Ping Identity PAP-001 Exam Dumps

When applications depend solely on header-based identity mapping, attackers can attempt to bypass PingAccess by injecting headers directly into requests sent to the backend. To prevent spoofing, PingAccess should be configured to pass cryptographically verifiable tokens (e.g., ID tokens from OIDC) instead of relying on plain headers.

Exact Extract:

''Headers can be spoofed if not protected. Use signed tokens, such as ID tokens or JWTs, to provide strong identity assurance and prevent header injection attacks.''

Option A (Use ID Tokens) is correct --- ID tokens are signed and verifiable, preventing spoofing.

Option B (Add Site Authenticator) protects PingAccess-to-site authentication, not client-to-API spoofing.

Option C (Require HTTPS) prevents eavesdropping but does not stop header spoofing from inside the network.

Option D (Use Target Host Header) ensures host header integrity but not user identity.

For PingAccess to terminate SSL for a proxied application, it requires access to the private key and certificate chain. These are stored as Key Pairs.

Exact Extract:

''For SSL termination, you must import the server certificate and its private key as a PKCS#12 file into Key Pairs.''

Option A is incorrect --- a public key alone cannot terminate SSL.

Option B is incorrect --- PKCS#12 files must go into Key Pairs, not Certificates.

Option C is incorrect --- public keys alone are insufficient; PingAccess must have the private key.

Option D is correct --- the PKCS#12 file with full chain and private key is imported into Key Pairs.

From the ''Promoting the replica administrative node'' documentation:

Exact Extract:

''Open the <PA_HOME>/conf/run.properties file in a text editor. Locate the pa.operational.mode line and change the value from CLUSTERED_CONSOLE_REPLICA to CLUSTERED_CONSOLE. These properties are case-sensitive. Do not restart the replica node during the promotion process.'' Ping Identity Documentation

Also from the documentation under ''Next steps'' / manual promotion / ''Using the admin API ...''

When promoting the replica, there is also mention of setting the new host-port in the primary admin configuration so that engine nodes and configuration references now point to the promoted replica. One of the API properties is editRunPropertyFile (to flip the mode), another is editPrimaryHostPort, which causes the primary-admin host setting to be updated. Ping Identity Documentation

Using those facts:

Why C is correct:

Option C says: Change pa.operational.mode to CLUSTERED_CONSOLE on the replica admin node. This directly matches the documented manual promotion step: switch pa.operational.mode from CLUSTERED_CONSOLE_REPLICA CLUSTERED_CONSOLE. Ping Identity Documentation+1

This is essential for promoting the replica to primary console.

Why E is correct:

Option E: Modify bootstrap.properties and set the engine.admin.configuration.host value to point at the replica admin node.

While the documentation doesn't always name the exact property engine.admin.configuration.host, the ''promote via admin API'' includes updating the ''primary host:port'' in the configuration so that engine nodes' configuration queries (or whatever is used by engines) point to the new primary. This maps to ensuring that engine nodes know that the promoted replica is now the administrative node. This requiring modifying the bootstrap or configuration that engine nodes use to find the administrative host is essential. Ping Identity Documentation

Why the other options are incorrect:

A . Change pa.operational.mode to CLUSTERED_CONSOLE_REPLICA on one of the engine nodes.

No. Engine nodes should have pa.operational.mode = CLUSTERED_ENGINE, not console modes. CLUSTERED_CONSOLE_REPLICA is an admin/replica console mode, not applicable for engines. docs.ping.directory+2Ping Identity Documentation+2

B . Restart all nodes in the cluster.

The documentation explicitly says do not restart the replica node during the promotion process because restart can cause file corruption or failure to properly promote. Only certain restarts are needed after configuration updates. So restarting all nodes is not a correct required action. Ping Identity Documentation

D . Restart the replica admin node.

As above, for manual promotion, a restart of the replica admin node is not required (and is even discouraged during the promotion process). The change in run.properties is detected without restarting. Ping Identity Documentation

PingAccess Reference Guide -- Promoting the replica administrative node / Manually promoting the replica administrative node Ping Identity Documentation+1

To enable Single Logout (SLO), the SLO scope must be defined in the PingAccess Web Session configuration. This determines which sessions are ended when a logout request occurs.

Exact Extract:

''The SLO scope option in a web session specifies which applications are included in a logout event when Single Logout is triggered.''

Option A (SLO scope) is correct; it explicitly enables SLO support by linking session termination across apps.

Option B (Idle timeout) is unrelated; this controls session expiration, not SLO.

Option C (Validate Session) ensures session state is synchronized but does not configure SLO.

Option D (Refresh User Attributes) is unrelated; it only controls whether attributes are reloaded.

PingAccess supports flexible path matching for resources using wildcards. If the requirement is to match any path that contains a folder named 'escalated', the correct format is:

*/escalated/ matches any location of the escalated directory within the path.

Exact Extract:

''The asterisk (*) wildcard matches zero or more characters. Use it in resource paths to match folders at any depth.''

Option A (escalated/) only matches when the resource starts with ''escalated/'' at the root, not at arbitrary depth.

Option B (*/escalated/) is correct --- it matches the escalated folder no matter where it occurs.

Option C (*/escalated/+ ) is incorrect --- + is not a valid PingAccess wildcard operator.

*Option D (/escalated/) matches only when the path starts with ''escalated'' at the first level, not arbitrary positions.