exam questions

Exam EPM-DEF All Questions

View all questions & answers for the EPM-DEF exam

Exam EPM-DEF topic 1 question 43 discussion

Actual exam question from CyberArk's EPM-DEF
Question #: 43
Topic #: 1
[All EPM-DEF Questions]

An application has been identified by the LSASS Credentials Harvesting Module.
What is the recommended approach to excluding the application?

  • A. In Agent Configurations, add the application to the Threat Protection Exclusions.
  • B. Add the application to the Files to be Ignored Always in Agent Configurations.
  • C. Exclude the application within the LSASS Credentials Harvesting module.
  • D. Add the application to an Advanced Policy or Application Group with an Elevate policy action.
Show Suggested Answer Hide Answer
Suggested Answer: A 🗳️

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
denianbqe
Highly Voted 1 year, 2 months ago
The correct answer is C: Exclude the application within the LSASS Credentials Harvesting module. In v23.11.1 is possible to configure the application exceptions from LSASS validation directly on LSASS CH module screen when enabled. The A and B options exclude the application from ALL EPM VALIDATIONS. This is not asked for in the question.
upvoted 6 times
...
Takumi
Most Recent 11 months ago
Selected Answer: C
The answer is C. https://docs.cyberark.com/EPM/Latest/en/Content/Policies/ConfigureThreatProtection-NewUI.htm
upvoted 2 times
...
Hyper
1 year, 5 months ago
correct answer is a To view global excluded applications, go to Agent Configuration > Threat Protection > Excluded Applications. https://docs.cyberark.com/EPM/22.12.0/en/Content/EPM/Server%20User%20Guide/ConfigureThreatProtection.htm
upvoted 1 times
...
pathomas1971
1 year, 5 months ago
Selected Answer: B
B. Add the application to the Files to be Ignored Always in Agent Configurations. The recommended approach to excluding an application that has been identified by the LSASS Credentials Harvesting Module in CyberArk EPM (Endpoint Privilege Manager) is to add the application to the "Files to be Ignored Always" list in Agent Configurations. By adding the application to this list, you are instructing EPM to ignore this application's behavior, even if it is flagged by certain modules like the LSASS Credentials Harvesting Module. This helps prevent false positives and ensures that legitimate applications are not unnecessarily blocked or restricted.
upvoted 1 times
...
Hyper
1 year, 5 months ago
Selected Answer: B
correct
upvoted 1 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
Loading ...