• Home
• CyberArk Exams
• ACCESS-DEF - CyberArk Defender Access

ACCESS-DEF CyberArk Practice Test Questions and Exam Dumps

Question 1

Which two of the following are primary advantages of implementing CyberArk's Privileged Access Security (PAS) solution? (Choose 2.)

A. Centralized management of privileged accounts
B. Automatic detection of vulnerabilities in endpoint devices
C. Real-time monitoring and auditing of privileged sessions
D. Full prevention of external cyberattacks
E. Automated patching of privileged accounts

Correct answers: A and C

Explanation:
CyberArk's Privileged Access Security (PAS) solution is specifically designed to help organizations secure, manage, and monitor access to privileged accounts, which are among the most targeted assets in any IT environment. The PAS solution focuses on centralizing control, reducing risk, and providing visibility into how and when privileged credentials are used.

Option A, centralized management of privileged accounts, is correct. One of the core features of CyberArk’s PAS solution is the centralization of credential storage and access control. Through its Vault and Password Vault Web Access (PVWA) interfaces, CyberArk enables organizations to store, rotate, and manage credentials for privileged accounts in a single, secure location. This not only reduces the attack surface but also ensures that policies for password complexity, expiration, and rotation are enforced consistently across all systems.

Option C, real-time monitoring and auditing of privileged sessions, is also a key capability. CyberArk’s Privileged Session Manager (PSM) enables live monitoring, recording, and auditing of privileged sessions. This ensures that all actions taken by privileged users can be traced and reviewed for compliance and forensic purposes. If suspicious behavior is detected, alerts can be generated, and sessions can even be terminated in real-time, providing an active defense mechanism.

The incorrect options can be clarified as follows:

Option B, automatic detection of vulnerabilities in endpoint devices, falls outside the scope of CyberArk’s PAS solution. Vulnerability scanning is typically the role of endpoint protection platforms (EPP) or vulnerability management tools like Tenable or Qualys. CyberArk does not directly scan or assess endpoint vulnerabilities.

Option D, full prevention of external cyberattacks, is misleading. No security solution can fully prevent all external attacks. While CyberArk’s PAS significantly reduces the risk of credential misuse and lateral movement within a network, it is just one layer of a broader defense-in-depth strategy. It cannot guarantee absolute protection against all external threats.

Option E, automated patching of privileged accounts, is technically incorrect. The term "patching" typically applies to software updates and security fixes. While CyberArk does offer automated credential rotation, this is different from software patching. Privileged account patching is not a function of the PAS solution.

In summary, the core benefits of CyberArk PAS lie in its ability to centrally manage sensitive credentials and provide deep visibility into their use, both of which are crucial for maintaining strong security and compliance across the enterprise. These capabilities align directly with options A and C, making them the correct choices.

Question 2

In which three scenarios can MFA (Multi-Factor Authentication) filters be applied? (Choose three.)

A. User and Admin Portal login
B. App level 2FA/MFA
C. RADIUS
D. Self-service password reset
E. Editing personal profile attributes
F. OAUTH2 connections

Answer: A, B, E

Explanation:

MFA filters are mechanisms applied to enforce additional layers of authentication beyond a simple username and password. These filters are typically applied in contexts where heightened security is necessary to protect sensitive resources or identity-related functions. In environments that use Identity Management or Access Management platforms—such as Avaya’s Identity Engines or external systems like Okta, Ping Identity, or Microsoft Entra (Azure AD)—MFA filters serve as policy enforcers at specific authentication points.

The first scenario where MFA filters can be applied is User and Admin Portal login, shown in option A. This is a common enforcement point for MFA, as login portals are front-facing access points to internal systems. By applying MFA here, administrators can ensure that both users and privileged roles (like admins) must pass a second authentication factor, such as a time-based one-time password (TOTP), push notification approval, or biometric challenge, to gain access.

