Discuss Ping Identity PAP-001 Exam Topic 3 Question 12

A company uses an internally based legacy PKI solution that does not adhere to the Certification Path Validation section of RFC-5280. Which configuration option needs to be enabled when creating Trusted Certificate Groups in PingAccess?

AUse Java Trust Store

BValidate disordered certificate chains

CSkip Certificate Date Check

DDeny when unable to determine revocation status

Suggested Answer: B

Legacy PKIs often provide certificate chains that are out of order or non-compliant with RFC-5280 path validation. PingAccess provides an option in Trusted Certificate Groups called Validate disordered certificate chains to allow chaining even if the order is not RFC-5280 compliant.

Exact Extract:

''Enable Validate disordered certificate chains when the certificate chain is not in RFC-5280 compliant order but should still be accepted.''

Option A is incorrect; using the Java trust store is unrelated to PKI ordering.

Option B is correct --- this setting allows PingAccess to process disordered certificate chains.

Option C is incorrect; date checks are unrelated to RFC-5280 path ordering.

Option D is incorrect; revocation status handling does not address legacy PKI ordering issues.

Get Premium PAP-001 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

12 comments · newest first

Jacki 3 months ago

I agree with Virgie. Validating disordered chains is key for compatibility.

Danica 3 months ago

I feel like option D is safer. Denying when revocation status is unknown is crucial.

Virgie 3 months ago

I think option B is the best choice. It helps with the legacy PKI issue.

Ashley 3 months ago

Can someone explain why we wouldn't want to deny on revocation status?

Aileen 3 months ago

Definitely B) is needed for legacy systems like this.

Skye 4 months ago

Wait, are we really skipping certificate date checks? That sounds risky!

Jamal 5 months ago

I disagree, I think A) Use Java Trust Store is more relevant here.

Yuki 5 months ago

B) Validate disordered certificate chains is the right choice.

Angelica 6 months ago

I practiced a similar question where revocation status was crucial, so I wonder if denying when unable to determine revocation status could be a key factor here.

Dalene 6 months ago

I feel like skipping the certificate date check could lead to security risks, so it probably isn't the right option.

Wayne 6 months ago

I'm not entirely sure, but I remember something about the Java Trust Store being important for legacy systems. Maybe that's the answer?

Kara 6 months ago

I think the option about validating disordered certificate chains might be the right choice since the legacy PKI could have issues with the order of certificates.

Ping Identity PAP-001 Exam - Topic 3 Question 12 Discussion