It is possible to restrict the time of day, or day of week that a [b]reconcile[/b] process can occur
Correct Answer: A
Explanation It is possible to restrict the time of day, or day of week that a reconcile process can occur by using the Reconcile Safe option in the Platform Management section of the PrivateArk Client. This option allows the administrator to define the reconcile schedule for each platform, which specifies when the reconcile process can run and how often it should be performed. The reconcile schedule can be set to run daily, weekly, monthly, or on specific days and times. By restricting the reconcile process, the administrator can reduce the risk of unauthorized access to the accounts and improve the performance of the system. References: * [Defender PAM Course], Module 5: Reconcile and Rotate, Lesson 1: Reconcile and Rotate Overview, Slide 9: Reconcile Safe * [Defender PAM Study Guide], Section 5.1: Reconcile and Rotate Overview, Page 24: Reconcile Safe * [CyberArk Documentation], Privileged Access Security Implementation Guide, Chapter 5: Configure the Vault, Section 5.4: Configure Platforms, Subsection 5.4.2: Reconcile Safe
Question 67
What is the chief benefit of PSM?
Correct Answer: D
Question 68
In order to connect to a target device through PSM, the account credentials used for the connection must be stored in the vault?
Correct Answer: D
Question 69
Match the log file name with the CyberArk Component that generates the log.
Correct Answer:
Question 70
Which of these accounts onboarding methods is considered proactive?
Correct Answer: C
Explanation A Rest API integration with account provisioning software is considered a proactive account onboarding method, because it enables the automatic creation and management of accounts in the Vault as soon as they are provisioned in the target systems. This way, the accounts are secured from the start and do not need to be discovered or onboarded manually later. A Rest API integration with account provisioning software can be achieved by using the CyberArk Accounts Feed REST API, which allows external applications to send account information to the Vault1. The other options are not proactive account onboarding methods, because they rely on the discovery of existing accounts that may have been exposed or compromised before being onboarded to the Vault. Accounts Discovery is a feature that enables the Vault to scan target systems and identify privileged accounts that are not managed by the Vault2. Detecting accounts with PTA is a feature that enables the Privileged Threat Analytics (PTA) component to detect and alert on suspicious account activities and credential thefts3. A DNA scan is a feature that enables the Discovery and Audit (DNA) tool to scan Windows and Unix machines and generate a report on the privileged accounts and vulnerabilities found4. References: * CyberArk Accounts Feed REST API - CyberArk, section "CyberArk Accounts Feed REST API" * Accounts Discovery - CyberArk, section "Accounts Discovery" * Detect and Respond to Privileged Account Threats - CyberArk, section "Detect and Respond to Privileged Account Threats" * CyberArk DNA - CyberArk, section "CyberArk DNA"
