Important Ping Identity PAP-001 Exam Questions

Answer: D

Explanation:

To prevent CORS errors, administrators must configure a Cross-Origin Request (CORS) Processing Rule. The secure practice is to allow the specific trusted domain (www.anycompany.com) and, when cookies or credentials are required, to enable Allow Credentials.

Exact Extract:

''For secure CORS, specify exact origins rather than wildcards. Enable 'Allow Credentials' when client-side resources must include cookies or authentication data.''

Option A is incomplete --- multiple values are possible, but in this case only www.anycompany.com is required.

Option B is less secure --- using a wildcard (*.anycompany.com) broadens exposure unnecessarily.

Option C is insecure --- * with credentials is disallowed by CORS specifications.

Option D is correct --- restricts access to the trusted domain and allows credentialed requests.

Answer: A

Explanation:

To transmit the id_token via a back channel according to OIDC best practices, the application must use the Authorization Code Flow (login type = code). This ensures tokens are retrieved securely via the back channel instead of being exposed in the browser.

Exact Extract:

''For back-channel transmission of ID tokens, configure the OIDC login type as Authorization Code.''

Option A is correct --- setting login type to code ensures back-channel delivery.

Option B is incorrect --- request preservation concerns request method persistence, not OIDC flow.

Option C is incorrect --- POST is not a valid login type; only Code, Implicit, or Hybrid.

Option D is incorrect --- request preservation has no bearing on token delivery.

Answer: C

Explanation:

When a backend application requires its own authentication (e.g., Basic Auth or mutual TLS), PingAccess uses a Site Authenticator to inject the necessary credentials.

Exact Extract:

''Site Authenticators provide the credentials PingAccess uses when authenticating to target applications that require their own authentication mechanisms.''

Option A (Token Provider) is incorrect --- this is used for OIDC/OAuth tokens, not site-level authentication.

Option B (Web Session) manages end-user sessions, not backend site authentication.

Option C (Site Authenticator) is correct --- it handles authentication between PingAccess and the backend.

Option D (Access Control Rule) enforces authorization, not backend authentication.

Answer: C, E

Explanation:

The run.properties file in PingAccess is the primary configuration file that defines system-level runtime behavior. According to PingAccess documentation:

Exact Extract:

''The run.properties file contains configuration properties for PingAccess, including operational mode, logging levels, admin authentication fallback, cluster settings, and system defaults.''

(PingAccess Administrator's Guide -- run.properties Reference)

From this, we can determine:

C . Operational mode for PingAccess Correct

The property pa.operational.mode in run.properties defines whether the node operates as STANDALONE, CLUSTERED_CONSOLE, CLUSTERED_CONSOLE_REPLICA, or CLUSTERED_ENGINE. This is one of the core configurable options.

E . Logging levels Correct

Properties such as log.level and other logging configurations are explicitly defined in run.properties, allowing administrators to adjust the verbosity of logs (DEBUG, INFO, WARN, ERROR).

Why the others are incorrect:

A . Default logs location Incorrect

The log file path is not controlled via run.properties. It is defined in log4j2.xml, not in run.properties.

B . URL for heartbeat endpoint Incorrect

The heartbeat endpoint (/pa/heartbeat.ping) is a fixed system endpoint and is not configurable in run.properties.

D . X-Frame-Options header Incorrect

Security headers like X-Frame-Options are managed under application security policies or global response headers, not in run.properties.

PingAccess Administrator's Guide -- run.properties Reference (section describing pa.operational.mode and logging configuration properties).

Answer: C

Explanation:

PingAccess enforces step-up or multi-factor authentication using Authentication Requirements, which can be applied to specific resources within an application.

Exact Extract:

''Authentication requirements allow administrators to configure additional authentication (for example, MFA) when accessing sensitive application resources.''

Option A (UI Authentication) applies to access to the admin console, not application resources.

Option B (Auth Token Management) relates to OAuth token lifetimes and refresh, not MFA enforcement.

Option C (Authentication Requirements) is correct --- these rules enforce MFA or step-up auth for specific URLs/resources.

Option D (Authentication Challenge Policy) governs how failed auth challenges are presented but does not enforce MFA.