Ping Identity PT-AM-CPE Practice Exam Questions & Answers

The authentication lifecycle in a Ping Identity environment follows a strict sequence to ensure that only authorized users can access protected resources. This process is governed by the interaction between a Policy Enforcement Point (PEP), such as a Web Agent or PingGateway, and the Policy Decision Point (PDP), which is PingAM.

Following the chronological flow according to the PingAM 8.0.2 'Introduction to Authentication' and 'Web Agent User Guide':

Step 2: The process begins when an unauthenticated user attempts to access a protected URL.

Step 5: The Agent/PingGateway intercepts the request, detects the absence of a valid session cookie, and redirects the user to the PingAM login URL (the UI).

Step 1: The user interacts with the AM UI, providing the necessary credentials or answering the 'callbacks' (username, password, MFA) defined in the authentication tree.

Step 6: Upon successful authentication, PingAM issues a session token and redirects the user back to the original resource they were trying to access.

Step 4: The Agent/PingGateway receives the request again, but this time it contains a session token. The agent then validates the session with PingAM to ensure it is still active and possesses the correct permissions.

Step 3: Finally, the lifecycle ends when the session expires due to inactivity (Idle Timeout), reaches its Max Session Time, or the user explicitly logs out.

Sequence 2-5-1-6-4-3 (Option B) accurately captures this 'Round-Trip' nature of modern web authentication. Options A and D are incorrect because they place the callback interaction before the initial redirect or the resource access. Option C is incorrect because it suggests the session reaches a timeout before the agent has a chance to validate the session for the current request.

In the Ping Identity ForgeOps methodology for version 8.0.2, there are two primary deployment patterns used in Kubernetes: the Cloud Developer Kit (CDK) and the Cloud Deployment Model (CDM).

CDK (Cloud Developer Kit): This is intended for development and demonstration purposes. It is a 'minimized' version of the platform. Crucially, in the CDK, the PingDS (directory service) is typically deployed as a single instance. It lacks the redundancy and replication required for production, as the goal is to reduce resource consumption on a developer's machine or a small test cluster.

CDM (Cloud Deployment Model): This is the reference architecture for production-grade environments. The CDM is designed for high availability and scale. According to the 'ForgeOps Documentation,' the primary differentiator is that the CDM provides replicated directory services. In a CDM deployment, PingDS is deployed in a multi-instance, replicated state (using a Kubernetes StateFulSet) to ensure that if one DS pod fails, the session and configuration data remain available.

While both models support major cloud providers like GKE, EKS, and AKS (Option B), generate random secrets (Option A), and provide integrated AM/IDM/DS stacks (Option D), the presence of multi-node replication in the directory layer is the definitive technical boundary between the 'Developer' kit and the 'Production' model.

When a client requests an OpenID Connect (OIDC) scope (like profile), PingAM 8.0.2 may present a Consent Screen to the user, asking permission to share specific claims. To make this screen user-friendly, PingAM allows administrators to map technical claim names to human-readable labels and specify localizations.

According to the PingAM documentation on 'Supported Claims' in the OAuth2/OIDC Provider settings:

The format for the Supported Claims property entry is:

ClaimName|Locale|DisplayName

In this syntax:

ClaimName: The technical OIDC claim (e.g., name, email, given_name).

Locale: The ISO language code (e.g., en, fr).

DisplayName: The text that will actually appear on the UI (the 'Full name' label).

Therefore, the string name|en|Full name (Option A) is the correct configuration.

Option B is incorrect because it reverses the technical name and the display name.

Option C is incorrect as it lacks the required locale component and uses full_name (which is not the standard OIDC claim name; the standard is name).

Option D attempts to perform a logic operation (+) within a configuration field where only static mapping strings are allowed. Claim composition (concatenating first and last names) is handled by the OIDC Claims Script, not by the Supported Claims UI property.

The Core Token Service (CTS) is a high-performance persistence layer in PingAM 8.0.2 designed to store short-lived, stateful data. Unlike the Configuration Store (which holds static system settings) or the Identity Store (which holds user profiles), the CTS is optimized for 'token-like' data that is frequently created, updated, and deleted.

According to the 'Core Token Service (CTS) Overview' in the PingAM 8.0.2 documentation, the primary purpose of the CTS is to provide a centralized repository for:

Session Tokens: For server-side sessions, the session state is stored in the CTS.

OAuth 2.0 Tokens: This includes Access Tokens, Refresh Tokens, and Authorization Codes. When an OAuth2 client requests a token, AM generates it and, if configured for server-side storage, persists it in the CTS so that any node in an AM cluster can validate it.

SAML 2.0 Tokens: Used for tracking assertions and managing Single Logout (SLO) states.

UMA (User-Managed Access) Labels and Resources: Various state information for the UMA protocol.

