PracticeVideosBlogFlashcardsEspañol
All Practice Exams

Free Practice Questions for CyberArk PAM-SEN

Exam-style questions and explanations by OpenExamPrep.

✓ No registration✓ No credit card
Exam pass rate: ~55%
100+ Questions
100% Free

Loading practice questions...

Same family resources

Explore More CyberArk Certifications

Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.

CyberArk Defender - PAM (PAM-DEF)

Practice Questions

CyberArk Certified Trustee (entry-level online assessment)

Practice Questions

CyberArk Defender - Endpoint Privilege Manager (EPM-DEF)

Practice Questions

CyberArk Defender - Identity (Access)

Practice Questions

CyberArk Defender + Sentry CDE (CAU302)

Practice Questions

CyberArk Guardian (GUARD)

Practice Questions
Exam Review

Key Facts: CyberArk PAM-SEN Exam

70%

Passing Score

CyberArk

65 Q

Question Count

CyberArk

90 min

Exam Duration

CyberArk

$200

Exam Fee

CyberArk

~55%

Est. Pass Rate

Industry estimate

2 yrs

Validity Period

CyberArk

CyberArk Sentry - PAM (PAM-SEN), formerly CAU301, is CyberArk's advanced PAS certification for engineers who install, upgrade, and operate the Vault, CPM, PVWA, PSM, PSMP, and PTA. It tests deep knowledge of Vault DR with PADR replication, Cluster Vault on shared storage, multi-CPM scoping, platform and Connection Component authoring (XML, AutoIT, AppLocker, Java security), Universal Connector design, REST API and PACLI automation, RADIUS/LDAPS/IWA integration, server and network hardening, and Privileged Threat Analytics anomaly response.

Sample CyberArk PAM-SEN Practice Questions

Try these sample questions to review concepts for the CyberArk PAM-SEN exam. Each question includes a detailed explanation. Start the interactive quiz above for the full 100+ question experience with AI tutoring.

