Ping Identity PAP-001 Exam Questions

When using the Authorization Code Flow for authentication, PingAccess must be configured with:

An OAuth Client ID that identifies the application to the IdP.

The OpenID Connect Login Type set to Authorization Code.

Exact Extract:

''When configuring an OIDC web session, specify the OAuth client ID and select the OpenID Connect login type (Authorization Code, Hybrid, or Implicit).''

Option A (OAuth Token Introspection Endpoint) is not required for Authorization Code flow --- token introspection is used in other cases.

Option B (OAuth Client ID) is correct --- required for OIDC authorization requests.

Option C (OpenID Connect Issuer) is discovered automatically via metadata when you configure the token provider.

Option D (Virtual Host) is required for application exposure but not specific to OIDC flow.

Option E (OpenID Connect Login Type) is correct --- must be set to ''Authorization Code.''

In PingAccess, when an application relies on claims from an OAuth access token, you must configure PingAccess to evaluate those claims and potentially inject them into headers for the backend application.

Exact Extract from PingAccess documentation:

''OAuth rules allow you to evaluate claims in OAuth access tokens. You can configure PingAccess to look at specific claims and enforce policies or pass them to target applications.''

''To extract attributes from an access token, configure an OAuth Attribute Rule.''

This clearly matches option D.

Analysis of each option:

A . An authentication requirement definition

Incorrect. Authentication requirements determine how users authenticate to applications (OIDC provider, etc.), but do not manage access token claims.

B . A web session attribute rule

Incorrect. Web session attribute rules map attributes from the authenticated user's web session (SSO session), not from OAuth access tokens.

C . An identity mapping definition

Incorrect. Identity mappings transform user attributes (from IdP to app), but they don't directly pull claims from OAuth tokens.

D . An OAuth attribute rule

Correct. This rule is specifically designed to extract and enforce policies on claims from OAuth access tokens.

Therefore, the correct answer is D. An OAuth attribute rule.

When using multiple Access Token Managers, the Send Audience option ensures that tokens are scoped properly and validated against the intended resource/application.

Exact Extract:

''Enable Send Audience in the token provider configuration to support environments with multiple Access Token Managers and enforce correct audience restrictions.''

Option A (Subject Attribute Name) is unrelated --- it maps user identity but not token manager selection.

Option B (Send Audience) is correct --- required when multiple ATMs are in use.

Option C (Use Token Introspection Endpoint) is optional and depends on deployment, not mandatory for multiple ATMs.

Option D (Client Secret) is part of OAuth client credentials, not specific to multiple ATMs.

PingAccess uses Identity Mappings to take identity attributes provided by the authentication source (e.g., PingFederate, OpenID Connect) and map them into HTTP request headers for back-end applications.

Exact Extract:

''An identity mapping allows you to map identity attributes from the user's session to HTTP headers, cookies, or query parameters that are then forwarded to the target application.''

Option A (Site Authenticators) is incorrect because Site Authenticators configure how PingAccess communicates with applications requiring authentication, not how attributes are inserted into headers.

Option B (Identity Mappings) is correct --- this is the feature designed specifically to expose user attributes to applications via HTTP headers.

Option C (Web Sessions) manages how sessions are stored and validated, but not the mapping of attributes into requests.

Option D (HTTP Requests) refers to request/response processing rules, but attributes are not mapped here.

Legacy PKIs often provide certificate chains that are out of order or non-compliant with RFC-5280 path validation. PingAccess provides an option in Trusted Certificate Groups called Validate disordered certificate chains to allow chaining even if the order is not RFC-5280 compliant.

Exact Extract:

''Enable Validate disordered certificate chains when the certificate chain is not in RFC-5280 compliant order but should still be accepted.''

Option A is incorrect; using the Java trust store is unrelated to PKI ordering.

Option B is correct --- this setting allows PingAccess to process disordered certificate chains.

Option C is incorrect; date checks are unrelated to RFC-5280 path ordering.

Option D is incorrect; revocation status handling does not address legacy PKI ordering issues.