BONUS!!! Download part of Prep4SureReview PT-AM-CPE dumps for free: https://drive.google.com/open?id=1MjpnHu9xqwPpLNlXF6l3HHBOanVhD-xu
To those time-sensitive exam candidates, our high-efficient PT-AM-CPE actual dumps comprised of important news will be best help. Only by practicing our PT-AM-CPE learning guide on a regular base, you will see clear progress happened on you. Besides, rather than waiting for the gain of our PT-AM-CPE Practice Engine, you can download them immediately after paying for it, so just begin your journey toward success now.
| Certification Vendor: | Ping Identity |
|---|---|
| Exam Name: | Certified Professional - PingAM Exam |
| Exam Number: | PT-AM-CPE |
| Passing Score: | 66% |
| Available Languages: | English |
| Exam Format: | Scenario-based, Multiple Choice |
| Related Certifications: | Ping Identity Certified Expert - PingAM |
| Certificate Validity Period: | 3 years |
| Exam Price: | $395 / £310 / €365 |
| Exam Duration: | 120 minutes |
| Real Exam Qty: | 100 |
| Recommended Training: | PingAM Deep Dive (AM-410) |
| Exam Registration: | Ping Identity Certification Portal |
| Sample Questions: | Ping Identity PT-AM-CPE Sample Questions |
| Exam Way: | Online proctored or onsite testing center |
| Pre Condition: | Completion of PingAM Deep Dive Course (AM-410); 3–6 months hands-on experience with PingAM |
| Official Syllabus URL: | https://backstage.pingidentity.com/university/ping/certification |
>> PT-AM-CPE Training Solutions <<
Our PT-AM-CPE guide torrent not only has the high quality and efficiency but also the perfect service system after sale. If you decide to buy our PT-AM-CPE test torrent, we would like to offer you 24-hour online efficient service, and you will receive a reply, we are glad to answer your any question about our PT-AM-CPE Guide Torrent. You have the right to communicate with us by online contacts or by an email. The high quality and the perfect service system after sale of our PT-AM-CPE exam questions have been approbated by our local and international customers. So you can rest assured to buy.
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
NEW QUESTION # 43
What is session denylisting used for?
Answer: C
Explanation:
Session Denylisting is a critical security feature in PingAM 8.0.2, primarily used when a realm is configured for client-side sessions.9 In a client-side session model, the session state is stored in a signed and encrypted JWT within the user's browser cookie rather than in the server's memory or the Core Token Service (CTS).10 Because the server does not "own" the session state, a logout event typically only involves deleting the cookie from the browser. However, if a malicious actor had previously copied that cookie, they could still use it until it naturally expires.
To solve this, PingAM uses Session Denylisting to keep track of logged out sessions.11 When a user logs out, or when a session is invalidated (e.g., during a session upgrade or administrative action), AM records the session identifier in a denylist stored within the Core Token Service (CTS).12 For every subsequent request, AM checks the incoming client-side session token against this denylist.13 If the session ID is found in the denylist, AM rejects the token as invalid, even if the cryptographic signature is correct and the expiration time has not passed.
The documentation emphasizes that this feature is essential for "tracking session logouts across multiple AM servers" in a cluster. Without denylisting, there would be no way to perform a "global logout" for client-side sessions that is immediately effective across all nodes.14 Administrators can configure properties such as the Denylist Purge Delay (to account for clock skew) and the Denylist Poll Interval (to balance security speed with system performance).15 By effectively managing the lifecycle of revoked tokens, session denylisting ensures that a logout is a cryptographically and operationally certain event.
NEW QUESTION # 44
Which of the following tab pages in the PingAM admin UI can be used to configure the OAuth2 and OpenID Connect may act scripts used for token exchange requests?
A) The OAuth2 provider service > Advanced tab page
B) The OAuth2 provider service > Core tab page
C) The OAuth2 client profile > Advanced tab page
D) The OAuth2 client profile > OAuth2 Provider Overrides tab page
Answer: D
Explanation:
The May Act script is a critical component of the OAuth 2.0 Token Exchange implementation in PingAM 8.0.2. It allows for the validation of impersonation or delegation requests. Because token exchange can be configured both globally for all clients and specifically for individual applications, the script can be attached at two different levels in the Administrative UI.
OAuth2 Provider Service > Advanced Tab (A): This is the global configuration level. If you want to apply a standard "May Act" validation script across the entire realm for any client performing a token exchange, you configure it here. This script will be the default unless specifically overridden.
OAuth2 Client Profile > OAuth2 Provider Overrides Tab (D): PingAM allows for granular control per client. If a specific "Confidential Client" (like a backend microservice) requires unique logic for determining who it can act as, you can specify a different script or override the global setting. This is done in the "OAuth2 Provider Overrides" tab within that specific client's configuration profile.
