CyberArk PAM-SEN Exam - Topic 1 Question 62 Discussion

Actual exam question for CyberArk's PAM-SEN exam

Question #: 62
Topic #: 1

To enable LDAP over SSL for a Vault when DNS lookups are blocked, which step must be completed?

AAdd the FQDN & IP details for each LDAP host into the local hosts file of the Vault server. Most Voted

BConfigure an AllowNonStandardFWAddresses rule in DBParm.ini on the Vault to allow outbound TCP 53 to the organization's DNS servers.

CEnsure LDAP hosts added to the directory mapping configuration are defined using only IP addresses.

DSet the ReferralsDNSLookup parameter value to ''No'' in the directory configuration.

Show Suggested Answer

Suggested Answer: A

by Charlie at Jul 13, 2025, 07:06 PM

Limited Time Offer

25%

Off

Get Premium PAM-SEN Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Brianne

5 months ago

Nope, it's definitely A. Trust me on this!

upvoted 0 times

...

Dawne

5 months ago

Wait, is that really necessary?

upvoted 0 times

...

Dorthy

5 months ago

Gotta add FQDN & IP to the hosts file!

upvoted 0 times

...

Galen

6 months ago

Totally agree, that's the way to go.

upvoted 0 times

...

Dorathy

6 months ago

I think it's option C, just use IPs.

upvoted 0 times

...

Jaclyn

6 months ago

Setting the ReferralsDNSLookup parameter to 'No' seems like it could help, but I wonder if that's the main step we need to focus on for SSL.

upvoted 0 times

...

Miss

6 months ago

I practiced a similar question where we had to ensure LDAP hosts were defined correctly. I feel like using only IP addresses might be important here.

upvoted 0 times

...

Adell

7 months ago

I remember something about configuring DNS settings, but I can't recall if it's about allowing outbound TCP 53 or something else.

upvoted 0 times

...

Nina

7 months ago

I think we might need to add the FQDN and IP details to the local hosts file, but I'm not entirely sure if that's the only step required.

upvoted 0 times

...

Willow

7 months ago

This is a good question. I'll need to review my notes on LDAP configuration to make sure I'm approaching it the right way.

upvoted 0 times

...

Reita

7 months ago

I'm pretty confident I know the answer to this one. It's option A - adding the FQDN and IP details to the local hosts file. That's the way to go when DNS lookups are blocked.

upvoted 0 times

...

Maile

7 months ago

Okay, I think I've got this. The key is to add the FQDN and IP details for the LDAP hosts into the local hosts file on the Vault server. That should do the trick.

upvoted 0 times

...

Catina

8 months ago

Hmm, I'm a bit confused by the wording of the question. I'll need to re-read it a few times to make sure I understand what they're asking.

upvoted 0 times

...

Nicolette

8 months ago

This looks like a tricky one. I'll need to think through the steps carefully to make sure I get the right answer.

upvoted 0 times

...

Nikita

9 months ago

I'm feeling option A. Editing the hosts file is always a reliable way to bypass DNS issues. It's like going back to the stone age of networking!

upvoted 0 times

Yesenia

8 months ago

I think option B might be more practical in this situation. Allowing outbound TCP 53 could solve the issue.

upvoted 0 times

...

Reynalda

8 months ago

I agree, editing the hosts file is a classic workaround for DNS problems.

upvoted 0 times

...

Chau

10 months ago

D all the way! Turning off DNS lookups is the simplest solution. Who needs those pesky domain names anyway?

upvoted 0 times

Chauncey

8 months ago

B) Configure an AllowNonStandardFWAddresses rule in DBParm.ini on the Vault to allow outbound TCP 53 to the organization's DNS servers.

upvoted 0 times

...

Johanna

8 months ago

A) Add the FQDN & IP details for each LDAP host into the local hosts file of the Vault server.

upvoted 0 times

...

Holley

8 months ago

A) Add the FQDN & IP details for each LDAP host into the local hosts file of the Vault server.

upvoted 0 times

...

Carylon

10 months ago

I'm not sure, but I think B) Configure an AllowNonStandardFWAddresses rule in DBParm.ini on the Vault to allow outbound TCP 53 to the organization's DNS servers could also be a valid option.

upvoted 0 times

...

Jani

10 months ago

Haha, option B is a classic! Trying to open up the firewall for DNS traffic? That's like trying to solve a broken leg with a bandaid.

upvoted 0 times

...

Bernardine

10 months ago

For LDAP over SSL, I'd go with option C. Using IP addresses is the way to go when DNS lookups are blocked. No need to mess with the hosts file or firewall rules.

upvoted 0 times