CAD Privileged Threat Analytics 3 — Questions and Answers
Question 1: Which PTA detection identifies when a user account authenticates from two geographically distant locations within an impossibly short time window?
- Brute force detection
- Impossible travel alert (Correct answer)
- Lateral movement alert
- Time-based access violation
Correct answer: Impossible travel alert
Impossible travel alerts fire when the same account authenticates from locations that cannot be reached within the elapsed time, suggesting credential compromise.
Question 2: In PTA's risk scoring model, which factor would MOST increase the risk score of a detected event?
- The account belongs to a non-privileged standard user
- The account is a highly privileged administrator account managed in the Vault (Correct answer)
- The event occurred during normal business hours
- The source IP belongs to a known internal workstation
Correct answer: The account is a highly privileged administrator account managed in the Vault
PTA weights events higher when the involved account holds elevated privileges, as compromise of such accounts carries greater organizational risk.
Question 3: Which type of attack does PTA detect when it observes an account performing authentication using an NT hash instead of a plaintext password?
- Pass-the-Ticket
- Pass-the-Hash (Correct answer)
- Kerberoasting
- DCSync
Correct answer: Pass-the-Hash
Pass-the-Hash attacks authenticate using the NT hash directly, bypassing the need for plaintext credentials, and PTA identifies this pattern.
Question 4: What does PTA use to establish a behavioral baseline for privileged accounts?
- Manual configuration profiles set by the security team
- Historical activity data collected over a learning period (Correct answer)
- CyberArk Vault policy definitions
- Static rule signatures from a threat intelligence feed
Correct answer: Historical activity data collected over a learning period
PTA analyzes historical account behavior over a learning period to build baselines that allow it to identify deviations indicating threats.
Question 5: A PTA alert shows 'Suspected DCSync attack.' What does this indicate?
- An attacker is synchronizing Active Directory replication to extract all password hashes (Correct answer)
- A domain controller failed to replicate group policy objects
- A user is attempting to sync offline files from a domain share
- A DNS zone transfer was initiated without authorization
Correct answer: An attacker is synchronizing Active Directory replication to extract all password hashes
A DCSync attack abuses AD replication protocols to pull password hashes for all domain accounts, effectively dumping the entire directory.
Question 6: Which PTA feature allows security teams to review a timeline of all events associated with a specific privileged account after an alert fires?
- Threat investigation view (Correct answer)
- Vault audit log
- PSM session player
- Compliance report dashboard
Correct answer: Threat investigation view
PTA's threat investigation view provides a chronological timeline of account activity to help analysts understand the full scope of a detected threat.
Question 7: Which network protocol activity does PTA primarily monitor to detect lateral movement between Windows hosts?
- HTTP/HTTPS web traffic
- SMB and Kerberos authentication traffic (Correct answer)
- DNS query volume
- SMTP email relay traffic
Correct answer: SMB and Kerberos authentication traffic
PTA monitors SMB and Kerberos traffic patterns to detect lateral movement techniques such as Pass-the-Hash and Pass-the-Ticket.
CAD Privileged Threat Analytics 3
Which PTA detection identifies when a user account authenticates from two geographically distant locations within an impossibly short time window?