EPM-DEF Practice Exam — 152 Free CyberArk Questions

Join Us Among the Stars

Sign Up & unlock 100% of Exam Questions

Log in / Sign up

No Strings Attached!

152Practice Questions

3Study Modes

Free

TopicSort

Question 1

Local Administrator Rights Removal

Which user or group will not be removed as part of CyberArk EPM's Remove Local Administrators feature?

A Built-in Local Administrator
B Domain Users
C Admin Users
D Power Users

Question 2

Least Privilege Enforcement

Question 3

Policy Audit and Compliance

Question 4

Least Privilege Enforcement

Question 5

Ransomware Protection

Question 6

Policy Audit and Compliance

Question 7

Least Privilege Enforcement

Question 8

Policy Audit and Compliance

Question 9

Policy Audit and Compliance

Question 10

Local Administrator Rights Removal

Question 11

Ransomware Protection

Question 12

Least Privilege Enforcement

Question 13

Ransomware Protection

Question 14

Ransomware Protection

Question 15

Least Privilege Enforcement

Question 16

Least Privilege Enforcement

Question 17

Policy Audit and Compliance

Question 18

Ransomware Protection

Question 19

Ransomware Protection

Question 20

Ransomware Protection

Question 21

Policy Audit and Compliance

Question 22

Ransomware Protection

Question 23

Least Privilege Enforcement

Question 24

Ransomware Protection

Question 25

Policy Audit and Compliance

Page 1 of 7 • Questions 1-25 of 152

1 2 3 4 5

→

Know a question that should be here? Contribute to this exam

When deploying EPM and in the Privilege Management phase what is the purpose of Discovery?

A To identify all non-administrative eventsВ. To identify all administrative level events
C To identify both administrative and non-administrative level events
D To identify non-administrative threats

How does a Trusted Source policy affect an application?

A Applications will be allowed to run and will only elevate if required.
B Applications will be allowed to run and will inherit the process token from the EPM agent.
C Applications will be allowed to run always in elevated mode.
D Application from the defined trusted sources must be configured on a per applicationbasis, in order to define run and elevation parameters.

If Privilege Management is not working on an endpoint, what is the most likely cause that can be verified in the EPM Agent Log Files?

A Behavior of the elevation prompt for administrators in Admin Approval Mode is set to “Prompt for Consent for non-Windows binaries”.
B Agent version is incompatible.
C UAC policy Admin Approval for the Built-in Administrator Account is set to “Disabled”.
D UAC policy Run all administrators in Admin Approval Mode is set to “Enabled”.

An EPM Administrator would like to include a particular file extension to be monitored and protected under Ransomware Protection. What setting should the EPM Administrator configure to add the extension?

A Authorized Applications (Ransomware Protection)
B Files to be Ignored Always
C Anti-tampering Protection
D Default Policies

Question 6

Policy Audit and Compliance

Question 7

Least Privilege Enforcement

Question 8

Policy Audit and Compliance

Question 9

Policy Audit and Compliance

Question 10

Local Administrator Rights Removal

Question 11

Ransomware Protection

Question 12

Least Privilege Enforcement

Question 13

Ransomware Protection

Question 14

Ransomware Protection

Question 15

Least Privilege Enforcement

Question 16

Least Privilege Enforcement

Question 17

Policy Audit and Compliance

Question 18

Ransomware Protection

Question 19

Ransomware Protection

Question 20

Ransomware Protection

Question 21

Policy Audit and Compliance

Question 22

Ransomware Protection

Question 23

Least Privilege Enforcement

Question 24

Ransomware Protection

Question 25

Policy Audit and Compliance

When working with credential rotation at the EPM level, what is the minimum time period that can be set between connections?

A 1 hour
B 5 hours
C 24 hours
D 72 hours

An EPM Administrator needs to create a policy to allow the MacOS developers elevation to an application. What type of policy should be used?

A Elevate Application Group
B Developer Applications Application Group
C Elevate Trusted Applications If Necessary Advanced Policy
D Elevate MacOS Policy

Which setting in the agent configuration controls how often the agent sends events to the EPM Server?

A Event Queue Flush Period
B Heartbeat Timeout
C Condition Timeout
D Policy Update Rate

Which of the following application options can be used when defining trusted sources?

A Publisher, Product, Size, URL
B Publisher, Name, Size, URI
C Product, URL, Machine, Package
D Product, Publisher, User/Group, Installation Package

Which of the following is CyberArk's Recommended FIRST roll out strategy?

A Implement Application Control
B Implement Privilege Management
C Implement Threat Detection
D Implement Ransomware Protection

Where can you view CyberArk EPM Credential Lures events?

A Application Catalog
B Threat Protection Inbox
C Events Management
D Policy Audit

CyberArk's Privilege Threat Protection policies are available for which Operating Systems? (Choose two.)

