CAD Privileged Threat Analytics 3

Question 1

Which PTA detection identifies when a user account authenticates from two geographically distant locations within an impossibly short time window?

Accepted Answer

Impossible travel alert

Answer

Impossible travel alerts fire when the same account authenticates from locations that cannot be reached within the elapsed time, suggesting credential compromise.

Question 2

In PTA's risk scoring model, which factor would MOST increase the risk score of a detected event?

Accepted Answer

The account is a highly privileged administrator account managed in the Vault

Answer

PTA weights events higher when the involved account holds elevated privileges, as compromise of such accounts carries greater organizational risk.

Question 3

Which type of attack does PTA detect when it observes an account performing authentication using an NT hash instead of a plaintext password?

Accepted Answer

Pass-the-Hash

Answer

Pass-the-Hash attacks authenticate using the NT hash directly, bypassing the need for plaintext credentials, and PTA identifies this pattern.

Question 4

What does PTA use to establish a behavioral baseline for privileged accounts?

Accepted Answer

Historical activity data collected over a learning period

Answer

PTA analyzes historical account behavior over a learning period to build baselines that allow it to identify deviations indicating threats.

Question 5

A PTA alert shows 'Suspected DCSync attack.' What does this indicate?

Accepted Answer

An attacker is synchronizing Active Directory replication to extract all password hashes

Answer

A DCSync attack abuses AD replication protocols to pull password hashes for all domain accounts, effectively dumping the entire directory.

(CAD) CyberArk Defender Certification Practice Test

(CAD) CyberArk Defender Certification Practice Test

CAD Privileged Threat Analytics 3