BeyondTrust PRA Practice Test

BeyondTrust PRA practice test: what's covered

• Vendor Access
• Session Auditing
• Jump Zones

Free BeyondTrust PRA sample questions

1. You need to grant a short-term contractor access to a specific database server for 48 hours. The contractor should not consume a permanent license and must authenticate without an Active Directory account. Which feature best satisfies these requirements?

   • A. Vendor Auth Provider with a local policy
   • B. SAML integration with the corporate IdP
   • C. Vendor Onboarding using an external user invitation
   • D. Jumpoint with a shared credential
   Show answer

   Correct: C. Vendor Onboarding allows administrators to invite external users (like contractors) via email. They authenticate through the provided link without needing an AD account, and their access can be time-boxed (e.g., 48 hours). Vendor Auth Provider is not a standard PRA feature. SAML requires an identity provider account. Jumpoint is a conduit, not an authentication method.

2. A vendor requires access to multiple Linux servers. The security team insists the vendor must explicitly agree to a custom acceptable use policy before establishing any SSH session. How is this configured in BeyondTrust PRA?

   • A. Enable the Session Policy and configure a Custom Agreement prompt
   • B. Configure a pre-session API script to prompt the user
   • C. Set the Acceptable Use Policy in the Jump Group settings
   • D. Apply an Access Policy that requires an explicit Acceptance Agreement
   Show answer

   Correct: D. Access Policies in BeyondTrust PRA can be configured to display a custom notification or agreement that the user must accept before the session initiates. Session Policy controls session behaviors, but Access Policies govern entry. API scripts are not used for native user prompts. Jump Group settings do not directly contain the agreement text.

3. A security policy requires that an internal sponsor be alerted immediately whenever a vendor initiates a session to a critical server. Which two methods can be used to satisfy this requirement? (Select two)

   • A. Configuring an Access Policy with an Authorization requirement
   • B. Setting an outbound SNMP trap on the Jump Client
   • C. Using the Outbound Event API to trigger an ITSM workflow
   • D. Installing a local agent on the vendor's workstation
   Show answer

   Correct: A and C. An Access Policy can require authorization, which sends an email notification to a sponsor who must approve or deny the access. Alternatively, the Outbound Event API can send webhooks to ITSM tools (like ServiceNow) to notify or log the event. SNMP traps are not configured on individual Jump Clients. Local agents do not handle sponsor notifications.

4. A group of external developers needs temporary access to a Jump Group. You want their access to automatically expire at the end of the month. Where is this expiration date configured?

   • A. In the Jump Group configuration under 'Expiration'
   • B. In the Vendor Group policy under 'Account Expiration'
   • C. In the Group Policy applied to the developers' accounts
   • D. In the Access Policy associated with the Jump Item
   Show answer

   Correct: C. Account expiration and role-based access are defined in the Group Policy assigned to the users. Group Policies control when the account or group membership expires, automatically revoking access at the end of the month. Jump Groups contain items, not user expirations. Access Policies control session rules, not account lifecycles.

5. When configuring Vendor Onboarding, which setting ensures that a vendor cannot share their invitation link with unauthorized users?

   • A. Require multi-factor authentication (MFA) for the invitation link
   • B. Bind the invitation link to the vendor's source IP address
   • C. Set the invitation to be single-use or require email verification upon clicking
   • D. Configure a VPN requirement for the invitation URL
   Show answer

   Correct: C. Vendor invitations can be restricted by requiring an email verification step (OTP sent to the email) when clicking the link, ensuring only the email owner can use it. IP binding and VPN requirements are not native invitation features. MFA is typically configured via an IdP, whereas Vendor Onboarding leverages email verification for standalone access.

Last updated: 2026-10-19

BeyondTrust PRA practice test FAQ