Free Ping Identity PAP-001 Practice Exam with Questions & Answers | Set: 2

When using multiple Access Token Managers, theSend Audienceoption ensures that tokens are scoped properly and validated against the intended resource/application.

Exact Extract:

“EnableSend Audiencein the token provider configuration to support environments with multiple Access Token Managers and enforce correct audience restrictions.”

Option A (Subject Attribute Name)is unrelated — it maps user identity but not token manager selection.

Option B (Send Audience)is correct — required when multiple ATMs are in use.

Option C (Use Token Introspection Endpoint)is optional and depends on deployment, not mandatory for multiple ATMs.

Option D (Client Secret)is part of OAuth client credentials, not specific to multiple ATMs.

To pass user attributes into HTTP headers for applications, PingAccess usesIdentity Mappings. When attributes need to be passed specifically as headers, the administrator must update theHeader Identity Mapping.

Exact Extract:

“Header identity mappings map attributes from a user’s web session to HTTP headers that are then sent to the back-end application.”

Option A (HTTP Request Header Rule)is incorrect — this adds or modifies static request headers, not user attributes.

Option B (Header Identity Mapping)is correct — this maps identity attributes into headers dynamically.

Option C (JWT Identity Mapping)is incorrect — that’s used for passing attributes as claims in JWTs.

Option D (Web Session Attribute Rule)is incorrect — that is for access control evaluation, not propagation of attributes.

Theadmin.authsetting in therun.propertiesfile is used to specify a fallback authentication method for the administrative console.

Exact Extract from official documentation:

“To define a fallback administrator authentication method if the OIDC token provider is unreachable, enable the admin.auth=native property in the run.properties file. This overrides any configured administrative authentication to basic authentication.”

This makes it clear that the purpose ofadmin.authis tooverrideany configured SSO for the admin UI and enforce native (basic) authentication instead.

Option Ais incorrect because theadmin.authsetting does not configure SSO. SSO for the admin UI is configured separately.

Option Bis incorrect because this setting does not apply to the administrative API; it specifically applies to the admin UI console.

Option Cis correct because it directly reflects the documented behavior:admin.authoverrides SSO configuration for the administrative UI and enables native authentication.

Option Dis incorrect because the setting does not enable automatic authentication. It still requires credentials, but falls back to basic auth.

Legacy PKIs often provide certificate chains that areout of orderor non-compliant with RFC-5280 path validation. PingAccess provides an option in Trusted Certificate Groups calledValidate disordered certificate chainsto allow chaining even if the order is not RFC-5280 compliant.

Exact Extract:

“EnableValidate disordered certificate chainswhen the certificate chain is not in RFC-5280 compliant order but should still be accepted.”

Option Ais incorrect; using the Java trust store is unrelated to PKI ordering.

Option Bis correct — this setting allows PingAccess to process disordered certificate chains.

Option Cis incorrect; date checks are unrelated to RFC-5280 path ordering.

Option Dis incorrect; revocation status handling does not address legacy PKI ordering issues.

From the “Promoting the replica administrative node” documentation:

Exact Extract:

“Open the/conf/run.propertiesfile in a text editor. Locate thepa.operational.modeline and change the value fromCLUSTERED_CONSOLE_REPLICAtoCLUSTERED_CONSOLE. These properties are case-sensitive. Do not restart the replica node during the promotion process.”Ping Identity Documentation

Also from the documentation under “Next steps” / manual promotion / “Using the admin API …”When promoting the replica, there is also mention of setting the new host-port in the primary admin configuration so that engine nodes and configuration references now point to the promoted replica. One of the API properties iseditRunPropertyFile(to flip the mode), another iseditPrimaryHostPort, which causes the primary-admin host setting to be updated.Ping Identity Documentation

Using those facts:

Why C is correct:

Option C says:Changepa.operational.modetoCLUSTERED_CONSOLEon the replica admin node.This directly matches the documented manual promotion step: switchpa.operational.modefromCLUSTERED_CONSOLE_REPLICA→CLUSTERED_CONSOLE.Ping Identity Documentation+1

This is essential for promoting the replica to primary console.

