Summer Special Sale Limited Time 60% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: 713PS592

PAM-CDE-RECERT CyberArk CDE Recertification Questions and Answers

Questions 4

For each listed prerequisite, identify if it is mandatory or not mandatory to run the PSM Health Check.

PAM-CDE-RECERT Question 4

Options:

Buy Now
Questions 5

In a default CyberArk installation, which group must a user be a member of to view the “reports” page in PVWA?

Options:

A.

PVWAMonitor

B.

ReportUsers

C.

PVWAReports

D.

Operators

Buy Now
Questions 6

If a customer has one data center and requires high availability, how many PVWA's should be deployed.

Options:

A.

Two

B.

One PVWA cluster

C.

One

D.

Two PVWA Cluster

Buy Now
Questions 7

A user requested access to view a password secured by dual-control and is unsure who to contact to expedite the approval process. The Vault Admin has been asked to look at the account and identify who can approve their request.

What is the correct location to identify users or groups who can approve?

Options:

A.

PVWA> Administration > Platform Configuration > Edit Platform > UI & Workflow > Dual Control> Approvers

B.

PVWA> Policies > Access Control (Safes) > Safe Members > Workflow > Authorize Password Requests

C.

PVWA> Account List > Edit > Show Advanced Settings > Dual Control > Direct Managers

D.

PrivateArk > Admin Tools > Users and Groups > Auditors (Group Membership)

Buy Now
Questions 8

When managing SSH keys, the CPM stores the Public Key

Options:

A.

In the Vault

B.

On the target server

C.

A & B

D.

Nowhere because the public key can always be generated from the private key.

Buy Now
Questions 9

You need to enable the PSM for all platforms. Where do you perform this task?

Options:

A.

Platform Management > (Platform) > UI & Workflows

B.

Master Policy > Session Management

C.

Master Policy > Privileged Access Workflows

D.

Administration > Options > Connection Components

Buy Now
Questions 10

Via Password Vault Web Access (PVWA), a user initiates a PSM connection to the target Linux machine using RemoteApp. When the client’s machine makes an RDP connection to the PSM server, which user will be utilized?

Options:

A.

Credentials stored in the Vault for the target machine

B.

Shadowuser

C.

PSMConnect

D.

PSMAdminConnect

Buy Now
Questions 11

When creating an onboarding rule, it will be executed upon.

Options:

A.

All accounts in the pending accounts list

B.

Any future accounts discovered by a discovery process

C.

Both “All accounts in the pending accounts list” and “Any future accounts discovered by a discovery process”

Buy Now
Questions 12

Accounts Discovery allows secure connections to domain controllers.

Options:

A.

TRUE

B.

FALSE

Buy Now
Questions 13

Which Cyber Are components or products can be used to discover Windows Services or Scheduled Tasks that use privileged accounts? Select all that apply.

Options:

A.

Discovery and Audit (DMA)

B.

Auto Detection (AD)

C.

Export Vault Data (EVD)

D.

On Demand Privileges Manager (OPM)

E.

Accounts Discovery

Buy Now
Questions 14

You need to move a platform from using PMTerminal to using Terminal Plugin Controller (TPC) What must you do?

Options:

A.

Within PVWA

Click Administration > Platform Management

Select the platform and then click Edit.

In the left pane, click Automatic Password Management > CPM Plug-in

Set the ExeName parameter value to CyberArk TPC exe

B.

Using PnvateArk. select the PasswordManager_Shared safe, and then select open Locate the mi file relating to the platform you wish to change and double click

At the bottom of the file, insert a line "UseTPC = True" Remove any lines that reference "PMTerminal" and save Return the mi file to the safe Restart CPM for this change to take effect

C.

Open the process file of the platform you wish to configure to use TPC Add the following parameter under the States section; "use TPC=yes"

D.

It is not possible to change a platform from using PMTerminal to using TPC You must locate a new version of the platform that supports TPC and import the new platform over-writing the existing platform

Buy Now
Questions 15

The System safe allows access to the Vault configuration files.

Options:

A.

TRUE

B.

FALS

Buy Now
Questions 16

You are installing HTML5 gateway on a Linux host using the RPM provided. After installing the Tomcat webapp, what is the next step in the installation process?

Options:

A.

Deploy the HTML5 service (guacd)

B.

Secure the connection between the guacd and the webapp

C.

Secure the webapp and JWT validation endpoint

D.

Configure ASLR

Buy Now
Questions 17

Which report provides a list of account stored in the vault.

Options:

A.

Privileged Accounts Inventory

B.

Privileged Accounts Compliance Status

C.

Entitlement Report

D.

