Ping Identity PAP-001 Dumps

PingAccess automatically creates configurationarchive backupswhenever changes are made. These are stored in thedata/archivedirectory.

Exact Extract:

“PingAccess stores configuration archive files in thePA_HOME/data/archivedirectory.”

Option A (tools)is incorrect — contains administrative scripts.

Option B (conf)is incorrect — holds configuration files likerun.properties.

Option C (data)is correct — archives are stored underdata/archive.

Option D (bin)is incorrect — contains executables and scripts.

PingAccess supports logging directly to a relational database usingLog4j database appenders. To enable this:

Configurelog4j2.xmlto use a JDBC Appender.

Configurelog4j2.db.propertieswith the database connection information.

Provide the appropriate database driver in thePA_HOME/libdirectory.

Exact Extract:

“To log to a database, configure log4j2.xml and log4j2.db.properties, and place the JDBC driver JAR file in PA_HOME/lib.”

Option Ais correct — both files must be configured.

Option Bis incorrect — existing logs do not need removal.

Option Cis incorrect — enabling audit is unrelated to database logging.

Option Dis correct — the Oracle JDBC driver must be installed in PA_HOME/lib.

Option Eis incorrect unless TLS is used to connect to the DB, but it is not required for standard DB logging setup.

When APIs are remote, latency is introduced by frequent token validation requests. EnablingCache Tokenon the OAuth Resource Server reduces repeated validation calls and improves performance.

Exact Extract:

“The OAuth Resource Server configuration includes aCache Tokenoption that improves performance by reducing round trips for token validation.”

Option Ais incorrect — key rolling affects cryptographic keys, not API latency.

Option Bis incorrect — virtual hosts control external FQDNs, not performance.

Option Cis incorrect — token attribute size does not significantly affect remote latency.

Option Dis correct — caching tokens reduces validation overhead.

To pass user attributes into HTTP headers for applications, PingAccess usesIdentity Mappings. When attributes need to be passed specifically as headers, the administrator must update theHeader Identity Mapping.

Exact Extract:

“Header identity mappings map attributes from a user’s web session to HTTP headers that are then sent to the back-end application.”

Option A (HTTP Request Header Rule)is incorrect — this adds or modifies static request headers, not user attributes.

Option B (Header Identity Mapping)is correct — this maps identity attributes into headers dynamically.

Option C (JWT Identity Mapping)is incorrect — that’s used for passing attributes as claims in JWTs.

Option D (Web Session Attribute Rule)is incorrect — that is for access control evaluation, not propagation of attributes.

The correct way to ensure resources such as CSS files, images, or JavaScript are accessible without authentication acrossallapplications is to configureGlobal Unprotected Resources.

Exact Extract:

“Global unprotected resources define resources that do not require authentication and are accessible to all clients across applications.”

Option Ais incorrect; Protocol Sources define back-end host connections, not authentication.

Option Bwould apply only per-resource, not across all applications.

Option Cis correct — Global Unprotected Resources are designed for this exact purpose.

Option D(Availability Profile) is related to application health checks and availability, not authentication.

PingAccess installs as a Windows service. To remove or prevent automatic startup, theuninstall-service.batscript is used.

Exact Extract:

“On Windows, useinstall-service.batto install PingAccess as a service anduninstall-service.batto remove the service.”

Option A (init.bat)initializes environment variables but does not manage services.

Option B (uninstall-service.bat)is correct — it removes the Windows service, preventing auto-start.

Option C (remove-install.bat)is not a valid PingAccess script.

Option D (wrapper-service.bat)configures wrapper options, not service removal.

When upgrading a PingAccess cluster, theAdmin Console node must always be upgraded firstbefore any replica admin or engine nodes. This ensures that the configuration and schema changes introduced in the new version are properly applied and replicated.

Exact Extract (from PingAccess documentation):

“In a clustered environment, you must first upgrade theadministrative console nodebefore upgrading any replica administrative nodes or engine nodes.”

