CyberArk Defender (CAU201) is a defender-level CyberArk certification exam. The blueprint splits the exam across 5 domains, starting with PAM Architecture, Vault Administration, Policy Management. On exam day you face around 60 questions in 90 minutes, in formats such as multiple-choice. The 20 questions below are free samples written to match that style: answer each one first, then reveal the correct answer and note which topics you miss. The CAU201 is rated medium in difficulty, and most candidates prepare with at least 6 months of hands-on experience. Because every answer is revealed in place, you can work through the whole set without leaving this page. Work through all 20 samples before deciding whether to buy the full 142+ question PDF.
Looking for more? Click here to get the full PDF with 142+ practice questions for $10 for offline study and deeper preparation.
Which parameter controls how often the CPM looks for Soon-to-be-expired Passwords that need to be changed?
Which of the following components can be used to create a tape backup of the Vault?
Which one of the following reports is NOT generated by using the PVWA?
A Vault administrator have associated a logon account to one of their Unix root accounts in the vault. When attempting to verify the root account's password the Central Policy Manager (CPM) will:
You are creating a new Rest API user that utilizes CyberArk Authentication. What is a correct process to provision this user?
You are creating a Dual Control workflow for a team's safe. Which safe permissions must you grant to the Approvers group?
Which is the primary purpose of exclusive accounts?
Which Automatic Remediation is configurable for a PTA detection of a `Suspected Credential Theft`?
VAULT authorizations may be granted to ____________________. (Choose all that apply.)
If a password is changed manually on a server, bypassing the CPM, how would you configure the account so that the CPM could resume management automatically?
Which usage can be added as a service account platform?
In order to connect to a target device through PSM, the account credentials used for the connection must be stored in the vault?
When Dual Control is enabled a user must first submit a request in the Password Vault Web Access (PVWA) and receive approval before being able to launch a secure connection via PSM for Windows (previously known as RDP Proxy).
When a DR Vault Server becomes an active vault, it will automatically fail back to the original state once the Primary Vault comes back online.
You have been asked to turn off the time access restrictions for a safe. Where is this setting found?
Target account platforms can be restricted to accounts that are stored in specific Safes using the AllowedSafes property.
To enable the Automatic response `Add to Pending` within PTA when unmanaged credentials are found, what are the minimum permissions required by PTAUser for the PasswordManager_pending safe?
PSM captures a record of each command that was executed in Unix.
The vault supports Subnet Based Access Control.
Which of these accounts onboarding methods is considered proactive?
No. They are original practice questions written to match the format and topic mix of the CyberArk Defender exam, which contains around 60 questions. Treat them as representative practice, not leaked exam content.
This page includes 20 questions, each with its correct answer you can reveal in place. The full study PDF expands that to 142+ questions.
Yes. Open the answer panel under each question to see which option is correct. Answer first, then reveal, so the set works as a self-check rather than a reading exercise.
Not on its own. Use the samples to find weak topics, revise them against the official domains, then work through the full 142+ question set under timed conditions before booking the exam.
Download the complete CAU201 study bundle with 142+ questions in a single printable PDF.