Pass the Ping Identity PingAccess PAP-001 Questions and answers with ExamsMirror

For multiple subdomains to share the same PingAccess session, theCookie Domainmust be configured so that the session cookie is valid across all listed applications.

Exact Extract:

“Set the Cookie Domain in the web session configuration to a parent domain (for example, .company.com) to enable applications in different subdomains to share the same session.”

Option A (Set Audience option)applies to OAuth token validation, not cookie sharing.

Option B (Set Cookie Domain option)is correct — e.g., setting.company.comallows session cookies to be shared.

Option C (Rewrite Cookie Domain rule)modifies upstream cookies for back-end applications, not PingAccess session cookies.

Option D (Rewrite Cookie Path rule)is unrelated; it modifies paths for cookies, not domains.

When a PingAccess agent is compromised, the secure approach is toinvalidate the existing credentials and issue a new configuration filefrom the PingAccess Admin Console. This provides a freshagent.propertiesfile with new secrets, ensuring compromised keys cannot be reused.

Exact Extract:

“If an agent is compromised, revoke and regenerate the agent configuration by downloading a newagent.propertiesfile from the administrative console.”

Option Ais incorrect — manually changing the secret in the file does not propagate it to PingAccess.

Option Bis incorrect — trusted certificates are not tied to agent authentication.

Option Cis unnecessary — reinstalling the agent does not reset credentials.

Option Dis correct — downloading a newagent.propertiesfile re-secures the agent.

PingAccess supports logging directly to a relational database usingLog4j database appenders. To enable this:

Configurelog4j2.xmlto use a JDBC Appender.

Configurelog4j2.db.propertieswith the database connection information.

Provide the appropriate database driver in thePA_HOME/libdirectory.

Exact Extract:

“To log to a database, configure log4j2.xml and log4j2.db.properties, and place the JDBC driver JAR file in PA_HOME/lib.”

Option Ais correct — both files must be configured.

Option Bis incorrect — existing logs do not need removal.

Option Cis incorrect — enabling audit is unrelated to database logging.

Option Dis correct — the Oracle JDBC driver must be installed in PA_HOME/lib.

Option Eis incorrect unless TLS is used to connect to the DB, but it is not required for standard DB logging setup.

Thepa.operational.modeproperty inrun.propertiesdefines therole of the nodein a PingAccess deployment (e.g.,STANDALONE,CLUSTERED_CONSOLE,CLUSTERED_CONSOLE_REPLICA,ENGINE).

Exact Extract:

“Thepa.operational.modeproperty determines the role of the server in the cluster, such as standalone, console, console replica, or engine.”

Option Ais incorrect — replication is implicit in certain roles, not controlled directly.

Option Bis correct — the setting specifies whether the node is admin console, replica, or engine.

Option Cis incorrect — development vs production is not a function of this setting.

Option Dis incorrect — it does not enable/disable nodes.

All onboarding in PingAccess begins with defining anApplication. Once the application exists, the administrator can defineResourceswithin it and assign different rules to those resources.

Exact Extract:

“Before you can configure resources and rules, you must first create an application in PingAccess.”

Option A (Identity Mapping)may be required later but not the first step.

Option B (Web Session)can be shared but is not the first onboarding step.

Option C (Application)is correct — the starting point for onboarding.

Option D (Resource)comes after creating the application.

PingAccess is designed to work with modern identity protocols. It doesnotsupport legacy WS-* protocols directly.

Exact Extract:

“PingAccess integrates with OAuth 2.0 and OpenID Connect (OIDC) to provide authentication and authorization for web and API resources.”

Option A (SAML)is incorrect — PingAccess does not natively consume SAML assertions; SAML can be used indirectly via PingFederate.

Option B (WS-Fed)is not supported.

Option C (WS-Trust)is not supported.

Option D (OAuth2)is correct — used for authorization and token validation.

Option E (OIDC)is correct — used for user authentication and sessions.

PingAccess usesEngine Listenersfor SSL termination of proxied applications. To minimize the number of certificates, administrators can:

Use awildcard certificate(e.g.,*.customer.com) on the engine listener.

Use aSubject Alternative Name (SAN) certificatethat covers multiple FQDNs under thecustomer.comdomain.

Exact Extract:

“PingAccess engine listeners can use certificates containing either wildcard entries or Subject Alternative Names to secure multiple applications under a single domain.”

Option Ais incorrect — assigning unique key pairs increases, not decreases, certificate management overhead.

Option Bis correct — a wildcard certificate covers all subdomains (e.g.,app1.customer.com,app2.customer.com).

Option Cis correct — a SAN certificate lists multiple FQDNs explicitly.

Option Dis incorrect — agent listeners don’t handle SSL termination for proxied apps.

Option Eis incorrect for the same reason — agent listeners aren’t used for SSL.

PingAccess terminates SSL at theVirtual Hostlevel. To configure an existing certificate, the administrator must assign the appropriateKey Pair(which contains the certificate and private key) to the Virtual Host.

Exact Extract:

“SSL termination occurs on the engine listener through virtual hosts. Assign the certificate’s key pair to the virtual host to secure proxied applications.”

Option Ais correct — assign the key pair to the Virtual Host for SSL termination.

Option Bis incorrect — Require HTTPS enforces secure access but does not configure SSL termination.

Option Cis incorrect — Agent Listener is for PingAccess Agents, not proxied apps.

Option Dis incorrect — secure flag affects cookie settings, not SSL certificates.

When upgrading a PingAccess cluster, theAdmin Console node must always be upgraded firstbefore any replica admin or engine nodes. This ensures that the configuration and schema changes introduced in the new version are properly applied and replicated.

Exact Extract (from PingAccess documentation):

“In a clustered environment, you must first upgrade theadministrative console nodebefore upgrading any replica administrative nodes or engine nodes.”

Why A is correct:

A. Upgrade the Admin Console— This is correct because the admin console node acts as the configuration master in a PingAccess cluster. Upgrading it first ensures the new version schema is available to replicas and engines.

Why the other options are incorrect:

B. Disable cluster communication— This is not required for standard upgrades. Cluster communication remains in place to synchronize changes after the upgrade.

C. Disable Key Rolling— Key rolling is unrelated to the upgrade process. It is a feature used for key rotation, not version upgrades.

D. Upgrade the Replica Admin— This is incorrect because upgrading a replica admin before the primary administrative console is against the documented procedure and would cause replication issues.

PingAccess supports flexible path matching for resources using wildcards. If the requirement is to matchany path that contains a folder named "escalated", the correct format is:

*/escalated/→ matchesany locationof theescalateddirectory within the path.

Exact Extract:

“The asterisk (*) wildcard matches zero or more characters. Use it in resource paths to match folders at any depth.”

Option A (escalated/)only matches when the resource starts with “escalated/” at the root, not at arbitrary depth.

Option B (*/escalated/)is correct — it matches theescalatedfolder no matter where it occurs.

Option C (*/escalated/+ )is incorrect —+is not a valid PingAccess wildcard operator.

*Option D (/escalated/)matches only when the path starts with “escalated” at the first level, not arbitrary positions.