Free PAM-CDE-RECERT sample questions

Correct answer: Asynchronous replication using PAReplicate.

Asynchronous replication using PAReplicate is the standard and recommended method for CyberArk DR Vaults. It provides a near-zero RPO by replicating Vault data at frequent intervals (typically every few minutes). It is resilient to network latency, making it suitable for geographically separate data centers. The failover process is well-documented and can be accomplished within the 4-hour RTO.

Correct answer: The 'Audit privileged session activity' setting in the Master Policy is disabled for the specified platform.

The Master Policy is the primary control for enabling or disabling session recording. If the 'Audit privileged session activity' rule is disabled for the platform governing the target account, PSM will establish the connection but will not record it, matching the described symptoms perfectly.

Correct answer: Define the logon script using `pmprerun`, the password change script using `pmpass`, and the logoff script using `pmpostrun`.

This is the correct approach. The `Process.ini` file uses specific commands to define the sequence. `pmprerun` is executed first for logon actions. `pmpass` is executed for the actual password change. `pmpostrun` is executed last for logoff or cleanup actions. This structure allows the CPM to manage each phase of the process correctly.

Correct answers: Windows Security Event Logs from Domain Controllers.; Network traffic captures from a TAP or SPAN port.

PTA requires Windows Security Event Logs, specifically those related to authentication (like Event ID 4624), to detect credential theft attacks such as Pass-the-Hash. It analyzes the authentication type and logon patterns to identify anomalies.

PTA can perform deep packet inspection on network traffic to detect the characteristic signatures of Pass-the-Hash and other attacks. This network-level visibility is a key data source for detecting attacks in real-time.

Correct answer: Run the `CAVaultManager` utility with the `DefragmentDB` command.

The `ITADB323W` and `ITADB324W` warnings indicate that the Vault database is fragmented, which can impact performance. The standard and recommended procedure to resolve this is to perform an offline defragmentation of the database using the `CAVaultManager DefragmentDB` command during a maintenance window. This is the correct first step to address the root cause.

Correct answer: In the PVWA settings, configure a PSM server ID that points to the European PSM and associate it with platforms used by European teams.

This is the correct design. In the PVWA `Administration > Configuration Options`, you can define multiple PSM servers and assign them unique IDs. You can then edit a platform's settings (`UI & Workflows > Privileged Session Management`) to use a specific `ID` for the PSM Server. By associating European platforms with the European PSM server ID, all sessions for those platforms will be routed to the local PSM.

Correct answer: False

This is correct. The PVWA handles the encryption of sensitive parameters like `WebFormFields` automatically upon saving the connection component configuration. The administrator enters the values in plain text during setup.

Correct answer: The 'Server' service is not running on the target Windows machine.

The error code `2114` and message `The service has not been started` directly correspond to the 'Server' service (service name `LanmanServer`) on the target machine being stopped. The CPM relies on this service for remote administration tasks, including password reconciliation for local accounts. This is the most direct cause.

Correct answer: Use Windows Event Forwarding (WEF) with a subscription that filters for specific event IDs required by PTA.

This is the CyberArk recommended best practice. Windows Event Forwarding (WEF) allows administrators to create subscriptions with XPath queries to select only the specific event IDs that PTA needs for its analysis. This filtering happens on the source (Domain Controller), ensuring that only relevant data is sent over the network, thus minimizing bandwidth.

Correct answer: The administrator did not stop the `CyberArk Event Notification Engine` service on the primary Vault.

The `CyberArk Event Notification Engine` (ENE) service is responsible for triggering replication. Even if the main Vault service is stopped, a running ENE can still attempt to initiate replication tasks, which can interfere with the DR promotion process. The documented DR procedure requires stopping both the PrivateArk Server and the ENE services on the primary Vault before promoting the DR Vault.