Free Ping Identity Certified Professional - PingAM Exam PT-AM-CPE Exam Questions

According to the PingAM 8.0.2 Upgrade Guide and the 'Plan the upgrade' documentation, a successful upgrade and potential rollback strategy rely on capturing the complete state of the application across three distinct locations on the filesystem. When PingAM is deployed in a container like Apache Tomcat, the configuration is not stored within the WAR file itself but is distributed to maintain persistence across redeployments.

The three critical areas that must be backed up are:

The Web Application Directory (/path/to/tomcat/webapps/openam/): This contains the expanded binaries, JSPs, and web-level configurations. While the upgrade involves replacing the openam.war file, backing up this folder preserves any manual customizations made to the UI, CSS, or specific library additions (JARs) in the WEB-INF/lib folder.

The Configuration Directory (<home directory>/openam/ or similar): This is the most vital component. By default, PingAM stores its instance-specific configuration, cryptographic keys (keystores), and internal metadata here. For file-based configurations (FBC), this directory holds the entire system state. Even with an external PingDS configuration store, this directory contains the bootstrap file and security secrets required to connect to that store.

The Bootstrap Configuration File (<home directory>/.openamcfg/): This hidden directory contains a file (usually named after the deployment path, e.g., am or openam) that tells the PingAM binaries where the actual configuration directory is located. Without this pointer, a restored PingAM instance will behave like a fresh installation and prompt for a new setup.

The documentation explicitly warns: 'Always back up your deployment before you upgrade... For AM servers, you can roll back by restoring from a file system backup of the deployed servers and their configuration directories.' Relying only on the webapps folder (Option A) or assuming automatic backups (Option B) will lead to data loss or an unrecoverable state.

PingAM 8.0.2 adheres to the OpenID Connect Core 1.0 specification regarding standard scopes and claims. When a client requests the profile scope, the OpenID Provider (PingAM) is expected to return a specific set of claims that describe the user's basic profile.

According to the PingAM documentation on 'Understanding OpenID Connect Scopes and Claims' and the default OIDC Claims Script (which maps internal LDAP attributes to OIDC claims):

The standard claims associated with the profile scope are strictly defined with lowercase, snake_case naming conventions. The default set includes:

name: The user's full name.

given_name: The user's first name.

family_name: The user's surname or last name.

middle_name: (Optional)

nickname: (Optional)

preferred_username: (Optional)

profile: URL to the profile page.

picture: URL to an image.

website: URL.

gender: (Optional)

birthdate: (Optional)

zoneinfo: Timezone.

locale: The user's preferred language/locale.

updated_at: Timestamp.

Option C is the only choice that correctly identifies the snake_case format (given_name, family_name, locale) required by the specification. Options A and B use camelCase or inconsistent naming that does not match the OIDC standard or PingAM's default mapping script. Option D includes preferred_locale, which is incorrect; the standard claim name for a user's language preference in OIDC is simply locale.

In PingAM 8.0.2, a Session Upgrade occurs when a user is required to authenticate at a higher security level (Auth Level). The outcomes of these upgrades depend on the session storage (server-side vs. client-side) and the parameters used.

Statement B is incorrect because it claims that a new token is issued only when the current session does not meet requirements. In reality, if a request explicitly includes a parameter like ForceAuth=true or prompt=login, PingAM will force a re-authentication and issue a new session token regardless of the current session's state.

According to the 'Session Upgrade' and 'Step-up Authentication' documentation:

Statement A is correct: When ForceAuth=true is used, the AM engine ignores the existing session's Auth Level and forces the user through the tree. A new session/token is generated upon success.

Statement C is correct: This describes the standard 'Advice' flow (e.g., from a policy). AM creates a new session, copies existing properties from the old one, and replaces the token.

Statement D is correct: In client-side sessions, since the state is in a JWT cookie, any change (like an Auth Level increase) requires the issuance of a brand-new signed JWT to replace the old one.

Therefore, because PingAM allows for forced re-authentication even when requirements are met, the restrictive 'only when' condition in Statement B makes it the incorrect (and thus the target) answer. This behavior is key for security scenarios where a fresh proof of presence is required regardless of previous activity.

This question tests the understanding of Session Cookie Domains and browser behavior in a PingAM 8.0.2 deployment. According to the 'Secure Session Cookies' documentation, the Cookie Domain setting in a realm determines the scope of the SSO token.

Standard browser cookie rules (RFC 6265) dictate that a cookie set for a specific domain is visible to that domain and all of its subdomains. However, a cookie is not visible to a parent domain or a 'sibling' domain.

