Weekend Sale - 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: spcl70

PAM-SEN PDF

$33

$109.99

3 Months Free Update

  • Printable Format
  • Value of Money
  • 100% Pass Assurance
  • Verified Answers
  • Researched by Industry Experts
  • Based on Real Exams Scenarios
  • 100% Real Questions

PAM-SEN PDF + Testing Engine

$52.8

$175.99

3 Months Free Update

  • Exam Name: CyberArk Sentry PAM
  • Last Update: Jul 18, 2025
  • Questions and Answers: 136
  • Free Real Questions Demo
  • Recommended by Industry Experts
  • Best Economical Package
  • Immediate Access

PAM-SEN Engine

$39.6

$131.99

3 Months Free Update

  • Best Testing Engine
  • One Click installation
  • Recommended by Teachers
  • Easy to use
  • 3 Modes of Learning
  • State of Art Technology
  • 100% Real Questions included

PAM-SEN Practice Exam Questions with Answers CyberArk Sentry PAM Certification

Question # 6

You want to improve performance on the CPM by restricting accounts for the CYBRWINDAD platform to only the WINDEMEA and WINDEMEA_Admin safes.

How do you set this in CyberArk?

A.

In the CYBRWINDAD platform, under Automatic Password Management/General, configure AllowedSafes and set to (WINDEMEA)|(WINDEMEA_ADMIN). Most Voted

B.

In the settings for Configuration/CPM assigned to the WINDEMEA and WINDEMEAADMIN safes, configure AllowedSafes and set to (WINDEMEA)|(WINDEMEAADMIN).

C.

In the CYBRWINDAD platform, under UI&Workflows/Properties/Optional, configure AllowedSafes and set to (WINDEMEA)|(WINDEMEA_ADMIN).

D.

Modify cpm.ini on the relevant CPM/s and add the setting AllowedSafesCYBRWINDAD and set to (WINDEMEA)|(WINDEMEAADMIN).

Full Access
Question # 7

The vault server uses a modified version of the Microsoft Windows firewall.

A.

TRUE

B.

FALSE

Full Access
Question # 8

Your customer wants to store the Safes Data on Vault Drive D instead of Drive C.

Which file should you edit?

A.

TSparm.ini Most Voted

B.

Vault.ini

C.

DBparm.ini

D.

user.ini

Full Access
Question # 9

When performing “In Domain” hardening of a PSM server, which steps must be performed? (Choose two.)

A.

Import CyberArk policy settings from the provided file into a new GPO. Most Voted

B.

Apply advanced audit on the PSM server.

C.

Link GPO to a dedicated OU containing CyberArk PSM servers. Most Voted

D.

Import an INF file to the local machine.

E.

Configure AppLocker rules to block running unknown executables.

Full Access
Question # 10

You are installing multiple PVWAs behind a load balancer.

Which statement is correct?

A.

Port 1858 must be opened between the load balancer and the PVWAs.

B.

The load balancer must be configured in DNS round robin.

C.

The load balancer must support "sticky sessions".

D.

The LoadBalancerClientAddressHeader parameter in the PVWA.ini file must be set.

Full Access
Question # 11

What would be a good use case for the Disaster Recovery module?

A.

Recovery Time Objectives or Recovery Point Objectives are at or near zero.

B.

Integration with an Enterprise Backup Solution is required.

C.

Off site replication is required.

D.

PSM is used.

Full Access
Question # 12

To enable LDAP over SSL for a Vault when DNS lookups are blocked, which step must be completed?

A.

Add the FQDN & IP details for each LDAP host into the local hosts file of the Vault server. Most Voted

B.

Configure an AllowNonStandardFWAddresses rule in DBParm.ini on the Vault to allow outbound TCP 53 to the organization’s DNS servers.

C.

Ensure LDAP hosts added to the directory mapping configuration are defined using only IP addresses.

D.

Set the ReferralsDNSLookup parameter value to “No” in the directory configuration.

Full Access
Question # 13

-

The installCyberArkSSHD parameter on the PSM for SSH can be set to multiple values.

Match each value to the correct condition.

PAM-SEN question answer

Full Access
Question # 14

As a member of a PAM Level-2 support team, you are troubleshooting an issue related to load balancing four PVWA servers at two data centers. You received a note from your Level-1 support team stating “When testing PVWA website from a workstation, we noticed that the “Source IP of last sign-in” was shown as the VIP (Virtual IP address) assigned to the four PVWA servers instead of the workstation IP where the PVWA site was launched from.”

Which step should you take?

A.