Active Log

Buy Now
Questions 18

It is possible to restrict the time of day, or day of week that a [b]reconcile[/b] process can occur

Options:

A.

TRUE

B.

FALS

Buy Now
Questions 19

Which of the following are secure options for storing the contents of the Operator CD, while still allowing the contents to be accessible upon a planned Vault restart? (Choose three.)

Options:

A.

Store the CD in a physical safe and mount the CD every time Vault maintenance is performed

B.

Copy the entire contents of the CD to the system Safe on the Vault

C.

Copy the entire contents of the CD to a folder on the Vault Server and secure it with NTFS permissions

D.

Store the server key in a Hardware Security Module (HSM) and copy the rest the keys from the CD to a folder on the Vault Server and secure it with NTFS permissions

Buy Now
Questions 20

Which component must be installed on the Vault if Distributed Vaults is used with PSM?

Options:

A.

RabbitMQ

B.

Disaster Recovery

C.

Remote Control Client

D.

Distributed Vault Server

Buy Now
Questions 21

How much disk space do you need on the server for a PAReplicate?

Options:

A.

500 GB

B.

1 TB

C.

same as disk size on Satellite Vault

D.

same as disk size on Primary Vault

Buy Now
Questions 22

In the screenshot displayed, you just configured the usage in CyberArk and want to update its password.

What is the least intrusive way to accomplish this?

PAM-CDE-RECERT Question 22

Options:

A.

Use the “change” button on the usage’s details page.

B.

Use the “change” button on the parent account’s details page.

C.

Use the “sync” button on the usage’s details page.

D.

Use the “reconcile” button on the parent account’s details page.

Buy Now
Questions 23

Which components can connect to a satellite Vault in distributed Vault architecture?

Options:

A.

CPM, EPM, PTA

B.

PVWA, PSM

C.

CPM,PVWA, PSM

D.

CPM, PSM

Buy Now
Questions 24

Match each permission to where it can be found.

PAM-CDE-RECERT Question 24

Options:

Buy Now
Questions 25

tsparm.ini is the main configuration file for the Vault.

Options:

A.

True

B.

False

Buy Now
Questions 26

When Dual Control is enabled a user must first submit a request in the Password Vault Web Access (PVWA) and receive approval before being able to launch a secure connection via PSM for Windows (previously known as RDP Proxy).

Options:

A.

True

B.

False, a user can submit the request after the connection has already been initiated via the PSM for Windows

Buy Now
Questions 27

What is mandatory for a PVWA installation?

Options:

A.

A DNS entry for PVWA url must be created.

B.

A company signed TLS certificate must be imported into the server

C.

A vault Administrator user must be used to register the PVWA

D.

Data Execution Prevention must be disabled.

Buy Now
Questions 28

You have been asked to identify the up or down status of Vault services.

Which CyberArk utility can you use to accomplish this task?

Options:

A.

Vault Replicator

B.

PAS Reporter

C.

Remote Control Agent

D.

Syslog

Buy Now
Questions 29

In a rule using “Privileged Session Analysis and Response” in PTA, which session options are available to configure as responses to activities?

Options:

A.

Suspend, Terminate, None

B.

Suspend, Terminate, Lock Account

C.

Pause, Terminate, None

D.

Suspend, Terminate

Buy Now
Questions 30

Select the best practice for storing the Master CD.

Options:

A.

Copy the files to the Vault server and discard the CD

B.

Copy the contents of the CD to a Hardware Security Module (HSM) and discard the CD

C.

Store the CD in a secure location, such as a physical safe

D.

Store the CD in a secure location, such as a physical safe, and copy the contents of the CD to a folder secured with NTFS permissions on the Vault

Buy Now
Questions 31

You are creating a new Rest API user that utilizes CyberArk Authentication.

What is a correct process to provision this user?

Options:

A.

Private Ark Client > Tools > Administrative Tools > Users and Groups > New > User

B.

Private Ark Client > Tools > Administrative Tools > Directory Mapping > Add

C.

PVWA > User Provisioning > LDAP Integration > Add Mapping

D.

PVWA > User Provisioning > Users and Groups > New > User

Buy Now
Questions 32

When running a “Privileged Accounts Inventory” Report through the Reports page in PVWA on a specific safe, which permission/s are required on that safe to show complete account inventory information?

Options:

A.

List Accounts, View Safe Members

B.

Manage Safe Owners

C.

List Accounts, Access Safe without confirmation

D.

Manage Safe, View Audit

Buy Now
Questions 33

Which of the following properties are mandatory when adding accounts from a file? (Choose three.)

Options:

A.

Safe Name

B.

Platform ID

C.

All required properties specified in the Platform

D.

Username

E.

Address

F.

