Important Ping Identity PT-AM-CPE Exam Questions

Answer: C

Explanation:

This question tests the understanding of Session Cookie Domains and browser behavior in a PingAM 8.0.2 deployment. According to the 'Secure Session Cookies' documentation, the Cookie Domain setting in a realm determines the scope of the SSO token.

Standard browser cookie rules (RFC 6265) dictate that a cookie set for a specific domain is visible to that domain and all of its subdomains. However, a cookie is not visible to a parent domain or a 'sibling' domain.

In this scenario, the cookie is set for am.example.com:

A . example.com: This is the parent domain. A cookie set for am.example.com is not visible here. To make it visible to example.com, the cookie domain would have to be explicitly set to .example.com.

B . am.example.com: The cookie is directly set for this domain, so it is obviously visible.

C . sub.am.example.com: This is a subdomain of am.example.com. Under standard cookie rules, it will receive the cookie.

D . login.am.example.com: While this is also a subdomain, the question implies a specific selection.

Looking at the provided options (B and C), Option C accurately reflects the inheritance rule where the domain itself and its immediate sub-levels are covered. While login.am.example.com (Option D) is technically also a subdomain, the standard documentation examples for 'Cross-domain' or 'Sub-domain' visibility typically emphasize the relationship between the primary AM host and its child applications. Therefore, the combination of B and C is the most accurate representation of how the browser handles the scope of an am.example.com cookie.

============

Answer: D

Explanation:

Upgrading PingAM 8.0.2 in an environment with multiple PingDS (Directory Server) instances requires a careful strategy to ensure data integrity and to allow for an immediate Rollback if the upgrade fails or introduces instability.6

According to the PingAM 'Plan for Rollback' and 'Upgrade in a Replicated Environment' documentation, the recommended safety measure involves isolating one of the data store nodes to act as a 'time-capsule' of the pre-upgrade state. The process is as follows:

Stop Replication: Before starting the upgrade, administrators should disable or stop replication between the PingDS nodes. This prevents any schema changes or data modifications performed during the AM upgrade from being propagated to the backup node.

Isolate a Node: One PingDS instance is shut down or taken out of the load balancer rotation. This instance remains in its original, healthy state.

Perform the Upgrade: The PingAM upgrade is performed against the remaining active PingDS instance. If the upgrade involves schema updates (which is common when moving to version 8.0.2), only the active node's data is modified.

Rollback Path: If the upgrade fails, the administrator can simply shut down the 'corrupted' upgraded environment and restart the isolated PingDS instance along with the original PingAM WAR file. Because replication was stopped, the isolated node still contains the original configuration and user data.

Option D is the only answer that correctly identifies this 'safety-net' architecture. Option A is risky because a failed upgrade would corrupt both instances. Option C is incomplete because simply 'starting up' the shutdown instance after an upgrade doesn't account for how you handle the discrepancy between the upgraded and non-upgraded nodes. The goal is to keep the shutdown instance as a valid, un-touched recovery point.

Answer: C

Explanation:

The Push Result Verifier node is a core component of the 'MFA: Push Authentication' journey in PingAM 8.0.2. Its primary function is to check the status of a push notification that was previously dispatched to a user's mobile device (usually via the Push Sender node).22

According to the 'Authentication Node Reference' for version 8.0.2, the node evaluates the state of the push request and yields exactly four distinct outcomes:

Success: This path is followed if the user has actively approved the push notification on their registered device using the ForgeRock/Ping Authenticator app.

Failure: This path is taken if the user explicitly denies or rejects the push notification on their device, indicating a potential unauthorized login attempt.

Expired: This outcome occurs if the notification reaches its 'Message Timeout' limit (defined in the Push Sender node) without any response from the user.23 In standard trees, this path often loops back to allow the user to try a different MFA method or resend the push.

Waiting: This outcome is triggered if a response has not yet been received but the timeout has not yet been reached. This is used in conjunction with a Push Wait or Polling mechanism to create a 'check-and-loop' logic until a final result (Success, Failure, or Expired) is determined.

The Retry outcome (mentioned in other options) is notably absent from this specific node's metadata. While a 'Retry' might be implemented in the overall tree logic (for example, by using a Retry Limit Decision node after an Expired outcome), the Push Result Verifier node itself only reports the state of the specific push transaction it is tracking. Understanding these four discrete states is vital for designing resilient authentication journeys that handle user delays or network issues gracefully.

Answer: D

Explanation:

Proof of Possession (PoP) tokens, specifically Certificate-Bound Access Tokens as defined in RFC 8705 and supported by PingAM 8.0.2, are designed to prevent token misuse by binding the access token to a specific client's cryptographic material.9

According to the PingAM documentation on 'Certificate-Bound Proof-of-Possession,' when an OAuth2 client requests a token, PingAM retrieves the client's public key (either from a provided certificate or a JWK) and embeds a thumbprint (the cnf claim) of that material into the issued token. When the client subsequently presents this token to the Resource Server (or the Authorization Server's introspection endpoint), it must also provide 'Proof' that it possesses the private key corresponding to that thumbprint.

In the Mutual TLS (mTLS) approach, this proof is provided by the Client private certificate presented during the TLS handshake.10 The server verifies that the certificate used to establish the secure connection matches the one bound to the token. Without presenting the certificate (Option D), the token is considered 'unbound' or invalid, even if the token itself is otherwise well-formed. This mechanism effectively 'pins' the token to the client, ensuring that if the token is stolen, it cannot be used by any other entity that does not possess the matching private key. Nonce and State (Options A and C) are used during the initial authorization request for different security purposes (replay protection and CSRF), and while a JWK (Option B) can be used to define the public key, the actual presentation of proof during an mTLS transaction is the certificate.

Answer: D

Explanation:

PingAM 8.0.2 is highly extensible through its Scripting Engine, which supports Groovy and JavaScript. However, scripts can only be applied to specific 'hooks' or 'extension points' defined by the platform.

According to the 'Scripting' and 'Script Types' reference in the PingAM 8.0.2 documentation, the standard supported script types are:

Decision node script (A): Used within Authentication Trees via the 'Scripted Decision Node.' These scripts allow for complex logic, such as checking user attributes, calling external APIs, or evaluating risk before deciding which path a user should take in their journey.

OpenID Connect claims script (C): This script type is used to customize the claims returned in OIDC ID Tokens or at the UserInfo endpoint. It allows administrators to transform internal LDAP attributes into the specific JSON format required by OIDC clients.

Policy condition script (D): Used within Authorization Policies. These scripts define custom logic for granting or denying access (e.g., 'Allow access only if the user is connecting from a specific IP range and it is between 9 AM and 5 PM').

Why Statement B is incorrect: There is no such thing as an 'End User user interface theme script' in the PingAM scripting engine. UI customization (Themeing) in PingAM 8.0.2 is handled through the XUI framework using CSS, HTML templates, and configuration JSON files, or by building a custom UI using the Ping SDKs. It does not use the server-side Groovy/JavaScript scripting engine that governs authentication and authorization logic. Therefore, the valid script types are A, C, and D, making Option D the correct choice.