Verify the “LoadBalancerClientAddressHeader” parameter setting in PVWA configuration file Web.config is set to “X-Forwarded-For”.

B.

Add the VIP (Virtual IP address) assigned to the four PVWA servers to the certificates issued for all four PVWA servers, if missing.

C.

Add a firewall rule to allow the testing workstation to connect to the VIP (Virtual IP address) assigned to the four PVWA servers on Port TCP 443.

D.

Edit the dbparm.ini file on the Vault server and add the IP or subnet of the workstation to the whitelist.

Full Access
Question # 15

Which keys are required to be present in order to start the PrivateArk Server Service? Select all that apply.

A.

Server Key

B.

Recovery Public Key

C.

Recovery Private Key

D.

Safe Key

Full Access
Question # 16

What utility is used to create or update a credential file?

A.

CreateCredFile exe

B.

CAVaultManager.exe

C.

Central Policy Manager

D.

Password Vault Web Access

Full Access
Question # 17

How should you configure PSM for SSH to support load balancing?

A.

by using a network load balancer Most Voted

B.

in PVWA > Options > PSM for SSH Proxy > Servers

C.

in PVWA > Options > PSM for SSH Proxy > Servers > VIP

D.

by editing sshd.config on the all the PSM for SSH servers

Full Access
Question # 18

You are designing the number of PVWAs a customer must deploy. The customer has three data centers with a distributed Vault in each, requires high availability, and wants to use all Vaults at all times.

How many PVWAs does the customer need?

A.

six or more

B.

four

C.

two or less

D.

three

Full Access
Question # 19

To apply a new license file you must:

A.

Upload the license.xml file to the System Safe

B.

Upload the license.xml file to the Vaultlnternal Safe.

C.

Upload the license.xml file to the System Safe and restart the PrivateArk Server service.

D.

Upload the license.xml file to the Vaultlnternal Safe and restart the PrivateArk Server service.

Full Access
Question # 20

Which of the following are secure options for storing the contents of the Operator CD, while still allowing the contents to be accessible upon a planned Vault restart? Choose all that apply

A.

Store the CD in a physical safe and mount the CD every time vault maintenance is performed.

B.

Copy the contents of the CD to the System Safe on the vault

C.

Copy the contents of the CD to a folder on the vault server and secure it with NTFS permissions.

D.

Store the server key in a Hardware Security Module.

E.

Store the server key in the Provider cache

Full Access
Question # 21

Which CyberArk component changes passwords on Target Devices?

A.

Vault

B.

CPM

C.

PVWA

D.

PSM

E.

PrivateArk

F.

OPM

G.

AIM

Full Access
Question # 22

What is a prerequisite step before installing the Vault on Windows 2019?

A.

Configure the Kerberos authentication method on the default IIS Application pool

B.

Check that the server IP address is correctly configured and that it is static

C.

In the Network Connection properties, configure Preferred DNS Servers

D.

Install Microsoft Windows patch KB4014998

Full Access
Question # 23

What authentication methods can be implemented to enforce Two-Factor Authentication (2FA) for users authenticating to CyberArk using both the PVWA (through the browser) and the PrivateArk Client?

A.

LDAP and RADIUS Most Voted

B.

CyberArk and RADIUS

C.

SAML and Cyber Ark

D.

SAML and RADIUS

Full Access
Question # 24

Which service must be set to Automatic (delayed start) after the Vault is installed and configured?

A.

Windows Time service

B.

PrivateArk Database

C.

Windows Update service

D.

PrivateArk Server

Full Access
Question # 25

Name two ways of viewing the ITAlog

A.

Log into the vault locally and navigate to the Server folder under the PrivateArk install location.

B.

Log into the PVWA and go to the Reports tab.

C.

Access the System Safe from the PrivateArk client.

D.

Go to the Thirdpary log directory on the CPM

Full Access
Question # 26

When configuring RADIUS authentication, which utility is used to create a file containing an encrypted version of the RADIUS secret?

A.

CAVaultManager

B.

CACert

C.

CreateAuthFile

D.

CreateCredFile

Full Access
Question # 27

A customer has three data centers distributed globally and wants highly-available PSM connections in each segmented zone. In addition, the customer needs a highly-available PSM connection for the CyberArk Admins.

What will best satisfy this customer's needs?

A.

one PSM per zone with a load balancer and two PSMs for Admins with a load balancer

B.

six PSMs in the mam data center with a load balancer and one PSM for Admins

C.

two PSMs per zone with a load balancer and two PSMs for Admins with a dedicated load balancer

D.

three PSMs per zone with CyberArk built-in load balancing

Full Access
Question # 28

Which of the following protocols need to be installed on a standalone vault server? Check all that apply.

