Ping Identity PT-AM-CPE Practice Exam Questions & Answers

In SAML 2.0, an Artifact is a reference (a 'pointer' or 'ticket') used in the SAML Artifact Binding.5 This is an alternative to the more common POST or Redirect bindings where the actual XML assertion is sent through the user's browser.

According to the PingAM 'SAML 2.0 Bindings' documentation:

When using the Artifact binding, the Identity Provider (IdP) does not send the full SAML Assertion through the browser.6 Instead, it sends a small, opaque string called the Artifact to the Service Provider (SP).

Issuance: The IdP stores the real assertion in its own local memory/cache and sends the Artifact to the SP via the browser redirect.

Resolution: The Service Provider receives the Artifact and then makes a direct, secure back-channel call (SOAP over HTTPS) to the IdP's Artifact Resolution Endpoint.

Exchange: The SP presents the Artifact, and the IdP returns the actual SAML Assertion.

Therefore, the Artifact is the value sent to retrieve the assertion (Option D). It is not the assertion itself (Option A), nor is it a binding name or an attribute name. The Artifact binding is often used for security reasons, as it prevents the sensitive assertion data from ever passing through the user's browser, thus mitigating certain types of interception attacks.

In PingAM 8.0.2, the OAuth 2.0 Token Exchange (RFC 8693) implementation allows for complex identity delegation scenarios. The may_act claim is a specific claim used to indicate that one entity is authorized to act on behalf of another. When customizing the behavior of token exchange via the OAuth2 Token Exchange Script, developers interact with specific scriptable objects provided by the PingAM engine.

According to the 'Scripting API' for OAuth2 and the 'Token Exchange' developer guide, the requestedToken object is the primary interface used to modify the structure of the token being issued during the exchange. To insert the may_act claim, the API provides the addMayAct() method.

The may_act claim is technically a JSON object that contains a sub (subject) claim of the entity that is allowed to act as the subject of the token. In the scripting environment:

The requestedToken variable represents the token currently being minted.

The .addMayAct() method is the defined function signature to append this delegation metadata.

Why other options are incorrect:

Options A and D: The object name token is not the standard binding used for the target token in the Token Exchange script context; requestedToken is the correct binding.

Option C: The method name setMayAct is incorrect. The PingAM API uses the add prefix for these types of claims (similar to addActor), reflecting the underlying structure where these claims are added to the claim set of the JWT.

Using the correct syntax requestedToken.addMayAct(mayAct) ensures that the resulting Access Token or ID Token contains the correctly formatted delegation information required by resource servers to validate that the 'Actor' has the permission to represent the 'Subject.'

This question explores the fundamental architecture of Session Management in PingAM 8.0.2. PingAM is designed to be highly flexible, supporting both traditional browser-based Single Sign-On (SSO) and modern API-driven interactions.

Analysis of the statements based on PingAM documentation:

Statement A is correct: For browser-based flows, PingAM uses HTTP cookies to maintain session state. Upon successful authentication, AM sends a Set-Cookie header to the browser containing the session token (the session reference).

Statement B is correct: For 'headless' or REST-based authentication (such as a mobile app or a back-end service calling /json/realms/root/authenticate), there is no browser to handle cookies automatically. In this case, PingAM returns the tokenId directly in the JSON response body, allowing the client to manage the token manually in subsequent API calls.

Statement D is correct: For historical reasons, the default value for the SSO Cookie Name in PingAM is iPlanetDirectoryPro. While administrators are encouraged to change this for security (obfuscation), it remains the default 'out-of-the-box' configuration.

Statement C is incorrect: This is the 'distractor' in the question. PingAM 8.0.2 supports multiple session storage models. While the Core Token Service (CTS) is the standard for server-side stateful sessions, AM also supports Client-side sessions (where the state is stored in a signed/encrypted JWT in the cookie itself) and In-memory sessions (primarily used for short-lived authentication journeys). Since AM is not restricted only to the CTS, Statement C is false.

Therefore, the combination of A, B, and D accurately reflects the session capabilities of PingAM 8.0.2, making Option A the correct answer.

The Push Result Verifier node is a core component of the 'MFA: Push Authentication' journey in PingAM 8.0.2. Its primary function is to check the status of a push notification that was previously dispatched to a user's mobile device (usually via the Push Sender node).22

According to the 'Authentication Node Reference' for version 8.0.2, the node evaluates the state of the push request and yields exactly four distinct outcomes:

Success: This path is followed if the user has actively approved the push notification on their registered device using the ForgeRock/Ping Authenticator app.

Failure: This path is taken if the user explicitly denies or rejects the push notification on their device, indicating a potential unauthorized login attempt.

Expired: This outcome occurs if the notification reaches its 'Message Timeout' limit (defined in the Push Sender node) without any response from the user.23 In standard trees, this path often loops back to allow the user to try a different MFA method or resend the push.

Waiting: This outcome is triggered if a response has not yet been received but the timeout has not yet been reached. This is used in conjunction with a Push Wait or Polling mechanism to create a 'check-and-loop' logic until a final result (Success, Failure, or Expired) is determined.

The Retry outcome (mentioned in other options) is notably absent from this specific node's metadata. While a 'Retry' might be implemented in the overall tree logic (for example, by using a Retry Limit Decision node after an Expired outcome), the Push Result Verifier node itself only reports the state of the specific push transaction it is tracking. Understanding these four discrete states is vital for designing resilient authentication journeys that handle user delays or network issues gracefully.

Mutual TLS (mTLS) is a security enhancement where both the client and the server provide X.509 certificates to prove their identities.9 In PingAM 8.0.2, mTLS is frequently used for secure 'Machine-to-Machine' (M2M) communication, such as between an OAuth2 client and the token endpoint, or between AM and a Directory Server (PingDS).

According to the PingAM documentation on 'Secure Network Communication' and 'mTLS for OAuth2,' the handshake sequence for mTLS follows these logical steps:

Client Hello: The client initiates the request to the server.10

Server Hello & Certificate: The server responds by presenting its own certificate (verifying the server's identity to the client).11 In an mTLS scenario, the server also includes a CertificateRequest message.12

Client Certificate & Key Exchange: The client validates the server's certificate. If valid, the client then sends its own Client Certificate to the server, along with the encrypted pre-master secret or key exchange data.

Verification and Establishment: The server validates the client's certificate against its truststore. If the certificate is trusted and the cryptographic signatures match, the mutually secure connection is established.

Option D represents the most accurate 'simplified' sequence. Option A is incorrect because the server presents its certificate before the client sends its own certificate. Option B and C are incorrect because the server always responds to the initial 'Client Hello' with its own identity (Server Certificate) before the client proceeds with identity submission. This 'handshake' ensures that no data is transmitted until both parties have cryptographically verified each other.