Free and Premium Ping Identity PAP-001 Dumps Questions Answers

All onboarding in PingAccess begins with defining anApplication. Once the application exists, the administrator can defineResourceswithin it and assign different rules to those resources.

Exact Extract:

“Before you can configure resources and rules, you must first create an application in PingAccess.”

Option A (Identity Mapping)may be required later but not the first step.

Option B (Web Session)can be shared but is not the first onboarding step.

Option C (Application)is correct — the starting point for onboarding.

Option D (Resource)comes after creating the application.

Legacy PKIs often provide certificate chains that areout of orderor non-compliant with RFC-5280 path validation. PingAccess provides an option in Trusted Certificate Groups calledValidate disordered certificate chainsto allow chaining even if the order is not RFC-5280 compliant.

Exact Extract:

“EnableValidate disordered certificate chainswhen the certificate chain is not in RFC-5280 compliant order but should still be accepted.”

Option Ais incorrect; using the Java trust store is unrelated to PKI ordering.

Option Bis correct — this setting allows PingAccess to process disordered certificate chains.

Option Cis incorrect; date checks are unrelated to RFC-5280 path ordering.

Option Dis incorrect; revocation status handling does not address legacy PKI ordering issues.

For SSL termination, PingAccess requires aKey Pair(certificate + private key). During a POC/demo, when aself-signed certificateis used, the administrator can create it directly in theKey Pairssection of the console.

Exact Extract:

“Use the Key Pairs section to create self-signed certificates for testing or proof-of-concept deployments. For production, import a PKCS#12 file containing a certificate chain and private key.”

Option Ais incorrect — Certificates store trust anchors (CAs), not SSL termination certs.

Option Bis incorrect — an internal CA-signed cert requires PKCS#12 import, not self-signed creation.

Option Cis incorrect — a publicly trusted CA is not used for a demo phase.

Option Dis correct — creating a new certificate in Key Pairs generates a self-signed cert suitable for demos.

TheSameSiteattribute is applied to session cookies to control cross-site behavior. In PingAccess, session cookie configuration (includingSameSite) is defined at theWeb Sessionlevel.

Exact Extract:

“Web session configuration includes cookie attributes such as name, domain, secure flag, HTTPOnly, and SameSite.”

Option A (Rules)is incorrect — rules govern access control, not cookies.

Option B (Sites)defines backend connections, not session cookies.

Option C (Applications)ties resources to sessions but does not define cookie behavior.

Option D (Web Sessions)is correct — session cookie SameSite settings are configured here.

The pattern/images/sitel/*matches all subpaths and files under the/images/sitel/directory, including nested paths.

Exact Extract:

“The asterisk (*) matches zero or more characters within the path. For example,/images/sitel/*matches all resources under thesitelfolder.”

Option Ais incorrect — it references/aitel/instead of/sitel/.

Option Bis incorrect —/site*matches strings beginning with “site”, but may also match “siteX” incorrectly.

Option Cis incorrect — it only matches resources under/english/, missing other folders.

Option Dis correct —/images/sitel/*covers all given examples.

For PingAccess to terminate SSL for a proxied application, it requires access to theprivate key and certificate chain. These are stored asKey Pairs.

Exact Extract:

“For SSL termination, you must import the server certificate and its private key as a PKCS#12 file intoKey Pairs.”

Option Ais incorrect — a public key alone cannot terminate SSL.

Option Bis incorrect — PKCS#12 files must go intoKey Pairs, not Certificates.

Option Cis incorrect — public keys alone are insufficient; PingAccess must have the private key.

Option Dis correct — the PKCS#12 file with full chain and private key is imported intoKey Pairs.

Therun.propertiesfile in PingAccess is the primary configuration file that defines system-level runtime behavior. According to PingAccess documentation:

Exact Extract:

“Therun.propertiesfile contains configuration properties for PingAccess, including operational mode, logging levels, admin authentication fallback, cluster settings, and system defaults.”

(PingAccess Administrator’s Guide –run.properties Reference)

From this, we can determine:

C. Operational mode for PingAccess→CorrectThe propertypa.operational.modeinrun.propertiesdefines whether the node operates asSTANDALONE,CLUSTERED_CONSOLE,CLUSTERED_CONSOLE_REPLICA, orCLUSTERED_ENGINE. This is one of the core configurable options.

E. Logging levels→CorrectProperties such aslog.leveland other logging configurations are explicitly defined inrun.properties, allowing administrators to adjust the verbosity of logs (DEBUG, INFO, WARN, ERROR).

Why the others are incorrect:

A. Default logs location→IncorrectThe log file path is not controlled viarun.properties. It is defined inlog4j2.xml, not inrun.properties.

