Ping Identity PT-AM-CPE Practice Test Questions Answers

When PingAM is installed, it creates a specific directory structure within its Configuration Directory (also known as the AM_HOME or .openamcfg pointer target). This structure is standardized across versions to ensure that administrators and automated scripts can locate critical files.

According to the PingAM 8.0.2 "File System Reference" and "Debug Logging" documentation:

The primary directory for engine-level troubleshooting files (debug logs) is named debug.17 This directory is located immediately within the root of the configuration directory. Therefore, if the configuration path is explicitly set to /home/forgerock/am, the resulting path for debug files will be /home/forgerock/am/debug (Option D).

It is important to distinguish betweenAudit LogsandDebug Logs:

Audit Logs: (e.g., access.audit.json) are usually found in the .../openam/log or .../openam/logs directory (making Option A a common distractor).

Debug Logs: (e.g., amAuth, amSession, amCore) are strictly stored in the debug directory.

The var directory (Options B and C) is a convention used in some ForgeRock "ForgeOps" containerized deployments (like those in Kubernetes) to separate variable data from static config. However, in a standard standalone installation as described in the question, the direct .../debug path is the verified default behavior of the PingAM installation wizard and configurator tool.

In a SAML 2.0 Federation flow, once the Service Provider (SP) receives and validates a SAML Assertion from an Identity Provider (IdP), it must determine which local user account the assertion corresponds to. This is the role of the SAML2 Account Mapper.

According to the PingAM 8.0.2 documentation on "Federate Identities" and the "SAML 2.0 Reference":

The SP-side account mapper (specifically the SPAccountMapper interface or its scripted equivalent) is responsible for mapping the remote user (identified in the SAML assertion) to a local user profile in the SP's identity store.

This mapping can be achieved in several ways:

Account Linking: Finding an existing link between the NameID in the assertion and a local DN.

Attribute Matching: Using an attribute from the assertion (like mail) to search the local directory for a matching user.

Auto-Federation: If configured, creating a link or a new profile automatically based on the incoming data.

If the account mapper cannot find a corresponding local profile, the SP cannot create a local session, and the SSO process will fail, typically with a "User not found" or "Local identity not found" error. Thus, the purpose is strictly the identification of the local subject based on the remote assertion (Option D). Options A and B are incorrect as they describe aggregation or account merging which are not the primary function of the SAML mapper. Option C describes "Attribute Mapping," which is a separate step (handled by the Attribute Mapper) that occursafterthe identity has been successfully mapped.

This question explores the fundamental architecture of Session Management in PingAM 8.0.2. PingAM is designed to be highly flexible, supporting both traditional browser-based Single Sign-On (SSO) and modern API-driven interactions.

Analysis of the statements based on PingAM documentation:

Statement A is correct: For browser-based flows, PingAM uses HTTP cookies to maintain session state. Upon successful authentication, AM sends a Set-Cookie header to the browser containing the session token (the session reference).

Statement B is correct: For "headless" or REST-based authentication (such as a mobile app or a back-end service calling /json/realms/root/authenticate), there is no browser to handle cookies automatically. In this case, PingAM returns the tokenId directly in the JSON response body, allowing the client to manage the token manually in subsequent API calls.

Statement D is correct: For historical reasons, the default value for theSSO Cookie Namein PingAM is iPlanetDirectoryPro. While administrators are encouraged to change this for security (obfuscation), it remains the default "out-of-the-box" configuration.

Statement C is incorrect: This is the "distractor" in the question. PingAM 8.0.2 supports multiple session storage models. While theCore Token Service (CTS)is the standard for server-side stateful sessions, AM also supportsClient-side sessions(where the state is stored in a signed/encrypted JWT in the cookie itself) andIn-memory sessions(primarily used for short-lived authentication journeys). Since AM is not restrictedonlyto the CTS, Statement C is false.

Therefore, the combination ofA, B, and Daccurately reflects the session capabilities of PingAM 8.0.2, making Option A the correct answer.

In PingAM 8.0.2, there is a critical distinction between Tree-based (or Chain-based) authentication and Module-based authentication. Module-based authentication is a legacy feature that allows a user to target an individual authentication module directly (e.g., .../UI/Login?module=DataStore).

According to the "Security Considerations" and "Hardening PingAM" documentation, module-based authentication poses a significant security risk and should be disabled in production. This is becauseit allows a user to bypass steps in an authentication chain(Option C).

If an administrator has designed a secure "Chain" that requires both aDataStore(password) check AND aOne-Time Password(MFA) check, the intention is for these to be inseparable. However, if module-based authentication is enabled, a malicious user or a tester could bypass the MFA requirement by crafting a URL that calls only the "DataStore" module. This effectively circumvents the multi-factor security logic intended by the administrator.

To mitigate this, PingAM provides a global and realm-level setting to "Disable Module-based Authentication." Once disabled, PingAM will only process authentication requests that target a namedAuthentication TreeorChain, ensuring that the user is forced through the entire sequence of nodes and logic defined by the security architect.

In PingAM 8.0.2, a Session Upgrade occurs when a user is required to authenticate at a higher security level (Auth Level). The outcomes of these upgrades depend on the session storage (server-side vs. client-side) and the parameters used.

Statement B isincorrectbecause it claims that a new token is issuedonlywhen the current session does not meet requirements. In reality, if a request explicitly includes a parameter like ForceAuth=true or prompt=login, PingAM will force a re-authentication and issue anew session tokenregardless of the current session's state.

According to the "Session Upgrade" and "Step-up Authentication" documentation:

Statement A is correct: When ForceAuth=true is used, the AM engine ignores the existing session's Auth Level and forces the user through the tree. A new session/token is generated upon success.

Statement C is correct: This describes the standard "Advice" flow (e.g., from a policy). AM creates a new session, copies existing properties from the old one, and replaces the token.

Statement D is correct: In client-side sessions, since the state is in a JWT cookie, any change (like an Auth Level increase) requires the issuance of a brand-new signed JWT to replace the old one.

Therefore, because PingAM allows for forced re-authentication even when requirements are met, the restrictive "only when" condition in Statement B makes it the incorrect (and thus the target) answer. This behavior is key for security scenarios where a fresh proof of presence is required regardless of previous activity.

============