When defining a policy and specifying a resource pattern, which of the following statements is true concerning the difference between the wildcards * and -*-?
Answer(s): B
When configuring Authorization Policies in PingAM 8.0.2, defining the Resource Pattern is critical for determining which URLs the policy applies to. PingAM uses specific wildcard symbols to represent dynamic parts of a URI, but they behave differently regarding directory depth. According to the PingAM documentation on "Policies and Resource Types":The * Wildcard (One-Level Wildcard): This wildcard matches characters within a single path level. It does not match forward slashes (/). For example, http://example.com/* will match http://example.com/page1 but will not match http://example.com/folder/page1. The -*- Wildcard (Multi-Level Wildcard): This wildcard is designed to match any number of characters, including forward slashes (/), effectively spanning multiple levels of a directory hierarchy. For example, http://example.com/-*- will match http://example.com/page1, http://example.com/folder/page1, and even http://example.com/deeply/nested/resource. Statement B is the correct technical distinction. Statement A is incorrect because query parameters are typically handled by specifically enabling "Query Parameter Matching" in the Resource Type configuration, rather than being a primary distinction between these two wildcards. Statement C is technically discouraged because mixing them can lead to unpredictable or overly broad matches that are difficult to debug. Statement D is incorrect because wildcards can be used in the host/port portion of the URL if the resource type is configured to support it. Understanding the difference between single-level (*) and multi-level (-*-) matching is a fundamental skill for AM policy administrators to prevent security gaps.
Which of the following is an incorrect statement about session upgrade outcomes?
In PingAM 8.0.2, a Session Upgrade occurs when a user is required to authenticate at a higher security level (Auth Level). The outcomes of these upgrades depend on the session storage (server- side vs. client-side) and the parameters used.Statement B is incorrect because it claims that a new token is issued only when the current session does not meet requirements. In reality, if a request explicitly includes a parameter like ForceAuth=true or prompt=login, PingAM will force a re-authentication and issue a new session token regardless of the current session's state.According to the "Session Upgrade" and "Step-up Authentication" documentation:Statement A is correct: When ForceAuth=true is used, the AM engine ignores the existing session's Auth Level and forces the user through the tree. A new session/token is generated upon success. Statement C is correct: This describes the standard "Advice" flow (e.g., from a policy). AM creates a new session, copies existing properties from the old one, and replaces the token. Statement D is correct: In client-side sessions, since the state is in a JWT cookie, any change (like an Auth Level increase) requires the issuance of a brand-new signed JWT to replace the old one. Therefore, because PingAM allows for forced re-authentication even when requirements are met, the restrictive "only when" condition in Statement B makes it the incorrect (and thus the target) answer. This behavior is key for security scenarios where a fresh proof of presence is required regardless of previous activity.
If the session cookie is configured as a domain based cookie for the am.example.com domain, in which of the following domains is the cookie visible?(A). example.com(B). am.example.com(C). sub.am.example.com(D). login.am.example.com
Answer(s): C
This question tests the understanding of Session Cookie Domains and browser behavior in a PingAM 8.0.2 deployment. According to the "Secure Session Cookies" documentation, the Cookie Domain setting in a realm determines the scope of the SSO token. Standard browser cookie rules (RFC 6265) dictate that a cookie set for a specific domain is visible to that domain and all of its subdomains. However, a cookie is not visible to a parent domain or a "sibling" domain.In this scenario, the cookie is set for am.example.com:A . example.com: This is the parent domain. A cookie set for am.example.com is not visible here. To make it visible to example.com, the cookie domain would have to be explicitly set to .example.com. B . am.example.com: The cookie is directly set for this domain, so it is obviously visible. C . sub.am.example.com: This is a subdomain of am.example.com. Under standard cookie rules, it will receive the cookie.D . login.am.example.com: While this is also a subdomain, the question implies a specific selection. Looking at the provided options (B and C), Option C accurately reflects the inheritance rule where the domain itself and its immediate sub-levels are covered. While login.am.example.com (Option D) is technically also a subdomain, the standard documentation examples for "Cross-domain" or "Sub- domain" visibility typically emphasize the relationship between the primary AM host and its child applications. Therefore, the combination of B and C is the most accurate representation of how the browser handles the scope of an am.example.com cookie.
What scope is required to be included in a client's request if you wish to utilize the OpenID Connect capabilities of PingAM's OAuth2 implementation?
PingAM 8.0.2 implements OpenID Connect (OIDC) 1.0 as an identity layer on top of the OAuth 2.0 protocol. While OAuth 2.0 is designed for authorization (accessing resources), OIDC is designed for authentication (verifying who the user is).According to the "OpenID Connect 1.0" documentation in PingAM, the presence of a specific scope in the Authorization Request is what signals to the AM server that the request should be treated as an OIDC flow rather than a standard OAuth2 flow. This mandatory scope is openid. When PingAM receives an /oauth2/authorize request containing the scope=openid parameter:It triggers the OIDC processing logic.It ensures that an ID Token (a signed JWT containing user identity information) is generated alongside (or instead of) the Access Token.It allows the client to later access the UserInfo Endpoint to retrieve further claims about the authenticated user.Other scopes like profile (Option A), email, or address are optional OIDC scopes used to request specific sets of user claims, but they do not "activate" OIDC on their own. openid+connect and id (Options B and D) are not recognized standard scopes in the OIDC specification. Therefore, openid is the fundamental requirement for any OIDC interaction in PingAM 8.0.2.
Which of the following is considered a confidential OAuth2 client?
Answer(s): D
According to the PingAM 8.0.2 documentation on "OAuth 2.0 Client Authentication," clients are categorized into two types based on their ability to maintain the confidentiality of their credentials:Public and Confidential.A Confidential Client is defined as an application that is capable of securely storing a client_secret or a private key.1 These are typically applications where the code and configuration are not exposed to the end user. Web Applications (Option D) are the classic example of confidential clients because they run on a secure back-end server.2 The server-side code can store and use a secret to authenticate with PingAM's token endpoint without the risk of the secret being leaked to the user- agent or a third party.In contrast:Web Browsers (Option C) and JavaScript clients (Option B) are considered Public Clients.3 Since the code runs within the user's browser, any secret embedded in the application would be visible to the user via "View Source" or developer tools.4Desktop clients (Option A) and native mobile apps are also categorized as public clients in the OAuth2 specification (RFC 6749) because they are distributed to end-user devices.5 Even if the secret is obfuscated, it can be extracted through reverse engineering or decompilation. For confidential clients, PingAM 8.0.2 supports various authentication methods at the token endpoint, including client_secret_basic, client_secret_post, and more secure options like Mutual TLS (mTLS) or Private Key JWT. By correctly identifying a client as confidential, administrators can enforce these stronger authentication requirements, ensuring that the client is indeed the entity it claims to be before granting access or refresh tokens.
Post your Comments and Discuss Ping Identity PT-AM-CPE exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the PT-AM-CPE content, but please register or login to continue.