Hostname

Buy Now
Questions 34

As vault Admin you have been asked to configure LDAP authentication for your organization's CyberArk users. Which permissions do you need to complete this task?

Options:

A.

Audit Users and Add Network Areas

B.

Audit Users and Manage Directory Mapping

C.

Audit Users and Add/Update Users

D.

Audit Users and Activate Users

Buy Now
Questions 35

Which configuration file and Vault utility are used to migrate the server key to an HSM?

Options:

A.

DBparm.ini and CAVaultManager exe

B.

VaultKeys.ini and CAVaultManager exe

C.

DBparm.ini and ChangeServerKeys exe

D.

VaultKeys.ini and ChangeServerKeys exe

Buy Now
Questions 36

Users can be resulted to using certain CyberArk interfaces (e.g.PVWA or PACLI).

Options:

A.

TRUE

B.

FALS

Buy Now
Questions 37

Which tools are used during a CPM renaming process?

Options:

A.

APIKeyManager Utility

B.

CreateCredFile Utility

C.

CPMinDomain_Hardening.ps1

D.

PMTerminal.exe

E.

Data Execution Prevention

Buy Now
Questions 38

What is the purpose of the PrivateArk Server service?

Options:

A.

Executes password changes

B.

Maintains Vault metadata

C.

Makes Vault data accessible to components

D.

Sends email alerts from the Vault

Buy Now
Questions 39

You are onboarding an account that is not supported out of the box.

What should you do first to obtain a platform to import?

Options:

A.

Create a service ticket in the customer portal explaining the requirements of the custom platform.

B.

Search common community portals like stackoverflow, reddit, github for an existing platform.

C.

From the platforms page, uncheck the “Hide non-supported platforms” checkbox and see if a platform meeting your needs appears.

D.

Visit the CyberArk marketplace and search for a platform that meets your needs.

Buy Now
Questions 40

What is the configuration file used by the CPM scanner when scanning UNIX/Linux devices?

Options:

A.

UnixPrompts.ini

B.

plink.exe

C.

dbparm.ini

D.

PVConfig.xml

Buy Now
Questions 41

What is the easiest way to duplicate an existing platform?

Options:

A.

From PrivateArk, copy/paste the appropriate Policy.ini file: then rename it.

B.

from the PVWA, navigate to the platforms page, select the existing platform that is similar to the new target account platform and click Duplicate, name the new platform.

C.

From PrivateArk, cop/paste the appropriate setting in the PVConfiguration.xml then update the policName variable.

D.

From the PVWA, navigate to the platforms page, select existing platform that is similar to the new target account platform, manually update the platform settings and click "Save as" instead of save to duplicate and rename the platform.

Buy Now
Questions 42

What is the default username for the PSM for SSH maintenance user?

Options:

A.

proxymng

B.

psmpjnamtenance

C.

psmpma/ntenanceuser

D.

psmpmnguser

Buy Now
Questions 43

Which of the following files must be created or configured m order to run Password Upload Utility? Select all that apply.

Options:

A.

PACli.ini

B.

Vault.ini

C.

conf.ini

D.

A comma delimited upload file

Buy Now
Questions 44

Arrange the steps to restore a Vault using PARestore for a Backup in the correct sequence.

PAM-CDE-RECERT Question 44

Options:

Buy Now
Questions 45

Which Master Policy Setting must be active in order to have an account checked-out by one user for a pre-determined amount of time?

Options:

A.

Require dual control password access Approval

B.

Enforce check-in/check-out exclusive access

C.

Enforce one-time password access

D.

Enforce check-in/check-out exclusive access & Enforce one-time password access

Buy Now
Questions 46

When a group is granted the 'Authorize Account Requests' permission on a safe Dual Control requests must be approved by

Options:

A.

Any one person from that group

B.

Every person from that group

C.

The number of persons specified by the Master Policy

D.

That access cannot be granted to groups

Buy Now
Questions 47

Match the Status of Service on a DR Vault to what is displayed when it is operating normally in Replication mode.

PAM-CDE-RECERT Question 47

Options:

Buy Now
Questions 48

Match the connection component to the corresponding OS/Function.

PAM-CDE-RECERT Question 48

Options:

Buy Now
Questions 49

What is the purpose of the PrivateArk Database service?

Options:

A.

Communicates with components

B.

Sends email alerts from the Vault

C.

Executes password changes

D.

Maintains Vault metadata

Buy Now
Questions 50

What is a prerequisite step betore CyberArk can be configured to support RADIUS authentication?

Options:

A.

Log on to the PrivateArk Client display the User properties to the user to configure, run the Authentication method dropdown list and select Radius authentication.

B.