1During an installation of the Vault, which file controls firewall behavior including AllowNonStandardFWAddresses and the list of permitted client IP addresses?
A.PADR.ini
B.DBPARM.ini
C.Vault.ini
D.TSparm.ini
Explanation: DBPARM.ini is the master Vault configuration file. The AllowNonStandardFWAddresses parameter and the AllowedMachines list (and the firewall section in general) are configured there. After editing, the Vault server service must be restarted for changes to take effect.
2What is the role of the master CD during a Vault installation?
A.It contains the Vault binaries and is required only for the install media
B.It carries the Server Key, Recovery Public Key, and operator credentials needed to install and bootstrap the Vault
C.It is the bootable PXE image used to image the Vault server
D.It is the licensing dongle that must remain inserted at runtime
Explanation: The master CD (or its modern soft-token equivalent) holds the Server Key, the Recovery Public Key, and the credentials for the predefined users (Master, Administrator). It must be presented during installation, key generation, recovery, and start-up of a brand-new Vault, and is then secured offline.
3You need to configure asynchronous replication from the Production Vault to a DR Vault. Which configuration file on the DR server primarily defines the replication behavior?
A.DBPARM.ini
B.PADR.ini
C.Vault.ini
D.CACPMScanner.ini
Explanation: PADR.ini on the DR server holds the PrivateArk Disaster Recovery service configuration: the production Vault address, port, user, replication interval (FailoverMode/EnableFailover), and log paths. The PADR service reads this file to perform asynchronous data and metadata replication.
4In a CyberArk DR architecture, what type of replication is used between the Production Vault and the DR Vault?
A.Synchronous block-level replication via shared storage
B.Asynchronous logical replication of Safe data and metadata performed by the PADR service
C.Active-active multi-master replication
D.DBMS-native streaming replication using SQL Server AlwaysOn
Explanation: CyberArk DR is asynchronous: the PADR service on the DR node periodically reads transaction logs from the Production Vault and replays them locally. Because it is asynchronous, the DR Vault can lag slightly behind production, which is why the replication interval matters.
5After a planned failover to the DR Vault, what is the correct method to fail back to the original Production Vault once it is healthy again?
A.Just start the original Vault service; it will automatically reconverge
B.Reverse the PADR direction so the former DR (now active) replicates back to the original Production Vault, then perform a controlled switchover
C.Restore the original Vault from the master CD
D.Delete and reinstall the original Vault
Explanation: For a controlled failback you reverse PADR: configure the original Production Vault's PADR.ini to replicate from the now-active DR Vault, let it sync, stop the DR service, and start the original Production Vault as active. This preserves all changes made while DR was active.
6In a Cluster Vault implementation, how do nodes share data and detect failure?
A.Asynchronous PADR replication and a heartbeat over TCP/1858
B.A shared cluster disk holds the Safe data and a private heartbeat network detects node liveness
C.Each node keeps an independent copy and clients write to both
D.DNS round-robin between two independent Vaults
Explanation: A CyberArk Cluster Vault is an active-passive Microsoft cluster: both nodes attach to a shared storage volume that holds the Vault data, and a dedicated cluster heartbeat network is used to detect node liveness and arbitrate failover. PADR is used for the separate DR Vault, not for clustering.
7Which port must be reachable from PVWA, CPM, PSM, and PrivateArk Client to the Vault to perform standard PAS operations?
A.TCP/443
B.TCP/389
C.TCP/1858
D.TCP/22
Explanation: All Vault-bound traffic uses CyberArk's proprietary Vault protocol on TCP/1858. PVWA, CPM, PSM, PTA, PrivateArk Client, PACLI, and the REST API gateway all open this port to the Vault. Hardening guides require it to be allowed in the AllowedMachines list and any intervening firewalls.
8You are deploying a second CPM in another data center to handle accounts for that region. Which of the following is the supported way to scope the new CPM only to those accounts?
A.Install the CPM and let it pick up all platforms automatically
B.Install the CPM with a unique CPM name and assign it to specific platforms via the platform's CPM selector / via Safe-level CPM assignment
C.Manually edit the Vault database to filter accounts
D.Two CPMs cannot coexist in the same Vault
Explanation: Multi-CPM deployments install each CPM with a unique name and then assign work to it either by setting the CPM on the platform (so that all accounts using that platform are managed by that CPM) or by assigning the CPM to a specific Safe. This lets you scope CPMs by region or by sensitivity.
9On the PSM server, which two predefined Windows accounts are used for connecting to and administering target sessions?
A.PSMConnect and PSMAdminConnect
B.PSMUser and PSMAdmin
C.PSMGateway and PSMRDP
D.RDPUser and RDPAdmin
Explanation: PSM uses the local accounts PSMConnect (for launching connection sessions to targets) and PSMAdminConnect (for administrators monitoring live sessions). Their passwords are managed through the PSM platform in the Vault and rotated by the CPM.
10What is the difference between a Logon Account and a Reconciliation Account on a managed Unix target?
A.They are the same; the labels are interchangeable
B.The Logon Account is used to log in to the target when the managed account cannot do so directly (e.g. root), and the Reconciliation Account is used to reset the password back to a known value when sync is lost
C.Logon Account stores the password in cleartext; Reconciliation Account encrypts it
D.Reconciliation Account is for SSH only; Logon Account is for RDP only
Explanation: A Logon Account is needed when the managed account cannot perform the privileged operation itself (for example, when root login is disabled and you must SSH as a normal account and elevate). A Reconciliation Account is a privileged account the CPM uses to reset the managed account's password after sync is lost. They serve different stages of credential management.

About the CyberArk PAM-SEN Exam

The CyberArk Sentry - PAM (PAM-SEN) certification validates advanced operational, troubleshooting, and configuration skills across the CyberArk Privileged Access Security suite, including Vault installation/upgrade, DR and clustering, multi-CPM, PSM/PSMP customization, REST API automation, PTA integration, and hardening.

Exam sponsor: CyberArk / Pearson VUE. The requirements and fees below concern the certification or admission exam, separate from our free practice resources.

Questions

65 questions

Time Limit

90 minutes

Passing Score

70%

Exam / Certification Fees

$200

Exam sponsor website

Reported exam pass rate: ~55%. estimated for first-time candidates at the Sentry tier This describes exam candidates, not OpenExamPrep users or results from using our resources. Exam sponsor website

Fees, eligibility, and exam policies can change. Confirm them with the exam sponsor before applying or paying.

Our practice resources: topics covered

We aim to reflect publicly available exam outlines and topic information in our study resources. Coverage, format, and difficulty may differ from the actual exam, and we cannot guarantee that every detail is accurate or current. Confirm exam requirements, fees, and policies with the official exam sponsor.