The second applicable scenario is App level 2FA/MFA, represented by option B. Many applications—especially those dealing with sensitive customer data, internal workflows, or financial transactions—support or even require per-application MFA enforcement. This means that even if a user has passed an MFA challenge during initial login, they may still need to pass another one when opening a high-risk application. This form of policy-based access control uses MFA filters to determine when and where to challenge the user again.

The third valid scenario is Editing personal profile attributes, shown in option E. Changing one’s profile information—such as email address, phone number, or security questions—can have serious implications for account recovery and identity verification. Therefore, many identity management systems enforce MFA at the point of profile modification to ensure that the person requesting the change is indeed the legitimate account owner. MFA filters are applied here to mitigate risks associated with identity hijacking or unauthorized updates.

Option C, RADIUS, refers to a protocol often used in networking (e.g., VPN or Wi-Fi authentication). While MFA can be integrated into RADIUS flows, standard MFA filters as defined in identity platforms are not directly applicable here unless the RADIUS client is MFA-aware or tied to a broader identity system. Therefore, this is not typically one of the native use cases for MFA filters.

Option D, Self-service password reset, is usually protected through identity verification methods such as challenge questions or email/SMS confirmation, but it’s not a standard enforcement point for general MFA filters unless the identity system explicitly supports it. It may involve secondary validation but not necessarily via configurable MFA filters.

Option F, OAUTH2 connections, are typically application-to-application interactions or delegated user access through tokens. MFA is not enforced during token issuance or validation in the same way it is during interactive logins. Therefore, applying traditional MFA filters to OAUTH2 connections is not standard practice.

In conclusion, the three scenarios where MFA filters are typically applied are: portal login, app-level MFA, and sensitive profile edits. Thus, the correct answers are A, B, and E.

Question 3

Which two multi-factor authentication (2FA/MFA) methods are available for users who are unable to use a mobile device? (Choose two.)

A. FIDO2
B. Security questions
C. OAUTH2
D. QR code
E. Push notification app

Answer: A, B

Explanation:
When users are unable to use a mobile device, either due to policy restrictions, lack of access, or technical limitations, it is important to provide alternate methods for multi-factor authentication (MFA) that do not depend on a smartphone or tablet. Two commonly supported alternatives in this situation are FIDO2 and security questions.

FIDO2 is a modern authentication standard that allows users to authenticate using hardware security keys (such as YubiKeys or built-in platform authenticators like those found on laptops). These devices work independently of mobile phones and provide strong cryptographic authentication. FIDO2 can be used through USB, NFC, or biometric support directly on a device like a laptop or desktop, making it ideal for users without access to a mobile device.

Security questions, while considered less secure than other MFA methods, are still used in some systems as a backup authentication method. They allow a user to verify their identity by correctly answering predefined personal questions. Though this method has known weaknesses (such as susceptibility to social engineering or guessability), it is mobile-independent and can be used in environments where mobile access is not practical or available.

Option C, OAUTH2, is not an authentication method itself. It is an authorization framework used for token-based access control, often in combination with other authentication factors like password or biometric login. It does not function as a direct user-interactive MFA method in the way that FIDO2 or security questions do.

Option D, QR code, typically involves scanning the code using a mobile app (such as a TOTP app or authenticator app), and thus depends on a mobile device. Similarly, option E, push notification apps (like Duo or Microsoft Authenticator), explicitly require a mobile device to receive and approve the login prompt. Both D and E are not viable solutions for users without mobile access.

Therefore, among the listed options, FIDO2 and security questions are the two viable MFA alternatives for users who cannot use mobile devices. These methods provide non-mobile paths to ensure secure authentication and can be integrated into most enterprise security policies. As a result, the correct answers are A and B.

Question 4

A user’s account information required for multi-factor authentication is not set up correctly, preventing them from logging in. What action should you take?

A. Use the MFA Unlock command in the Admin Portal to suspend multifactor authentication for 10 minutes.
B. Delete the user’s account and create a new one.
C. Ask the user to delete all browser cookies, then try again.
D. Change the user’s directory source from Active Directory to LDAP for authentication.