In the RADIUS server define the CyberArk Vault as a RADIUS client/agent

C.

In the Vault installation folder, run CAVaultManager as administrator with the SecureSecretFiles command

D.

Navigate to /Server/Conf and open DBParm mi and set the RadiusServerslnfo parameter

Buy Now
Questions 51

What is the purpose of a linked account?

Options:

A.

To ensure that a particular collection of accounts all have the same password.

B.

To ensure a particular set of accounts all change at the same time.

C.

To connect the CPNI to a target system.

D.

To allow more than one account to work together as part of a password management process.

Buy Now
Questions 52

Secure Connect provides the following. Choose all that apply.

Options:

A.

PSM connections to target devices that are not managed by CyberArk.

B.

Session Recording

C.

Real-time live session monitoring.

D.

PSM connections from a terminal without the need to login to the PVWA

Buy Now
Questions 53

You have been asked to configure SNMP remote monitoring for your organization's Vault servers. In the PARAgent.ini, which parameter specifies the destination of the Vault SNMP Traps?

Options:

A.

SNMPHostIP

B.

SNMPTrapPort

C.

SNMPCommunity

D.

SNMP Version

Buy Now
Questions 54

Which usage can be added as a service account platform?

Options:

A.

Kerberos Tokens

B.

IIS Application Pools

C.

PowerShell Libraries

D.

Loosely Connected Devices

Buy Now
Questions 55

If a user is a member of more than one group that has authorizations on a safe, by default that user is granted________.

Options:

A.

the vault will not allow this situation to occur.

B.

only those permissions that exist on the group added to the safe first.

C.

only those permissions that exist in all groups to which the user belongs.

D.

the cumulative permissions of all groups to which that user belongs.

Buy Now
Questions 56

Which certificate type do you need to configure the vault for LDAP over SSL?

Options:

A.

the CA Certificate that signed the certificate used by the External Directory

B.

a CA signed Certificate for the Vault server

C.

a CA signed Certificate for the PVWA server

D.

a self-signed Certificate for the Vault

Buy Now
Questions 57

Customers who have the ‘Access Safe without confirmation’ safe permission on a safe where accounts are configured for Dual control, still need to request approval to use the account.

Options:

A.

TRUE

B.

FALSE

Buy Now
Questions 58

Which report shows the accounts that are accessible to each user?

Options:

A.

Activity report

B.

Entitlement report

C.

Privileged Accounts Compliance Status report

D.

Applications Inventory report

Buy Now
Questions 59

A logon account can be specified in the platform settings.

Options:

A.

True

B.

False

Buy Now
Questions 60

You are configuring the vault to send syslog audit data to your organization's SIEM solution. What is a valid value for the SyslogServerProtocol parameter in DBPARM.ini file?

Options:

A.

TLS

B.

SSH

C.

SMTP

D.

SNMP

Buy Now
Questions 61

VAULT authorizations may be granted to_____.

Options:

A.

Vault Users

B.

Vault Groups

C.

LDAP Users

D.

LDAP Groups

Buy Now
Questions 62

PTA can automatically suspend sessions if suspicious activities are detected in a privileged session, but only if the session is made via the CyberArk PSM.

Options:

A.

True

B.

False, the PTA can suspend sessions whether the session is made via the PSM or not

Buy Now
Questions 63

An auditor needs to login to the PSM in order to live monitor an active session. Which user ID is used to establish the RDP connection to the PSM server?

Options:

A.

PSMConnect

B.

PSMMaster

C.

PSMGwUser

D.

PSMAdminConnect

Buy Now
Questions 64

A customer's environment three data centers, consisting of 5,000 servers in Germany, 10,000 servers in Canada, 1,500 servers in Singapore. You want to manage target servers and avoid complex firewall rules. How many CPM's should you deploy?

Options:

A.

1

B.

3, total, 1 per data center

C.

15

D.

6, total, 2 per data center

Buy Now
Questions 65

The vault supports Subnet Based Access Control.

Options:

A.

TRUE

B.

FALSE

Buy Now
Questions 66

Which of the following PTA detections are included in the Core PAS offering?

Options:

A.

Suspected Credential Theft

B.

Over-Pass-The Hash

C.

Golden Ticket

D.

Unmanaged Privileged Access

Buy Now
Exam Code: PAM-CDE-RECERT
Exam Name: CyberArk CDE Recertification
Last Update: Sep 10, 2025
Questions: 221

PDF + Testing Engine

$72.6  $181.49

Testing Engine

$57.8  $144.49
buy now PAM-CDE-RECERT testing engine

PDF (Q&A)

$49.8  $124.49
buy now PAM-CDE-RECERT pdf