Which of the following statements about the PingAM tree designer is not true?
Answer(s): B
The Tree Designer in PingAM 8.0.2 is a visual, drag-and-drop tool used to build sophisticated login journeys. While it is highly flexible, it follows specific structural rules to ensure the authentication engine can execute the logic predictably.Analysis of the statements:Statement A is true: Trees must terminate in an outcome. Success and Failure nodes are standard. Additionally, the Inner Tree Evaluator node allows one tree to hand off processing to another "child" tree.Statement C is true: The designer is extensible. Administrators can develop their own Java or Scripted nodes, and the Ping Identity Marketplace provides a wide range of third-party nodes (e.g., for biometric providers or specialized risk engines) that appear in the designer palette once installed. Statement D is true: "Inner trees" are a supported concept, allowing for modularity where common logic (like MFA) can be built once and called from multiple parent trees. Statement B is the "not true" statement. While the designer allows for complex logic and loops (e.g., looping back to a username prompt if a password is wrong), it does not support nesting nodes within a tree. In PingAM architecture, nodes are atomic components placed on a flat canvas. You cannot "nest" a node inside another node's configuration in the visual designer. Complexity is achieved through the branching and linking of these atomic nodes. If logic needs to be "nested" or grouped, it is done by creating a separate tree and calling it as an Inner Tree. Understanding this structural limitation is key for architects designing modular authentication frameworks.
To ensure the user's full name is displayed on the consent screen for an OpenID Connect application, which string should be added into the Support Claims property on the OpenID Connect tab page of the OAuth2 Provider service in PingAM?
Answer(s): A
When a client requests an OpenID Connect (OIDC) scope (like profile), PingAM 8.0.2 may present a Consent Screen to the user, asking permission to share specific claims. To make this screen user- friendly, PingAM allows administrators to map technical claim names to human-readable labels and specify localizations.According to the PingAM documentation on "Supported Claims" in the OAuth2/OIDC Provider settings:The format for the Supported Claims property entry is:ClaimName|Locale|DisplayNameIn this syntax:ClaimName: The technical OIDC claim (e.g., name, email, given_name).Locale: The ISO language code (e.g., en, fr).DisplayName: The text that will actually appear on the UI (the "Full name" label). Therefore, the string name|en|Full name (Option A) is the correct configuration. Option B is incorrect because it reverses the technical name and the display name. Option C is incorrect as it lacks the required locale component and uses full_name (which is not the standard OIDC claim name; the standard is name).Option D attempts to perform a logic operation (+) within a configuration field where only static mapping strings are allowed. Claim composition (concatenating first and last names) is handled by the OIDC Claims Script, not by the Supported Claims UI property.
What is the purpose of the extended metadata in PingAM?
Answer(s): D
In SAML 2.0 Federation, there is a standard XML schema (defined by OASIS) that all vendors use to describe an Identity Provider (IdP) or Service Provider (SP). This is known as "Standard Metadata." However, standard metadata does not include every configuration option required to run a sophisticated Access Management server.PingAM 8.0.2 uses Extended Metadata to store implementation-specific settings that fall outside the OASIS SAML 2.0 specification. According to the "SAML 2.0 Guide," extended metadata is stored as a separate configuration file (or JSON entry in newer versions) and includes parameters such as:Identity Store Mapping: Which attribute in the local datastore matches the SAML NameID. Session Information: How AM should handle the session lifecycle after a successful SAML assertion. Attribute Mapping: Detailed instructions on how to transform local LDAP attributes into SAML attributes (and vice versa).Authentication Trees: Which specific tree should be triggered when a request arrives at the IdP. Option D is the correct description. Option C is incorrect because extended metadata is not a standard way to communicate features; in fact, other SAML products (like ADFS or Okta) cannot read or process PingAM's extended metadata. Option A is incorrect because basic certificates/keys are usually part of the standard metadata (KeyDescriptor), and Option B is incorrect because SAML federation usually triggers authentication journeys or attribute mapping rather than a standard authorization "policy."
In order to secure a PingAM deployment with an external configuration data store and user data store using server-side sessions, which of the following should be considered?
Answer(s): C
Securing a PingAM 8.0.2 environment involves hardening multiple layers of the architecture, particularly when using external data stores and stateful sessions. According to the "General Security Considerations" and "Hardening PingAM" documentation, several key "Best Practices" must be applied.Changing the SSO Cookie Name: By default, AM uses iPlanetDirectoryPro. Attackers often scan for this specific cookie name to identify ForgeRock/PingAM installations. Changing it provides "security through obscurity" and prevents some automated attacks. Using Your Own Keys: PingAM ships with default test keys in the keystore. For production, you must generate your own cryptographic keys for signing and encrypting tokens (SSO, OIDC, SAML) to ensure the integrity of the environment.Specific Bind Accounts: When connecting to an external PingDS or Active Directory, PingAM should never use a highly privileged account (like cn=Directory Manager). Instead, a dedicated account with limited, specific permissions (ACLs) should be created for AM's use. Top-Level Administrator Management: The amAdmin account is the "root" of the AM system. In a production environment, it is considered a significant security risk to use this account for daily operations.Why Option C is the correct answer: The documentation specifically recommends creating a new top- level administrator and then securing or disabling the default amAdmin. This is more effective than simply "renaming" it (Option A) or "reducing privileges" (Options B and D). In PingAM, amAdmin has hardcoded superuser capabilities in many areas; therefore, the best practice is to create a new administrative user with the necessary roles and then protect the amAdmin credentials in a vault. Option B is also incorrect because server-side sessions already store data on the server; the cookie only contains the session ID (the reference), so "encrypting the cookie contents" is redundant for server-side sessions compared to client-side sessions where the entire state is in the cookie.
Which statements are correct about push notification authentication implemented with PingAM?(A). The user must have a device with a camera and install the Authenticator app. (B). The registration and authentication steps must be part of the same authentication tree. (C). To register a device the user scans a barcode with the Authenticator installed on their device.1 (D). During subsequent authentication processes, PingAM instructs the push server to send a notification to the registered device, and waits for the user to use the Authenticator app to approve the request.2Options:
Push authentication in PingAM 8.0.2 utilizes the ForgeRock/Ping Authenticator app to provide a seamless, out-of-band multi-factor authentication (MFA) experience.3 To understand the correct statements, we must look at the technical requirements and the authentication lifecycle defined in the "MFA: Push Authentication" documentation.Statement A is correct: For the initial setup, a device with a camera is required because the registration process involves scanning a QR code generated by PingAM. Additionally, the user must install the specific Authenticator app (available for iOS and Android) to handle the cryptographic exchange and receive push notifications.4Statement D is correct: This accurately describes the runtime flow of a push journey. When a user reaches a Push Sender node, PingAM communicates with the Push Notification Service (Apple APNs or Google FCM).5 The user's device receives the notification, and PingAM enters a "waiting" state (via the Push Result Verifier node) until the user either approves or denies the request within the app.6Why other statements are incorrect:Statement B is incorrect because registration and authentication are typically handled by separate trees. Best practice dictates a "Device Registration" tree for the initial onboarding and a "Login/MFA" tree for day-to-day access. Forcing them into the same tree would be inefficient and create a poor user experience.Statement C is a common point of confusion; while the user scans a code, the documentation refers to it as a QR code, not a standard barcode. In technical certification contexts, this distinction is often strictly enforced.Therefore, only statements A and D represent the verified facts of the Push implementation in version 8.0.2, making Option C the correct answer.
Post your Comments and Discuss Ping Identity PT-AM-CPE exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the PT-AM-CPE content, but please register or login to continue.