Ping Identity PAP-001 Exam Questions Instant Access

Question 1

An administrator is integrating a new PingAccess Proxied Application. The target site uses a certificate issued by an internal Certificate Authority hosted by the customer. Prior to assigning the certificate group in the Site configuration, which action should the administrator take to configure PingAccess to trust the certificate?

AConfigure the PingAccess Site to use the Java Trust Store Certificate Group.

BImport the certificate chain into Key Pairs and add it to the Trusted Certificate Group.

CImport the certificate chain into Key Pairs and assign it to a new engine listener.

DImport the certificate chain and add it to the Trusted Certificate Group.

Answer : D

PingAccess must trust the back-end site's certificate to establish TLS. For internally issued certificates, the administrator imports the certificate chain into a Trusted Certificate Group.

Exact Extract:

''When a target site uses an internal CA, import the certificate or chain into a Trusted Certificate Group and assign that group to the site.''

Option A is incorrect --- the Java trust store does not contain the internal CA by default.

Option B is incorrect --- Key Pairs store private keys for SSL termination, not trusted CA certs.

Option C is incorrect --- engine listeners use key pairs for inbound SSL, not site trust.

Option D is correct --- the certificate must be imported into Trusted Certificate Groups.

Question 2

Any user who accesses an application must be in sales unless the user is a manager in the marketing department. The administrator creates the following web session rules:

(A) Look for department = sales

(B) Look for department = marketing

Which additional actions should be taken to properly enforce this requirement?

ACreate a Rule Set (D) to accept ALL (A) (B AND C) Add Rule Set (D) to the resource

BCreate a Rule Set (D) to accept ANY (A) (B) (C) Add Rule Set (D) to the resource

CCreate a Rule Set (D) to accept ALL (A) Create a Rule Set (E) to accept ANY (B) (C) Create a Rule Set Group (F) to accept ALL (D) (E) Add Rule Set Group (F) to the resource

DCreate a Rule Set (D) to accept ANY (A) Create a Rule Set (E) to accept ALL (B) (C) Create a Rule Set Group (F) to accept ANY (D) (E) Add Rule Set Group (F) to the resource

Answer : D

The requirement is:

Allow access if user is in sales

OR if user is in marketing AND is a manager

This is logically represented as:

(A) OR (B AND C)

To configure this in PingAccess:

Rule Set (D) = ANY (A)

Rule Set (E) = ALL (B, C)

Rule Set Group (F) = ANY (D, E)

Assign Group (F) to the resource

This exactly matches Option D.

Option A is incorrect --- requires both A and (B AND C), which is stricter than the requirement.

Option B is incorrect --- ANY(A, B, C) would allow users in marketing or managers without requiring both.

Option C is incorrect --- it uses ALL(D, E), which would require both conditions instead of OR.

Option D is correct --- it models (A OR (B AND C)).

Question 3

A PingAccess API deployment requires multiple Access Token Managers to maintain compliance with customer requirements. Which feature must be set on the Token Provider configuration?

ASubject Attribute Name

BSend Audience

CUse Token Introspection Endpoint

DClient Secret

Answer : B

When using multiple Access Token Managers, the Send Audience option ensures that tokens are scoped properly and validated against the intended resource/application.

Exact Extract:

''Enable Send Audience in the token provider configuration to support environments with multiple Access Token Managers and enforce correct audience restrictions.''

Option A (Subject Attribute Name) is unrelated --- it maps user identity but not token manager selection.

Option B (Send Audience) is correct --- required when multiple ATMs are in use.

Option C (Use Token Introspection Endpoint) is optional and depends on deployment, not mandatory for multiple ATMs.

Option D (Client Secret) is part of OAuth client credentials, not specific to multiple ATMs.

Question 4

A business requires logs to be written to a centralized Oracle database. Which two actions must the PingAccess administrator take to enable this? (Choose 2 answers.)

AConfigure log4j2.xml and log4j2.db.properties.

BRemove the logs located in PA_HOME/log.

CEnable the Audit flag in the Resource.

DCopy the database driver JAR file to the PA_HOME/lib directory.

EImport the database certificate into the Trusted Certificate Group.

Answer : A, D

PingAccess supports logging directly to a relational database using Log4j database appenders. To enable this:

Configure log4j2.xml to use a JDBC Appender.

Configure log4j2.db.properties with the database connection information.

Provide the appropriate database driver in the PA_HOME/lib directory.

Exact Extract:

''To log to a database, configure log4j2.xml and log4j2.db.properties, and place the JDBC driver JAR file in PA_HOME/lib.''

Option A is correct --- both files must be configured.

Option B is incorrect --- existing logs do not need removal.

Option C is incorrect --- enabling audit is unrelated to database logging.

Option D is correct --- the Oracle JDBC driver must be installed in PA_HOME/lib.

Option E is incorrect unless TLS is used to connect to the DB, but it is not required for standard DB logging setup.

Question 5

How many administrators are supported using HTTP Basic Authentication in the Administrative Console?

A1000

C10

D100

Answer : B

When using HTTP Basic Authentication (admin.auth=native), PingAccess only supports a single administrative account (the default admin user). For multiple administrators, SSO integration (e.g., OIDC) is required.

Exact Extract:

''When admin authentication is set to native (HTTP Basic), only one administrative user is supported. For multiple admins, configure UI authentication with an OIDC provider.''

Option A (1000) is incorrect.

Option B (1) is correct --- only one basic auth admin account.

Option C (10) and Option D (100) are incorrect.

Question 6

Which two protocols does PingAccess use for authentication and authorization? (Choose 2 answers.)

ASAML

BWS-Fed

CWS-Trust

DOAuth2

EOIDC

Answer : D, E

PingAccess is designed to work with modern identity protocols. It does not support legacy WS-* protocols directly.

Exact Extract:

''PingAccess integrates with OAuth 2.0 and OpenID Connect (OIDC) to provide authentication and authorization for web and API resources.''

Option A (SAML) is incorrect --- PingAccess does not natively consume SAML assertions; SAML can be used indirectly via PingFederate.

Option B (WS-Fed) is not supported.

Option C (WS-Trust) is not supported.

Option D (OAuth2) is correct --- used for authorization and token validation.

Option E (OIDC) is correct --- used for user authentication and sessions.

Question 7

An administrator is integrating a new PingAccess Proxied Application for which the target site uses a certificate issued by a publicly trusted Certificate Authority.

How should the administrator configure PingAccess to trust the target site?

AImport the certificate chain into Key Pairs and add it to a Trusted Certificate Group

BConfigure the PingAccess Site to use the Java Trust Store Certificate Group

CImport the certificate chain into Key Pairs

DDrop the certificate chain into a Trusted Certificate Group

Answer : B

Publicly trusted Certificate Authorities are already included in the Java Trust Store Certificate Group, which PingAccess can use directly. This avoids importing the certificate manually.

Exact Extract:

''If the target site uses a certificate from a well-known public CA, configure the site to use the Java Trust Store Certificate Group.''

Option A is incorrect --- Key Pairs store private keys for SSL termination, not public CA trust anchors.

Option B is correct --- Java Trust Store already contains trusted public CAs.

Option C is incorrect --- again, Key Pairs are not used for trust validation.

Option D is unnecessary for public CAs --- only internal/self-signed certs must be imported.

Ping Identity Certified Professional - PingAccess PAP-001 Exam Questions