Key details for this exam, checked against the published exam outline
Each question shows the correct answer and an explanation of why it is right
An internal audit reveals that an agent has been compromised. What action must be taken to re-secure the agent?
When a PingAccess agent is compromised, the secure approach is to invalidate the existing credentials and issue a new configuration file from the PingAccess Admin Console. This provides a fresh agent.properties file with new secrets, ensuring compromised keys cannot be reused.
Exact Extract:
''If an agent is compromised, revoke and regenerate the agent configuration by downloading a new agent.properties file from the administrative console.''
Option A is incorrect --- manually changing the secret in the file does not propagate it to PingAccess.
Option B is incorrect --- trusted certificates are not tied to agent authentication.
Option C is unnecessary --- reinstalling the agent does not reset credentials.
Option D is correct --- downloading a new agent.properties file re-secures the agent.
An administrator needs to add a set of rules to an application protected by a PingAccess agent. Which rule will be unavailable to add to the application?
PingAccess distinguishes between gateway rules and agent rules. Some processing rules, such as Rewrite Cookie Domain, only apply when PingAccess is acting as a reverse proxy (gateway), not when protecting applications via agents.
Exact Extract:
''Rewrite Cookie Domain rules are not supported for agent applications. They are only available for proxied (gateway) applications.''
Option A (Rewrite Cookie Domain) is correct --- unavailable with agent applications.
Option B (Network Range) is available for both agents and gateways.
Option C (Rate Limiting) is supported on both application types.
Option D (Cross-Origin Request) is also supported in both.
Which element in the log4j2.xml file must be modified to change the log level in PingAccess?
In Log4j2, the Logger element controls the log level (INFO, DEBUG, ERROR, etc.) for specific packages or classes.
Exact Extract:
''To modify logging levels, edit the <Logger> element in log4j2.xml and change the level attribute.''
Option A (AsyncLogger) is a performance optimization, not for changing levels.
Option B (RollingFile) defines file rotation, not log levels.
Option C (Logger) is correct --- this is where log levels are defined.
Option D (Appenders) define output destinations, not severity levels.
During a business review of an application, the administrator needs to change the Resource Authentication to anonymous. What are the two effects of making this change to the resource? (Choose 2 answers.)
When a resource is configured as anonymous, PingAccess does not challenge the user for authentication. However, certain processing and identity propagation still occur.
Exact Extract:
''Anonymous resources do not require authentication. Identity mappings and request/response processing rules still apply.''
Option A is incorrect because rules such as identity mappings and processing still apply.
Option B is correct --- Identity Mappings can still forward attributes, even for anonymous access.
Option C is correct --- Processing rules (e.g., request/response modifications) still apply.
Option D is incorrect --- requests are logged; anonymous does not disable logging.
Option E is incorrect --- access control rules (authorization) are not evaluated for anonymous resources.
Where in the administrative console should an administrator make user attributes available as HTTP request headers?
PingAccess uses Identity Mappings to take identity attributes provided by the authentication source (e.g., PingFederate, OpenID Connect) and map them into HTTP request headers for back-end applications.
Exact Extract:
''An identity mapping allows you to map identity attributes from the user's session to HTTP headers, cookies, or query parameters that are then forwarded to the target application.''
Option A (Site Authenticators) is incorrect because Site Authenticators configure how PingAccess communicates with applications requiring authentication, not how attributes are inserted into headers.
Option B (Identity Mappings) is correct --- this is the feature designed specifically to expose user attributes to applications via HTTP headers.
Option C (Web Sessions) manages how sessions are stored and validated, but not the mapping of attributes into requests.
Option D (HTTP Requests) refers to request/response processing rules, but attributes are not mapped here.
Refer to the following applications:
hr.company.com
finance.company.com
customer.order.company.com
Which action should be taken to allow these applications to share the same web session?
For multiple subdomains to share the same PingAccess session, the Cookie Domain must be configured so that the session cookie is valid across all listed applications.
Exact Extract:
''Set the Cookie Domain in the web session configuration to a parent domain (for example, .company.com) to enable applications in different subdomains to share the same session.''
Option A (Set Audience option) applies to OAuth token validation, not cookie sharing.
Option B (Set Cookie Domain option) is correct --- e.g., setting .company.com allows session cookies to be shared.
Option C (Rewrite Cookie Domain rule) modifies upstream cookies for back-end applications, not PingAccess session cookies.
Option D (Rewrite Cookie Path rule) is unrelated; it modifies paths for cookies, not domains.
Exam domains verified against: Official Ping Identity PAP-001 exam guide, last checked September 2026.
Describe the product's features, functionality, and basic use cases. Describe the use cases for integration with other Ping products.
Outline the installation requirements. Explain how to install and remove the product using command-line and graphical installation tools. Demonstrate an understanding of how to set and obfuscate configuration database passwords. Define the purpose of specified run.properties configuration entries. Explain the elements and basic configuration of an on-premise PingAccess cluster.
Sample question from this domain above: Q1
Explain how to import and manage certificates and certificate groups. Explain the ways a certificate can be associated with a virtual host or a listener. Describe how to use roles in the context of administrator authentication.
Explain the different configuration options used to configure PingAccess to use a token provider. Define the OAuth authorization prerequisites and settings for protecting APIs. Define the OpenID Connect pre-requisites and settings for protecting web applications. Describe the purpose of site authenticators. Explain how to configure PingAccess to use an agent. Define the OpenID Connect/OAuth pre-requisites and settings for protecting Web+API applications.
Explain how PingAccess evaluates paths to apply policy and select the appropriate application or resource. Define the purpose of the different types of rules. Explain how to configure different rules. Explain the usage of rule sets and rule set groups.
Explain basic maintenance tasks including managing licenses, managing backups, configuration import/export, enabling resource auditing, and upgrading. Explain the purpose of various PingAccess log files. Describe the product's file system structure and important configuration files.
Sample question from this domain above: Q3
Explain the different object types such as application, virtual host, and web session, and how they relate to each other. Explain how to create and manage application resource properties. Explain how to create or manage a web session. Explain how to configure header-based and JWT identity mappings. Describe the functionality and how to navigate the administrative console.
Common questions about the exam itself