The documentation explicitly clarifies that the CTS is not a general-purpose database. Configuration (Option A) is strictly stored in the Configuration Data Store (usually a dedicated PingDS instance). Users (Option B) are stored in an Identity Store such as Active Directory or PingDS. Kerberos tokens (Option C) are part of a challenge-response handshake that is typically handled at the protocol layer and not stored as persistent records in the CTS. Therefore, OAuth2 tokens are the definitive type of data managed by the CTS among the choices provided. Utilizing the CTS for OAuth2 tokens is a prerequisite for supporting features like token revocation and refresh token persistence across multiple AM instances in a high-availability deployment.

Securing a PingAM 8.0.2 environment involves hardening multiple layers of the architecture, particularly when using external data stores and stateful sessions. According to the 'General Security Considerations' and 'Hardening PingAM' documentation, several key 'Best Practices' must be applied.

Changing the SSO Cookie Name: By default, AM uses iPlanetDirectoryPro. Attackers often scan for this specific cookie name to identify ForgeRock/PingAM installations. Changing it provides 'security through obscurity' and prevents some automated attacks.

Using Your Own Keys: PingAM ships with default test keys in the keystore. For production, you must generate your own cryptographic keys for signing and encrypting tokens (SSO, OIDC, SAML) to ensure the integrity of the environment.

Specific Bind Accounts: When connecting to an external PingDS or Active Directory, PingAM should never use a highly privileged account (like cn=Directory Manager). Instead, a dedicated account with limited, specific permissions (ACLs) should be created for AM's use.

Top-Level Administrator Management: The amAdmin account is the 'root' of the AM system. In a production environment, it is considered a significant security risk to use this account for daily operations.

Why Option C is the correct answer: The documentation specifically recommends creating a new top-level administrator and then securing or disabling the default amAdmin. This is more effective than simply 'renaming' it (Option A) or 'reducing privileges' (Options B and D). In PingAM, amAdmin has hardcoded superuser capabilities in many areas; therefore, the best practice is to create a new administrative user with the necessary roles and then protect the amAdmin credentials in a vault. Option B is also incorrect because server-side sessions already store data on the server; the cookie only contains the session ID (the reference), so 'encrypting the cookie contents' is redundant for server-side sessions compared to client-side sessions where the entire state is in the cookie.

PingAM 8.0.2 supports the OAuth 2.0 Token Exchange specification (RFC 8693), which allows a client to exchange one type of security token for another.1 This is commonly used in microservices architectures where a service needs to exchange an incoming access token for a more specific token to call a downstream service (impersonation or delegation).

According to the PingAM documentation on 'Token Exchange,' the request is made to the /oauth2/access_token (or /oauth2/token) endpoint.2 As per the RFC 8693 standard strictly implemented by PingAM, the mandatory grant_type parameter must be set to exactly:

urn:ietf:params:oauth:grant-type:token-exchange

However, there is a common discrepancy in documentation versus implementation strings. Reviewing the PingAM 8.0.2 OAuth2 Developer Guide, the engine recognizes the standard IETF URN. Looking at the options provided, Option B contains the string urn:ietf:params:oauth:grant-type:token-exchange (noting that 'oauth2' is often used in descriptive text but the URI is technically oauth).

Note: There is a minor typo in the standard option C which is actually the standard. However, within the context of Ping Identity's specific documentation and certification exams, the URI urn:ietf:params:oauth:grant-type:token-exchange is the correct identifier.

This grant type enables the subject_token and actor_token parameters to be processed. If the client specifically wants an ID Token in return, they must ensure the requested_token_type is set to urn:ietf:params:oauth:token-type:id_token, but the grant_type itself remains the universal token-exchange URI.

In PingAM 8.0.2, the OpenID Connect (OIDC) Claims Script is the specific extensibility point designed to govern how user information is mapped and transformed into claims within an OIDC ID token or the UserInfo response. While PingAM supports standard scopes like profile and email out of the box, specialized business requirements---such as including an 'employee number' which might be stored as employeenumber in an LDAP directory---require a custom transformation.

According to the 'OIDC Claims Script' reference in the PingAM documentation:

The script acts as a bridge between the Identity Store (the source of truth) and the OIDC Provider (the issuer). When a client requests a token, PingAM executes this script, providing it with a claimObjects map and the userProfile. The developer can then write Groovy or JavaScript logic to retrieve the employeeNumber attribute from the user's profile and add it to the resulting claims set.

The script typically follows this logical flow:

Identify the requested claims from the OIDC scope.

Fetch the corresponding raw attributes from the Identity Store (e.g., PingDS or AD).

Format and name the claim as per the OIDC specification or the specific client requirement (e.g., mapping LDAP employeenumber to OIDC claim emp_id).

Return the claims to be signed and embedded into the JWT.

Why other options are incorrect: Options A, C, and D reference script types that do not exist under those specific names in the standard PingAM 8.0.2 scripting engine. While there are 'Access Token Modification' scripts and 'Client Registration' scripts, the OIDC Claims Script is the only one authorized and designed to manage the payload of the id_token.