2026 Actual Ping Identity PT-AM-CPE Dumps, Updated Exam Questions for Guaranteed Pass

PT-AM-CPE free sample questions and answers

Ping Identity PT-AM-CPE practice quiz with correct answers for search indexing.

1. Question 1

   Which OAuth2 flow is most appropriate to support the use case of a client application implemented in a browser using a scripted language such as JavaScript?

   AAuthorization code grant flow with PKCE
   

   BImplicit grant flow
   

   CResource owner grant flow
   

   DClient credentials grant flow
   

   Correct answer: A

   In PingAM 8.0.2, the recommended and most secure flow for 'Public Clients'---such as Single Page Applications (SPAs) written in JavaScript---is the Authorization Code Grant Flow with PKCE (Proof Key for Code Exchange).

   Historically, the Implicit Grant Flow (Option B) was used for browser-based apps because they could not securely store a client_secret. However, the Implicit flow is now considered legacy and insecure due to the risk of access token leakage in the browser history or via referrer headers. The Resource Owner Password Credentials Grant (Option C) is also discouraged as it requires the application to handle user credentials directly, violating the core principle of delegated authorization. Client Credentials (Option D) is reserved strictly for machine-to-machine communication where no user is involved.

   The Authorization Code Grant with PKCE addresses the security limitations of public clients by replacing the static client_secret with a dynamically generated 'code verifier' and 'code challenge.' The process works as follows:

   Challenge Generation: The JavaScript app creates a cryptographically strong random string (Verifier) and transforms it (Challenge).

   Authorization Request: The app sends the challenge to PingAM.21

   Code Exchange: After user login, AM returns an authorization code. The app then sends the code and the original verifier to the token endpoint.

   Verification: AM verifies that the verifier matches the initial challenge before issuing the Access Token.

   This flow ensures that even if an attacker intercepts the authorization code, they cannot exchange it for a token without the original verifier, which never left the browser's execution context. PingAM 8.0.2 fully supports this flow and provides specific configuration options in the OAuth2 Provider settings to enforce PKCE for all public clients.

   
   

2. Question 2

   Does the user who runs the PingAM process need to have a home directory?

   AYes, because this is where PingAM stores a pointer to the configuration
   

   BYes, because this is where PingAM stores some of the configuration
   

   CYes, because otherwise the process cannot listen on a port below 1024
   

   DNo, not at all
   

   Correct answer: A

   According to the PingAM 8.0.2 Installation Guide, the user account on the operating system that runs the web application container (such as Apache Tomcat) must have a home directory. This requirement is critical for the 'Bootstrap' process of the application.

   When PingAM starts for the first time or after a restart, the binaries need to know where the configuration data resides. PingAM looks for a hidden directory in the user's home directory named .openamcfg (or a similar name based on the deployment path). Inside this directory, AM creates and reads a file that contains the absolute path to the actual configuration directory (e.g., /home/tomcat/openam). This file acts as the pointer or 'bootstrap' record.

   If the user running the process does not have a home directory, the AM application will fail to initialize because it cannot create this bootstrap pointer. This often results in a 'Configuration failed' error or the application reverting to an 'unconfigured' state upon every restart. While it is possible to override the location of the configuration directory using JVM system properties (like -Dcom.sun.identity.configuration.directory), the default behavior and best practice documented for standard deployments assume the existence of a home directory for the service user. This ensures that configuration remains persistent and isolated from the web container's temporary application files. Option C is incorrect as port listening restrictions are handled by the OS kernel/root privileges, not the existence of a home directory.

   
   

3. Question 3

   Which of the following approaches can be used to configure a basic installation of PingAM?

