Pass the Ping Identity PingAccess PAP-001 Questions and answers with CertsForce

Identity Mapping in PingAccess relies on attributes provided by thetoken provider(e.g., PingFederate, OIDC provider). If the desired attributes are not present in the dropdown, it means they are not being provided in the token or userinfo response.

Exact Extract:

“Attributes available in identity mappings are those provided in the web session by the token provider. If attributes are missing, they must be added to the token by the identity provider.”

Option Ais correct — the token provider administrator must configure the IdP to include the additional attributes.

Option Bis incorrect — rewrite rules modify content but do not supply new identity attributes.

Option Cis incorrect — developers cannot directly add identity attributes; they must come from the IdP.

Option Dis incorrect — Web Session Attribute rules only evaluate available attributes; they don’t create new ones.

When PingAccess is integrated with PingFederate as aToken Provider, the OAuth clients already configured in PingFederate become available in PingAccess. This enables administrators toautomatically select Client IDswhen creating Web Sessions.

Exact Extract:

“When PingAccess uses PingFederate as its token provider, PingFederate OAuth clients appear automatically in PingAccess for selection during web session configuration.”

Option Ais incorrect — this refers to Admin Console authentication, which is separate.

Option Bis incorrect — OAuth clients must be created in PingFederate, not from within PingAccess.

Option Cis incorrect — token issuance policies are managed in PingFederate, not PingAccess.

Option Dis correct — the Client ID dropdown is populated automatically from PingFederate.

PingAccess is designed to work with modern identity protocols. It doesnotsupport legacy WS-* protocols directly.

Exact Extract:

“PingAccess integrates with OAuth 2.0 and OpenID Connect (OIDC) to provide authentication and authorization for web and API resources.”

Option A (SAML)is incorrect — PingAccess does not natively consume SAML assertions; SAML can be used indirectly via PingFederate.

Option B (WS-Fed)is not supported.

Option C (WS-Trust)is not supported.

Option D (OAuth2)is correct — used for authorization and token validation.

Option E (OIDC)is correct — used for user authentication and sessions.

PingAccess allows administrators to configurecustom error pages or messagesat theRoot Resource levelof an application. This ensures that when rule violations (e.g., authorization failures) occur, the application can display tailored error responses.

Exact Extract:

“Custom error handling for rule violations is configured within the Root Resource of an application.”

Option Ais incorrect — assigning a rule to a resource does not allow defining custom errors.

Option Bis correct — the Root Resource is where administrators define custom error handling for the entire application.

Option Cis incorrect — Rule Sets only combine rules; they do not handle error responses.

Option Dis incorrect — individual rule definitions do not contain custom error configurations.

TheSameSiteattribute is applied to session cookies to control cross-site behavior. In PingAccess, session cookie configuration (includingSameSite) is defined at theWeb Sessionlevel.

Exact Extract:

“Web session configuration includes cookie attributes such as name, domain, secure flag, HTTPOnly, and SameSite.”

Option A (Rules)is incorrect — rules govern access control, not cookies.

Option B (Sites)defines backend connections, not session cookies.

Option C (Applications)ties resources to sessions but does not define cookie behavior.

Option D (Web Sessions)is correct — session cookie SameSite settings are configured here.

For PingAccess to terminate SSL for a proxied application, it requires access to theprivate key and certificate chain. These are stored asKey Pairs.

Exact Extract:

“For SSL termination, you must import the server certificate and its private key as a PKCS#12 file intoKey Pairs.”

Option Ais incorrect — a public key alone cannot terminate SSL.

Option Bis incorrect — PKCS#12 files must go intoKey Pairs, not Certificates.

Option Cis incorrect — public keys alone are insufficient; PingAccess must have the private key.

Option Dis correct — the PKCS#12 file with full chain and private key is imported intoKey Pairs.

PingAccess rules are categorized intoAccess Control RulesandProcessing Rules.

Processing Rulesmodify or add to HTTP requests and responses.

Cross-Origin Request (CORS)is specifically listed as aProcessing Rule, because it modifies response headers to support cross-origin requests.

Exact Extract:

“Processing rules apply to HTTP traffic, such as Cross-Origin Resource Sharing (CORS), header injection, or response modification.”

Option A (Web Session Attribute)is an access control rule.

Option B (Cross-Origin Request)is correct — this is a processing rule.

Option C (HTTP Request Parameter)is an access control rule.

Option D (HTTP Request Header)is an access control rule.

When usingHTTP Basic Authentication(admin.auth=native), PingAccess only supports asingle administrative account(the default admin user). For multiple administrators, SSO integration (e.g., OIDC) is required.

Exact Extract:

“When admin authentication is set to native (HTTP Basic), only one administrative user is supported. For multiple admins, configure UI authentication with an OIDC provider.”

Option A (1000)is incorrect.

Option B (1)is correct — only one basic auth admin account.

Option C (10)andOption D (100)are incorrect.

Because the application context root is/parts, resource paths are defined relative to it. The correct relative path is:

/suspension/struts/manufacturer

Exact Extract:

“Resource matching begins at the context root. The most specific matching path is selected.”

Option Ais incorrect —/*/struts/manufacturerdoes not match because it starts with a wildcard, not the defined path.

Option Bis incorrect —/*/manufacturerwould match less specifically and at a different depth.

Option Cis correct — exact match relative to/parts.

Option Dis incorrect — too generic and not the best match.

All onboarding in PingAccess begins with defining anApplication. Once the application exists, the administrator can defineResourceswithin it and assign different rules to those resources.

Exact Extract:

“Before you can configure resources and rules, you must first create an application in PingAccess.”

Option A (Identity Mapping)may be required later but not the first step.

Option B (Web Session)can be shared but is not the first onboarding step.

Option C (Application)is correct — the starting point for onboarding.

Option D (Resource)comes after creating the application.