A modified application now requires additional attributes to be passed in the headers. What needs to be modified in order to pass the additional attributes?
Answer(s): B
To pass user attributes into HTTP headers for applications, PingAccess uses Identity Mappings. When attributes need to be passed specifically as headers, the administrator must update the Header Identity Mapping.Exact Extract:"Header identity mappings map attributes from a user's web session to HTTP headers that are then sent to the back-end application."Option A (HTTP Request Header Rule) is incorrect -- this adds or modifies static request headers, not user attributes.Option B (Header Identity Mapping) is correct -- this maps identity attributes into headers dynamically.Option C (JWT Identity Mapping) is incorrect -- that's used for passing attributes as claims in JWTs. Option D (Web Session Attribute Rule) is incorrect -- that is for access control evaluation, not propagation of attributes.
PingAccess Administration Guide Identity Mapping (Header Identity Mapping)
A change is made to the configuration that prevents user access to an application. No one claims to have made the change. Which log file should the administrator use to determine who made the change?
Answer(s): D
All administrative API calls that change PingAccess configuration are logged in pingaccess_api_audit.log. This allows administrators to track who made configuration changes.Exact Extract:"The pingaccess_api_audit.log file contains entries for all administrative API calls and is used to audit configuration changes."Option A (pingaccess.log) contains runtime system messages but not detailed API audit entries. Option B (pingaccess_engine_audit.log) is specific to engine request/response audit logging. Option C (pingaccess_agent_audit.log) is used for PingAccess Agent traffic auditing, not administrative changes.Option D (pingaccess_api_audit.log) is correct -- it tracks admin API modifications.
PingAccess Administration Guide Log Files
A company uses an internally based legacy PKI solution that does not adhere to the Certification Path Validation section of RFC-5280. Which configuration option needs to be enabled when creating Trusted Certificate Groups in PingAccess?
Legacy PKIs often provide certificate chains that are out of order or non-compliant with RFC-5280 path validation. PingAccess provides an option in Trusted Certificate Groups called Validate disordered certificate chains to allow chaining even if the order is not RFC-5280 compliant.Exact Extract:"Enable Validate disordered certificate chains when the certificate chain is not in RFC-5280 compliant order but should still be accepted."Option A is incorrect; using the Java trust store is unrelated to PKI ordering. Option B is correct -- this setting allows PingAccess to process disordered certificate chains. Option C is incorrect; date checks are unrelated to RFC-5280 path ordering. Option D is incorrect; revocation status handling does not address legacy PKI ordering issues.
PingAccess Administration Guide Trusted Certificate Groups
An administrator configures the following:HTTP Request Parameter Rule for "can_read=yes"Web Session Attribute Rule for Opt-in = yesWeb Session Attribute Rule for group = customerService Rule Set A (ALL) includes (HTTP Request Parameter Rule) Rule Set B (ANY) includes (Opt-in yes, group customerService) Rule Set Group C (ALL) includes (Rule Set A, Rule Set B) Assigned to the web application.Which set of conditions must be met to be able to access the application?
The Rule Set Group C (ALL) requires both Rule Set A and Rule Set B to evaluate to true.Rule Set A (ALL) requires can_read=yes.Rule Set B (ANY) requires either Opt-in=yes OR group=customerService. Together in Rule Set Group C (ALL), both conditions must hold:can_read=yes must be present in the request.User must have either opt-in=yes or be in the customerService group.This matches Option D exactly.Option A is incorrect; it requires both attributes in Rule Set B, but B is ANY (either is sufficient). Option B is incorrect; the "unless" wording is misleading -- the parameter is always required because Rule Set A uses ALL.Option C is incorrect; same reasoning as above, B is ANY not AND. Option D is correct -- can_read=yes AND (opt-in=yes OR group=customerService).
PingAccess Administration Guide Rules, Rule Sets, and Rule Set Groups
An administrator needs to configure a signed JWT identity mapping for an application that expects to be able to validate the signature. Which endpoint does the application need to access to validate the signature?
Answer(s): A
Applications consuming signed JWTs need the JSON Web Key Set (JWKS) endpoint to retrieve the public keys used for validating JWT signatures. PingAccess exposes this at /pa/authtoken/JWKS.Exact Extract:"When using JWT identity mapping, applications can obtain the signing keys from the /pa/authtoken/JWKS endpoint to validate the JWT signature." Option A is correct -- /pa/authtoken/JWKS provides the key set for signature validation. Option B is incorrect -- that's an administrative API for configuring identity mappings, not a runtime validation endpoint.Option C is incorrect -- /pa/aidc/cb is the OIDC callback endpoint. Option D is incorrect -- /pa-admin-api/v3/authTokenManagement is for admin token management, not JWT validation.
PingAccess Administration Guide JWT Identity Mapping
Post your Comments and Discuss Ping Identity PAP-001 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the PAP-001 content, but please register or login to continue.