B. URL for heartbeat endpoint→IncorrectThe heartbeat endpoint (/pa/heartbeat.ping) is a fixed system endpoint and is not configurable inrun.properties.

D. X-Frame-Options header→IncorrectSecurity headers likeX-Frame-Optionsare managed under application security policies or global response headers, not inrun.properties.

PingAccess automatically creates configurationarchive backupswhenever changes are made. These are stored in thedata/archivedirectory.

Exact Extract:

“PingAccess stores configuration archive files in thePA_HOME/data/archivedirectory.”

Option A (tools)is incorrect — contains administrative scripts.

Option B (conf)is incorrect — holds configuration files likerun.properties.

Option C (data)is correct — archives are stored underdata/archive.

Option D (bin)is incorrect — contains executables and scripts.

For multiple subdomains to share the same PingAccess session, theCookie Domainmust be configured so that the session cookie is valid across all listed applications.

Exact Extract:

“Set the Cookie Domain in the web session configuration to a parent domain (for example, .company.com) to enable applications in different subdomains to share the same session.”

Option A (Set Audience option)applies to OAuth token validation, not cookie sharing.

Option B (Set Cookie Domain option)is correct — e.g., setting.company.comallows session cookies to be shared.

Option C (Rewrite Cookie Domain rule)modifies upstream cookies for back-end applications, not PingAccess session cookies.

Option D (Rewrite Cookie Path rule)is unrelated; it modifies paths for cookies, not domains.

Identity Mapping in PingAccess relies on attributes provided by thetoken provider(e.g., PingFederate, OIDC provider). If the desired attributes are not present in the dropdown, it means they are not being provided in the token or userinfo response.

Exact Extract:

“Attributes available in identity mappings are those provided in the web session by the token provider. If attributes are missing, they must be added to the token by the identity provider.”

Option Ais correct — the token provider administrator must configure the IdP to include the additional attributes.

Option Bis incorrect — rewrite rules modify content but do not supply new identity attributes.

Option Cis incorrect — developers cannot directly add identity attributes; they must come from the IdP.

Option Dis incorrect — Web Session Attribute rules only evaluate available attributes; they don’t create new ones.

PingAccess installs as a Windows service. To remove or prevent automatic startup, theuninstall-service.batscript is used.

Exact Extract:

“On Windows, useinstall-service.batto install PingAccess as a service anduninstall-service.batto remove the service.”

Option A (init.bat)initializes environment variables but does not manage services.

Option B (uninstall-service.bat)is correct — it removes the Windows service, preventing auto-start.

Option C (remove-install.bat)is not a valid PingAccess script.

Option D (wrapper-service.bat)configures wrapper options, not service removal.

When PingAccess is integrated with PingFederate as aToken Provider, the OAuth clients already configured in PingFederate become available in PingAccess. This enables administrators toautomatically select Client IDswhen creating Web Sessions.

Exact Extract:

“When PingAccess uses PingFederate as its token provider, PingFederate OAuth clients appear automatically in PingAccess for selection during web session configuration.”

Option Ais incorrect — this refers to Admin Console authentication, which is separate.

Option Bis incorrect — OAuth clients must be created in PingFederate, not from within PingAccess.

Option Cis incorrect — token issuance policies are managed in PingFederate, not PingAccess.

Option Dis correct — the Client ID dropdown is populated automatically from PingFederate.

When APIs are remote, latency is introduced by frequent token validation requests. EnablingCache Tokenon the OAuth Resource Server reduces repeated validation calls and improves performance.

Exact Extract:

“The OAuth Resource Server configuration includes aCache Tokenoption that improves performance by reducing round trips for token validation.”

Option Ais incorrect — key rolling affects cryptographic keys, not API latency.

Option Bis incorrect — virtual hosts control external FQDNs, not performance.

Option Cis incorrect — token attribute size does not significantly affect remote latency.

Option Dis correct — caching tokens reduces validation overhead.

PingAccess is designed to work with modern identity protocols. It doesnotsupport legacy WS-* protocols directly.

Exact Extract:

“PingAccess integrates with OAuth 2.0 and OpenID Connect (OIDC) to provide authentication and authorization for web and API resources.”

Option A (SAML)is incorrect — PingAccess does not natively consume SAML assertions; SAML can be used indirectly via PingFederate.

Option B (WS-Fed)is not supported.

Option C (WS-Trust)is not supported.

Option D (OAuth2)is correct — used for authorization and token validation.

Option E (OIDC)is correct — used for user authentication and sessions.

PingAccess allows fine-grained authentication enforcement by applyingAuthentication Requirement rulesat the resource level. These rules can invoke MFA flows based on request context or policy.

Exact Extract:

“Authentication requirement rules determine whether PingAccess challenges a user to authenticate again (for example, with MFA) before allowing access to a protected resource.”

