Which of the following would be a possible combination of fields in the JSON body when making a policy evaluation via REST?
Answer(s): B
In PingAM 8.0.2, requesting policy decisions via the REST API involves sending a POST request to the policies endpoint with the _action=evaluate parameter. To receive an accurate decision, the request body must provide the context of the access attempt.According to the "Request policy decisions over REST" documentation, the JSON body typically includes the following core fields:resources: (Required) An array of strings representing the URIs the user is attempting to access. application: (Required) This field specifies the name of the Policy Set (formerly known as the application) that contains the relevant policies for the evaluation. subject: (Optional, but usually required for user-specific policies) This object identifies the user or entity requesting access. It can include the user's ssoToken or a set of claims if using JWT-based subjects.Why other options are incorrect: Advices (Options A and C) are not inputs for a policy evaluation request. Instead, advices are returned by PingAM in the response if a policy condition fails (e.g., an AuthLevelConditionAdvice requesting the user to provide MFA). A request cannot "evaluate" an advice; it triggers one. Option D is incorrect because the resources field is a mandatory requirement for any evaluation; without a target resource, the engine has nothing to compare against the defined policy rules. Therefore, the combination of resources, subject, and application represents the standard, valid structure for a policy decision request in PingAM 8.0.2.
A SAML2 identity provider (IdP) is configured in a subrealm. Which of the following URLs can be used to export the IdP metadata?
Answer(s): D
To facilitate federation between a SAML2 Identity Provider (IdP) and a Service Provider (SP), metadata must be exchanged. PingAM 8.0.2 provides a built-in utility page, exportmetadata.jsp, specifically for this purpose.When an IdP is configured within a subrealm (rather than the Top Level Realm), the metadata export URL must be qualified with specific query parameters to ensure the correct entity configuration is retrieved. According to the "SAML 2.0 Reference" and "Exporting SAML 2.0 Metadata" documentation:entityid: This parameter is mandatory when there are multiple entities configured. It specifies the unique URI of the IdP (e.g., http://myserver.domain.com:8080/openam). This tells the JSP which specific provider's metadata to generate.realm: This parameter is crucial for subrealm deployments. By default, the JSP looks in the root realm (/). If the IdP resides in a subrealm named /idprealm, the URL must explicitly include &realm=/idprealm.Option D is the correct technical string. Option B is incorrect as it lacks parameters and would only attempt to export default root-level metadata. Option C is incorrect because the parameter name is entityid, not idp. While Amster (Option A) can indeed be used to export configuration, the exportmetadata.jsp remains the standard and most common method for generating the XML- formatted metadata required by external partners.
An OpenID Connect application makes a request for an ID token with the openid and profile scope. Which set of claim attributes are available with the profile scope?
Answer(s): C
PingAM 8.0.2 adheres to the OpenID Connect Core 1.0 specification regarding standard scopes and claims. When a client requests the profile scope, the OpenID Provider (PingAM) is expected to return a specific set of claims that describe the user's basic profile. According to the PingAM documentation on "Understanding OpenID Connect Scopes and Claims" and the default OIDC Claims Script (which maps internal LDAP attributes to OIDC claims):The standard claims associated with the profile scope are strictly defined with lowercase, snake_case naming conventions. The default set includes:name: The user's full name.given_name: The user's first name.family_name: The user's surname or last name.middle_name: (Optional)nickname: (Optional)preferred_username: (Optional)profile: URL to the profile page.picture: URL to an image.website: URL.gender: (Optional)birthdate: (Optional)zoneinfo: Timezone.locale: The user's preferred language/locale.updated_at: Timestamp.Option C is the only choice that correctly identifies the snake_case format (given_name, family_name, locale) required by the specification. Options A and B use camelCase or inconsistent naming that does not match the OIDC standard or PingAM's default mapping script. Option D includes preferred_locale, which is incorrect; the standard claim name for a user's language preference in OIDC is simply locale.
Which statements are correct about PingAM sessions?A) When a web browser is involved, the web browser is instructed to set a cookie as the session reference.B) When no browser is involved, PingAM returns the session reference in the JSON response. C) PingAM can only track the session in the Core Token Service store.D) The default session cookie name created in a web browser is iPlanetDirectoryPro.
Answer(s): A
This question explores the fundamental architecture of Session Management in PingAM 8.0.2. PingAM is designed to be highly flexible, supporting both traditional browser-based Single Sign-On (SSO) and modern API-driven interactions.Analysis of the statements based on PingAM documentation:Statement A is correct: For browser-based flows, PingAM uses HTTP cookies to maintain session state. Upon successful authentication, AM sends a Set-Cookie header to the browser containing the session token (the session reference).Statement B is correct: For "headless" or REST-based authentication (such as a mobile app or a back- end service calling /json/realms/root/authenticate), there is no browser to handle cookies automatically. In this case, PingAM returns the tokenId directly in the JSON response body, allowing the client to manage the token manually in subsequent API calls. Statement D is correct: For historical reasons, the default value for the SSO Cookie Name in PingAM is iPlanetDirectoryPro. While administrators are encouraged to change this for security (obfuscation), it remains the default "out-of-the-box" configuration. Statement C is incorrect: This is the "distractor" in the question. PingAM 8.0.2 supports multiple session storage models. While the Core Token Service (CTS) is the standard for server-side stateful sessions, AM also supports Client-side sessions (where the state is stored in a signed/encrypted JWT in the cookie itself) and In-memory sessions (primarily used for short-lived authentication journeys). Since AM is not restricted only to the CTS, Statement C is false. Therefore, the combination of A, B, and D accurately reflects the session capabilities of PingAM 8.0.2, making Option A the correct answer.
In an authentication tree process, considering best practice, where can the collected context data for mobile devices be persisted for subsequent risk analysis?
In PingAM 8.0.2, the Intelligent Access engine (Authentication Trees) uses a specific data-passing mechanism to move information between individual nodes within a single journey. When a journey involves collecting context--such as device metadata (OS, version, screen resolution), location data (IP, geofencing), or risk signals--this information must be stored temporarily while the tree evaluates the next steps.According to the "Authentication Node Development" and "Nodes and Trees" documentation, PingAM uses two primary transient storage objects during the authentication flow:Shared State: This is the primary map used to share data between nodes in the same tree. Contextual data collected by nodes like the Device Profile Collector or Browser Capabilities nodes is stored here. It exists only for the duration of the authentication journey. Transient State: Similar to shared state, but often used for sensitive data that should not be visible to certain types of nodes or scripts.The documentation identifies Shared Node State (Option B) as the best practice for persisting collected context during the tree process.Session State (Option A) is only available after the authentication is successful and a session has been created. It is not suitable for data needed by nodes within the tree to make a decision (like a risk engine node).User Profile (Option C) is for long-term persistence (LDAP/PingDS). Storing transient device context there would cause unnecessary database write overhead and privacy concerns. Browser Cookies (Option D) are limited in size and pose security risks if used to store raw device data that could be tampered with by the client.Therefore, for real-time risk analysis within a journey, nodes write data to the shared state, where subsequent nodes (like a Scripted Decision Node or Adaptive Risk Node) can retrieve and analyze it.
Post your Comments and Discuss Ping Identity PT-AM-CPE exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the PT-AM-CPE content, but please register or login to continue.