Ping Identity PAP-001 Exam Questions Instant Access

Question 1

A company uses an internally based legacy PKI solution that does not adhere to the Certification Path Validation section of RFC-5280. Which configuration option needs to be enabled when creating Trusted Certificate Groups in PingAccess?

AUse Java Trust Store

BValidate disordered certificate chains

CSkip Certificate Date Check

DDeny when unable to determine revocation status

Answer : B

Legacy PKIs often provide certificate chains that are out of order or non-compliant with RFC-5280 path validation. PingAccess provides an option in Trusted Certificate Groups called Validate disordered certificate chains to allow chaining even if the order is not RFC-5280 compliant.

Exact Extract:

''Enable Validate disordered certificate chains when the certificate chain is not in RFC-5280 compliant order but should still be accepted.''

Option A is incorrect; using the Java trust store is unrelated to PKI ordering.

Option B is correct --- this setting allows PingAccess to process disordered certificate chains.

Option C is incorrect; date checks are unrelated to RFC-5280 path ordering.

Option D is incorrect; revocation status handling does not address legacy PKI ordering issues.

Question 2

An administrator configures the following:

HTTP Request Parameter Rule for "can_read=yes"

Web Session Attribute Rule for Opt-in = yes

Web Session Attribute Rule for group = customerService

Rule Set A (ALL) includes (HTTP Request Parameter Rule)

Rule Set B (ANY) includes (Opt-in yes, group customerService)

Rule Set Group C (ALL) includes (Rule Set A, Rule Set B)

Assigned to the web application.

Which set of conditions must be met to be able to access the application?

AThe request requires a parameter called can_read with a value of yes. Additionally, the authenticated user must be in customer service and have the opt-in attribute set to yes.

BThe request requires a parameter called can_read with a value of yes unless the authenticated user is in either customer service or has the opt-in attribute set to yes.

CThe request requires a parameter called can_read with a value of yes unless the authenticated user is in customer service and the opt-in attribute set to yes.

DThe request requires a parameter called can_read with a value of yes. The authenticated user must be either in customer service or have the opt-in attribute set to yes.

Answer : D

The Rule Set Group C (ALL) requires both Rule Set A and Rule Set B to evaluate to true.

Rule Set A (ALL) requires can_read=yes.

Rule Set B (ANY) requires either Opt-in=yes OR group=customerService.

Together in Rule Set Group C (ALL), both conditions must hold:

can_read=yes must be present in the request.

User must have either opt-in=yes or be in the customerService group.

This matches Option D exactly.

Option A is incorrect; it requires both attributes in Rule Set B, but B is ANY (either is sufficient).

Option B is incorrect; the ''unless'' wording is misleading --- the parameter is always required because Rule Set A uses ALL.

Option C is incorrect; same reasoning as above, B is ANY not AND.

Option D is correct --- can_read=yes AND (opt-in=yes OR group=customerService).

Question 3

During a business review of an application, the administrator needs to change the Resource Authentication to anonymous. What are the two effects of making this change to the resource? (Choose 2 answers.)

AThe resource requires no further authentication, and no rules will apply.

BThe resource requires no further authentication, and Identity Mappings still apply.

CThe resource requires no further authentication, and Processing rules still apply.

DRequests to this resource are not logged, and Identity Mappings are applied.

EThe resource requires no further authentication, and all Access Control rules still apply.

Answer : B, C

When a resource is configured as anonymous, PingAccess does not challenge the user for authentication. However, certain processing and identity propagation still occur.

Exact Extract:

''Anonymous resources do not require authentication. Identity mappings and request/response processing rules still apply.''

Option A is incorrect because rules such as identity mappings and processing still apply.

Option B is correct --- Identity Mappings can still forward attributes, even for anonymous access.

Option C is correct --- Processing rules (e.g., request/response modifications) still apply.

Option D is incorrect --- requests are logged; anonymous does not disable logging.

Option E is incorrect --- access control rules (authorization) are not evaluated for anonymous resources.

