EPM-DEF Practice Exam Questions with Answers CyberArk Defender - EPM Certification

The username should match to an existing account.

The username should have a strong password associated.

The username should not match to an existing account.

The username should match the built-in local Administrator.

Implement Application Control

Implement Privilege Management

Implement Threat Detection

Implement Ransomware Protection

Advanced Policy - Application Control - Check Wi-Fi security

Advanced Policy - Options: Conditional enforcement - Apply Policy according to Script execution result

Default policies - Check if network access is secure

Advanced Policy - Access - Specify permissions to be set for Wi-Fi network security

Threat Protection Inbox

Policies

Threat Intelligence

Policy Audit

Yes, when Audit Video recording started, when Audit Video recording stopped, and when Audit Recording video reached size limit.

Yes, when Audit Video recording started, when not enough disk space to start the video recording, and when video recording is initializing.

Yes, when Audit Video recording started, when Audit Video recording is uploaded to the EPM server, and when audit recording cannot be initialized.

No, Audit Video is only available without the possibility of having End-User dialog pop-ups.

Use of automated distribution of reports to the security team

Provides reports in standard formats such as PDF, Word and Excel

Print reports

Create custom reports

It compares known ransomware signatures retrieved from virus databases.

It sandboxes the suspected ransomware and applies heuristics.

It monitors for any unauthorized access to specified files.

It performs a lookup of file signatures against VirusTotal's database.

Behavior of the elevation prompt for administrators in Admin Approval Mode is set to “Prompt for Consent for non-Windows binaries”.

Agent version is incompatible.

UAC policy Admin Approval for the Built-in Administrator Account is set to “Disabled”.

UAC policy Run all administrators in Admin Approval Mode is set to “Enabled”.

Privilege Escalation, Privilege Management, Application Management

Privilege Management, Application Control, Threat analysis

Privilege Management, Threat Protection, Application Escalation Control

Privilege Management, Privilege Threat Protection, Local Privileged Accounts Management

PTA

???

PVWA

DAP

Privilege Threat Protection under Policies.

Authorized Applications under Application Groups.

Protect Against Ransomware under Default Policies.

Threat Protection under Agent Configurations.

NSRL

Palo Alto Wildfire

VirusTotal

CyberArk Application Risk Analysis Service (ARA)

Enable the Threat Protection policy and configure the Policy Targets.

Do not enable the Threat Protection policy.

Enable the Threat Protection policy only in Detect mode.

Split up the endpoints in to separate Sets and enable Threat Protection for only one of the Sets.