PAP-001 Ping Identity Certified Professional - PingAccess Free Practice Exam Questions (2025 Updated)

PingAccess supportsone primary administrative console (active)and any number ofreplica administrative consoles. Engines must be configured to connect to theactive console, with replicas available for failover.

Exact Extract:

“In a clustered environment, PingAccess supports one clustered console (active) and replica consoles. Engines can connect to any console node for high availability.”

Option Ais incomplete — only one replica limits redundancy.

Option Bis incorrect — multiple active consoles are not supported.

Option Cis incorrect — cannot run two active consoles.

Option Dis correct — one active admin console with multiple replicas ensures HA.

PingAccess installs as a Windows service. To remove or prevent automatic startup, theuninstall-service.batscript is used.

Exact Extract:

“On Windows, useinstall-service.batto install PingAccess as a service anduninstall-service.batto remove the service.”

Option A (init.bat)initializes environment variables but does not manage services.

Option B (uninstall-service.bat)is correct — it removes the Windows service, preventing auto-start.

Option C (remove-install.bat)is not a valid PingAccess script.

Option D (wrapper-service.bat)configures wrapper options, not service removal.

When using multiple Access Token Managers, theSend Audienceoption ensures that tokens are scoped properly and validated against the intended resource/application.

Exact Extract:

“EnableSend Audiencein the token provider configuration to support environments with multiple Access Token Managers and enforce correct audience restrictions.”

Option A (Subject Attribute Name)is unrelated — it maps user identity but not token manager selection.

Option B (Send Audience)is correct — required when multiple ATMs are in use.

Option C (Use Token Introspection Endpoint)is optional and depends on deployment, not mandatory for multiple ATMs.

Option D (Client Secret)is part of OAuth client credentials, not specific to multiple ATMs.

PingAccess can be configured to log or suppress back-channel requests that occur duringtoken validationwith an OAuth/OpenID Connect provider such as PingFederate. These requests happen when PingAccess calls PingFederate to validate access tokens or retrieve key material.

Exact Extract from PingAccess documentation:

“Back-channel requests are logged during token validation by default. To prevent these requests from being written to the audit log, update theToken Validationsettings in PingAccess.”

This makesToken Validationthe correct location for changing the behavior without modifying application-specific configurations.

Why other options are wrong:

B. Web Sessions

Incorrect. Web Sessions control user session management and cookie handling, not back-channel token validation traffic.

C. Sites

Incorrect. Sites are the definitions of backend servers that PingAccess proxies to. This setting does not affect back-channel logging to PingFederate.

D. Token Provider

Incorrect. The Token Provider defines the OIDC/OAuth server (e.g., PingFederate) and its endpoints, but the logging of back-channel requests is not controlled here.

Thus, the correct answer isA. Token Validation.

Because the application context root is/parts, resource paths are defined relative to it. The correct relative path is:

/suspension/struts/manufacturer

Exact Extract:

“Resource matching begins at the context root. The most specific matching path is selected.”

Option Ais incorrect —/*/struts/manufacturerdoes not match because it starts with a wildcard, not the defined path.

Option Bis incorrect —/*/manufacturerwould match less specifically and at a different depth.

Option Cis correct — exact match relative to/parts.

Option Dis incorrect — too generic and not the best match.

PingAccess enforces step-up or multi-factor authentication usingAuthentication Requirements, which can be applied to specific resources within an application.

Exact Extract:

“Authentication requirements allow administrators to configure additional authentication (for example, MFA) when accessing sensitive application resources.”

Option A (UI Authentication)applies to access to theadmin console, not application resources.

Option B (Auth Token Management)relates to OAuth token lifetimes and refresh, not MFA enforcement.

Option C (Authentication Requirements)is correct — these rules enforce MFA or step-up auth for specific URLs/resources.

Option D (Authentication Challenge Policy)governs how failed auth challenges are presented but does not enforce MFA.

Theadmin.authsetting in therun.propertiesfile is used to specify a fallback authentication method for the administrative console.

Exact Extract from official documentation:

“To define a fallback administrator authentication method if the OIDC token provider is unreachable, enable the admin.auth=native property in the run.properties file. This overrides any configured administrative authentication to basic authentication.”

