Ping Identity PAP-001 Exam Questions Instant Access

Question 1

Any user who accesses an application must be in sales unless the user is a manager in the marketing department. The administrator creates the following web session rules:

(A) Look for department = sales

(B) Look for department = marketing

Which additional actions should be taken to properly enforce this requirement?

ACreate a Rule Set (D) to accept ALL (A) (B AND C) Add Rule Set (D) to the resource

BCreate a Rule Set (D) to accept ANY (A) (B) (C) Add Rule Set (D) to the resource

CCreate a Rule Set (D) to accept ALL (A) Create a Rule Set (E) to accept ANY (B) (C) Create a Rule Set Group (F) to accept ALL (D) (E) Add Rule Set Group (F) to the resource

DCreate a Rule Set (D) to accept ANY (A) Create a Rule Set (E) to accept ALL (B) (C) Create a Rule Set Group (F) to accept ANY (D) (E) Add Rule Set Group (F) to the resource

Answer : D

The requirement is:

Allow access if user is in sales

OR if user is in marketing AND is a manager

This is logically represented as:

(A) OR (B AND C)

To configure this in PingAccess:

Rule Set (D) = ANY (A)

Rule Set (E) = ALL (B, C)

Rule Set Group (F) = ANY (D, E)

Assign Group (F) to the resource

This exactly matches Option D.

Option A is incorrect --- requires both A and (B AND C), which is stricter than the requirement.

Option B is incorrect --- ANY(A, B, C) would allow users in marketing or managers without requiring both.

Option C is incorrect --- it uses ALL(D, E), which would require both conditions instead of OR.

Option D is correct --- it models (A OR (B AND C)).

Question 2

An administrator configures the following:

HTTP Request Parameter Rule for "can_read=yes"

Web Session Attribute Rule for Opt-in = yes

Web Session Attribute Rule for group = customerService

Rule Set A (ALL) includes (HTTP Request Parameter Rule)

Rule Set B (ANY) includes (Opt-in yes, group customerService)

Rule Set Group C (ALL) includes (Rule Set A, Rule Set B)

Assigned to the web application.

Which set of conditions must be met to be able to access the application?

AThe request requires a parameter called can_read with a value of yes. Additionally, the authenticated user must be in customer service and have the opt-in attribute set to yes.

BThe request requires a parameter called can_read with a value of yes unless the authenticated user is in either customer service or has the opt-in attribute set to yes.

CThe request requires a parameter called can_read with a value of yes unless the authenticated user is in customer service and the opt-in attribute set to yes.

DThe request requires a parameter called can_read with a value of yes. The authenticated user must be either in customer service or have the opt-in attribute set to yes.

Answer : D

The Rule Set Group C (ALL) requires both Rule Set A and Rule Set B to evaluate to true.

Rule Set A (ALL) requires can_read=yes.

Rule Set B (ANY) requires either Opt-in=yes OR group=customerService.

Together in Rule Set Group C (ALL), both conditions must hold:

can_read=yes must be present in the request.

User must have either opt-in=yes or be in the customerService group.

This matches Option D exactly.

Option A is incorrect; it requires both attributes in Rule Set B, but B is ANY (either is sufficient).

Option B is incorrect; the ''unless'' wording is misleading --- the parameter is always required because Rule Set A uses ALL.

Option C is incorrect; same reasoning as above, B is ANY not AND.

Option D is correct --- can_read=yes AND (opt-in=yes OR group=customerService).

Question 3

What is the purpose of the Mutual TLS Site Authenticator?

AAllows the backend server to authenticate to PingAccess

BAllows the user to authenticate to the backend server

CAllows PingAccess to authenticate to the backend server

DAllows PingAccess to authenticate to the token provider

Answer : C

Mutual TLS (mTLS) is used to establish two-way authentication where both the client and the server present certificates to prove their identity. In the case of PingAccess, a Mutual TLS Site Authenticator is configured when PingAccess acts as a reverse proxy making requests to a backend (target) server.

Exact Extract from PingAccess documentation:

''Mutual TLS site authenticators provide client certificate authentication when PingAccess connects to a backend site. This allows PingAccess to present its certificate to the target server during the TLS handshake.''

This means the purpose is for PingAccess (client) to authenticate itself to the backend server (target resource) when establishing a secure connection.

Why other options are wrong:

A . Allows the backend server to authenticate to PingAccess

Incorrect. That's normal server-side TLS authentication (the server presents a cert to the client), not mutual TLS initiated by PingAccess.

