Ping Identity Certified Professional - PingAM PT-AM-CPE Exam Questions

Answer : C

Push authentication in PingAM 8.0.2 utilizes the ForgeRock/Ping Authenticator app to provide a seamless, out-of-band multi-factor authentication (MFA) experience.3 To understand the correct statements, we must look at the technical requirements and the authentication lifecycle defined in the 'MFA: Push Authentication' documentation.

Statement A is correct: For the initial setup, a device with a camera is required because the registration process involves scanning a QR code generated by PingAM. Additionally, the user must install the specific Authenticator app (available for iOS and Android) to handle the cryptographic exchange and receive push notifications.4

Statement D is correct: This accurately describes the runtime flow of a push journey. When a user reaches a Push Sender node, PingAM communicates with the Push Notification Service (Apple APNs or Google FCM).5 The user's device receives the notification, and PingAM enters a 'waiting' state (via the Push Result Verifier node) until the user either approves or denies the request within the app.6

Why other statements are incorrect:

Statement B is incorrect because registration and authentication are typically handled by separate trees. Best practice dictates a 'Device Registration' tree for the initial onboarding and a 'Login/MFA' tree for day-to-day access. Forcing them into the same tree would be inefficient and create a poor user experience.

Statement C is a common point of confusion; while the user scans a code, the documentation refers to it as a QR code, not a standard barcode. In technical certification contexts, this distinction is often strictly enforced.

Therefore, only statements A and D represent the verified facts of the Push implementation in version 8.0.2, making Option C the correct answer.

Answer : C

PingAM 8.0.2 provides a 'Recovery Code' mechanism as part of its Multi-Factor Authentication (MFA) suite. This allows users to regain access to their accounts if they lose their MFA device (such as a smartphone used for Push or OATH).

According to the PingAM 'Authentication Node Reference' for version 8.0.2:

The node responsible for the validation of these codes is the Recovery Code Collector Decision node. This node performs a dual function:

Collection: It renders the UI callback to the user (a text input field) asking for the recovery code.

Decision/Validation: Once the user submits a code, the node checks the input against the stored, hashed recovery codes in the user's profile.

Analysis of the other options:

Recovery Code Display node (Option A): This node is used during the registration phase to show the user their newly generated codes so they can save them. It does not validate them.

Recovery Code Verifier node (Option D): This is a common distractor name. While 'Verifier' sounds logical, the actual name in the AM designer is the 'Collector Decision' node, reflecting the pattern of nodes that both collect data and make a branching decision.

Recovery Code Comparator node (Option B): Not a standard node in PingAM 8.0.2.

The Recovery Code Collector Decision node typically has two outcomes: Success (code matched and was consumed/removed) or Failure (code was invalid). This node is vital for ensuring that 'Account Recovery' journeys remain secure and functional within the Intelligent Access framework.

============

Answer : A

In PingAM 8.0.2, Multi-Factor Authentication (MFA) using the OATH standard supports two primary algorithms: TOTP (Time-based One-Time Password) and HOTP (HMAC-based One-Time Password).14 For an authentication journey to function correctly, the 'Registration' phase (where the user's device and AM agree on a secret and algorithm) and the 'Verification' phase (where AM checks the submitted code) must be perfectly synchronized.

According to the 'Authentication Node Reference' for the OATH Token Verifier node and OATH Registration node:

Both nodes contain a configuration property named OATH Algorithm.15 This property determines how the six- or eight-digit code is generated and validated. If the OATH Registration node is configured to set up a user for TOTP, it will generate a QR code containing the TOTP parameters for the user's authenticator app.

When that user later attempts to log in, the OATH Token Verifier node (Option A) must also be set to TOTP.16 If the verifier is accidentally set to HOTP (which uses a counter rather than a time step), the validation will consistently fail because the server will be looking for a counter-based value while the app is providing a time-based value.

Other nodes like the Recovery Code Collector Decision node (Option B) or OATH Device Storage node (Option D) handle subsequent or separate tasks (like account recovery or writing the final profile to LDAP) and do not directly participate in the real-time OATH mathematical validation logic. Thus, the OATH Token Verifier is the mandatory counterpart that must match the registration's algorithm setting.

Answer : C

In PingAM 8.0.2, Authorization Policies can be configured to use complex conditions to determine if access should be granted. When a policy uses a Subject Condition based on an OpenID Connect (OIDC) ID Token, the policy engine looks for specific claims within that token (such as group membership or a specific user ID).

According to the 'Authorization and Policy Evaluation' best practices, it is crucial to understand the separation of concerns between the Policy Decision Point (PDP) and the client. The PingAM policy engine is designed to evaluate logic---it checks if claimX == valueY. However, the policy engine typically does not perform a full cryptographic validation of the ID token's signature every time it evaluates a condition, especially if the token is passed as a string in the evaluation request.