Correct answer: A

Explanation:
When a user is experiencing issues with multi-factor authentication (MFA) due to incorrect setup of their account information, the issue likely lies in how MFA has been configured or enforced for that user. Instead of deleting the account or making unnecessary configuration changes, the MFA Unlock command can temporarily suspend MFA requirements to allow the user to log in and correct their authentication setup.

Option A, using the MFA Unlock command in the Admin Portal, is the correct course of action. This command temporarily suspends MFA for the affected user, allowing them to log in and correct the issue with their account setup. It is a safe and effective way to resolve login problems without making unnecessary, disruptive changes to the user's account or authentication system.

Let’s consider why the other options are incorrect:

Option B, deleting the user’s account and creating a new one, is a drastic measure and typically unnecessary. The issue seems to be related to the configuration of MFA, which can be fixed without needing to delete the account. Deleting the account might also cause data loss or other complications, which can be avoided with less invasive solutions.

Option C, asking the user to delete browser cookies, is unlikely to resolve an issue related to multi-factor authentication setup. While clearing cookies might help with session-related issues, it will not address problems with the configuration of MFA itself. This step would not be effective in resolving the core issue of improper setup.

Option D, changing the directory source from Active Directory to LDAP, is an unnecessary and complex change. The issue at hand is related to the user’s multi-factor authentication setup, not the directory source being used for authentication. Changing the directory source could introduce more problems and would not directly resolve the MFA issue.

To summarize, the MFA Unlock command is the most appropriate and targeted solution to temporarily bypass MFA, allowing the user to log in and fix any issues with their MFA configuration. This option addresses the root cause of the issue in a controlled and effective manner.

Question 5

Which of the following statements accurately describes the enrollment process for CyberArk Identity Windows Device Trust?

A. An enrollment code is optional.
B. The endpoint does not need to be a domain-joined machine.
C. You can define the maximum number of joinable endpoints.
D. You can define the minimum number of joinable endpoints.

Answer: C

Explanation:

CyberArk Identity’s Windows Device Trust feature is used to establish a secure and verifiable relationship between Windows endpoints and the identity platform. This trust relationship allows policies to enforce conditional access, device-based controls, and stronger authentication requirements. During the enrollment process, each Windows device must follow a structured registration procedure to be recognized as trusted.

A key part of managing this process involves defining limits on how many endpoints a particular user or policy is allowed to enroll. This is done to prevent abuse and to maintain control over the trust framework within an enterprise. Option C, which states that you can define the maximum number of joinable endpoints, is therefore correct. Administrators have the ability to set an upper limit on how many devices a user or group can enroll into the trusted device list. This limit ensures that trust is extended only to a finite number of endpoints per user, which is critical in high-security environments where unmanaged or excessive device trust could pose a risk.

Option A, which claims that an enrollment code is optional, is incorrect. In CyberArk Identity, an enrollment code is mandatory to ensure that only authorized devices can be enrolled. This code typically has a time-bound validity and is tied to a specific user or policy, serving as an authentication token for the enrollment process. It is a critical security mechanism that prevents rogue devices from impersonating legitimate endpoints.

Option B suggests that the endpoint does not need to be domain-joined. While CyberArk Identity supports both domain-joined and non-domain-joined devices, the trust features are more tightly integrated and policy-controllable when domain membership is present. However, Windows Device Trust often assumes or encourages domain-joined machines to facilitate seamless identity mapping and policy enforcement. Therefore, while not a strict technical requirement, saying that domain membership is not needed may mislead about best practices.

Option D, which refers to defining the minimum number of joinable endpoints, is not applicable in this context. There is no concept of setting a minimum number of devices a user must enroll; the configuration is about setting limits, specifically maximum numbers, to prevent misuse.

In summary, CyberArk Identity Windows Device Trust allows administrators to control the enrollment process by setting a maximum number of joinable endpoints, making Option C the only accurate statement. This control ensures trust is managed carefully and aligned with enterprise security policies.

