Select the best practice for storing the Master CD.
Correct Answer: C
Explanation The best practice for storing the Master CD is to store it in a secure location, such as a physical safe. The Master CD contains the server key, the public recovery key, and the private recovery key, which are essential for starting, operating, and recovering the Vault. These keys are sensitive and should be protected from unauthorized access, loss, or damage. Therefore, storing the CD in a physical safe ensures that the keys are kept in a secure location when not in use, and that they are available when needed. This is the recommended option by CyberArk1. The other options are not best practices and should be avoided, as they expose the keys to potential risks, such as theft, corruption, or deletion. Copying the files to the Vault server and discarding the CD is not secure, as it makes the keys accessible to anyone who can access the Vault server or compromise its security. Copying the contents of the CD to a Hardware Security Module (HSM) and discarding the CD is not feasible, as the HSM can only store the server key, not the recovery keys2. Storing the CD in a secure location, such as a physical safe, and copying the contents of the CD to a folder secured with NTFS permissions on the Vault is not necessary, as it creates redundant copies of the keys that may not be synchronized or updated. Moreover, NTFS permissions are not sufficient to protect the keys from malicious or accidental actions. References: * Server Keys - CyberArk, section "Server Keys" * Store the Server Key in an HSM - CyberArk, section "Store the Server Key in an HSM"
Question 42
Which report provides a list of account stored in the vault.
Correct Answer: A
Explanation The report that provides a list of accounts stored in the vault is the Privileged Accounts Inventory report. This report can be generated in the Reports page in the PVWA by users who belong to the group that is specified in the ManageReportsGroup parameter in the Reports section of the Web Access Options in the System Configuration page1. The Privileged Accounts Inventory report contains information such as the safe, folder, name, platform ID, username, address, group, last accessed date, last accessed by, last modified date, last modified by, verification date, checkout date, checked out by, age, change failure, verification failure, master pass folder, master pass name, disabled by, and disabled reason of each account stored in the vault2. References: * 1: Reports in PVWA * 2: Users List Report
Question 43
For each listed prerequisite, identify if it is mandatory or not mandatory to run the PSM Health Check.
Correct Answer:
Explanation According to the CyberArk documentation1, the prerequisites for running the PSM Health Check are: * PSM service installed on Windows 2016 or Windows 2019 * Web Server (IIS 8.5) role is installed * A valid SSL certificate is installed on the Web Server Therefore, these prerequisites are mandatory for the PSM Health Check to work properly. The PSM service installed on Windows 2008 R2 is not mandatory, as it is not supported by the PSM Health Check2. References: PSM Health Check, PSM Health Check - CyberArk
Question 44
When an account is unable to change its own password, how can you ensure that password reset with the reconcile account is performed each time instead of a change?
Correct Answer: C
Question 45
user has successfully conducted a short PSM session and logged off. However, the user cannot access the Monitoring tab to view the recordings. What is the issue?