Therefore, the best practice is as follows:

The client application or the PEP (Policy Enforcement Point) must validate the ID token (ensuring it is signed by a trusted provider, has not expired, and contains the correct audience) before sending the claims to the AM policy service for evaluation. If an unvalidated or forged token is used to supply claims for a policy request, and the policy engine assumes the input is 'trusted,' it could result in unauthorized access.

By validating the token first (Option C), the implementation ensures that only legitimate identity data is processed by the authorization logic. Option D is incorrect because the policy engine's primary role is decision-making based on presented attributes, not act as a full OIDC validation service during a REST evaluation call. Option B is a security risk as it ignores the necessity of cryptographic proof of identity.

Answer : A

The Cloud Developer Kit (CDK), part of the forgeops repository, represents the modern approach to deploying the Ping Identity Platform (including PingAM 8.0.2) in a containerized, Kubernetes-native environment. According to the PingAM deployment and ForgeOps documentation, the platform has transitioned from a monolithic architecture---where the user interface was embedded within the AM web application---to a decoupled, microservices-aligned architecture. In a standard CDK deployment, the user interface components are separated into their own distinct pods to allow for independent scaling, updates, and management.

The three specific pods that provide user interface functionality in a default CDK environment are:

admin-ui: This pod hosts the administrative console. It is the centralized interface that administrators use to configure realms, manage identity stores, define authentication trees, and oversee the general health of both PingAM and PingIDM. By separating the administrative UI from the core engine, the platform reduces the attack surface and allows for more granular resource allocation.

end-user-ui: This pod serves the self-service portal for end-users. It is responsible for providing the interface where users can manage their own profiles, update passwords, register Multi-Factor Authentication (MFA) devices, and manage their consent for OAuth2/UMA applications. This UI interacts with the back-end via REST APIs to ensure a seamless and responsive user experience.

login-ui: This is a specialized pod dedicated to the authentication journey. When a user interacts with an 'Intelligent Access' tree, the login-ui pod renders the callbacks (such as username prompts, password fields, or MFA challenges). This pod ensures that the presentation layer of the authentication process is modernized and distinct from the heavy processing logic of the PingAM core.

Collectively, these three pods ensure that the 'User Interface' layer of the deployment is modular. This architecture is a prerequisite for high-availability deployments and is the standard configuration verified in the ForgeOps documentation for version 8.0.2 deployments.

============

Answer : B

In PingAM 8.0.2, a Session Upgrade occurs when a user is required to authenticate at a higher security level (Auth Level). The outcomes of these upgrades depend on the session storage (server-side vs. client-side) and the parameters used.

Statement B is incorrect because it claims that a new token is issued only when the current session does not meet requirements. In reality, if a request explicitly includes a parameter like ForceAuth=true or prompt=login, PingAM will force a re-authentication and issue a new session token regardless of the current session's state.

According to the 'Session Upgrade' and 'Step-up Authentication' documentation:

Statement A is correct: When ForceAuth=true is used, the AM engine ignores the existing session's Auth Level and forces the user through the tree. A new session/token is generated upon success.

Statement C is correct: This describes the standard 'Advice' flow (e.g., from a policy). AM creates a new session, copies existing properties from the old one, and replaces the token.

Statement D is correct: In client-side sessions, since the state is in a JWT cookie, any change (like an Auth Level increase) requires the issuance of a brand-new signed JWT to replace the old one.

Therefore, because PingAM allows for forced re-authentication even when requirements are met, the restrictive 'only when' condition in Statement B makes it the incorrect (and thus the target) answer. This behavior is key for security scenarios where a fresh proof of presence is required regardless of previous activity.

============

Answer : A

In PingAM 8.0.2, Realms are the primary organizational units used to group configuration, policies, and identities.13 A common misconception is that a user is 'locked' into a single realm. However, according to the 'Realms' and 'Identity Stores' documentation, the relationship is highly flexible.

A Realm does not actually 'contain' users in a physical sense; instead, a realm is configured with one or more Identity Stores (such as an LDAP directory or a database). Multiple realms can be configured to point to the same underlying Identity Store. Therefore, if a user profile exists in an LDAP directory that is shared by 'Realm A' and 'Realm B,' that user is effectively a member of both realms. They can authenticate to either realm and receive different policies or session properties based on the realm-specific configuration.

Key points from the documentation:

Logical Partitioning: Realms provide a way to apply different authentication logic (different trees) to the same set of users.14

Multi-tenancy: An organization can create separate realms for different departments or customer groups, even if they overlap in the back-end user database.

Identity Store Mapping: Because a realm maps to an identity store, and an identity store can be reused across realms, a user's membership is determined by where the realm is 'looking' for data.

Thus, Option A is the correct description of the architecture: a user can be a member of one or more realms depending on how the administrator has mapped the identity repositories.

Would you like me to proceed with more questions, or would you like to focus on a specific area such as OAuth2 Grant Flows?