A.

Client for Microsoft Networks

B.

QoS Packet Scheduler

C.

File and Printer Sharing for Microsoft Networks

D.

Internet Protocol version 4 (TCP/IPv4)

E.

NIC Teaming Driver, if applicable

Full Access
Question # 29

In which configuration file on the Vault can filters be configured to either include or exclude log messages that are sent through SNMP?

A.

PARAgent.ini

B.

DBParm.ini

C.

TSParm.ini

D.

CyberArkv2 MIB file

Full Access
Question # 30

What is the default username for the PSM for SSH maintenance user when InstallCyberarkSSHD is set to yes?

A.

proxymng

B.

psmp_maintenance

C.

psmpmaintenanceuser

D.

psmpmnguser

Full Access
Question # 31

What is a prerequisite step before CyberArk can be configured to support RADIUS authentication?

A.

Log on to the PrivateArk Client, display the User properties of the user to configure, run the Authentication method drop-down list, and select RADIUS authentication.

B.

In the RADIUS server, define the CyberArk Vault as a RADIUS client/agent. Most Voted

C.

In the Vault installation folder, run CAVaultManager as administrator with the SecureSecretFiles command.

D.

Navigate to /Server/Conf and open DBParm.ini and set the RadiusServersInfo parameter.

Full Access
Question # 32

You need to add a new PSM server to an existing CyberArk environment.

What is the best way to determine the sizing of this server?

A.

Review the “Recommended Server Specifications” for PSMs in the CyberArk Documents website. Most Voted

B.

Use the specifications of any existing PSM and request a server of the same size.

C.

Use the CyberArk Support Knowledgebase, search for “PSM Sizing” and locate the Knowledgebase article related to sizing.

D.

Refer to the Microsoft Windows website, determine the minimum specifications required for the Operating System you are installing, and then add 4 Gb of RAM and 20 GB of disk.

Full Access
Question # 33

The primary purpose of the CPM is Password Management.

A.

TRUE

B.

FALSE

Full Access
Question # 34

You are configuring the Vault to send syslog audit data to your organization’s SIEM solution.

What is a valid value for the SyslogServerProtocol parameter in DBPARM.INI file?

A.

TLS

B.

SSH

C.

SMTP

D.

SNMP

Full Access
Question # 35

You are successfully managing passwords in the alpha cyberark com domain; however, when you attempt to manage a password in the beta cyberark com domain, you receive the 'network path not found' error. What should you check first?

A.

That the username and password are correct

B.

That the CPM can successfully resolve addresses in the beta cyberark com domain

C.

That the end user has the correct permissions on the safe.

D.

That an appropriate trust relationship exists between alpha.cyberark com and beta cyberark.com

Full Access
Question # 36

Which configuration file and Vault utility are used to migrate the server key to an HSM?

A.

DBparm.ini and CAVaultManager.exe

B.

VaultKeys.ini and CAVaultManager.exe

C.

DBparm.ini and ChangeServerKeys.exe

D.

VaultKeys.ini and ChangeServerKeys.exe

Full Access
Question # 37

PAM-SEN question answer

Arrange the steps to failover to the DR CPM in the correct sequence.

Full Access
Question # 38

After installing the first PSM server and before installing additional PSM servers, you must ensure the user performing the installation is not a direct owner of which safe?

A.

PSMUnmanagedSessionAccounts Safe

B.

PSMRecordingsSessionAccounts Safe

C.

PSMUnmanagedApplicationAccounts Safe

D.

PSMSessionBackupAccounts Safe

Full Access
Question # 39

After installing the Vault, you need to allow Firewall Access for Windows Time service to sync with NTP servers 10.1.1.1 and 10.2.2.2.

What should you do?

A.

Edit DBParm.ini to add: AllowNonStandardFWAddresses=[10.1.1.1,10.2.2.2],Yes,123:outbound/udp. Most Voted

B.

Edit DBParm.ini to add: NTPServer=[10.1.1.1:123/UDP,10.2.2.2:123/UDP].

C.

Edit DBParm.ini to add: AllowNonStandardFWAddresses=[10.1.1.1,10.2.2.2],Yes,123:outbound/udp,123:inbound/udp.

D.

Edit the Windows Firewall configuration to add a rule for Port 123/udp outbound to 10.1.1.1 and 10.2.2.2.

Full Access
Question # 40

Which file would you modify to configure the vault to send SNMP traps to your monitoring solution?

A.

dbparm ini

B.

paragent.ini

C.

ENEConf.ini I

D.

padr ini

Full Access