Question 6

ACME Corporation employees use CyberArk Identity to access sensitive business web applications. You detect continuous unauthorized access attempts originating from the 103.1.200.0/24 IP range. Given the urgency and sensitivity of the portal access, 

Which configuration action will most effectively mitigate this risk?

A. Log in to the CyberArk Identity Admin portal and define the IP range of 103.1.200.0/24 into the ACME Corporation IP range.
B. Log in to the CyberArk Identity Admin portal and define the IP range of 103.1.200.0/24 into the blocked IP range.
C. Implement device trust through the Windows Cloud Agent.
D. Implement zero trust through the App Gateway.

Answer: B

Explanation:
To respond effectively to unauthorized access attempts targeting the CyberArk Identity portal, the best course of action is to proactively block the source of malicious traffic. In this case, the network segment 103.1.200.0/24 is responsible for these repeated access attempts, which could be indicative of a brute-force attack, credential stuffing, or vulnerability probing from that IP range.

CyberArk Identity provides administrators with the ability to manage IP restrictions. This includes allowing or denying access based on specific IP addresses or subnets. When administrators log into the CyberArk Identity Admin portal, they can configure a blocked IP range to explicitly deny any authentication or access requests originating from that range. This approach ensures that malicious or unauthorized traffic is stopped at the perimeter level before any authentication mechanisms are even invoked.

Option A is incorrect because adding the 103.1.200.0/24 IP range into the "ACME Corporation IP range" would do the opposite of what is intended. It would designate the malicious IPs as trusted, which would potentially allow them unrestricted access to the CyberArk Identity portal, increasing the organization’s attack surface rather than securing it.

Option C, implementing device trust via the Windows Cloud Agent, is a useful security control for ensuring that only known, managed, and secure endpoints can access the CyberArk portal. However, it does not directly prevent IP-based attacks. Moreover, device trust operates at the endpoint level, not the network layer, so it won’t stop traffic from specific IP addresses from reaching the authentication portal.

Option D, implementing zero trust through the App Gateway, is a broader architectural strategy that focuses on continuous verification of identity, device, and network conditions before granting access to applications. While valuable, it is not an immediate solution for blocking a known malicious IP subnet. Implementing zero trust would require time, configuration, and policy design, which does not match the urgency of the current issue.

Given the immediate threat from a specific IP block and the need for a quick and effective response, the most direct and appropriate action is to log in to the CyberArk Identity Admin portal and add the offending subnet 103.1.200.0/24 to the blocked IP list. This will prevent any traffic from that range from attempting to authenticate or access the portal, thereby reducing the vulnerability window for ACME Corporation. Thus, the correct answer is B.

Question 7

Which two technologies are used by CyberArk to secure privileged credentials and accounts? (Choose 2.)

A. Vaulting passwords and SSH keys in an encrypted repository
B. Multi-factor authentication (MFA) for user login
C. Automatic detection of weak passwords in user accounts
D. Using encryption-only methods for data storage
E. Session isolation to prevent unauthorized activity

Correct answers: A and E

Explanation:
CyberArk’s Privileged Access Security (PAS) solution focuses on safeguarding privileged credentials and controlling access to critical systems. Two key technologies used by CyberArk to achieve this are:

Option A, vaulting passwords and SSH keys in an encrypted repository, is correct. One of CyberArk’s core features is the secure storage and management of sensitive credentials, including passwords and SSH keys, in a vault. The vault uses strong encryption to protect these credentials from unauthorized access. CyberArk ensures that passwords and keys are rotated regularly to minimize the risk of compromise. This process, known as privileged credential vaulting, is a key security mechanism in CyberArk to prevent unauthorized access to critical systems.

Option E, session isolation to prevent unauthorized activity, is also correct. CyberArk offers session isolation and monitoring features as part of its Privileged Session Manager (PSM). This technology isolates privileged sessions to ensure that actions performed during these sessions are secure, monitored, and auditable. By isolating privileged sessions, CyberArk helps prevent unauthorized access and reduces the risk of insider threats and malicious activity during a privileged session. Additionally, these sessions can be recorded for auditing and compliance purposes.

