Ping Identity PAP-001 Exam Dumps

When applications require additional attributes:

The Web Session must be configured to retrieve those attributes from the token provider (OIDC or PingFederate).

The Identity Mapping must be updated to forward those attributes to the application (e.g., as headers).

Exact Extract:

''Web sessions define how user attributes are retrieved from the token provider. Identity mappings determine how those attributes are inserted into requests to applications.''

Option A is not necessarily required; attributes can be retrieved via userinfo endpoint or access token, not only ID tokens.

Option B is correct --- Identity Mappings must be updated to pass attributes to the app.

Option C is incorrect --- Site Authenticators define how PingAccess authenticates to apps, not attribute handling.

Option D is incorrect unless the architecture specifically requires access token updates; PingAccess often uses the Web Session to fetch attributes.

Option E is correct --- Web Session must be updated to retrieve additional attributes.

When upgrading a PingAccess cluster, the Admin Console node must always be upgraded first before any replica admin or engine nodes. This ensures that the configuration and schema changes introduced in the new version are properly applied and replicated.

Exact Extract (from PingAccess documentation):

''In a clustered environment, you must first upgrade the administrative console node before upgrading any replica administrative nodes or engine nodes.''

Why A is correct:

A . Upgrade the Admin Console --- This is correct because the admin console node acts as the configuration master in a PingAccess cluster. Upgrading it first ensures the new version schema is available to replicas and engines.

Why the other options are incorrect:

B . Disable cluster communication --- This is not required for standard upgrades. Cluster communication remains in place to synchronize changes after the upgrade.

C . Disable Key Rolling --- Key rolling is unrelated to the upgrade process. It is a feature used for key rotation, not version upgrades.

D . Upgrade the Replica Admin --- This is incorrect because upgrading a replica admin before the primary administrative console is against the documented procedure and would cause replication issues.

Upgrading PingAccess in a Clustered Environment (PingAccess Upgrade Guide)

PingAccess Administration Guide -- Upgrade Process

When a back-end site requires HTTP Basic Authentication, PingAccess supports this via a Basic Authentication Site Authenticator. The authenticator is configured with credentials so that PingAccess can successfully authenticate to the target site.

Exact Extract:

''PingAccess can authenticate to target sites using a Site Authenticator. Use the Basic Authentication Site Authenticator when the site requires a username and password.''

Option A is incorrect --- identity mappings are used to forward user attributes, not for site-to-site authentication.

Option B is incorrect --- web sessions represent end-user sessions, not back-end credentials.

Option C is correct --- the Basic Authentication Site Authenticator should be configured on the Site.

Option D is incorrect --- mTLS authenticates with certificates, not username/password.

The admin.auth setting in the run.properties file is used to specify a fallback authentication method for the administrative console.

Exact Extract from official documentation:

''To define a fallback administrator authentication method if the OIDC token provider is unreachable, enable the admin.auth=native property in the run.properties file. This overrides any configured administrative authentication to basic authentication.''

This makes it clear that the purpose of admin.auth is to override any configured SSO for the admin UI and enforce native (basic) authentication instead.

Option A is incorrect because the admin.auth setting does not configure SSO. SSO for the admin UI is configured separately.

Option B is incorrect because this setting does not apply to the administrative API; it specifically applies to the admin UI console.

Option C is correct because it directly reflects the documented behavior: admin.auth overrides SSO configuration for the administrative UI and enables native authentication.

Option D is incorrect because the setting does not enable automatic authentication. It still requires credentials, but falls back to basic auth.

Applications in PingAccess can be associated with multiple Virtual Hosts. Each virtual host defines an FQDN and port combination through which the application is exposed, allowing protection across multiple domains or hostnames.

Exact Extract:

''Virtual hosts specify the fully qualified domain names (FQDNs) and ports that PingAccess uses to expose applications.''

Option A (Sites) represent the target back-end servers, not the external FQDN.

Option B (Virtual Hosts) is correct --- use multiple virtual hosts for multiple domains.

Option C (Redirects) are unrelated to multi-domain application protection.

Option D (Rules) define access policies, not hostnames.