In this scenario, the cookie is set for am.example.com:

A . example.com: This is the parent domain. A cookie set for am.example.com is not visible here. To make it visible to example.com, the cookie domain would have to be explicitly set to .example.com.

B . am.example.com: The cookie is directly set for this domain, so it is obviously visible.

C . sub.am.example.com: This is a subdomain of am.example.com. Under standard cookie rules, it will receive the cookie.

D . login.am.example.com: While this is also a subdomain, the question implies a specific selection.

Looking at the provided options (B and C), Option C accurately reflects the inheritance rule where the domain itself and its immediate sub-levels are covered. While login.am.example.com (Option D) is technically also a subdomain, the standard documentation examples for 'Cross-domain' or 'Sub-domain' visibility typically emphasize the relationship between the primary AM host and its child applications. Therefore, the combination of B and C is the most accurate representation of how the browser handles the scope of an am.example.com cookie.

The OAuth2 May Act script type in PingAM 8.0.2 allows administrators to programmatically determine if a token exchange request (impersonation or delegation) should be allowed by adding a may_act claim to the token.

According to the 'Scripting' and 'Token Exchange Scripting API' documentation, when this script is executed, the AM engine provides a specific set of 'Bindings' or variables. These allow the script to inspect the context of the request before deciding to modify the token. The documented variables for the OAuth2 May Act script are:

clientProperties: A map of the OAuth2 client's configuration properties.

identity: The identity object for the user/subject.

logger: The logging object for debugging within the script.

requestProperties: Properties of the incoming HTTP request.

scopes: The set of scopes requested or associated with the token.

scriptName: The name of the script being executed.

session: The user's SSO session (if available).

requestedToken: This is the most important variable; it represents the token being issued. Methods like .addMayAct() or .setMayAct() are called on this specific object.

Why other options are incorrect:

Option B correctly lists the bindings.

Options A and D are incorrect because they use the variable name token. While token is a common variable name in other OAuth2 script types (like the Access Token Modification script), the Token Exchange script specifically uses requestedToken to distinguish the new token from the subject_token or actor_token provided in the request.

Option C uses scopeList, which is not the standard variable name for the scopes in this specific script context; the documentation defines it as scopes.

PingAM 8.0.2 implements OpenID Connect (OIDC) 1.0 as an identity layer on top of the OAuth 2.0 protocol. While OAuth 2.0 is designed for authorization (accessing resources), OIDC is designed for authentication (verifying who the user is).

According to the 'OpenID Connect 1.0' documentation in PingAM, the presence of a specific scope in the Authorization Request is what signals to the AM server that the request should be treated as an OIDC flow rather than a standard OAuth2 flow. This mandatory scope is openid.

When PingAM receives an /oauth2/authorize request containing the scope=openid parameter:

It triggers the OIDC processing logic.

It ensures that an ID Token (a signed JWT containing user identity information) is generated alongside (or instead of) the Access Token.

It allows the client to later access the UserInfo Endpoint to retrieve further claims about the authenticated user.

Other scopes like profile (Option A), email, or address are optional OIDC scopes used to request specific sets of user claims, but they do not 'activate' OIDC on their own. openid+connect and id (Options B and D) are not recognized standard scopes in the OIDC specification. Therefore, openid is the fundamental requirement for any OIDC interaction in PingAM 8.0.2.

When configuring secure communication (LDAPS, HTTPS) in PingAM 8.0.2, managing the Truststore is a critical security task. The truststore contains the public certificates (trust anchors) of the servers PingAM needs to communicate with, such as PingDS or external Identity Providers.

The PingAM 'Secure Network Communication' documentation outlines several best practices:

Avoid Modifying the JVM Truststore: One should not add internal certificates (like those for PingDS) to the default JVM cacerts file (Option D is a best practice). This prevents pollution of the system-wide Java environment.

Use a Dedicated Truststore: Creating a fresh, minimal truststore containing only necessary certificates (Option B and C) ensures a 'least privilege' approach to trust.

Why Statement A is NOT a best practice: Statement A suggests that you should copy the JVM truststore to isolate it from changes made to the JVM container's truststore. In a production security context, this is a dangerous anti-pattern. The JVM's default truststore (e.g., cacerts) is frequently updated by Java maintainers and OS vendors to include new Root CAs and, more importantly, to remove/revoke compromised or untrustworthy CAs. By making a static copy to 'isolate' AM from these updates, an administrator inadvertently keeps obsolete or insecure certificates in AM's trust list while missing out on critical security updates provided by the platform.