Option Ais incomplete. Creating a requirement does nothing unless it is applied.

Option Bis correct because applying the Authentication Requirement rule to thespecific resource (URL)enforces MFA only for that resource.

Option Cis incorrect; Web Session Attribute rules are about evaluating existing session attributes, not triggering MFA.

Option Dis incorrect; HTTP Request Parameter rules are used to evaluate request data, not enforce MFA policies.

PingAccess supports logging directly to a relational database usingLog4j database appenders. To enable this:

Configurelog4j2.xmlto use a JDBC Appender.

Configurelog4j2.db.propertieswith the database connection information.

Provide the appropriate database driver in thePA_HOME/libdirectory.

Exact Extract:

“To log to a database, configure log4j2.xml and log4j2.db.properties, and place the JDBC driver JAR file in PA_HOME/lib.”

Option Ais correct — both files must be configured.

Option Bis incorrect — existing logs do not need removal.

Option Cis incorrect — enabling audit is unrelated to database logging.

Option Dis correct — the Oracle JDBC driver must be installed in PA_HOME/lib.

Option Eis incorrect unless TLS is used to connect to the DB, but it is not required for standard DB logging setup.

PingAccess rules are categorized intoAccess Control RulesandProcessing Rules.

Processing Rulesmodify or add to HTTP requests and responses.

Cross-Origin Request (CORS)is specifically listed as aProcessing Rule, because it modifies response headers to support cross-origin requests.

Exact Extract:

“Processing rules apply to HTTP traffic, such as Cross-Origin Resource Sharing (CORS), header injection, or response modification.”

Option A (Web Session Attribute)is an access control rule.

Option B (Cross-Origin Request)is correct — this is a processing rule.

Option C (HTTP Request Parameter)is an access control rule.

Option D (HTTP Request Header)is an access control rule.

PingAccess service scripts depend on knowing:

Where the Java runtime is installed (JAVA_HOME)

Where PingAccess itself is installed (PA_HOME)

Exact Extract:

“The PingAccess startup scripts require theJAVA_HOMEenvironment variable to locate the JDK/JRE and thePA_HOMEvariable to locate the PingAccess installation directory.”

Option A (J2EE_HOME)is irrelevant to PingAccess.

Option B (JAVA_HOME)is correct — needed for Java execution.

Option C (PA_PATH)is not a standard variable.

Option D (PA_HOME)is correct — required to point to the PingAccess installation root.

Option E (JAVA_PATH)is not valid;PATHcan include Java, butJAVA_HOMEis the correct environment variable.

Modern browsers enforce stricter cookie handling rules. If cookies are not configured correctly with theSameSiteattribute, behavior can differ across browsers, leading to inconsistent authentication and access denials. Security exceptions may appear when session cookies are blocked.

Exact Extract:

“The SameSite cookie setting defines how browsers send cookies in cross-site requests. Misconfigured SameSite values can lead to inconsistent application behavior across browsers.”

Option A (Enable PKCE)is related to OAuth flow security, not browser cookie behavior.

Option B (SameSite Cookie)is correct — this directly explains the inconsistent browser issues.

Option C (Request Preservation)ensures query parameters are kept, not related to cross-browser session handling.

Option D (Validate Session)checks session state but does not address browser inconsistencies.

PingAccess usesEngine Listenersfor SSL termination of proxied applications. To minimize the number of certificates, administrators can:

Use awildcard certificate(e.g.,*.customer.com) on the engine listener.

Use aSubject Alternative Name (SAN) certificatethat covers multiple FQDNs under thecustomer.comdomain.

Exact Extract:

“PingAccess engine listeners can use certificates containing either wildcard entries or Subject Alternative Names to secure multiple applications under a single domain.”

Option Ais incorrect — assigning unique key pairs increases, not decreases, certificate management overhead.

Option Bis correct — a wildcard certificate covers all subdomains (e.g.,app1.customer.com,app2.customer.com).

Option Cis correct — a SAN certificate lists multiple FQDNs explicitly.

Option Dis incorrect — agent listeners don’t handle SSL termination for proxied apps.

Option Eis incorrect for the same reason — agent listeners aren’t used for SSL.

All administrative API calls that change PingAccess configuration are logged inpingaccess_api_audit.log. This allows administrators to track who made configuration changes.

Exact Extract:

“Thepingaccess_api_audit.logfile contains entries for all administrative API calls and is used to audit configuration changes.”

Option A (pingaccess.log)contains runtime system messages but not detailed API audit entries.

Option B (pingaccess_engine_audit.log)is specific to engine request/response audit logging.

Option C (pingaccess_agent_audit.log)is used for PingAccess Agent traffic auditing, not administrative changes.

Option D (pingaccess_api_audit.log)is correct — it tracks admin API modifications.