Ping Identity Certified Professional - PingAM PT-AM-CPE Exam Questions

Answer : A

In PingAM 8.0.2, troubleshooting complex issues often requires moving beyond audit logs to Debug Logs. These logs capture the internal operations of the AM engine and its various components (e.g., Authentication, Core Token Service, Session Management).7

According to the 'Debug Logging' section of the PingAM 8.0.2 Maintenance Guide, the standard format for a debug log entry is designed to provide maximum context for support engineers and developers. A typical entry includes:

Time and Date Header: Precise timestamp of when the event occurred.

The Component (Category): Identifies which part of the code issued the message (e.g., amAuth, amSession, amOAuth2).

The Debug Level: Indicates the verbosity/severity, such as ERROR, WARNING, INFO, MESSAGE, or OFF.

The Thread ID: Crucial for multi-threaded environments like Tomcat, allowing administrators to trace a single user's request across multiple log entries.

The Message: A descriptive string explaining the internal operation or the error encountered.

Stack Trace: If the entry is recording an exception, a full Java stack trace is optionally included to pinpoint the exact line of code where the failure occurred.

Option A is the most complete and accurate representation of this structured output. Options B, C, and D are incorrect because they omit essential troubleshooting fields like the Thread ID or the Component name, which are necessary for correlating logs in a high-concurrency production environment. Understanding this structure is fundamental for any administrator using tools like ssoadm or the REST API to capture and analyze troubleshooting information.

Answer : D

In a SAML 2.0 Federation flow, once the Service Provider (SP) receives and validates a SAML Assertion from an Identity Provider (IdP), it must determine which local user account the assertion corresponds to. This is the role of the SAML2 Account Mapper.

According to the PingAM 8.0.2 documentation on 'Federate Identities' and the 'SAML 2.0 Reference':

The SP-side account mapper (specifically the SPAccountMapper interface or its scripted equivalent) is responsible for mapping the remote user (identified in the SAML assertion) to a local user profile in the SP's identity store.

This mapping can be achieved in several ways:

Account Linking: Finding an existing link between the NameID in the assertion and a local DN.

Attribute Matching: Using an attribute from the assertion (like mail) to search the local directory for a matching user.

Auto-Federation: If configured, creating a link or a new profile automatically based on the incoming data.

If the account mapper cannot find a corresponding local profile, the SP cannot create a local session, and the SSO process will fail, typically with a 'User not found' or 'Local identity not found' error. Thus, the purpose is strictly the identification of the local subject based on the remote assertion (Option D). Options A and B are incorrect as they describe aggregation or account merging which are not the primary function of the SAML mapper. Option C describes 'Attribute Mapping,' which is a separate step (handled by the Attribute Mapper) that occurs after the identity has been successfully mapped.

Answer : D

Mutual TLS (mTLS) is a security enhancement where both the client and the server provide X.509 certificates to prove their identities.9 In PingAM 8.0.2, mTLS is frequently used for secure 'Machine-to-Machine' (M2M) communication, such as between an OAuth2 client and the token endpoint, or between AM and a Directory Server (PingDS).

According to the PingAM documentation on 'Secure Network Communication' and 'mTLS for OAuth2,' the handshake sequence for mTLS follows these logical steps:

Client Hello: The client initiates the request to the server.10

Server Hello & Certificate: The server responds by presenting its own certificate (verifying the server's identity to the client).11 In an mTLS scenario, the server also includes a CertificateRequest message.12

Client Certificate & Key Exchange: The client validates the server's certificate. If valid, the client then sends its own Client Certificate to the server, along with the encrypted pre-master secret or key exchange data.

Verification and Establishment: The server validates the client's certificate against its truststore. If the certificate is trusted and the cryptographic signatures match, the mutually secure connection is established.

Option D represents the most accurate 'simplified' sequence. Option A is incorrect because the server presents its certificate before the client sends its own certificate. Option B and C are incorrect because the server always responds to the initial 'Client Hello' with its own identity (Server Certificate) before the client proceeds with identity submission. This 'handshake' ensures that no data is transmitted until both parties have cryptographically verified each other.

Answer : D

PingAM 8.0.2 is highly extensible through its Scripting Engine, which supports Groovy and JavaScript. However, scripts can only be applied to specific 'hooks' or 'extension points' defined by the platform.

According to the 'Scripting' and 'Script Types' reference in the PingAM 8.0.2 documentation, the standard supported script types are:

Decision node script (A): Used within Authentication Trees via the 'Scripted Decision Node.' These scripts allow for complex logic, such as checking user attributes, calling external APIs, or evaluating risk before deciding which path a user should take in their journey.

OpenID Connect claims script (C): This script type is used to customize the claims returned in OIDC ID Tokens or at the UserInfo endpoint. It allows administrators to transform internal LDAP attributes into the specific JSON format required by OIDC clients.

