PAP-001 Exam Dumps - Ping Identity PingAccess Questions and Answers

PingAccess officially supportsGoogle ChromeandMicrosoft Edgefor the administrative console. Other browsers (Safari, Opera, Brave) may work but are not officially supported.

Exact Extract:

“The PingAccess administrative console is supported on current versions of Google Chrome and Microsoft Edge.”

Option A (Safari)is not officially supported.

Option B (Opera)is not supported.

Option C (Google Chrome)is correct.

Option D (Microsoft Edge)is correct.

Option E (Brave)is not officially supported.

To enforcestep-up authenticationfor selected resources, PingAccess usesAuthentication Challenge Policies. These policies allow different challenge methods to be applied depending on the resource.

Exact Extract:

“Authentication challenge policies define how PingAccess challenges users for authentication and are often applied when step-up authentication is required for specific resources.”

Option A (Authentication Challenge Policy)is correct — it ensures only certain resources trigger step-up MFA.

Option Bis incorrect; the reserved resource base path is unrelated to authentication.

Option Cis incorrect; changing the context root just changes the URL path prefix.

Option Dis incorrect; manual ordering of resources is unrelated to enforcing MFA.

For multiple subdomains to share the same PingAccess session, theCookie Domainmust be configured so that the session cookie is valid across all listed applications.

Exact Extract:

“Set the Cookie Domain in the web session configuration to a parent domain (for example, .company.com) to enable applications in different subdomains to share the same session.”

Option A (Set Audience option)applies to OAuth token validation, not cookie sharing.

Option B (Set Cookie Domain option)is correct — e.g., setting.company.comallows session cookies to be shared.

Option C (Rewrite Cookie Domain rule)modifies upstream cookies for back-end applications, not PingAccess session cookies.

Option D (Rewrite Cookie Path rule)is unrelated; it modifies paths for cookies, not domains.

PingAccess allows administrators to configurecustom error pages or messagesat theRoot Resource levelof an application. This ensures that when rule violations (e.g., authorization failures) occur, the application can display tailored error responses.

Exact Extract:

“Custom error handling for rule violations is configured within the Root Resource of an application.”

Option Ais incorrect — assigning a rule to a resource does not allow defining custom errors.

Option Bis correct — the Root Resource is where administrators define custom error handling for the entire application.

Option Cis incorrect — Rule Sets only combine rules; they do not handle error responses.

Option Dis incorrect — individual rule definitions do not contain custom error configurations.

When PingAccess is first installed, theAdministrative Console(the web-based UI for managing configuration) is bound to adefault port of 9000. This is documented in the installation and configuration guides:

Exact Extract from documentation:

“By default, the administrative console is available athttps:// :9000.”

(PingAccess Installation Guide – Default Ports)

This means that unless the administrator has explicitly changed the port inrun.propertiesor during installation, the console will always be available onport 9000.

Option Analysis:

A. 9000✅Correct. Default administrative console port.

B. 3000❌Incorrect. This is not a PingAccess default port.

C. 9090❌Incorrect. Sometimes used by other Ping products for APIs, but not the PingAccess admin console.

D. 3030❌Incorrect. Not a default PingAccess port.

Exact Extract (from PingAccess documentation):

“The key pair that you create for theCONFIG QUERYlistener must include both the administrative node and the replica administrative node. To make sure the replica administrative node is included, you can eitheruse a wildcard certificateordefine subject alternative namesin the key pair that use the replica administrative node’s DNS name.”

Why B and D are correct:

*B. Subject = .company.com— A wildcard certificate for *.company.com is valid for both pa-admin.company.com and pa-admin2.company.com, satisfying the documented requirement that the key pair include both hostnames for the CONFIG QUERY listener.

D. Subject Alternative Names = pa-admin.company.com, pa-admin2.company.com— Explicitly placing both DNS names in the SAN extension also satisfies the requirement that the certificate cover both the administrative node and the replica administrative node.

Why the other options are incorrect:

A. Issuer = pa-admin.company.com— TheIssuerfield identifies the certificate authority (CA) that signed the certificate, not the service hostname. Setting the issuer to a host value is not how X.509 server certificates are validated and would not meet the hostname‑matching requirement.

C. Subject = pa-admin.company.com— While this covers the administrative node, itdoes not include the replica administrative node. Without a wildcard or SAN entries, it fails the requirement that the key pair include both hostnames.

E. Subject = pa-admin2.company.com— Similarly, this would only cover the replica administrative node andnotthe primary administrative node, failing the requirement.