25%

Vault Installation, Upgrade & Hardening

DBPARM.ini, PADR.ini, TSparm.ini, master CD, Server Key, server hardening, AllowedMachines, AllowNonStandardFWAddresses, upgrade order

20%

Disaster Recovery, Clustering & High Availability

PADR asynchronous replication, DR failover/failback, Cluster Vault on shared storage, multi-PVWA load balancing, multi-site deployment

20%

CPM, Platforms & Connection Components

Multi-CPM design, CACPMScanner, Logon vs Reconciliation accounts, platform XML customization, password policies, dependent/service accounts

20%

PSM, PSMP & Universal Connector

PSMConnect/PSMAdminConnect, AppLocker hardening, Java security, AutoIT dispatchers, Universal Connector for thick/thin/web apps, HTML5 Gateway

10%

REST API, PACLI & Automation

REST authentication and CRUD on Safes/Accounts/Users, PACLI scripts, bulk onboarding, automated session termination

5%

PTA, Authentication & Logging

PTA detections and automatic response, RADIUS 2FA, LDAPS troubleshooting, IWA, ITAlog, PMConsole/PMTrace, psm.log/PSMTrace.log, SIEM forwarding

Preparing for the CyberArk PAM-SEN Exam

What You Need to Know

  • Passing score: 70%
  • Exam length: 65 questions
  • Time limit: 90 minutes
  • Exam / certification fees: $200 Official sources

Using Our Practice Resources

  • Work through all 100 available questions
  • Review every answer and explanation
  • Track weak areas and revisit them
  • Use our AI tutor for tough concepts

CyberArk PAM-SEN: Suggested Study Strategy

1Master DBPARM.ini and PADR.ini line-by-line, including AllowNonStandardFWAddresses, AllowedMachines, syslog forwarding, and PADR replication intervals
2Build a DR Vault in the lab and walk through a full failover and reverse-replication failback so you internalize the PADR runbook
3Set up a multi-CPM deployment and assign platforms/Safes to each CPM to understand scoping, CACPMScanner, and Logon vs Reconciliation accounts
4Author at least one Universal Connector: clone an existing PSM-Web component, edit the AutoIT script, update AppLocker, and adjust Java security if needed
5Practice the REST API end-to-end (Logon, Safes, Safe Members, Accounts, Live Sessions) and rehearse PACLI scripts for bulk onboarding

Frequently Asked Questions

What is the CyberArk PAM-SEN exam format?

The CyberArk Sentry - PAM (PAM-SEN) exam, formerly known as CAU301, has 65 multiple-choice questions with a 90-minute time limit, delivered at Pearson VUE test centers or via online proctoring. A passing score of 70% is required, and the exam fee is $200 USD.

Is CyberArk Defender (PAM-DEF) required before taking PAM-SEN?

CyberArk strongly recommends earning the Defender PAM-DEF (formerly CAU201) first because Sentry assumes you already understand day-to-day Vault, CPM, PVWA, and PSM operation. PAM-SEN focuses on advanced installation, upgrade, troubleshooting, customization, and integration.

What hands-on experience does PAM-SEN expect?

Plan for 1-2 years of hands-on PAS administration, including at least one full Vault install or upgrade, a configured DR Vault with PADR replication, a multi-CPM deployment, custom platforms or Connection Components, and an LDAPS/RADIUS authentication integration.

Which topics are most heavily tested on PAM-SEN?

Vault installation/upgrade with DBPARM.ini and PADR.ini, DR failover and failback, Cluster Vault, multi-CPM scoping, PSM/PSMP customization with AppLocker and AutoIT, platform XML editing, REST/PACLI automation, server hardening, and PTA integration are the highest-yield areas.

How long is the CyberArk PAM-SEN certification valid?

CyberArk Sentry credentials are typically valid for 2 years. Recertification is generally achieved by passing the current Sentry exam again or by passing the CDE (Defender + Sentry) recertification exam (CAU302) within the validity window.

How long should I study for the PAM-SEN exam?

Plan for 80-150 hours over 8-14 weeks if you already hold PAM-DEF and have hands-on experience. Lab time matters most: build a Vault + DR pair, configure a multi-CPM setup, author a Universal Connector with AutoIT/AppLocker, and run REST API scripts end to end.