EPM-DEF Cyberark Endpoint Privilege Manager Practice Questions

This is the most secure and precise approach. By creating an Elevate policy for java.exe and adding a condition based on the command-line parameters, you ensure that elevation is only granted when Java is being used for the intended, legitimate purpose (running their specific application). Any other attempt to run java.exe for different purposes will not be elevated, mitigating the security risk.

In a CyberArk EPM SaaS (cloud-hosted) environment, the Privilege Cloud Connector is a component installed within the customer's on-premises network. Its primary role is to bridge the gap between the cloud service and internal resources, most commonly to enable LDAP integration for synchronizing users and groups from the on-premises Active Directory.

On macOS, the EPM agent integrates directly with the standard OS authentication prompt. When an action requires elevation, the native prompt appears. The EPM agent adds an icon next to the password field. The user clicks this icon to trigger the EPM elevation workflow (which may be silent, require justification, etc.) instead of entering a password.

EPM supports granular delegation through scoped roles. By creating a role with 'Policy Administrator' permissions and then scoping that role to a specific Set ('Marketing'), you grant the assigned users full policy management rights, but only for the computers and policies associated with that Set. They will be unable to see or affect other Sets.

Microsoft Office updates are complex and often involve multiple executables, temporary files, and scripts that are launched as child processes of the main update service. A restrictive 'Block' mode policy that only allows the main Office applications will inadvertently block these necessary child processes, causing the update to fail. The solution is to identify and create rules to allow these specific update-related processes.

An Elevate policy lets only the targeted administrators run regedit.exe and cmd.exe with admin rights, and its End user UI setting shows a prompt that asks the user for a justification each time the policy is enforced. With Audit policy enforcement turned on, each of these events is collected, so every use is both justified and recorded, which is the evidence PCI DSS asks for. A notification that only reminds users to document their actions captures no justification, a Block policy with per-use exceptions stops legitimate admin work and moves justification into a manual process, and a Detect policy only monitors and leaves justification outside EPM.

The Remove local administrators policy removes users and groups from the local Administrators group, except built-in admin users and the users and groups that the EPM administrator excludes by adding them to the policy scope. Adding 'PharmaLab Admins' there keeps that group in the local Administrators group. The built-in Administrator account is already left alone by the policy, so excluding its SID changes nothing (disabling and vaulting it is done outside this policy). Turning the policy off and using GPO gives up EPM's control, and a second lower-priority policy is not how EPM keeps a group: exclusions in the policy scope are.

The Offline Policy Authorization Generator (OPAG) is the EPM tool for endpoint users who have no connection to the EPM server and cannot receive policy updates. An EPM administrator runs the tool (EPM_OPAG_tool.exe) to create an authorization code, and the on-site user runs the application with that code through 'Run with authorization code' (or first sends a Request for Authorization), provided OPAG is enabled in the agent configuration. The EPM secure token is different: it lets an admin upgrade, stop or uninstall an agent protected by Agent self-defense, not elevate an application. A just-in-time access request needs the EPM server to approve it, and policy push by removable media or a self-defense bypass code is not the EPM mechanism for this.

An EPM policy covers child processes only when the Include child processes option is selected for the application definition (childProcess = true in the policy API); otherwise the rule applies to the matching process and not to its children. CyberArk says to use this option with caution and only for applications that need it, such as software installers, because once it is selected every descendant runs with the same elevated token and no other policy, even one with higher priority, applies to those descendants.

Trusted Sources policies restrict installations to specific origins, such as URLs, network paths, or publishers. Even if an application is legitimate and signed, if its download source (the vendor's website) is not explicitly listed in the 'Trusted Sources' definition, EPM will block the installation as it originates from an untrusted location.