Why A is correct:

A. Upgrade the Admin Console— This is correct because the admin console node acts as the configuration master in a PingAccess cluster. Upgrading it first ensures the new version schema is available to replicas and engines.

Why the other options are incorrect:

B. Disable cluster communication— This is not required for standard upgrades. Cluster communication remains in place to synchronize changes after the upgrade.

C. Disable Key Rolling— Key rolling is unrelated to the upgrade process. It is a feature used for key rotation, not version upgrades.

D. Upgrade the Replica Admin— This is incorrect because upgrading a replica admin before the primary administrative console is against the documented procedure and would cause replication issues.

Therun.propertiesfile in PingAccess is the primary configuration file that defines system-level runtime behavior. According to PingAccess documentation:

Exact Extract:

“Therun.propertiesfile contains configuration properties for PingAccess, including operational mode, logging levels, admin authentication fallback, cluster settings, and system defaults.”

(PingAccess Administrator’s Guide –run.properties Reference)

From this, we can determine:

C. Operational mode for PingAccess→CorrectThe propertypa.operational.modeinrun.propertiesdefines whether the node operates asSTANDALONE,CLUSTERED_CONSOLE,CLUSTERED_CONSOLE_REPLICA, orCLUSTERED_ENGINE. This is one of the core configurable options.

E. Logging levels→CorrectProperties such aslog.leveland other logging configurations are explicitly defined inrun.properties, allowing administrators to adjust the verbosity of logs (DEBUG, INFO, WARN, ERROR).

Why the others are incorrect:

A. Default logs location→IncorrectThe log file path is not controlled viarun.properties. It is defined inlog4j2.xml, not inrun.properties.

B. URL for heartbeat endpoint→IncorrectThe heartbeat endpoint (/pa/heartbeat.ping) is a fixed system endpoint and is not configurable inrun.properties.

D. X-Frame-Options header→IncorrectSecurity headers likeX-Frame-Optionsare managed under application security policies or global response headers, not inrun.properties.

Virtual Hostsin PingAccess define the external FQDNs (and ports) through which applications are accessed. An application can be bound to multiple virtual hosts to allow access via multiple FQDNs.

Exact Extract:

“A virtual host specifies the fully qualified domain name and port number through which an application is accessed.”

Option A (Virtual Hosts)is correct — multiple FQDNs can be supported by assigning multiple virtual hosts.

Option B (Applications)define resource protection but do not manage FQDN binding.

Option C (Sites)define back-end targets, not the public-facing FQDN.

Option D (Web Sessions)handle authentication state, unrelated to hostnames.

From the “Promoting the replica administrative node” documentation:

Exact Extract:

“Open the/conf/run.propertiesfile in a text editor. Locate thepa.operational.modeline and change the value fromCLUSTERED_CONSOLE_REPLICAtoCLUSTERED_CONSOLE. These properties are case-sensitive. Do not restart the replica node during the promotion process.”Ping Identity Documentation

Also from the documentation under “Next steps” / manual promotion / “Using the admin API …”When promoting the replica, there is also mention of setting the new host-port in the primary admin configuration so that engine nodes and configuration references now point to the promoted replica. One of the API properties iseditRunPropertyFile(to flip the mode), another iseditPrimaryHostPort, which causes the primary-admin host setting to be updated.Ping Identity Documentation

Using those facts:

Why C is correct:

Option C says:Changepa.operational.modetoCLUSTERED_CONSOLEon the replica admin node.This directly matches the documented manual promotion step: switchpa.operational.modefromCLUSTERED_CONSOLE_REPLICA→CLUSTERED_CONSOLE.Ping Identity Documentation+1

This is essential for promoting the replica to primary console.

