CAD Privileged Threat Analytics 2

Question 1

Which data source does CyberArk PTA use to detect suspicious Kerberos activity such as Golden Ticket attacks?

Accepted Answer

Windows Event Logs from domain controllers

Answer

PTA ingests Windows Event Logs from domain controllers to detect Kerberos anomalies like Golden Ticket and Pass-the-Ticket attacks.

Question 2

In CyberArk PTA, what does a 'suspected credential theft' alert typically indicate?

Accepted Answer

Credentials were extracted from memory using tools like Mimikatz

Answer

Suspected credential theft alerts in PTA indicate that credential extraction tools may have dumped passwords or hashes from memory.

Question 3

How does PTA classify accounts that are discovered performing privileged actions but are not managed by the CyberArk Vault?

Accepted Answer

Unmanaged privileged accounts

Answer

PTA identifies and classifies accounts performing privileged activity without Vault management as unmanaged privileged accounts.

Question 4

When PTA detects a threat and automatically responds by rotating a compromised account's password, this capability is known as:

Accepted Answer

Automatic response

Answer

PTA's automatic response feature triggers actions such as password rotation or account suspension when a threat is confirmed.

Question 5

Which PTA detection scenario identifies an attacker who has obtained a long-lived Kerberos ticket that does not expire normally?

Accepted Answer

Golden Ticket

Answer

A Golden Ticket attack forges a Kerberos TGT signed with the KRBTGT hash, producing a ticket with an abnormally long lifetime.

(CAD) CyberArk Defender Certification Practice Test