The other options are not directly related to CyberArk’s core technology for securing privileged credentials:

Option B, multi-factor authentication (MFA) for user login, while a valuable security measure, is not the primary method used by CyberArk to secure privileged credentials. CyberArk focuses more on credential vaulting, session management, and access control. MFA may be integrated into CyberArk as part of the authentication process for administrators or users accessing the CyberArk system, but it is not the main technology used for securing privileged credentials.

Option C, automatic detection of weak passwords in user accounts, is not a feature specifically associated with CyberArk. While CyberArk does perform password rotation and enforces strong password policies for privileged accounts, it does not primarily focus on detecting weak passwords across an organization’s user accounts. Tools like password policy managers or vulnerability scanners are typically responsible for such tasks.

Option D, using encryption-only methods for data storage, while encryption is a key part of CyberArk’s solution, encryption alone is not the defining feature of the technology. The focus of CyberArk is on vaulting and managing privileged credentials, and while encryption is crucial for securing the stored data, it works in conjunction with other technologies like session management and password rotation.

In conclusion, vaulting passwords and SSH keys in an encrypted repository and session isolation to prevent unauthorized activity are the primary technologies that CyberArk employs to secure privileged credentials and accounts. These mechanisms work together to provide a comprehensive approach to managing and protecting sensitive access credentials.

Question 8

Which two CyberArk components are specifically used to monitor and control privileged sessions? (Choose two.)

A. CyberArk Privileged Session Manager (PSM)
B. CyberArk Vault
C. CyberArk Central Policy Manager (CPM)
D. CyberArk Identity Management System
E. CyberArk Privileged Access Security (PAS) dashboard

Answer: A, E

Explanation:

CyberArk is widely recognized for its robust Privileged Access Management (PAM) solutions, which are designed to secure, manage, and monitor access to accounts that have elevated permissions. Among the many components in the CyberArk suite, two stand out when it comes to monitoring and controlling privileged sessions: the Privileged Session Manager (PSM) and the Privileged Access Security (PAS) dashboard.

The Privileged Session Manager (PSM), noted in option A, is the cornerstone of CyberArk’s session management capabilities. PSM acts as a secure proxy that intermediates privileged access to critical systems, without ever exposing direct credentials to the end-user. When a privileged user initiates a connection to a target system (like a server or database), PSM records the session—including keystrokes, screen activity, and commands issued. It also enables real-time monitoring and can enforce pre-set policies, such as blocking certain commands or alerting administrators to suspicious activity. This makes PSM essential for both monitoring and controlling privileged access in a secure and auditable way.

Option E, the Privileged Access Security (PAS) dashboard, is another correct answer. The PAS dashboard offers administrators a central visual interface to oversee privileged account activities. It consolidates session information from various components, including PSM, and presents it in a user-friendly format for real-time monitoring, risk analysis, and alert management. Although the dashboard itself does not enforce controls, it is deeply integrated with policy engines and analytics that enable security teams to take action if necessary. As such, it plays a vital role in monitoring privileged sessions and responding to potential threats in real time.

On the other hand, option B, the CyberArk Vault, serves as a secure storage facility for privileged credentials, configuration files, and policy definitions. While it plays a crucial role in the overall PAM architecture by safeguarding sensitive data, it does not monitor or control sessions directly.

Option C, the Central Policy Manager (CPM), automates the password management process, ensuring that credentials are regularly rotated and compliant with policy. Although it enhances security posture, it does not have any session monitoring or control capabilities.

Option D, the CyberArk Identity Management System, typically refers to tools focused on identity governance and access management, including user provisioning, single sign-on, and multi-factor authentication. While these features can help regulate access, they are not responsible for monitoring or controlling privileged sessions, which is a separate functional area.

To summarize, Privileged Session Manager (PSM) is directly responsible for session control and auditing, while the PAS dashboard enables monitoring and oversight. These two components work together to ensure that privileged activity is both visible and controllable within an enterprise environment. Therefore, the correct answers are A and E.