Which of the following statements are correct regarding session upgrades in PingAM? A) An authenticated user is required to authenticate again either to the same or a different authentication service.B) The user must not change for the session upgrade to succeed. C) The only PingAM mechanism to do a session upgrade is the ForceAuth=true request parameter. D) A session upgrade is PingAM's mechanism to perform what is called step-up authentication.1
Answer(s): C
In PingAM 8.0.2, Session Upgrade (often referred to as Step-up Authentication) is the process of increasing the "Authentication Level" (Auth Level) associated with a user's session.2 This is common when a user has logged in with a basic method (like username/password) but attempts to access a resource that requires a stronger method (like MFA).Regarding the statements:Statement A is correct: To upgrade a session, PingAM requires the user to satisfy the requirements of an authentication tree or module that has a higher Auth Level than the current session.3 This technically involves a "re-authentication" event specifically for the higher-level requirement. Statement B is correct: Crucially, the identity authenticated during the upgrade must match the identity of the existing session. If a different user attempts to authenticate during an upgrade process, PingAM will reject the upgrade to prevent session hijacking or identity swapping.4 Statement D is correct: Session upgrade is indeed the technical implementation of the industry- standard "step-up authentication" concept.Statement C is incorrect because ForceAuth=true is not the only mechanism for a session upgrade.While ForceAuth=true (in SAML2 or OIDC) or the prompt=login parameter can force a fresh authentication, PingAM also supports upgrades via Policy Advice.5 When a policy engine determines that a resource requires a higher Auth Level, it sends an "advice" to the client, triggering a session upgrade journey.6 Additionally, authentication trees can be configured to perform upgrades natively using the Session Upgrade configuration in the realm settings. Therefore, since A, B, and D are technically accurate descriptions of the AM 8.0.2 lifecycle, Option C is the correct choice.
Which organization sets, maintains, and governs the SAML2 standard?
Answer(s): A
PingAM 8.0.2 is strictly compliant with various identity standards to ensure interoperability between different vendors and platforms. The Security Assertion Markup Language (SAML) V2.0 is the cornerstone of modern XML-based federation.7According to the PingAM "SAML 2.0 Introduction" and "Supported Standards" documentation, the SAML 2.0 standard is developed and maintained by OASIS (the Organization for the Advancement of Structured Information Standards).8 Specifically, the OASIS Security Services Technical Committee (SSTC) is responsible for the specifications that define the SAML core (assertions and protocols), bindings (how SAML messages are mapped onto transport protocols like HTTP), and profiles (how SAML is used to solve specific use cases like Web Browser SSO). Knowing the governing body is important for administrators when reviewing the "Technical Metadata" and "Schema" sections of PingAM, as AM's implementation follows the OASIS SAML 2.0 standards for XML signing, encryption, and assertion structure. Other organizations listed, such as the IETF (Internet Engineering Task Force), govern protocols like OAuth2 and OpenID Connect, while the W3C (World Wide Web Consortium) handles general web standards like XML and WebAuthn. However, for SAML2, OASIS remains the authoritative governing body.
Which is the correct simplified TLS handshake sequence needed to authenticate clients using a mutual TLS exchange?
Answer(s): D
Mutual TLS (mTLS) is a security enhancement where both the client and the server provide X.509 certificates to prove their identities.9 In PingAM 8.0.2, mTLS is frequently used for secure "Machine- to-Machine" (M2M) communication, such as between an OAuth2 client and the token endpoint, or between AM and a Directory Server (PingDS).According to the PingAM documentation on "Secure Network Communication" and "mTLS for OAuth2," the handshake sequence for mTLS follows these logical steps:Client Hello: The client initiates the request to the server.10 Server Hello & Certificate: The server responds by presenting its own certificate (verifying the server's identity to the client).11 In an mTLS scenario, the server also includes a CertificateRequest message.12Client Certificate & Key Exchange: The client validates the server's certificate. If valid, the client then sends its own Client Certificate to the server, along with the encrypted pre-master secret or key exchange data.Verification and Establishment: The server validates the client's certificate against its truststore. If the certificate is trusted and the cryptographic signatures match, the mutually secure connection is established.Option D represents the most accurate "simplified" sequence. Option A is incorrect because the server presents its certificate before the client sends its own certificate. Option B and C are incorrect because the server always responds to the initial "Client Hello" with its own identity (Server Certificate) before the client proceeds with identity submission. This "handshake" ensures that no data is transmitted until both parties have cryptographically verified each other.
Which of the following best describes the relationship between users and realms?
In PingAM 8.0.2, Realms are the primary organizational units used to group configuration, policies, and identities.13 A common misconception is that a user is "locked" into a single realm. However, according to the "Realms" and "Identity Stores" documentation, the relationship is highly flexible. A Realm does not actually "contain" users in a physical sense; instead, a realm is configured with one or more Identity Stores (such as an LDAP directory or a database). Multiple realms can be configured to point to the same underlying Identity Store. Therefore, if a user profile exists in an LDAP directory that is shared by "Realm A" and "Realm B," that user is effectively a member of both realms. They can authenticate to either realm and receive different policies or session properties based on the realm-specific configuration.Key points from the documentation:Logical Partitioning: Realms provide a way to apply different authentication logic (different trees) to the same set of users.14Multi-tenancy: An organization can create separate realms for different departments or customer groups, even if they overlap in the back-end user database. Identity Store Mapping: Because a realm maps to an identity store, and an identity store can be reused across realms, a user's membership is determined by where the realm is "looking" for data. Thus, Option A is the correct description of the architecture: a user can be a member of one or more realms depending on how the administrator has mapped the identity repositories. Would you like me to proceed with more questions, or would you like to focus on a specific area such as OAuth2 Grant Flows?
Which one of the default PingAM audit log file contains messages related to changes made to sessions by end users?
In PingAM 8.0.2, the audit logging service is designed to provide a comprehensive record of events for security, compliance, and troubleshooting. The audit logs are categorized by the type of event they record. According to the "Audit Logging Reference," PingAM generates several default log files, typically in JSON format.The access.audit.json file is the primary log for events related to the lifecycle of a session and access to resources. This includes:Session Creation: When a user successfully authenticates and a new session is established. Session Termination: When a user logs out or a session expires. Session Updates: Any changes made to the session, such as a Session Upgrade or modification of session properties by the end user or an application.Policy Evaluations: Records of when a user requests access to a protected resource and the resulting permit or deny decision.By contrast, the config.audit.json (Option B) records administrative changes to the system configuration (e.g., modifying a realm or a node). The authentication.audit.json (Option C) focuses specifically on the steps within an authentication tree, such as which nodes were visited and whether they succeeded or failed. While session changes happen after or as a result of authentication, the resulting session management event is logged in the access audit. The activity.audit.json (Option D) is generally used for internal system tasks and background processes. Therefore, for monitoring end- user session modifications, the access.audit.json is the correct authoritative source defined in the PingAM 8 documentation.
Post your Comments and Discuss Ping Identity PT-AM-CPE exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the PT-AM-CPE content, but please register or login to continue.