EPM-DEF Sample Questions & Answers

The correct way to handle legitimate applications that trigger threat protection events is to create an Application Group for that specific application. This Application Group can then be added to the Exclusions list within the Privilege Threat Protection policy. This surgically excludes only the specified application, maintaining protection for all other processes.

Using the 'Folder Path' parameter type and enabling the 'Include subfolders' option is the most robust and maintainable method. This configuration dynamically includes any executable within the specified root folder and all its subdirectories, automatically accommodating new versions and tools without requiring policy updates.

This setting directly controls how often the agent contacts the server to check for new or updated policies. Increasing this interval for stable environments like POS terminals reduces network traffic and server load.

This setting determines how often the agent sends its collected event data to the server. Increasing this period means the agent batches more events together before sending, which reduces the frequency of communication and is ideal for high-latency networks.

This solution meets all requirements. It removes admin rights. It uses a file hash to securely identify the specific, unsigned application. The Elevate policy runs it silently (no prompt). The default block policy prevents unauthorized software. Because policies are cached locally on the agent, this configuration will continue to function correctly even if the EPM server is unreachable, ensuring factory resilience.

According to the flowchart, after confirming the application is defined in a policy (B), the next critical check is the signature match (D). Since the administrator has already verified the policy is active and the computer is in scope (implying F is correct), the most probable point of failure is the signature check (D). This could happen if the vendor released a new version signed with a different certificate, or if the file's signature is corrupted or expired.

The 'View-Only Administrator' role is specifically designed for this purpose. It grants read-only access to the EPM console, allowing users to view policies, events, and reports without having any permissions to make changes. This adheres to the principle of least privilege.

The SET_ID parameter in the msiexec command requires the exact name of the Set that the agent should be assigned to upon installation. This name is defined in the EPM console (e.g., 'Workstations', 'Servers', 'VDI_Pool_A'). The agent will then inherit the policies and configuration assigned to that Set.

CyberArk EPM's ransomware protection works by creating and monitoring hidden decoy files. When a process, such as ransomware, begins to encrypt files on a system, it will inevitably attempt to modify one of these decoys. The EPM agent detects this unauthorized modification, identifies the offending process, terminates it, and can automatically restore the decoy file, effectively stopping the ransomware in its tracks.

The Directory Sync component connects to Active Directory via LDAP to read and import object information. This allows EPM administrators to create policies that target AD users and groups directly, rather than having to recreate them manually. It keeps the EPM's view of the directory synchronized with the actual state of Active Directory.

While the EPM agent for macOS provides core functionality like privilege management and application control, it does not have complete feature parity with the Windows agent. Certain advanced security features, such as credential theft protection (which targets Windows-specific mechanisms like LSASS) and the decoy-based ransomware protection, are specific to the Windows platform and not available on macOS.