B . Allows the user to authenticate to the backend server

Incorrect. End users do not directly use this setting; this is between PingAccess and the backend application server.

C . Allows PingAccess to authenticate to the backend server

Correct. This is exactly the definition of a Mutual TLS Site Authenticator in PingAccess.

D . Allows PingAccess to authenticate to the token provider

Incorrect. That would involve OIDC/OAuth token exchange and possibly TLS trust, but it's not the role of the Site Authenticator.

Thus, the correct answer is C. Allows PingAccess to authenticate to the backend server.

Question 4

An administrator needs to configure an application that uses a backend web server that has its own authentication mechanism. Which type of object must be configured for PingAccess to provide access to the target server?

AToken Provider

BWeb Session

CSite Authenticator

DAccess Control Rule

Answer : C

When a backend application requires its own authentication (e.g., Basic Auth or mutual TLS), PingAccess uses a Site Authenticator to inject the necessary credentials.

Exact Extract:

''Site Authenticators provide the credentials PingAccess uses when authenticating to target applications that require their own authentication mechanisms.''

Option A (Token Provider) is incorrect --- this is used for OIDC/OAuth tokens, not site-level authentication.

Option B (Web Session) manages end-user sessions, not backend site authentication.

Option C (Site Authenticator) is correct --- it handles authentication between PingAccess and the backend.

Option D (Access Control Rule) enforces authorization, not backend authentication.

Question 5

An application is hosted on a server that requires clients to authenticate using a username:password pair. This application is behind PingAccess, which is acting as a gateway. What action should the administrator take to allow PingAccess to access the application?

AApply an Identity Mapping that includes the username and password

BApply a valid Web Session that contains the username and password

CConfigure a Basic Authentication Site Authenticator to the Site

DConfigure a Mutual TLS Site Authenticator to the Site

Answer : C

When a back-end site requires HTTP Basic Authentication, PingAccess supports this via a Basic Authentication Site Authenticator. The authenticator is configured with credentials so that PingAccess can successfully authenticate to the target site.

Exact Extract:

''PingAccess can authenticate to target sites using a Site Authenticator. Use the Basic Authentication Site Authenticator when the site requires a username and password.''

Option A is incorrect --- identity mappings are used to forward user attributes, not for site-to-site authentication.

Option B is incorrect --- web sessions represent end-user sessions, not back-end credentials.

Option C is correct --- the Basic Authentication Site Authenticator should be configured on the Site.

Option D is incorrect --- mTLS authenticates with certificates, not username/password.

Question 6

During a business review of an application, the administrator needs to change the Resource Authentication to anonymous. What are the two effects of making this change to the resource? (Choose 2 answers.)

AThe resource requires no further authentication, and no rules will apply.

BThe resource requires no further authentication, and Identity Mappings still apply.

CThe resource requires no further authentication, and Processing rules still apply.

DRequests to this resource are not logged, and Identity Mappings are applied.

EThe resource requires no further authentication, and all Access Control rules still apply.

Answer : B, C

When a resource is configured as anonymous, PingAccess does not challenge the user for authentication. However, certain processing and identity propagation still occur.

Exact Extract:

''Anonymous resources do not require authentication. Identity mappings and request/response processing rules still apply.''

Option A is incorrect because rules such as identity mappings and processing still apply.

Option B is correct --- Identity Mappings can still forward attributes, even for anonymous access.

Option C is correct --- Processing rules (e.g., request/response modifications) still apply.

Option D is incorrect --- requests are logged; anonymous does not disable logging.

Option E is incorrect --- access control rules (authorization) are not evaluated for anonymous resources.

Question 7

A PingAccess API deployment requires multiple Access Token Managers to maintain compliance with customer requirements. Which feature must be set on the Token Provider configuration?

ASubject Attribute Name

BSend Audience

CUse Token Introspection Endpoint

DClient Secret

Answer : B

When using multiple Access Token Managers, the Send Audience option ensures that tokens are scoped properly and validated against the intended resource/application.

Exact Extract:

''Enable Send Audience in the token provider configuration to support environments with multiple Access Token Managers and enforce correct audience restrictions.''

Option A (Subject Attribute Name) is unrelated --- it maps user identity but not token manager selection.

Option B (Send Audience) is correct --- required when multiple ATMs are in use.

Option C (Use Token Introspection Endpoint) is optional and depends on deployment, not mandatory for multiple ATMs.

Option D (Client Secret) is part of OAuth client credentials, not specific to multiple ATMs.

Ping Identity Certified Professional - PingAccess PAP-001 Exam Questions