Why E is correct:

Option E:Modifybootstrap.propertiesand set theengine.admin.configuration.hostvalue to point at the replica admin node.While the documentation doesn’t always name the exact propertyengine.admin.configuration.host, the “promote via admin API” includes updating the “primary host:port” in the configuration so that engine nodes’ configuration queries (or whatever is used by engines) point to the new primary. This maps to ensuring that engine nodes know that the promoted replica is now the administrative node. This requiring modifying the bootstrap or configuration that engine nodes use to find the administrative host is essential.Ping Identity Documentation

Why the other options are incorrect:

A.Changepa.operational.modetoCLUSTERED_CONSOLE_REPLICAon one of the engine nodes.No. Engine nodes should havepa.operational.mode = CLUSTERED_ENGINE, not console modes.CLUSTERED_CONSOLE_REPLICAis an admin/replica console mode, not applicable for engines.docs.ping.directory+2Ping Identity Documentation+2

B.Restart all nodes in the cluster.The documentation explicitly saysdo not restartthe replica node during the promotion process because restart can cause file corruption or failure to properly promote. Only certain restarts are neededafterconfiguration updates. So restarting all nodes is not a correct required action.Ping Identity Documentation

D.Restart the replica admin node.As above, for manual promotion, a restart of the replica admin node isnotrequired (and is even discouraged during the promotion process). The change inrun.propertiesis detected without restarting.Ping Identity Documentation

PingAccess retains backup archives of its configuration in thedata/archivedirectory. The number of retained backups is controlled in therun.propertiesfile.

Exact Extract:

“The number of configuration backups retained in thedata/archivedirectory is controlled by thearchive.maxCountproperty inrun.properties.”

Option A (log4j2.db.properties)is incorrect; this file controls database logging, not archive retention.

Option B (jvm-memory.options)is incorrect; this file sets JVM heap and memory arguments.

Option C (run.properties)is correct — it contains system-level settings includingarchive.maxCount.

Option D (log4j2.xml)is incorrect; this file configures log appenders and levels, not archive backups.

When a resource is configured asanonymous, PingAccess does not challenge the user for authentication. However, certain processing and identity propagation still occur.

Exact Extract:

“Anonymous resources do not require authentication. Identity mappings and request/response processing rules still apply.”

Option Ais incorrect because rules such as identity mappings and processing still apply.

Option Bis correct — Identity Mappings can still forward attributes, even for anonymous access.

Option Cis correct — Processing rules (e.g., request/response modifications) still apply.

Option Dis incorrect — requestsarelogged; anonymous does not disable logging.

Option Eis incorrect — access control rules (authorization) are not evaluated for anonymous resources.

PingAccess validates access tokens usingAccess Token Managers, which are typically backed byPingFederateor ageneric OIDC provider.

Exact Extract:

“PingAccess validates tokens through Access Token Managers, which can be configured against PingFederate or a common OIDC provider.”

Option A (PingFederate)is correct — the most common token provider.

Option B (Kerberos)is not supported for token validation.

Option C (SAML provider)is incorrect — PingAccess does not natively consume SAML assertions.

Option D (Common OIDC provider)is correct — tokens can be validated against any OIDC-compliant IdP.

Option E (PingAuthorize)is an authorization engine, not a token provider.

PingAccess distinguishes betweengateway rulesandagent rules. Some processing rules, such asRewrite Cookie Domain, only apply when PingAccess is acting as areverse proxy (gateway), not when protecting applications viaagents.

Exact Extract:

“Rewrite Cookie Domain rules are not supported for agent applications. They are only available for proxied (gateway) applications.”

Option A (Rewrite Cookie Domain)is correct — unavailable with agent applications.

Option B (Network Range)is available for both agents and gateways.

Option C (Rate Limiting)is supported on both application types.

Option D (Cross-Origin Request)is also supported in both.

PingAccess terminates SSL at theVirtual Hostlevel. To configure an existing certificate, the administrator must assign the appropriateKey Pair(which contains the certificate and private key) to the Virtual Host.

Exact Extract:

“SSL termination occurs on the engine listener through virtual hosts. Assign the certificate’s key pair to the virtual host to secure proxied applications.”