This makes it clear that the purpose ofadmin.authis tooverrideany configured SSO for the admin UI and enforce native (basic) authentication instead.

Option Ais incorrect because theadmin.authsetting does not configure SSO. SSO for the admin UI is configured separately.

Option Bis incorrect because this setting does not apply to the administrative API; it specifically applies to the admin UI console.

Option Cis correct because it directly reflects the documented behavior:admin.authoverrides SSO configuration for the administrative UI and enables native authentication.

Option Dis incorrect because the setting does not enable automatic authentication. It still requires credentials, but falls back to basic auth.

PingAccess resources have anAudit flag. When enabled, all access attempts (allowed or denied) are recorded in the audit logs.

Exact Extract:

“To audit access requests to a specific resource, enable the Audit option on that resource in the application configuration.”

Option Ais correct — enabling audit for/adminensures its access requests are logged.

Option Bis incorrect — enabling audit for/*is overly broad and logs everything, not just/admin.

Option Cis incorrect — Splunk integration is for log forwarding, not per-resource auditing.

Option Dis incorrect —log4j2.xmlcontrols log destinations/levels, not resource-specific auditing.

When applications require additional attributes:

TheWeb Sessionmust be configured to retrieve those attributes from the token provider (OIDC or PingFederate).

TheIdentity Mappingmust be updated to forward those attributes to the application (e.g., as headers).

Exact Extract:

“Web sessions define how user attributes are retrieved from the token provider. Identity mappings determine how those attributes are inserted into requests to applications.”

Option Ais not necessarily required; attributes can be retrieved via userinfo endpoint or access token, not only ID tokens.

Option Bis correct — Identity Mappings must be updated to pass attributes to the app.

Option Cis incorrect — Site Authenticators define how PingAccess authenticates to apps, not attribute handling.

Option Dis incorrect unless the architecture specifically requires access token updates; PingAccess often uses the Web Session to fetch attributes.

Option Eis correct — Web Session must be updated to retrieve additional attributes.

PingAccess rules are categorized intoAccess Control RulesandProcessing Rules.

Processing Rulesmodify or add to HTTP requests and responses.

Cross-Origin Request (CORS)is specifically listed as aProcessing Rule, because it modifies response headers to support cross-origin requests.

Exact Extract:

“Processing rules apply to HTTP traffic, such as Cross-Origin Resource Sharing (CORS), header injection, or response modification.”

Option A (Web Session Attribute)is an access control rule.

Option B (Cross-Origin Request)is correct — this is a processing rule.

Option C (HTTP Request Parameter)is an access control rule.

Option D (HTTP Request Header)is an access control rule.

The correct way to ensure resources such as CSS files, images, or JavaScript are accessible without authentication acrossallapplications is to configureGlobal Unprotected Resources.

Exact Extract:

“Global unprotected resources define resources that do not require authentication and are accessible to all clients across applications.”

Option Ais incorrect; Protocol Sources define back-end host connections, not authentication.

Option Bwould apply only per-resource, not across all applications.

Option Cis correct — Global Unprotected Resources are designed for this exact purpose.

Option D(Availability Profile) is related to application health checks and availability, not authentication.

The pattern/images/sitel/*matches all subpaths and files under the/images/sitel/directory, including nested paths.

Exact Extract:

“The asterisk (*) matches zero or more characters within the path. For example,/images/sitel/*matches all resources under thesitelfolder.”

Option Ais incorrect — it references/aitel/instead of/sitel/.

Option Bis incorrect —/site*matches strings beginning with “site”, but may also match “siteX” incorrectly.

Option Cis incorrect — it only matches resources under/english/, missing other folders.

Option Dis correct —/images/sitel/*covers all given examples.

When using theAuthorization Code Flowfor authentication, PingAccess must be configured with:

AnOAuth Client IDthat identifies the application to the IdP.

TheOpenID Connect Login Typeset to Authorization Code.

Exact Extract:

“When configuring an OIDC web session, specify the OAuth client ID and select the OpenID Connect login type (Authorization Code, Hybrid, or Implicit).”