Question 4

An administrator needs to configure a signed JWT identity mapping for an application that expects to be able to validate the signature. Which endpoint does the application need to access to validate the signature?

A/pa/authtoken/JWKS

B/pa-admin-api/v3/identityMappinga/descriptora/jwtidentitymapping

C/pa/aidc/cb

D/pa-admin-api/v3/authTokenManagement

Answer : A

Applications consuming signed JWTs need the JSON Web Key Set (JWKS) endpoint to retrieve the public keys used for validating JWT signatures. PingAccess exposes this at /pa/authtoken/JWKS.

Exact Extract:

''When using JWT identity mapping, applications can obtain the signing keys from the /pa/authtoken/JWKS endpoint to validate the JWT signature.''

Option A is correct --- /pa/authtoken/JWKS provides the key set for signature validation.

Option B is incorrect --- that's an administrative API for configuring identity mappings, not a runtime validation endpoint.

Option C is incorrect --- /pa/aidc/cb is the OIDC callback endpoint.

Option D is incorrect --- /pa-admin-api/v3/authTokenManagement is for admin token management, not JWT validation.

Question 5

A department has a requirement to protect anything in its application that resides in a folder named "escalated," no matter where that folder is in the path. Which path prefix should be used in this situation?

Aescalated/

B*/escalated/

C*/escalated/+

D/*escalated/

Answer : B

PingAccess supports flexible path matching for resources using wildcards. If the requirement is to match any path that contains a folder named 'escalated', the correct format is:

*/escalated/ matches any location of the escalated directory within the path.

Exact Extract:

''The asterisk (*) wildcard matches zero or more characters. Use it in resource paths to match folders at any depth.''

Option A (escalated/) only matches when the resource starts with ''escalated/'' at the root, not at arbitrary depth.

Option B (*/escalated/) is correct --- it matches the escalated folder no matter where it occurs.

Option C (*/escalated/+ ) is incorrect --- + is not a valid PingAccess wildcard operator.

*Option D (/escalated/) matches only when the path starts with ''escalated'' at the first level, not arbitrary positions.

Question 6

Anycompany has several applications that need to load images and fonts from www.anycompany.com. Users are currently getting CORS errors. How should the Cross-Origin Request rule be set to allow secure access?

AAllowed Origins value for each of the listed domains

BAllowed Origins to *.anycompany.com and disable the Allow Credentials option

CAllowed Origins to * and enable the Allow Credentials option

DAllowed Origins to www.anycompany.com and enable the Allow Credentials option

Answer : D

To prevent CORS errors, administrators must configure a Cross-Origin Request (CORS) Processing Rule. The secure practice is to allow the specific trusted domain (www.anycompany.com) and, when cookies or credentials are required, to enable Allow Credentials.

Exact Extract:

''For secure CORS, specify exact origins rather than wildcards. Enable 'Allow Credentials' when client-side resources must include cookies or authentication data.''

Option A is incomplete --- multiple values are possible, but in this case only www.anycompany.com is required.

Option B is less secure --- using a wildcard (*.anycompany.com) broadens exposure unnecessarily.

Option C is insecure --- * with credentials is disallowed by CORS specifications.

Option D is correct --- restricts access to the trusted domain and allows credentialed requests.

Question 7

What is the purpose of PingAccess processing rules?

ATo collect data for offline processing

BTo modify web traffic in real time

CTo override upstream access control decisions

DTo allow for more detailed auditing

Answer : B

Processing Rules in PingAccess apply transformations to HTTP traffic (requests or responses) in real time, such as modifying headers, handling CORS, or rewriting cookies.

Exact Extract:

''Processing rules allow PingAccess to modify HTTP requests and responses in real time, such as adding headers or enabling cross-origin requests.''

Option A is incorrect --- they are not for offline data collection.

Option B is correct --- their purpose is real-time modification of web traffic.

Option C is incorrect --- access control rules enforce or override authorization, not processing rules.

Option D is incorrect --- auditing is handled in log configurations, not processing rules.

Ping Identity Certified Professional - PingAccess PAP-001 Exam Questions