Free ACCESS-DEF sample questions

Correct answer: An Authentication Rule within the Authentication Policy

Authentication Rules are the core component for implementing adaptive MFA. An administrator can create a rule that specifies a condition, such as the source IP address not being in a predefined range, and then apply a specific Authentication Profile (e.g., one requiring FIDO2) when that condition is met. The default policy can be set to password-only, which would apply to all other conditions, including logins from the corporate IP range.

Correct answer: The laptop has no connection to the domain controller; Windows Device Trust needs the machine to be on the corporate network or connected through a VPN.

Windows Device Trust requires a domain-joined Windows computer, a tenant with IWA configured, and a connection to the domain controller (for example, inside the corporate network or connected through a VPN). A laptop at home without VPN cannot meet the domain controller connectivity requirement, so the device-trust check fails and access to apps that require a trusted device is denied. An expired enrollment code affects only new enrollments, not an already-enrolled laptop.

Correct answers: Setting an Authentication Policy at the application level for each cloud console app.; Creating a policy set assigned to the 'Cloud Admins' role whose authentication policy requires an MFA authentication profile.

Two documented mechanisms work. (1) App-level policy: each cloud console app has a Policy tab where you add authentication rules and profiles. For web-app access, a rule can use the Role filter (Cloud Admins), so MFA is required whenever those users launch AWS or Azure. (2) A policy set assigned to the 'Cloud Admins' role (policy sets can target all users or specified roles), placed above more general sets, applies its authentication policy (an MFA profile) to those users when they sign in to CyberArk Identity. The Role filter cannot be used in portal-login rules, policies are assigned to roles rather than individual accounts, and MFA Unlock temporarily suspends MFA instead of enforcing it.

Two documented mechanisms work. (1) App-level policy: each cloud console app has a Policy tab where you add authentication rules and profiles. For web-app access, a rule can use the Role filter (Cloud Admins), so MFA is required whenever those users launch AWS or Azure. (2) A policy set assigned to the 'Cloud Admins' role (policy sets can target all users or specified roles), placed above more general sets, applies its authentication policy (an MFA profile) to those users when they sign in to CyberArk Identity. The Role filter cannot be used in portal-login rules, policies are assigned to roles rather than individual accounts, and MFA Unlock temporarily suspends MFA instead of enforcing it.

Correct answer: False

The 'MFA Unlock' command is a temporary troubleshooting tool. It suspends the multi-factor authentication requirement for the selected user for a fixed duration, typically 10 minutes, to allow them to log in and resolve their MFA device issue. After the time expires, MFA is automatically re-enforced.

Correct answer: In the 'Account Mapping' section of the application settings.

In a CyberArk Identity SAML app, the NameID (subject) value is the login user name that the app's Account Mapping page produces (LoginUser.Username). By default the assertion script calls setSubjectName(LoginUser.Username). To send the UPN, set Account Mapping to use the directory service field userPrincipalName, or use an account mapping script. If the SP also requires a specific format, set ' Format' on the Trust page under Service Provider Configuration. The Identity Provider Configuration section holds only the IdP's entity ID, signing certificate and URLs.

Correct answer: Under Multiple Authentication Mechanisms, select Password for Challenge 1, and select Mobile Authenticator, Security Question(s), and OATH OTP Client for Challenge 2.

An authentication profile (Settings > Authentication > Add Profile) defines Multiple Authentication Mechanisms as Challenge 1 and Challenge 2. The user must pass both challenges and may choose any one of the mechanisms selected in each challenge column. Password in Challenge 1 plus Mobile Authenticator, Security Question(s) and OATH OTP Client in Challenge 2 gives a password followed by the user's choice of second factor. Mechanisms under Single Authentication Mechanism are each enough on their own and would bypass the two challenges. The same mechanism cannot be selected in both challenge menus, and a rule selects only one profile.

Correct answer: The CyberArk Identity Connector

The CyberArk Identity Connector is a required component that is installed on a Windows server within the corporate network. It acts as a secure proxy between the CyberArk Identity cloud tenant and the on-premises Active Directory. It is responsible for handling authentication requests and synchronizing users, groups, and OUs.

Correct answer: In the 'Core Services > Reports' section using a built-in report.

The Admin Portal contains a dedicated 'Reports' section with numerous built-in reports for security and compliance. A report such as 'User Logins' or a similar audit event report can be filtered by date range (e.g., last 90 days) and will contain the necessary details, including username, application, timestamp, and source IP address.

Correct answer: The CyberArk Identity platform.

When a user accesses an application through the App Gateway, the initial authentication and authorization are handled by the CyberArk Identity platform. Therefore, the platform itself generates the primary audit trail for the access event, which can be viewed in the built-in reports. The App Gateway acts as a reverse proxy, but the central logging occurs within the Identity tenant.

Correct answer: Role Mappings in the 'Provisioning' tab.

The 'Provisioning' feature for applications like Salesforce allows for detailed role mapping. An administrator can create mappings that link CyberArk Identity roles (which can be populated dynamically from AD groups or attributes) to specific destination roles and license types within Salesforce. This allows for fine-grained, automated assignment of the correct licenses upon user creation.