Applications in PingAccess can be associated with multipleVirtual Hosts. Each virtual host defines an FQDN and port combination through which the application is exposed, allowing protection across multiple domains or hostnames.

Exact Extract:

“Virtual hosts specify the fully qualified domain names (FQDNs) and ports that PingAccess uses to expose applications.”

Option A (Sites)represent the target back-end servers, not the external FQDN.

Option B (Virtual Hosts)is correct — use multiple virtual hosts for multiple domains.

Option C (Redirects)are unrelated to multi-domain application protection.

Option D (Rules)define access policies, not hostnames.

From the “Promoting the replica administrative node” documentation:

Exact Extract:

“Open the/conf/run.propertiesfile in a text editor. Locate thepa.operational.modeline and change the value fromCLUSTERED_CONSOLE_REPLICAtoCLUSTERED_CONSOLE. These properties are case-sensitive. Do not restart the replica node during the promotion process.”Ping Identity Documentation

Also from the documentation under “Next steps” / manual promotion / “Using the admin API …”When promoting the replica, there is also mention of setting the new host-port in the primary admin configuration so that engine nodes and configuration references now point to the promoted replica. One of the API properties iseditRunPropertyFile(to flip the mode), another iseditPrimaryHostPort, which causes the primary-admin host setting to be updated.Ping Identity Documentation

Using those facts:

Why C is correct:

Option C says:Changepa.operational.modetoCLUSTERED_CONSOLEon the replica admin node.This directly matches the documented manual promotion step: switchpa.operational.modefromCLUSTERED_CONSOLE_REPLICA→CLUSTERED_CONSOLE.Ping Identity Documentation+1

This is essential for promoting the replica to primary console.

Why E is correct:

Option E:Modifybootstrap.propertiesand set theengine.admin.configuration.hostvalue to point at the replica admin node.While the documentation doesn’t always name the exact propertyengine.admin.configuration.host, the “promote via admin API” includes updating the “primary host:port” in the configuration so that engine nodes’ configuration queries (or whatever is used by engines) point to the new primary. This maps to ensuring that engine nodes know that the promoted replica is now the administrative node. This requiring modifying the bootstrap or configuration that engine nodes use to find the administrative host is essential.Ping Identity Documentation

Why the other options are incorrect:

A.Changepa.operational.modetoCLUSTERED_CONSOLE_REPLICAon one of the engine nodes.No. Engine nodes should havepa.operational.mode = CLUSTERED_ENGINE, not console modes.CLUSTERED_CONSOLE_REPLICAis an admin/replica console mode, not applicable for engines.docs.ping.directory+2Ping Identity Documentation+2

B.Restart all nodes in the cluster.The documentation explicitly saysdo not restartthe replica node during the promotion process because restart can cause file corruption or failure to properly promote. Only certain restarts are neededafterconfiguration updates. So restarting all nodes is not a correct required action.Ping Identity Documentation

D.Restart the replica admin node.As above, for manual promotion, a restart of the replica admin node isnotrequired (and is even discouraged during the promotion process). The change inrun.propertiesis detected without restarting.Ping Identity Documentation

For SSL termination, PingAccess requires aKey Pair(certificate + private key). During a POC/demo, when aself-signed certificateis used, the administrator can create it directly in theKey Pairssection of the console.

Exact Extract:

“Use the Key Pairs section to create self-signed certificates for testing or proof-of-concept deployments. For production, import a PKCS#12 file containing a certificate chain and private key.”

Option Ais incorrect — Certificates store trust anchors (CAs), not SSL termination certs.

Option Bis incorrect — an internal CA-signed cert requires PKCS#12 import, not self-signed creation.

Option Cis incorrect — a publicly trusted CA is not used for a demo phase.

Option Dis correct — creating a new certificate in Key Pairs generates a self-signed cert suitable for demos.

PingAccess validates access tokens usingAccess Token Managers, which are typically backed byPingFederateor ageneric OIDC provider.

Exact Extract:

“PingAccess validates tokens through Access Token Managers, which can be configured against PingFederate or a common OIDC provider.”

Option A (PingFederate)is correct — the most common token provider.

Option B (Kerberos)is not supported for token validation.

Option C (SAML provider)is incorrect — PingAccess does not natively consume SAML assertions.

Option D (Common OIDC provider)is correct — tokens can be validated against any OIDC-compliant IdP.

Option E (PingAuthorize)is an authorization engine, not a token provider.