   AEither the graphical user interface in a browser, or a command-line program
   

   BThe graphical user interface in a browser
   

   CThere is no basic configuration needed
   

   DA command-line program
   

   Correct answer: A

   According to the PingAM 8.0.2 Installation Guide, once the am.war file has been deployed into a web container (such as Apache Tomcat), the administrator must perform an initial configuration to set up the configuration store and the primary administrative user (amAdmin). PingAM provides two primary pathways for this 'basic' configuration to accommodate different environment needs:

   GUI-based Configuration (Interactive): By accessing the AM deployment URL (e.g., https://auth.example.com:8443/am) in a standard web browser, the administrator is presented with an interactive setup wizard. This wizard guides the user through the license agreement, setting the amAdmin password, and defining the connection details for the Configuration Store (typically PingDS). This is the preferred method for single-instance setups or initial trials.

   Command-Line Configuration (Automated/Passive): For DevOps-centric deployments, headless environments, or automated scripts, PingAM provides the configurator.jar (often used for 'Passive' installations). Additionally, for version 8 deployments, Amster is the primary command-line interface (CLI) tool. Amster allows administrators to import a full configuration state from JSON files, bypassing the GUI entirely. This is crucial for CI/CD pipelines and Kubernetes-based deployments (like the ForgeOps CDK/CDP).

   The flexibility to use either the browser-based GUI or command-line tools ensures that PingAM can be deployed efficiently across diverse infrastructures, from traditional on-premises servers to modern cloud-native orchestration platforms. Therefore, Option A is the correct answer as it recognizes both valid administrative interfaces for the initial setup.

   
   

4. Question 4

   A user's SSOTokenID is stored in a cookie when they successfully log in. What is the name of the PingAM property used to configure this cookie?

   Acom.iplanet.am.cookie.name
   

   BiPlanetDirectoryPro
   

   CcomIplanetAmSessionCookieName
   

   Dcom.sun.identity.agents.config.cookie.name
   

   Correct answer: A

   In PingAM 8.0.2, once a user successfully completes an authentication journey, the server issues a session token. For browser-based clients, this token is typically delivered via an HTTP cookie. The server-side property that defines the name of this specific cookie is com.iplanet.am.cookie.name.

   According to the 'Global Properties' and 'System Configuration' documentation, this property is found under the Session service settings. By default, its value is set to iPlanetDirectoryPro (Option B). While iPlanetDirectoryPro is the default value of the cookie name, the question asks for the name of the property used to configure it.

   Administrators often modify this property for security reasons to hide the fact that they are using PingAM or to avoid conflicts with other legacy systems. It is important to note that if this property is changed in the AM server, the corresponding configuration in all Policy Agents (Web or Java Agents) must also be updated to look for the new cookie name, otherwise, the agents will not be able to find the user's session and will redirect them to login repeatedly. Option D refers to an agent-side configuration key, but the central 'Source of Truth' for the session cookie name within the AM platform is the server-side property com.iplanet.am.cookie.name.

   
   

5. Question 5

   Which of the following components is used to return data to PingGateway or the agent to be included with the policy decision?

   ASubjects
   

   BResources
   

   CResponse attributes
   

   DActions
   

   Correct answer: C

   When PingAM 8.0.2 evaluates an authorization policy, the primary output is a 'Permit' or 'Deny' decision. However, applications and Policy Enforcement Points (PEPs)---like PingGateway or a Web Agent---often require additional metadata about the user or the session to function correctly (e.g., the user's employee ID, department, or a specific preference).

   According to the PingAM documentation on 'Policies' and 'Requesting Decisions':

   The mechanism used to provide this extra information is Response Attributes. When defining a policy in the PingAM UI or via REST, an administrator can configure 'Response Attributes' which map internal attributes (from the User Profile or the Session) to keys that are sent back in the policy decision payload.

   How it works: If a policy is configured with a response attribute mapping uid to User-ID, when PingGateway asks 'Can user X access resource Y?', PingAM responds with 'Permit' AND a map containing User-ID: X.

   Consumption: PingGateway or the Web Agent can then take these attributes and inject them into HTTP headers (e.g., X-User-ID) so the downstream application can consume them without having to query AM again.

   Subjects (Option A), Resources (Option B), and Actions (Option D) are all input components used to define the scope of a policy; they are not used to return data to the enforcer. Only Response Attributes serve the purpose of enriching the decision response with additional context.

   ============