CyberArk Defender - CAU201 Exam Questions [2026]

QUESTION NO: 1
When a group is granted the 'Authorize Account Requests' permission on a safe Dual Control requests must be approved by

A. The number of persons specified by the Master Policy B. That access cannot be granted to groups C. Any one person from that group D. Every person from that group

Correct Answer: A

QUESTION NO: 2
Your organization has a requirement to allow users to "check out passwords" and connect to targets with the same account through the PSM.
What needs to be configured in the Master policy to ensure this will happen?

A. Enforce check-in/check-out exclusive access = inactive; Require privileged session monitoring and isolation = inactive B. Enforce check-in/check-out exclusive access = active; Record and save session activity = inactive C. Enforce check-in/check-out exclusive access = inactive; Record and save session activity = active D. Enforce check-in/check-out exclusive access = active; Require privileged session monitoring and isolation = active

Correct Answer: C

QUESTION NO: 3
Which PTA sensors are required to detect suspected credential theft?

A. Logs, Vault Logs B. Logs, Network Sensor, Vault Logs C. Logs, PSM Logs, CPM Logs D. Logs, Network Sensor, EPM

Correct Answer: A

QUESTION NO: 4
Which parameter controls how often the CPM looks for accounts that need to be changed from recently completed Dual control requests.

A. Interval B. HeadStartInterval C. ImmediateInterval D. The CPM does not change the password under this circumstance

Correct Answer: A

QUESTION NO: 5
If a password is changed manually on a server, bypassing the CPM, how would you configure the account so that the CPM could resume management automatically?

A. Associate a reconcile account and configure the platform to reconcile automatically B. Associate a logon account and configure the platform to reconcile automatically C. Run the correct auto detection process to rediscover the password D. Configure the Provider to change the password to match the Vault's Password

Correct Answer: A

QUESTION NO: 6
A user with administrative privileges to the vault can only grant other users privileges that he himself has.

A. FALSE B. TRUE

Correct Answer: A

QUESTION NO: 7
A new HTML5 Gateway has been deployed in your organization.
Where do you configure the PSM to use the HTML5 Gateway?

A. Administration > Options > Privileged Session Management > Add Configured PSM Gateway Servers B. Administration > Options > Privileged Session Management > Configured PSM Servers > Add PSM Gateway C. Administration > Options > Privileged Session Management > Configured PSM Servers > Connection Details D. Administration > Options > Privileged Session Management > Configured PSM Servers > Connection Details > Add PSM Gateway

Correct Answer: D

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 8
A Vault Administrator team member can log in to CyberArk, but for some reason, is not given Vault Admin rights.
Where can you check to verify that the Vault Admins directory mapping points to the correct AD group?

A. PVWA > Administration > LDAP Integration > AD Groups B. PVWA > User Provisioning > LDAP Integration > Map Name C. PVWA > User Provisioning > LDAP Integration > Mapping Criteria D. PVWA > Administration > LDAP Integration > Mappings

Correct Answer: D

QUESTION NO: 9
Which of the following statements are NOT true when enabling PSM recording for a target Windows server? (Choose all that apply)

A. PSMConnect must be added as a local user on the target server B. PSM must be enabled in the Master Policy (either directly, or through exception) C. The PSM software must be instated on the target server D. RDP must be enabled on the target server

Correct Answer: B,C