Ping Identity Certified Professional - PingAM PT-AM-CPE Exam Questions

Answer : C

To enforce complex authorization logic based on session duration, PingAM 8.0.2 administrators must move beyond the static 'Out-of-the-Box' conditions.

Analysis of the options based on the 'Policy Conditions' documentation:

Time Condition (Option A): This condition is used to restrict access based on the clock time of day or day of the week (e.g., 'Allow access only between 9 AM and 5 PM'). It does not track the elapsed time of a specific user session.

Current Session Properties (Option B): This condition checks for the presence of specific key-value pairs in a session. While a session contains a startTime property, this condition is designed for matching static values (like department=HR), not for performing mathematical time calculations.

Active Session Time (Option D): This is not a standard default condition name in the PingAM 8.0.2 policy engine.

The Correct Approach (Option C): A Scripted Policy Condition is required for this use case. Within a Policy Condition script, the administrator has access to the session object. The script can retrieve the startTime (or creationTime) of the session and compare it against the current system time (currentTime).

Example logic in the script:

var sessionStartTime = session.getProperty('startTime');

var maxDuration = 10 * 60 * 1000; // 10 minutes in milliseconds

if ((currentTime - sessionStartTime) > maxDuration) { authorized = false; }

By using a script, PingAM can dynamically calculate the age of the session at the moment of the access request and return a 'Deny' decision if the 10-minute threshold has been exceeded. This provides the granular control needed for high-security environments where 'session freshness' is a requirement for specific sensitive resources.

Answer : D

In SAML 2.0 Federation, there is a standard XML schema (defined by OASIS) that all vendors use to describe an Identity Provider (IdP) or Service Provider (SP). This is known as 'Standard Metadata.' However, standard metadata does not include every configuration option required to run a sophisticated Access Management server.

PingAM 8.0.2 uses Extended Metadata to store implementation-specific settings that fall outside the OASIS SAML 2.0 specification. According to the 'SAML 2.0 Guide,' extended metadata is stored as a separate configuration file (or JSON entry in newer versions) and includes parameters such as:

Identity Store Mapping: Which attribute in the local datastore matches the SAML NameID.

Session Information: How AM should handle the session lifecycle after a successful SAML assertion.

Attribute Mapping: Detailed instructions on how to transform local LDAP attributes into SAML attributes (and vice versa).

Authentication Trees: Which specific tree should be triggered when a request arrives at the IdP.

Option D is the correct description. Option C is incorrect because extended metadata is not a standard way to communicate features; in fact, other SAML products (like ADFS or Okta) cannot read or process PingAM's extended metadata. Option A is incorrect because basic certificates/keys are usually part of the standard metadata (KeyDescriptor), and Option B is incorrect because SAML federation usually triggers authentication journeys or attribute mapping rather than a standard authorization 'policy.'

Answer : C

Cross-Site Request Forgery (CSRF) is an attack where a malicious site sends a request to PingAM using the victim's authenticated browser session. Because standard HTML forms and cross-site requests cannot easily set custom HTTP headers, requiring a specific header is an effective defense for REST APIs.

According to the PingAM 'Security' documentation and the 'REST API' reference:

By default, PingAM 8.0.2 enforces a CSRF filter on its REST endpoints (such as /json/authenticate or /json/users). For any 'state-changing' request (like a POST, PUT, or DELETE), the client must prove the request is intentional and not a forged browser-driven request. This is achieved by requiring at least one of the following headers:

X-Requested-With: Commonly used by AJAX libraries like jQuery. Its presence indicates the request was made via a script, which is generally not possible for a standard cross-site CSRF attack.

Accept-API-Version: This header serves two purposes. First, it ensures the client is targeting a specific version of the PingAM REST API (e.g., resource=2.0, protocol=1.0). Second, since custom headers cannot be set in simple cross-site <form> submissions, it acts as a CSRF token.

If a POST request is sent to the REST API without one of these headers, PingAM will reject the request with a 403 Forbidden error, even if the user has a valid session cookie.

Option B (If-Match: _rev) is used for concurrency control (preventing 'lost updates' in IDM or AM configuration), but it is not the primary CSRF defense. Options A and D are headers sometimes used for 'Zero-Page Login' or legacy authentication, but they do not provide protection against CSRF for the general REST API. Therefore, the combination of X-Requested-With or Accept-API-Version is the correct answer for default CSRF protection in PingAM 8.0.2.

Answer : D

PingAM 8.0.2 supports advanced client authentication methods defined in the OpenID Connect and OAuth 2.0 specifications, including private_key_jwt and client_secret_jwt. These methods allow a client to authenticate without sending a static password/secret in the request. Instead, the client generates and signs a JSON Web Token (JWT).