Best practice dictates that AM should point to a truststore that is intentionally managed. If isolation is needed, it should be achieved by creating a new store for internal certificates and potentially using the -Djavax.net.ssl.trustStore property to manage the hierarchy, rather than cloning the system-wide CA bundle to avoid 'changes.' Therefore, Option A is the correct answer as it describes a maintenance and security risk.

When configuring Authorization Policies in PingAM 8.0.2, defining the Resource Pattern is critical for determining which URLs the policy applies to. PingAM uses specific wildcard symbols to represent dynamic parts of a URI, but they behave differently regarding directory depth.

According to the PingAM documentation on 'Policies and Resource Types':

The * Wildcard (One-Level Wildcard): This wildcard matches characters within a single path level. It does not match forward slashes (/). For example, http://example.com/* will match http://example.com/page1 but will not match http://example.com/folder/page1.

The -*- Wildcard (Multi-Level Wildcard): This wildcard is designed to match any number of characters, including forward slashes (/), effectively spanning multiple levels of a directory hierarchy. For example, http://example.com/-*- will match http://example.com/page1, http://example.com/folder/page1, and even http://example.com/deeply/nested/resource.

Statement B is the correct technical distinction. Statement A is incorrect because query parameters are typically handled by specifically enabling 'Query Parameter Matching' in the Resource Type configuration, rather than being a primary distinction between these two wildcards. Statement C is technically discouraged because mixing them can lead to unpredictable or overly broad matches that are difficult to debug. Statement D is incorrect because wildcards can be used in the host/port portion of the URL if the resource type is configured to support it. Understanding the difference between single-level (*) and multi-level (-*-) matching is a fundamental skill for AM policy administrators to prevent security gaps.

According to the PingAM 8.0.2 documentation on 'OAuth 2.0 Client Authentication,' clients are categorized into two types based on their ability to maintain the confidentiality of their credentials: Public and Confidential.

A Confidential Client is defined as an application that is capable of securely storing a client_secret or a private key.1 These are typically applications where the code and configuration are not exposed to the end user. Web Applications (Option D) are the classic example of confidential clients because they run on a secure back-end server.2 The server-side code can store and use a secret to authenticate with PingAM's token endpoint without the risk of the secret being leaked to the user-agent or a third party.

In contrast:

Web Browsers (Option C) and JavaScript clients (Option B) are considered Public Clients.3 Since the code runs within the user's browser, any secret embedded in the application would be visible to the user via 'View Source' or developer tools.4

Desktop clients (Option A) and native mobile apps are also categorized as public clients in the OAuth2 specification (RFC 6749) because they are distributed to end-user devices.5 Even if the secret is obfuscated, it can be extracted through reverse engineering or decompilation.

For confidential clients, PingAM 8.0.2 supports various authentication methods at the token endpoint, including client_secret_basic, client_secret_post, and more secure options like Mutual TLS (mTLS) or Private Key JWT. By correctly identifying a client as confidential, administrators can enforce these stronger authentication requirements, ensuring that the client is indeed the entity it claims to be before granting access or refresh tokens.

Proof of Possession (PoP) tokens, specifically Certificate-Bound Access Tokens as defined in RFC 8705 and supported by PingAM 8.0.2, are designed to prevent token misuse by binding the access token to a specific client's cryptographic material.9

According to the PingAM documentation on 'Certificate-Bound Proof-of-Possession,' when an OAuth2 client requests a token, PingAM retrieves the client's public key (either from a provided certificate or a JWK) and embeds a thumbprint (the cnf claim) of that material into the issued token. When the client subsequently presents this token to the Resource Server (or the Authorization Server's introspection endpoint), it must also provide 'Proof' that it possesses the private key corresponding to that thumbprint.

In the Mutual TLS (mTLS) approach, this proof is provided by the Client private certificate presented during the TLS handshake.10 The server verifies that the certificate used to establish the secure connection matches the one bound to the token. Without presenting the certificate (Option D), the token is considered 'unbound' or invalid, even if the token itself is otherwise well-formed. This mechanism effectively 'pins' the token to the client, ensuring that if the token is stolen, it cannot be used by any other entity that does not possess the matching private key. Nonce and State (Options A and C) are used during the initial authorization request for different security purposes (replay protection and CSRF), and while a JWK (Option B) can be used to define the public key, the actual presentation of proof during an mTLS transaction is the certificate.