Free PAM-SEN sample questions

Correct answer: LoadBalancerClientAddressHeader

When a PVWA is placed behind a load balancer that uses X-Forwarded-For headers to pass the original client IP, the `LoadBalancerClientAddressHeader` parameter must be configured in the `web.config` file on the PVWA server. This tells the PVWA to look for the specified header (e.g., 'X-Forwarded-For') to identify the true client IP address for logging and auditing, rather than logging the IP of the load balancer itself.

Correct answer: The CPM user was created on the Primary Vault after the last successful replication to the DR Vault.

The error 'ITACM024S User is not defined' indicates the user attempting to authenticate does not exist in the Vault's user database. In a DR scenario, this most commonly occurs when the component user (like the CPM user) was created or had its credentials updated on the Primary Vault, but a full replication cycle did not complete before the failover. As a result, the DR Vault does not have the user's definition, causing authentication to fail.

Correct answers: Privileged Session Manager (PSM); Privileged Threat Analytics (PTA)

The PSM is required to establish, record, and control the privileged session. It is the component that can physically terminate the active session upon receiving a command.

PTA analyzes the session data from PSM in real-time. It contains the security engine and policy configuration to detect specific commands like `useradd` and trigger an automated response, such as instructing the PSM to terminate the session.

Correct answer: False

False. The PSM for SSH installation script (`psmp_install.sh`) automatically configures the `sshd_config` file with the required parameters, including `AllowTcpForwarding yes`. Manual editing for this specific purpose is not required and could lead to misconfiguration if done incorrectly.

Correct answer: Deploy PSM servers in each region. On each remote PSM server, configure the PSM to cache recordings locally. The PSM service will automatically and securely upload the cached recordings to the central Vault when network connectivity is available.

This is the correct, built-in CyberArk solution for distributed PSM deployments. The PSM is designed to cache recordings locally in a secure, encrypted format if it cannot immediately connect to the Vault. Once connectivity is restored, it automatically uploads the recordings, ensuring no data is lost and providing resilience against network interruptions. This architecture meets all stated requirements for performance, central storage, and resilience.

Correct answer: VFPerformAfterChange

The `VFPerformAfterChange` (Verify-Fail-Perform After Change) parameter in a platform's password management settings controls whether the CPM performs a password verification immediately after a password change. Setting this to 'Yes' ensures the new password is valid and functional before the change is considered successful.

Correct answer: Deploy the Central Credential Provider (CCP) and have Jenkins make REST API calls to its web service.

The Central Credential Provider (CCP) is a web service component of AAM designed for this exact use case. It allows applications like Jenkins to retrieve credentials via a secure REST API call without requiring a local agent (Credential Provider) installation. The Jenkins server authenticates to the CCP using methods like client certificates or IP address validation, eliminating the need to store secrets locally.

Correct answer: The account is completely removed from the target server.

The core principle of JIT access with ephemeral accounts is that the account is provisioned only for the duration of the approved access window. Once the session ends or the time expires, the de-provisioning process is automatically triggered by the CPM, which removes the user account entirely from the target system, leaving no standing privileges.

Correct answers: Configures Windows Firewall rules to restrict network traffic to essential Vault ports.; Disables unnecessary Windows services that are not required for Vault operation.

The Vault hardening script creates specific inbound and outbound Windows Firewall rules to ensure that only necessary communication for Vault operations (e.g., on port 1858) is allowed, blocking all other non-essential traffic.

A key part of the hardening process is reducing the server's attack surface. The script disables a list of predefined Windows services (e.g., Print Spooler, Windows Audio) that are not needed for the Vault to function, thereby improving its security posture.

Correct answer: WinWaitActive("SecureApp Login")

The `WinWaitActive` function is the correct and most reliable method in AutoIt for this purpose. It pauses the script's execution until a window with the specified title becomes the active window, ensuring that subsequent `ControlSend` and `ControlClick` commands are sent to the correct target. This is a fundamental function for creating robust connection components.