According to the 'OAuth 2.0 Client Authentication' and 'JWT Profile for Client Authentication' (RFC 7523) documentation, when a client sends this JWT to the /oauth2/access_token endpoint, it must use the client_assertion parameter.

The request must also include the client_assertion_type parameter, which must be set to the constant value: urn:ietf:params:oauth:client-assertion-type:jwt-bearer.

Option A (client_credentials) is a grant type, not a parameter for providing a JWT.

Option B (client_token_value) is not a standard OAuth2 parameter name.

Option C (client_id) is often included in the request, but it is the identifier of the client, not the container for the cryptographic assertion itself.

When PingAM receives a request with a client_assertion, it extracts the JWT, verifies the signature using the client's public key (stored in the client's profile or retrieved via a JWKS URI), and validates the standard claims (iss, sub, aud, exp). This method is significantly more secure than simple secrets because it proves the client possesses the private key and limits the window for replay attacks through the token's expiration claim.

Answer : C

This question tests the understanding of Session Cookie Domains and browser behavior in a PingAM 8.0.2 deployment. According to the 'Secure Session Cookies' documentation, the Cookie Domain setting in a realm determines the scope of the SSO token.

Standard browser cookie rules (RFC 6265) dictate that a cookie set for a specific domain is visible to that domain and all of its subdomains. However, a cookie is not visible to a parent domain or a 'sibling' domain.

In this scenario, the cookie is set for am.example.com:

A . example.com: This is the parent domain. A cookie set for am.example.com is not visible here. To make it visible to example.com, the cookie domain would have to be explicitly set to .example.com.

B . am.example.com: The cookie is directly set for this domain, so it is obviously visible.

C . sub.am.example.com: This is a subdomain of am.example.com. Under standard cookie rules, it will receive the cookie.

D . login.am.example.com: While this is also a subdomain, the question implies a specific selection.

Looking at the provided options (B and C), Option C accurately reflects the inheritance rule where the domain itself and its immediate sub-levels are covered. While login.am.example.com (Option D) is technically also a subdomain, the standard documentation examples for 'Cross-domain' or 'Sub-domain' visibility typically emphasize the relationship between the primary AM host and its child applications. Therefore, the combination of B and C is the most accurate representation of how the browser handles the scope of an am.example.com cookie.

============

Answer : C

PingAM 8.0.2 implements OpenID Connect (OIDC) 1.0 as an identity layer on top of the OAuth 2.0 protocol. While OAuth 2.0 is designed for authorization (accessing resources), OIDC is designed for authentication (verifying who the user is).

According to the 'OpenID Connect 1.0' documentation in PingAM, the presence of a specific scope in the Authorization Request is what signals to the AM server that the request should be treated as an OIDC flow rather than a standard OAuth2 flow. This mandatory scope is openid.

When PingAM receives an /oauth2/authorize request containing the scope=openid parameter:

It triggers the OIDC processing logic.

It ensures that an ID Token (a signed JWT containing user identity information) is generated alongside (or instead of) the Access Token.

It allows the client to later access the UserInfo Endpoint to retrieve further claims about the authenticated user.

Other scopes like profile (Option A), email, or address are optional OIDC scopes used to request specific sets of user claims, but they do not 'activate' OIDC on their own. openid+connect and id (Options B and D) are not recognized standard scopes in the OIDC specification. Therefore, openid is the fundamental requirement for any OIDC interaction in PingAM 8.0.2.

Answer : C

Social Authentication in PingAM 8.0.2 allows users to log in using identities from external providers like Google, Apple, or LinkedIn. This process relies on PingAM acting as an OAuth2 Client or OpenID Connect Relying Party (RP) toward the social provider.

According to the PingAM 'Social Authentication' and 'Social Identity Provider Client Configuration' documentation, for PingAM to successfully hand off authentication to a social provider, you must configure an OAuth2 Client (specifically a Social Identity Provider client) within the PingAM realm. This configuration includes:

Client ID and Client Secret: Obtained from the social provider's developer console (e.g., Google Cloud Console).

Endpoints: The authorization, token, and UserInfo endpoints of the social provider.

Scopes: The permissions PingAM is requesting (e.g., openid, profile, email).

Once this 'Social Client' is configured, it is used by a Social Provider Handler node (or the legacy Social Authentication module) within an authentication tree. When the user clicks 'Login with Google,' PingAM uses these client credentials to initiate the OIDC flow with Google.

Why other options are not the primary requirement:

While a Data Store (A) is eventually used to save the linked user profile, the mechanism of social auth itself is driven by the OAuth2 client configuration.

A realm service (B) is too broad; while social auth is a service within a realm, the specific configuration object required is the client.

A realm policy (D) governs authorization after login, but does not enable the social login process itself. Therefore, the OAuth2 client configuration is the technical prerequisite for establishing the trust relationship with the external provider.