled
  4. A CPM-based password change policy plus a Safe with Dual control enabled

Explanation

Session isolation comes from routing the connection through a PSM connection component so the PSM supplies the credential to the target on the user's behalf. Combined with the user lacking Retrieve accounts on the Safe, the password never reaches the user.

Question 50Privileged Access Management (PAM)

A security team reports that a user can connect to a target through PSM but cannot see the account in the PVWA account list. Which authorization state best explains this?

  1. The user has Use accounts but lacks List accounts on the Safe Correct answer.
  2. The user has List accounts but lacks Use accounts on the Safe
  3. The user has Manage Safe but lacks Delete accounts on the Safe
  4. The user has Retrieve accounts but lacks Add accounts on the Safe

Explanation

List accounts governs visibility of accounts in the PVWA, while Use accounts governs the ability to connect through PSM. A user can therefore launch a session without the account appearing in their list, which indicates Use without List.