Ping Identity PAP-001 Practice Exam Questions & Answers

PingAccess uses obfuscated keys to secure sensitive configuration values (like passwords). The obfuscate.bat (Windows) or obfuscate.sh (Linux) script is used to generate a new key and protect sensitive data.

Exact Extract:

''Use obfuscate.[bat|sh] to generate a new obfuscation key for protecting configuration values.''

Option A (db-passwd-rotate.bat) is not a valid PingAccess script.

Option B (memoryoptions.bat) configures JVM memory, not encryption.

Option C (run.bat) starts PingAccess.

Option D (obfuscate.bat) is correct --- it is used to protect sensitive configuration.

When using HTTP Basic Authentication (admin.auth=native), PingAccess only supports a single administrative account (the default admin user). For multiple administrators, SSO integration (e.g., OIDC) is required.

Exact Extract:

''When admin authentication is set to native (HTTP Basic), only one administrative user is supported. For multiple admins, configure UI authentication with an OIDC provider.''

Option A (1000) is incorrect.

Option B (1) is correct --- only one basic auth admin account.

Option C (10) and Option D (100) are incorrect.

The pa.operational.mode property in run.properties defines the role of the node in a PingAccess deployment (e.g., STANDALONE, CLUSTERED_CONSOLE, CLUSTERED_CONSOLE_REPLICA, ENGINE).

Exact Extract:

''The pa.operational.mode property determines the role of the server in the cluster, such as standalone, console, console replica, or engine.''

Option A is incorrect --- replication is implicit in certain roles, not controlled directly.

Option B is correct --- the setting specifies whether the node is admin console, replica, or engine.

Option C is incorrect --- development vs production is not a function of this setting.

Option D is incorrect --- it does not enable/disable nodes.

Applications consuming signed JWTs need the JSON Web Key Set (JWKS) endpoint to retrieve the public keys used for validating JWT signatures. PingAccess exposes this at /pa/authtoken/JWKS.

Exact Extract:

''When using JWT identity mapping, applications can obtain the signing keys from the /pa/authtoken/JWKS endpoint to validate the JWT signature.''

Option A is correct --- /pa/authtoken/JWKS provides the key set for signature validation.

Option B is incorrect --- that's an administrative API for configuring identity mappings, not a runtime validation endpoint.

Option C is incorrect --- /pa/aidc/cb is the OIDC callback endpoint.

Option D is incorrect --- /pa-admin-api/v3/authTokenManagement is for admin token management, not JWT validation.

Processing Rules in PingAccess apply transformations to HTTP traffic (requests or responses) in real time, such as modifying headers, handling CORS, or rewriting cookies.

Exact Extract:

''Processing rules allow PingAccess to modify HTTP requests and responses in real time, such as adding headers or enabling cross-origin requests.''

Option A is incorrect --- they are not for offline data collection.

Option B is correct --- their purpose is real-time modification of web traffic.

Option C is incorrect --- access control rules enforce or override authorization, not processing rules.

Option D is incorrect --- auditing is handled in log configurations, not processing rules.

PingAccess retains backup archives of its configuration in the data/archive directory. The number of retained backups is controlled in the run.properties file.

Exact Extract:

''The number of configuration backups retained in the data/archive directory is controlled by the archive.maxCount property in run.properties.''

Option A (log4j2.db.properties) is incorrect; this file controls database logging, not archive retention.

Option B (jvm-memory.options) is incorrect; this file sets JVM heap and memory arguments.

Option C (run.properties) is correct --- it contains system-level settings including archive.maxCount.

Option D (log4j2.xml) is incorrect; this file configures log appenders and levels, not archive backups.

To pass user attributes into HTTP headers for applications, PingAccess uses Identity Mappings. When attributes need to be passed specifically as headers, the administrator must update the Header Identity Mapping.

Exact Extract:

''Header identity mappings map attributes from a user's web session to HTTP headers that are then sent to the back-end application.''

Option A (HTTP Request Header Rule) is incorrect --- this adds or modifies static request headers, not user attributes.

Option B (Header Identity Mapping) is correct --- this maps identity attributes into headers dynamically.

Option C (JWT Identity Mapping) is incorrect --- that's used for passing attributes as claims in JWTs.

Option D (Web Session Attribute Rule) is incorrect --- that is for access control evaluation, not propagation of attributes.