Option A (OAuth Token Introspection Endpoint)is not required for Authorization Code flow — token introspection is used in other cases.

Option B (OAuth Client ID)is correct — required for OIDC authorization requests.

Option C (OpenID Connect Issuer)is discovered automatically via metadata when you configure the token provider.

Option D (Virtual Host)is required for application exposure but not specific to OIDC flow.

Option E (OpenID Connect Login Type)is correct — must be set to “Authorization Code.”

When APIs are remote, latency is introduced by frequent token validation requests. EnablingCache Tokenon the OAuth Resource Server reduces repeated validation calls and improves performance.

Exact Extract:

“The OAuth Resource Server configuration includes aCache Tokenoption that improves performance by reducing round trips for token validation.”

Option Ais incorrect — key rolling affects cryptographic keys, not API latency.

Option Bis incorrect — virtual hosts control external FQDNs, not performance.

Option Cis incorrect — token attribute size does not significantly affect remote latency.

Option Dis correct — caching tokens reduces validation overhead.

Identity Mapping in PingAccess relies on attributes provided by thetoken provider(e.g., PingFederate, OIDC provider). If the desired attributes are not present in the dropdown, it means they are not being provided in the token or userinfo response.

Exact Extract:

“Attributes available in identity mappings are those provided in the web session by the token provider. If attributes are missing, they must be added to the token by the identity provider.”

Option Ais correct — the token provider administrator must configure the IdP to include the additional attributes.

Option Bis incorrect — rewrite rules modify content but do not supply new identity attributes.

Option Cis incorrect — developers cannot directly add identity attributes; they must come from the IdP.

Option Dis incorrect — Web Session Attribute rules only evaluate available attributes; they don’t create new ones.

PingAccess usesobfuscated keysto secure sensitive configuration values (like passwords). Theobfuscate.bat(Windows) orobfuscate.sh(Linux) script is used to generate a new key and protect sensitive data.

Exact Extract:

“Useobfuscate.[bat|sh]to generate a new obfuscation key for protecting configuration values.”

Option A (db-passwd-rotate.bat)is not a valid PingAccess script.

Option B (memoryoptions.bat)configures JVM memory, not encryption.

Option C (run.bat)starts PingAccess.

Option D (obfuscate.bat)is correct — it is used to protect sensitive configuration.

PingAccess allows fine-grained authentication enforcement by applyingAuthentication Requirement rulesat the resource level. These rules can invoke MFA flows based on request context or policy.

Exact Extract:

“Authentication requirement rules determine whether PingAccess challenges a user to authenticate again (for example, with MFA) before allowing access to a protected resource.”

Option Ais incomplete. Creating a requirement does nothing unless it is applied.

Option Bis correct because applying the Authentication Requirement rule to thespecific resource (URL)enforces MFA only for that resource.

Option Cis incorrect; Web Session Attribute rules are about evaluating existing session attributes, not triggering MFA.

Option Dis incorrect; HTTP Request Parameter rules are used to evaluate request data, not enforce MFA policies.

PingAccess validates access tokens usingAccess Token Managers, which are typically backed byPingFederateor ageneric OIDC provider.

Exact Extract:

“PingAccess validates tokens through Access Token Managers, which can be configured against PingFederate or a common OIDC provider.”

Option A (PingFederate)is correct — the most common token provider.

Option B (Kerberos)is not supported for token validation.

Option C (SAML provider)is incorrect — PingAccess does not natively consume SAML assertions.

Option D (Common OIDC provider)is correct — tokens can be validated against any OIDC-compliant IdP.

Option E (PingAuthorize)is an authorization engine, not a token provider.

PingAccess allows administrators to configurecustom error pages or messagesat theRoot Resource levelof an application. This ensures that when rule violations (e.g., authorization failures) occur, the application can display tailored error responses.

Exact Extract:

“Custom error handling for rule violations is configured within the Root Resource of an application.”

Option Ais incorrect — assigning a rule to a resource does not allow defining custom errors.

Option Bis correct — the Root Resource is where administrators define custom error handling for the entire application.

Option Cis incorrect — Rule Sets only combine rules; they do not handle error responses.

Option Dis incorrect — individual rule definitions do not contain custom error configurations.