Important Ping Identity PAP-001 Exam Questions

Answer: A

Explanation:

PingAccess can be configured to log or suppress back-channel requests that occur during token validation with an OAuth/OpenID Connect provider such as PingFederate. These requests happen when PingAccess calls PingFederate to validate access tokens or retrieve key material.

Exact Extract from PingAccess documentation:

''Back-channel requests are logged during token validation by default. To prevent these requests from being written to the audit log, update the Token Validation settings in PingAccess.''

This makes Token Validation the correct location for changing the behavior without modifying application-specific configurations.

Why other options are wrong:

B . Web Sessions

Incorrect. Web Sessions control user session management and cookie handling, not back-channel token validation traffic.

C . Sites

Incorrect. Sites are the definitions of backend servers that PingAccess proxies to. This setting does not affect back-channel logging to PingFederate.

D . Token Provider

Incorrect. The Token Provider defines the OIDC/OAuth server (e.g., PingFederate) and its endpoints, but the logging of back-channel requests is not controlled here.

Thus, the correct answer is A. Token Validation.

Answer: D

Explanation:

To prevent CORS errors, administrators must configure a Cross-Origin Request (CORS) Processing Rule. The secure practice is to allow the specific trusted domain (www.anycompany.com) and, when cookies or credentials are required, to enable Allow Credentials.

Exact Extract:

''For secure CORS, specify exact origins rather than wildcards. Enable 'Allow Credentials' when client-side resources must include cookies or authentication data.''

Option A is incomplete --- multiple values are possible, but in this case only www.anycompany.com is required.

Option B is less secure --- using a wildcard (*.anycompany.com) broadens exposure unnecessarily.

Option C is insecure --- * with credentials is disallowed by CORS specifications.

Option D is correct --- restricts access to the trusted domain and allows credentialed requests.

Answer: D

Explanation:

When APIs are remote, latency is introduced by frequent token validation requests. Enabling Cache Token on the OAuth Resource Server reduces repeated validation calls and improves performance.

Exact Extract:

''The OAuth Resource Server configuration includes a Cache Token option that improves performance by reducing round trips for token validation.''

Option A is incorrect --- key rolling affects cryptographic keys, not API latency.

Option B is incorrect --- virtual hosts control external FQDNs, not performance.

Option C is incorrect --- token attribute size does not significantly affect remote latency.

Option D is correct --- caching tokens reduces validation overhead.

Answer: B

Explanation:

When using HTTP Basic Authentication (admin.auth=native), PingAccess only supports a single administrative account (the default admin user). For multiple administrators, SSO integration (e.g., OIDC) is required.

Exact Extract:

''When admin authentication is set to native (HTTP Basic), only one administrative user is supported. For multiple admins, configure UI authentication with an OIDC provider.''

Option A (1000) is incorrect.

Option B (1) is correct --- only one basic auth admin account.

Option C (10) and Option D (100) are incorrect.

Answer: D

Explanation:

For SSL termination, PingAccess requires a Key Pair (certificate + private key). During a POC/demo, when a self-signed certificate is used, the administrator can create it directly in the Key Pairs section of the console.

Exact Extract:

''Use the Key Pairs section to create self-signed certificates for testing or proof-of-concept deployments. For production, import a PKCS#12 file containing a certificate chain and private key.''

Option A is incorrect --- Certificates store trust anchors (CAs), not SSL termination certs.

Option B is incorrect --- an internal CA-signed cert requires PKCS#12 import, not self-signed creation.

Option C is incorrect --- a publicly trusted CA is not used for a demo phase.

Option D is correct --- creating a new certificate in Key Pairs generates a self-signed cert suitable for demos.