Why E is correct:

Option E:Modifybootstrap.propertiesand set theengine.admin.configuration.hostvalue to point at the replica admin node.While the documentation doesn’t always name the exact propertyengine.admin.configuration.host, the “promote via admin API” includes updating the “primary host:port” in the configuration so that engine nodes’ configuration queries (or whatever is used by engines) point to the new primary. This maps to ensuring that engine nodes know that the promoted replica is now the administrative node. This requiring modifying the bootstrap or configuration that engine nodes use to find the administrative host is essential.Ping Identity Documentation

Why the other options are incorrect:

A.Changepa.operational.modetoCLUSTERED_CONSOLE_REPLICAon one of the engine nodes.No. Engine nodes should havepa.operational.mode = CLUSTERED_ENGINE, not console modes.CLUSTERED_CONSOLE_REPLICAis an admin/replica console mode, not applicable for engines.docs.ping.directory+2Ping Identity Documentation+2

B.Restart all nodes in the cluster.The documentation explicitly saysdo not restartthe replica node during the promotion process because restart can cause file corruption or failure to properly promote. Only certain restarts are neededafterconfiguration updates. So restarting all nodes is not a correct required action.Ping Identity Documentation

D.Restart the replica admin node.As above, for manual promotion, a restart of the replica admin node isnotrequired (and is even discouraged during the promotion process). The change inrun.propertiesis detected without restarting.Ping Identity Documentation

Applications consuming signed JWTs need theJSON Web Key Set (JWKS)endpoint to retrieve the public keys used for validating JWT signatures. PingAccess exposes this at/pa/authtoken/JWKS.

Exact Extract:

“When using JWT identity mapping, applications can obtain the signing keys from the/pa/authtoken/JWKSendpoint to validate the JWT signature.”

Option Ais correct —/pa/authtoken/JWKSprovides the key set for signature validation.

Option Bis incorrect — that’s an administrative API for configuring identity mappings, not a runtime validation endpoint.

Option Cis incorrect —/pa/aidc/cbis the OIDC callback endpoint.

Option Dis incorrect —/pa-admin-api/v3/authTokenManagementis for admin token management, not JWT validation.

TheSameSiteattribute is applied to session cookies to control cross-site behavior. In PingAccess, session cookie configuration (includingSameSite) is defined at theWeb Sessionlevel.

Exact Extract:

“Web session configuration includes cookie attributes such as name, domain, secure flag, HTTPOnly, and SameSite.”

Option A (Rules)is incorrect — rules govern access control, not cookies.

Option B (Sites)defines backend connections, not session cookies.

Option C (Applications)ties resources to sessions but does not define cookie behavior.

Option D (Web Sessions)is correct — session cookie SameSite settings are configured here.

PingAccess rules are categorized intoAccess Control RulesandProcessing Rules.

Processing Rulesmodify or add to HTTP requests and responses.

Cross-Origin Request (CORS)is specifically listed as aProcessing Rule, because it modifies response headers to support cross-origin requests.

Exact Extract:

“Processing rules apply to HTTP traffic, such as Cross-Origin Resource Sharing (CORS), header injection, or response modification.”

Option A (Web Session Attribute)is an access control rule.

Option B (Cross-Origin Request)is correct — this is a processing rule.

Option C (HTTP Request Parameter)is an access control rule.

Option D (HTTP Request Header)is an access control rule.

When applications depend solely onheader-based identity mapping, attackers can attempt to bypass PingAccess by injecting headers directly into requests sent to the backend. To prevent spoofing, PingAccess should be configured to passcryptographically verifiable tokens(e.g.,ID tokens from OIDC) instead of relying on plain headers.

Exact Extract:

“Headers can be spoofed if not protected. Use signed tokens, such as ID tokens or JWTs, to provide strong identity assurance and prevent header injection attacks.”

Option A (Use ID Tokens)is correct — ID tokens are signed and verifiable, preventing spoofing.

Option B (Add Site Authenticator)protects PingAccess-to-site authentication, not client-to-API spoofing.

Option C (Require HTTPS)prevents eavesdropping but does not stop header spoofing from inside the network.

Option D (Use Target Host Header)ensures host header integrity but not user identity.

When configuring PingAccess to use PingFederate as theStandard Token Providerfor runtime engines, PingAccess must know how to contact PingFederate. The configuration requires theHost(PingFederate base URL).

Exact Extract:

“When configuring the Standard Token Provider, specify the PingFederate host to which PingAccess engines will connect for token validation.”

Option A (Issuer)is part of OIDC metadata but not required explicitly in this configuration.

Option B (Client ID)is needed for OAuth clients but not when defining the token provider connection itself.

Option C (Host)is correct — this is required to connect to PingFederate.

Option D (Port)may be included within the host definition (host:port) but is not the required field.