Which of the following files must be created or configured m order to run Password Upload Utility? Select all that apply.
Correct Answer: A,C,D
Explanation To run the Password Upload Utility, you need to create or configure the following files: * A comma delimited upload file: This is a text file that contains the passwords and their properties that will be uploaded to the Vault. The file must have a .csv extension and follow a specific format. The first line in the file defines the names of the password properties as specified in the Password Vault. Every other line represents a single password object and its property values, according to the properties specified in the first line1. * PACli.ini: This is a configuration file that stores the parameters for the PACli, which is a command-line interface that enables communication between the Password Upload Utility and the Vault. The PACli.ini file must be located in the same folder as the Password Upload Utility executable file. The file must contain the following parameters: Vault, User, Password, and LogFile2. * conf.ini: This is a configuration file that stores the parameters for the Password Upload Utility. The conf.ini file must be located in the same folder as the Password Upload Utility executable file. The file must contain the following parameters: InputFile, LogFile, and ErrorFile3. You do not need to create or configure the following file to run the Password Upload Utility: * Vault.ini: This is a configuration file that stores the parameters for the Vault server, such as the database name, port, and password. This file is not used by the Password Upload Utility, and it is not located in the same folder as the Password Upload Utility executable file. The Vault.ini file is located in the Vault installation folder, and it is used by the Vault service and the PrivateArk Client4. References: * 1: Create the Password File * 2: PACli.ini * 3: Password Upload Utility Parameter File (conf.ini) * 4: [CyberArk Privileged Access Security Implementation Guide], Chapter 2: Installing the Vault, Section: Configuring the Vault, Subsection: Vault.ini
Question 62
You have been asked to delegate the rights to unlock users to Tier 1 support. The Tier 1 support team already has an LDAP group for its members. Arrange the steps to do this in the correct sequence.
Correct Answer:
Explanation The correct sequence to delegate the rights to unlock users to Tier 1 support with an existing LDAP group is as follows: * Sign into the PWA (V10) as a local user with the "Manage Directory Mapping" privilege. * Open LDAP Integration view. * Add Mapping to the existing LDAP integration. * Name the new mapping and set the mapping order. * Select required LDAP group and assign authorization "Activate Users". Comprehensive Explanation: To delegate the rights to unlock users, you must first access the Privileged Web Access (PWA) with the appropriate privileges to manage directory mappings. Then, navigate to the LDAP Integration view to add a new mapping to the existing LDAP integration. This mapping should be named and ordered correctly. Finally, select the LDAP group that represents Tier 1 support and assign the specific authorization needed to unlock users, which is "Activate Users" in this context12. References: * CyberArk Docs: LDAP Integration in V102 * CyberArk Knowledge Article: How to delegate permissions to unlock Active Directory accounts1
Question 63
You receive this error: "Error in changepass to user domain\user on domain server(\domain. (winRc=5) Access is denied." Which root cause should you investigate?
Correct Answer: B
Question 64
In a default CyberArk installation, which group must a user be a member of to view the "reports" page in PVWA?
Correct Answer: A
Explanation In a default CyberArk installation, to view the "reports" page in the PVWA (Privileged Web Access), a user must be a member of the PVWAMonitor group1. This group is specified in the ManageReportsGroup parameter in the Reports section of the Web Access Options in the System Configuration page. Being a member of this group grants the user the necessary permissions to generate and view reports within the PVWA. References: * CyberArk's official documentation on Reports in PVWA outlines the requirement for users to belong to the PVWAMonitor group to access the reports page and generate reports1.
Question 65
An auditor needs to login to the PSM in order to live monitor an active session. Which user ID is used to establish the RDP connection to the PSM server?
Correct Answer: A
Explanation The PSMConnect user is a local user on the PSM server that is used to establish RDP connections to the PSM server. The PSMConnect user has the following permissions: Log on locally, Log on as a batch job, and Allow log on through Remote Desktop Services. The PSMConnect user is also a member of the local group PSMUsers, which has access to the PSM web console. The other user IDs are not used for RDP connections to the PSM server. The PSMMaster user is a local user on the PSM server that is used to run the PSM services. The PSMGwUser user is a local user on the PSM server that is used to run the PSM Gateway service. The PSMAdminConnect user is a local user on the PSM server that is used to connect to the PSM web console as an administrator. References: Privileged Session Manager, Defender - PAM, PSM for Web Console, Connect through PSM for SSH
