Important Ping Identity PT-AM-CPE Exam Questions

Answer: B

Explanation:

In PingAM 8.0.2, a Session Upgrade occurs when a user is required to authenticate at a higher security level (Auth Level). The outcomes of these upgrades depend on the session storage (server-side vs. client-side) and the parameters used.

Statement B is incorrect because it claims that a new token is issued only when the current session does not meet requirements. In reality, if a request explicitly includes a parameter like ForceAuth=true or prompt=login, PingAM will force a re-authentication and issue a new session token regardless of the current session's state.

According to the 'Session Upgrade' and 'Step-up Authentication' documentation:

Statement A is correct: When ForceAuth=true is used, the AM engine ignores the existing session's Auth Level and forces the user through the tree. A new session/token is generated upon success.

Statement C is correct: This describes the standard 'Advice' flow (e.g., from a policy). AM creates a new session, copies existing properties from the old one, and replaces the token.

Statement D is correct: In client-side sessions, since the state is in a JWT cookie, any change (like an Auth Level increase) requires the issuance of a brand-new signed JWT to replace the old one.

Therefore, because PingAM allows for forced re-authentication even when requirements are met, the restrictive 'only when' condition in Statement B makes it the incorrect (and thus the target) answer. This behavior is key for security scenarios where a fresh proof of presence is required regardless of previous activity.

============

Answer: B

Explanation:

The Tree Designer in PingAM 8.0.2 is a visual, drag-and-drop tool used to build sophisticated login journeys. While it is highly flexible, it follows specific structural rules to ensure the authentication engine can execute the logic predictably.

Analysis of the statements:

Statement A is true: Trees must terminate in an outcome. Success and Failure nodes are standard. Additionally, the Inner Tree Evaluator node allows one tree to hand off processing to another 'child' tree.

Statement C is true: The designer is extensible. Administrators can develop their own Java or Scripted nodes, and the Ping Identity Marketplace provides a wide range of third-party nodes (e.g., for biometric providers or specialized risk engines) that appear in the designer palette once installed.

Statement D is true: 'Inner trees' are a supported concept, allowing for modularity where common logic (like MFA) can be built once and called from multiple parent trees.

Statement B is the 'not true' statement. While the designer allows for complex logic and loops (e.g., looping back to a username prompt if a password is wrong), it does not support nesting nodes within a tree. In PingAM architecture, nodes are atomic components placed on a flat canvas. You cannot 'nest' a node inside another node's configuration in the visual designer. Complexity is achieved through the branching and linking of these atomic nodes. If logic needs to be 'nested' or grouped, it is done by creating a separate tree and calling it as an Inner Tree. Understanding this structural limitation is key for architects designing modular authentication frameworks.

Answer: D

Explanation:

The forgeops command-line tool is used to manage the lifecycle of the Ping Identity Platform in Kubernetes environments.9 When using the Cloud Developer Kit (CDK) for version 8.0.2, the delete subcommand is used to tear down the environment.

According to the 'ForgeOps CLI Reference' and 'CDK Shutdown and Removal' documentation:

The forgeops delete command (without additional flags like --force or specific component names) is designed to remove the Ping Identity Platform pods. This includes the core applications like PingAM, PingIDM, and PingDS, as well as the specialized UI pods (login-ui, etc.). It also removes the standard CDK artifacts and configuration manifests associated with that specific namespace.

However, the command follows a 'safe delete' philosophy regarding infrastructure-level components:

Ingress Controllers, Certificate Managers (cert-manager), and the DS Operator are considered part of the 'Base' or 'Infrastructure' layer. These are typically installed once per cluster or namespace and are shared across multiple deployments. The forgeops delete command does not remove these by default, as doing so could disrupt other services.

PVCs (Persistent Volume Claims) and Secrets are also preserved unless the --force or -f flag is explicitly added to the command.

Thus, the answer is D. The command focuses strictly on the platform pods and their immediate deployment artifacts. If a developer wishes to perform a 'deep clean' that removes the ingress and operators, they would need to use more specific commands like forgeops delete base or kubectl commands.10 This distinction is vital for developers to avoid accidentally deleting shared cluster infrastructure when they only intended to restart the Ping platform.

Answer: C

Explanation:

To enforce complex authorization logic based on session duration, PingAM 8.0.2 administrators must move beyond the static 'Out-of-the-Box' conditions.

Analysis of the options based on the 'Policy Conditions' documentation:

Time Condition (Option A): This condition is used to restrict access based on the clock time of day or day of the week (e.g., 'Allow access only between 9 AM and 5 PM'). It does not track the elapsed time of a specific user session.

Current Session Properties (Option B): This condition checks for the presence of specific key-value pairs in a session. While a session contains a startTime property, this condition is designed for matching static values (like department=HR), not for performing mathematical time calculations.

Active Session Time (Option D): This is not a standard default condition name in the PingAM 8.0.2 policy engine.

The Correct Approach (Option C): A Scripted Policy Condition is required for this use case. Within a Policy Condition script, the administrator has access to the session object. The script can retrieve the startTime (or creationTime) of the session and compare it against the current system time (currentTime).

Example logic in the script:

var sessionStartTime = session.getProperty('startTime');

var maxDuration = 10 * 60 * 1000; // 10 minutes in milliseconds

if ((currentTime - sessionStartTime) > maxDuration) { authorized = false; }

By using a script, PingAM can dynamically calculate the age of the session at the moment of the access request and return a 'Deny' decision if the 10-minute threshold has been exceeded. This provides the granular control needed for high-security environments where 'session freshness' is a requirement for specific sensitive resources.

Answer: D

Explanation:

In SAML 2.0 federation with PingAM 8.0.2, there are two ways to initiate SSO: IdP-Initiated (where the user starts at the Identity Provider) and SP-Initiated (where the user starts at the Service Provider).3

According to the 'SAML 2.0 Guide' for PingAM:

SP-Initiated SSO: The correct JSP file for an SP-initiated flow is spSSOInit.jsp. 4This script is used by an SP (in this case, PingAM acting as an SP or a 'Fedlet') to generate a SAML AuthnRequest and send it to the IdP.

Redirecting to the Application: In the SAML 2.0 standard, the mechanism used to preserve state (like the final destination URL) across the redirect-heavy SSO process is the RelayState parameter. When the IdP sends the SAML assertion back to the SP, it also returns the RelayState value. The SP then uses this value to redirect the user to the final application.

While PingAM uses the goto parameter for internal redirects (like standard web login), RelayState is the required parameter name for SAML-related JSPs to ensure interoperability with the SAML specification. Therefore, the correct URL is .../spSSOInit.jsp combined with the RelayState parameter (Option D). Using idpSSOInit.jsp (Options A and B) would trigger an IdP-initiated flow, which is not what the question describes. Option C is incorrect because it uses the non-SAML goto parameter in a SAML initialization context.