Policy condition script (D): Used within Authorization Policies. These scripts define custom logic for granting or denying access (e.g., 'Allow access only if the user is connecting from a specific IP range and it is between 9 AM and 5 PM').

Why Statement B is incorrect: There is no such thing as an 'End User user interface theme script' in the PingAM scripting engine. UI customization (Themeing) in PingAM 8.0.2 is handled through the XUI framework using CSS, HTML templates, and configuration JSON files, or by building a custom UI using the Ping SDKs. It does not use the server-side Groovy/JavaScript scripting engine that governs authentication and authorization logic. Therefore, the valid script types are A, C, and D, making Option D the correct choice.

Answer : C

Cross-Site Request Forgery (CSRF) is an attack where a malicious site sends a request to PingAM using the victim's authenticated browser session. Because standard HTML forms and cross-site requests cannot easily set custom HTTP headers, requiring a specific header is an effective defense for REST APIs.

According to the PingAM 'Security' documentation and the 'REST API' reference:

By default, PingAM 8.0.2 enforces a CSRF filter on its REST endpoints (such as /json/authenticate or /json/users). For any 'state-changing' request (like a POST, PUT, or DELETE), the client must prove the request is intentional and not a forged browser-driven request. This is achieved by requiring at least one of the following headers:

X-Requested-With: Commonly used by AJAX libraries like jQuery. Its presence indicates the request was made via a script, which is generally not possible for a standard cross-site CSRF attack.

Accept-API-Version: This header serves two purposes. First, it ensures the client is targeting a specific version of the PingAM REST API (e.g., resource=2.0, protocol=1.0). Second, since custom headers cannot be set in simple cross-site <form> submissions, it acts as a CSRF token.

If a POST request is sent to the REST API without one of these headers, PingAM will reject the request with a 403 Forbidden error, even if the user has a valid session cookie.

Option B (If-Match: _rev) is used for concurrency control (preventing 'lost updates' in IDM or AM configuration), but it is not the primary CSRF defense. Options A and D are headers sometimes used for 'Zero-Page Login' or legacy authentication, but they do not provide protection against CSRF for the general REST API. Therefore, the combination of X-Requested-With or Accept-API-Version is the correct answer for default CSRF protection in PingAM 8.0.2.

Answer : A

The ForceAuth=true parameter is a standard directive used in various authentication protocols (specifically SAML2 and OIDC) and is natively supported by the PingAM 8.0.2 XUI (the modern End-User User Interface).

According to the 'Authentication and SSO' documentation:

Normally, if a user has an active, valid session cookie (iPlanetDirectoryPro), and they navigate to the AM login URL, PingAM will recognize the session and automatically redirect the user to their destination (the 'Success URL') without prompting for credentials. This is the core benefit of Single Sign-On.

However, when the ForceAuth=true parameter is appended to the query string, it instructs the PingAM authentication engine to bypass the session check for the purpose of re-authentication. The engine will:

Ignore the existing valid session cookie.

Force the user back to the login page (rendering the initial nodes of the configured authentication tree).

Require the user to provide their credentials again.

This is a critical security feature for high-value transactions. For instance, if a user is already logged in but attempts to change their bank transfer details, the application can redirect them to AM with ForceAuth=true to ensure the person sitting at the computer is indeed the authorized user. Option B is incorrect because ForceAuth only forces a re-authentication; whether that includes MFA depends on the tree configuration, not the parameter itself. Option C is incorrect as PingAM explicitly processes this parameter. Therefore, the primary outcome is the redirection to the login page regardless of the current session state.

Answer : D

The forgeops command-line tool is used to manage the lifecycle of the Ping Identity Platform in Kubernetes environments.9 When using the Cloud Developer Kit (CDK) for version 8.0.2, the delete subcommand is used to tear down the environment.

According to the 'ForgeOps CLI Reference' and 'CDK Shutdown and Removal' documentation:

The forgeops delete command (without additional flags like --force or specific component names) is designed to remove the Ping Identity Platform pods. This includes the core applications like PingAM, PingIDM, and PingDS, as well as the specialized UI pods (login-ui, etc.). It also removes the standard CDK artifacts and configuration manifests associated with that specific namespace.

However, the command follows a 'safe delete' philosophy regarding infrastructure-level components:

Ingress Controllers, Certificate Managers (cert-manager), and the DS Operator are considered part of the 'Base' or 'Infrastructure' layer. These are typically installed once per cluster or namespace and are shared across multiple deployments. The forgeops delete command does not remove these by default, as doing so could disrupt other services.

PVCs (Persistent Volume Claims) and Secrets are also preserved unless the --force or -f flag is explicitly added to the command.

Thus, the answer is D. The command focuses strictly on the platform pods and their immediate deployment artifacts. If a developer wishes to perform a 'deep clean' that removes the ingress and operators, they would need to use more specific commands like forgeops delete base or kubectl commands.10 This distinction is vital for developers to avoid accidentally deleting shared cluster infrastructure when they only intended to restart the Ping platform.