Ping Identity PT-AM-CPE Exam Dumps

In PingAM 8.0.2, the recommended and most secure flow for 'Public Clients'---such as Single Page Applications (SPAs) written in JavaScript---is the Authorization Code Grant Flow with PKCE (Proof Key for Code Exchange).

Historically, the Implicit Grant Flow (Option B) was used for browser-based apps because they could not securely store a client_secret. However, the Implicit flow is now considered legacy and insecure due to the risk of access token leakage in the browser history or via referrer headers. The Resource Owner Password Credentials Grant (Option C) is also discouraged as it requires the application to handle user credentials directly, violating the core principle of delegated authorization. Client Credentials (Option D) is reserved strictly for machine-to-machine communication where no user is involved.

The Authorization Code Grant with PKCE addresses the security limitations of public clients by replacing the static client_secret with a dynamically generated 'code verifier' and 'code challenge.' The process works as follows:

Challenge Generation: The JavaScript app creates a cryptographically strong random string (Verifier) and transforms it (Challenge).

Authorization Request: The app sends the challenge to PingAM.21

Code Exchange: After user login, AM returns an authorization code. The app then sends the code and the original verifier to the token endpoint.

Verification: AM verifies that the verifier matches the initial challenge before issuing the Access Token.

This flow ensures that even if an attacker intercepts the authorization code, they cannot exchange it for a token without the original verifier, which never left the browser's execution context. PingAM 8.0.2 fully supports this flow and provides specific configuration options in the OAuth2 Provider settings to enforce PKCE for all public clients.

PingAM 8.0.2 provides a 'Recovery Code' mechanism as part of its Multi-Factor Authentication (MFA) suite. This allows users to regain access to their accounts if they lose their MFA device (such as a smartphone used for Push or OATH).

According to the PingAM 'Authentication Node Reference' for version 8.0.2:

The node responsible for the validation of these codes is the Recovery Code Collector Decision node. This node performs a dual function:

Collection: It renders the UI callback to the user (a text input field) asking for the recovery code.

Decision/Validation: Once the user submits a code, the node checks the input against the stored, hashed recovery codes in the user's profile.

Analysis of the other options:

Recovery Code Display node (Option A): This node is used during the registration phase to show the user their newly generated codes so they can save them. It does not validate them.

Recovery Code Verifier node (Option D): This is a common distractor name. While 'Verifier' sounds logical, the actual name in the AM designer is the 'Collector Decision' node, reflecting the pattern of nodes that both collect data and make a branching decision.

Recovery Code Comparator node (Option B): Not a standard node in PingAM 8.0.2.

The Recovery Code Collector Decision node typically has two outcomes: Success (code matched and was consumed/removed) or Failure (code was invalid). This node is vital for ensuring that 'Account Recovery' journeys remain secure and functional within the Intelligent Access framework.

============

In a high-availability PingAM 8.0.2 cluster, Affinity Load Balancing is a mechanism used to ensure that requests related to a specific session or configuration are routed to the same Directory Server (DS) instance to avoid issues with replication lag. This is particularly important for stores where data changes frequently or where consistent reads are required immediately after a write.

According to the PingAM documentation on 'Load Balancing' and 'External Data Stores,' affinity can be configured for the following primary stores:

Core Token Service (CTS) Store: This is the most critical area for affinity. Since the CTS handles stateful data like session tokens and OAuth2 tokens that are updated constantly, ensuring that an AM server consistently communicates with a specific DS node (using the HOST:PORT|SERVERID|SITEID syntax) prevents 'token not found' errors that might occur if a request reached a DS node before the token was replicated.

Configuration Store: This store holds the central configuration for the AM deployment. In multi-server environments, affinity ensures that configuration changes are read consistently across the cluster.

Identity Stores: These hold the user profiles. While often read-heavy, affinity is used here to improve caching efficiency and ensure that profile updates (like password changes or attribute updates) are reflected immediately in subsequent authentication steps within the same cluster.

Policy Data Store: This stores authorization policies. Similar to configuration, affinity ensures consistent policy evaluation.

Option D is the correct answer because it includes the Core Token Service, Identity Stores, Configuration Store, and Policy Data Store. The 'Application Data Store' (mentioned in other options) is often logically grouped with or replaced by the Policy Data Store in many 8.0.2 configurations, but the four stores listed in Option D are the specific ones explicitly called out in the 'External Data Stores' secondary configuration documentation for supporting affinity settings.

PingAM 8.0.2 adheres to the OpenID Connect Core 1.0 specification regarding standard scopes and claims. When a client requests the profile scope, the OpenID Provider (PingAM) is expected to return a specific set of claims that describe the user's basic profile.

According to the PingAM documentation on 'Understanding OpenID Connect Scopes and Claims' and the default OIDC Claims Script (which maps internal LDAP attributes to OIDC claims):

The standard claims associated with the profile scope are strictly defined with lowercase, snake_case naming conventions. The default set includes:

name: The user's full name.

given_name: The user's first name.

family_name: The user's surname or last name.

middle_name: (Optional)

nickname: (Optional)

preferred_username: (Optional)

profile: URL to the profile page.

picture: URL to an image.

website: URL.

gender: (Optional)

birthdate: (Optional)

zoneinfo: Timezone.

locale: The user's preferred language/locale.

updated_at: Timestamp.

Option C is the only choice that correctly identifies the snake_case format (given_name, family_name, locale) required by the specification. Options A and B use camelCase or inconsistent naming that does not match the OIDC standard or PingAM's default mapping script. Option D includes preferred_locale, which is incorrect; the standard claim name for a user's language preference in OIDC is simply locale.

In PingAM 8.0.2, Multi-Factor Authentication (MFA) using the OATH standard supports two primary algorithms: TOTP (Time-based One-Time Password) and HOTP (HMAC-based One-Time Password).14 For an authentication journey to function correctly, the 'Registration' phase (where the user's device and AM agree on a secret and algorithm) and the 'Verification' phase (where AM checks the submitted code) must be perfectly synchronized.

According to the 'Authentication Node Reference' for the OATH Token Verifier node and OATH Registration node:

Both nodes contain a configuration property named OATH Algorithm.15 This property determines how the six- or eight-digit code is generated and validated. If the OATH Registration node is configured to set up a user for TOTP, it will generate a QR code containing the TOTP parameters for the user's authenticator app.

When that user later attempts to log in, the OATH Token Verifier node (Option A) must also be set to TOTP.16 If the verifier is accidentally set to HOTP (which uses a counter rather than a time step), the validation will consistently fail because the server will be looking for a counter-based value while the app is providing a time-based value.

Other nodes like the Recovery Code Collector Decision node (Option B) or OATH Device Storage node (Option D) handle subsequent or separate tasks (like account recovery or writing the final profile to LDAP) and do not directly participate in the real-time OATH mathematical validation logic. Thus, the OATH Token Verifier is the mandatory counterpart that must match the registration's algorithm setting.