Option Ais correct — assign the key pair to the Virtual Host for SSL termination.

Option Bis incorrect — Require HTTPS enforces secure access but does not configure SSL termination.

Option Cis incorrect — Agent Listener is for PingAccess Agents, not proxied apps.

Option Dis incorrect — secure flag affects cookie settings, not SSL certificates.

PingAccess service scripts depend on knowing:

Where the Java runtime is installed (JAVA_HOME)

Where PingAccess itself is installed (PA_HOME)

Exact Extract:

“The PingAccess startup scripts require theJAVA_HOMEenvironment variable to locate the JDK/JRE and thePA_HOMEvariable to locate the PingAccess installation directory.”

Option A (J2EE_HOME)is irrelevant to PingAccess.

Option B (JAVA_HOME)is correct — needed for Java execution.

Option C (PA_PATH)is not a standard variable.

Option D (PA_HOME)is correct — required to point to the PingAccess installation root.

Option E (JAVA_PATH)is not valid;PATHcan include Java, butJAVA_HOMEis the correct environment variable.

PingAccess officially supportsGoogle ChromeandMicrosoft Edgefor the administrative console. Other browsers (Safari, Opera, Brave) may work but are not officially supported.

Exact Extract:

“The PingAccess administrative console is supported on current versions of Google Chrome and Microsoft Edge.”

Option A (Safari)is not officially supported.

Option B (Opera)is not supported.

Option C (Google Chrome)is correct.

Option D (Microsoft Edge)is correct.

Option E (Brave)is not officially supported.

When configuring PingAccess to use PingFederate as theStandard Token Providerfor runtime engines, PingAccess must know how to contact PingFederate. The configuration requires theHost(PingFederate base URL).

Exact Extract:

“When configuring the Standard Token Provider, specify the PingFederate host to which PingAccess engines will connect for token validation.”

Option A (Issuer)is part of OIDC metadata but not required explicitly in this configuration.

Option B (Client ID)is needed for OAuth clients but not when defining the token provider connection itself.

Option C (Host)is correct — this is required to connect to PingFederate.

Option D (Port)may be included within the host definition (host:port) but is not the required field.

PingAccess supportsone primary administrative console (active)and any number ofreplica administrative consoles. Engines must be configured to connect to theactive console, with replicas available for failover.

Exact Extract:

“In a clustered environment, PingAccess supports one clustered console (active) and replica consoles. Engines can connect to any console node for high availability.”

Option Ais incomplete — only one replica limits redundancy.

Option Bis incorrect — multiple active consoles are not supported.

Option Cis incorrect — cannot run two active consoles.

Option Dis correct — one active admin console with multiple replicas ensures HA.

TheSameSiteattribute is applied to session cookies to control cross-site behavior. In PingAccess, session cookie configuration (includingSameSite) is defined at theWeb Sessionlevel.

Exact Extract:

“Web session configuration includes cookie attributes such as name, domain, secure flag, HTTPOnly, and SameSite.”

Option A (Rules)is incorrect — rules govern access control, not cookies.

Option B (Sites)defines backend connections, not session cookies.

Option C (Applications)ties resources to sessions but does not define cookie behavior.

Option D (Web Sessions)is correct — session cookie SameSite settings are configured here.

Applications consuming signed JWTs need theJSON Web Key Set (JWKS)endpoint to retrieve the public keys used for validating JWT signatures. PingAccess exposes this at/pa/authtoken/JWKS.

Exact Extract:

“When using JWT identity mapping, applications can obtain the signing keys from the/pa/authtoken/JWKSendpoint to validate the JWT signature.”

Option Ais correct —/pa/authtoken/JWKSprovides the key set for signature validation.

Option Bis incorrect — that’s an administrative API for configuring identity mappings, not a runtime validation endpoint.

Option Cis incorrect —/pa/aidc/cbis the OIDC callback endpoint.

Option Dis incorrect —/pa-admin-api/v3/authTokenManagementis for admin token management, not JWT validation.