Explanation
To restore DR replication to normal after network activity caused the PrivateArk Server on the DR Vault to become active while the Primary Vault was also running, you should first shut down the PrivateArk Server on the DR Vault. This ensures that the DR Vault is no longer active and can be prepared for replication. After shutting down the server, you should then start the replication process on the DR Vault to synchronize the data from the Primary Vault1.
References:
* CyberArk's official documentation on initiating a DR failback to the Production Vault provides a detailed procedure for restoring DR replication to normal1.
* Additional information on monitoring backup and DR replications can be found in CyberArk's documentation2.
* For further study and understanding of the CyberArk Defender PAM course objectives and documents, the official CyberArk training resources and study guides are recommended3.

Explanation
To create a cold storage backup, you would install the PAReplicate utility on the DR Vault as per the installation guide. This utility is part of the CyberArk Vault's backup solution and is used to export the encrypted contents of your Safes securely to a computer outside the Vault environment. After installation, you would configure the logon ini file with the necessary credentials and define the scheduled tasks for both full and incremental backups. This ensures that the Safes are regularly backed up and that the data is available for recovery if needed1.
References:
* CyberArk's official documentation on using the CyberArk Backup Process, which includes details on the PAReplicate utility and how to configure it for cold storage backups1.
* Additional information on installing the Vault Backup Utility and configuring backup options, which
* provides context for the correct answer

Explanation
To support LDAP over SSL, the Vault requires the CA Certificate(s) that were used to sign the certificate of the External Directory. This is necessary to establish a trusted SSL connection between the Vault and the External Directory. The CA Certificate(s) must be imported into the Windows certificate store on the Vault machine to facilitate this SSL connection1. References: The information provided is based on general knowledge of CyberArk PAM best practices and the requirements for configuring LDAP over SSL as outlined in CyberArk's official documentation1.