A Windows Workstations
B Windows Servers
C MacOS
D Linux

An EPM Administrator would like to enable CyberArk EPM's Ransomware Protection in Restrict mode. What should the EPM Administrator do?

A Set Block unhandled applications to On.
B Set Protect Against Ransomware to Restrict.
C Set Protect Against Ransomware to Restrict and Set Block unhandled applications to On.
D Set Control unhandled applications to Detect.

An EPM Administrator would like to enable a Threat Protection policy, however, the policy protects an application that is not installed on all endpoints.
What should the EPM Administrator do?

A Enable the Threat Protection policy and configure the Policy Targets.
B Do not enable the Threat Protection policy.
C Enable the Threat Protection policy only in Detect mode.
D Split up the endpoints in to separate Sets and enable Threat Protection for only one of the Sets.

A company is looking to manage their Windows Servers and Desktops with CyberArk EPM. Management would like to define different default policies between the Windows Servers and Windows Desktops.
What should the EPM Administrator do?

A In the Default Policies, exclude either the Windows Servers or the Windows Desktops.
B Create Advanced Policies to apply different policies between Windows Servers and Windows Desktops.
C CyberArk does not recommend installing EPM Agents on Windows Servers.
D Create a separate Set for Windows Servers and Windows Desktops.

A particular user in company ABC requires the ability to run any application with administrative privileges every day that they log in to their systems for a total duration of 5 working days.
What is the correct solution that an EPM admin can implement?

A An EPM admin can generate a JIT access and elevation policy with temporary access timeframe set to 120 hours
B An EPM admin can generate a JIT access and elevation policy with temporary access timeframe set to 120 hours and Terminate administrative processes when the policy expires option unchecked
C An EPM admin can create an authorization token for each application needed by running: EPMOPAGtool.exe -command gentoken -targetUser <username> -filehash <file hash> -timeLimit 120 -action run
D An EPM admin can create a secure token for the end user's computer and instruct the end user to open an administrative command prompt and run the command vfagent.exe -UseToken <securetoken_value>

What can you manage by using User Policies?

A Just-In-Time endpoint access and elevation, access to removable drives, and Services access.
B Access to Windows Services only.
C Filesystem and registry access, access to removable drives, and Services access.
D Just-In-Time endpoint access and elevation, access to removable drives, filesystem and registry access, Services access, and User account control monitoring.

Select the default threat intelligence source that requires additional licensing.

A VirusTotal
B Palo Alto WildFire
C CyberArk Application Risk Analysis Service
D NSRL

Which EPM reporting tool provides a comprehensive view of threat detection activity?

A Threat Detection Dashboard
B Detected Threats
C Threat Detection Events
D McAfee ePO Reports

What is a valid step to investigate an EPM agent that is unable to connect to the EPM server?

A On the end point, open a browser session to the URL of the EPM server.
B Ping the endpoint from the EPM server.
C Ping the server from the endpoint.
D Restart the end point

Which programming interface enables you to perform activities on EPM objects via a REST Web Service?

A EPM Web Services SDK
B Application Password SDK
C Mac Credential Provider SDK
D Java password SDK

When enabling Threat Protection policies, what should an EPM Administrator consider? (Choose two.)

A Some Threat Protection policies are applicable only for Windows Servers as opposed to Workstations.
B Certain Threat Protection policies apply for specific applications not found on all machines.
C Threat Protection policies requires an additional agent to be installed.
D Threat Protection features are not available in all regions.

When working with credential rotation/loosely connected devices, what additional CyberArk components are required?

A PTA
B ОРМ
C PVWA
D DAP

Before enabling Ransomware Protection, what should the EPM Administrator do first?

A Enable the Privilege Management Inbox in Elevate mode.
B Enable the Control Applications Downloaded From The Internet feature in Restrict mode.
C Review the Authorized Applications (Ransomware Protection) group and update if necessary.
D Enable Threat Protection and Threat Intelligence modules.

How does EPM help streamline security compliance and reporting?

A Use of automated distribution of reports to the security team
B Provides reports in standard formats such as PDF, Word and Excel
C Print reports
D Create custom reports

Join Us Among the Stars

EPM-DEFPreview

About the EPM-DEF Exam

Mode Selection

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

Question 11

Question 12

Question 13

Question 14

Question 15

Question 16

Question 17

Question 18

Question 19

Question 20

Question 21

Question 22

Question 23

Question 24

Question 25

Question 6

Question 7

Question 8

Question 9

Question 10

Question 11

Question 12

Question 13

Question 14

Question 15

Question 16

Question 17

Question 18

Question 19

Question 20

Question 21

Question 22

Question 23

Question 24

Question 25