Why other options are incorrect: The Core tab (B) is used for basic settings like issuer names and token lifetimes, not for advanced scripting hooks. The Advanced tab of the Client Profile (C) contains settings like TTLs and Logout URLs, but the specific ability to override "Provider" level logic (like the May Act script) is moved to the specialized Overrides tab to keep the interface organized. Therefore, the correct locations are A and D, as identified in the "Token Exchange Configuration" guide for version 8.0.2.
NEW QUESTION # 45
What is the purpose of the extended metadata in PingAM?
Answer: C
Explanation:
In SAML 2.0 Federation, there is a standard XML schema (defined by OASIS) that all vendors use to describe an Identity Provider (IdP) or Service Provider (SP). This is known as "Standard Metadata." However, standard metadata does not include every configuration option required to run a sophisticated Access Management server.
PingAM 8.0.2 uses Extended Metadata to store implementation-specific settings that fall outside the OASIS SAML 2.0 specification. According to the "SAML 2.0 Guide," extended metadata is stored as a separate configuration file (or JSON entry in newer versions) and includes parameters such as:
Identity Store Mapping: Which attribute in the local datastore matches the SAML NameID.
Session Information: How AM should handle the session lifecycle after a successful SAML assertion.
Attribute Mapping: Detailed instructions on how to transform local LDAP attributes into SAML attributes (and vice versa).
Authentication Trees: Which specific tree should be triggered when a request arrives at the IdP.
Option D is the correct description. Option C is incorrect because extended metadata is not a standard way to communicate features; in fact, other SAML products (like ADFS or Okta) cannot read or process PingAM's extended metadata. Option A is incorrect because basic certificates/keys are usually part of the standard metadata (KeyDescriptor), and Option B is incorrect because SAML federation usually triggers authentication journeys or attribute mapping rather than a standard authorization "policy."
NEW QUESTION # 46
Which of the following components is used to return data to PingGateway or the agent to be included with the policy decision?
Answer: C
Explanation:
When PingAM 8.0.2 evaluates an authorization policy, the primary output is a "Permit" or "Deny" decision. However, applications and Policy Enforcement Points (PEPs)-like PingGateway or a Web Agent-often require additional metadata about the user or the session to function correctly (e.g., the user's employee ID, department, or a specific preference).
According to the PingAM documentation on "Policies" and "Requesting Decisions":
The mechanism used to provide this extra information is Response Attributes. When defining a policy in the PingAM UI or via REST, an administrator can configure "Response Attributes" which map internal attributes (from the User Profile or the Session) to keys that are sent back in the policy decision payload.
How it works: If a policy is configured with a response attribute mapping uid to User-ID, when PingGateway asks "Can user X access resource Y?", PingAM responds with "Permit" AND a map containing User-ID: X.
Consumption: PingGateway or the Web Agent can then take these attributes and inject them into HTTP headers (e.g., X-User-ID) so the downstream application can consume them without having to query AM again.
Subjects (Option A), Resources (Option B), and Actions (Option D) are all input components used to define the scope of a policy; they are not used to return data to the enforcer. Only Response Attributes serve the purpose of enriching the decision response with additional context.
NEW QUESTION # 47
Which of the following code examples inserts a may_act claim to the resulting token in a PingAM implementation?
Answer: B
Explanation:
In PingAM 8.0.2, the OAuth 2.0 Token Exchange (RFC 8693) implementation allows for complex identity delegation scenarios. The may_act claim is a specific claim used to indicate that one entity is authorized to act on behalf of another. When customizing the behavior of token exchange via the OAuth2 Token Exchange Script, developers interact with specific scriptable objects provided by the PingAM engine.
According to the "Scripting API" for OAuth2 and the "Token Exchange" developer guide, the requestedToken object is the primary interface used to modify the structure of the token being issued during the exchange. To insert the may_act claim, the API provides the addMayAct() method.
The may_act claim is technically a JSON object that contains a sub (subject) claim of the entity that is allowed to act as the subject of the token. In the scripting environment:
The requestedToken variable represents the token currently being minted.
The .addMayAct() method is the defined function signature to append this delegation metadata.
Why other options are incorrect:
Options A and D: The object name token is not the standard binding used for the target token in the Token Exchange script context; requestedToken is the correct binding.
Option C: The method name setMayAct is incorrect. The PingAM API uses the add prefix for these types of claims (similar to addActor), reflecting the underlying structure where these claims are added to the claim set of the JWT.
Using the correct syntax requestedToken.addMayAct(mayAct) ensures that the resulting Access Token or ID Token contains the correctly formatted delegation information required by resource servers to validate that the "Actor" has the permission to represent the "Subject."
NEW QUESTION # 48
......
Latest PT-AM-CPE Test Answers: https://www.prep4surereview.com/PT-AM-CPE-latest-braindumps.html
P.S. Free & New PT-AM-CPE dumps are available on Google Drive shared by Prep4SureReview: https://drive.google.com/open?id=1MjpnHu9xqwPpLNlXF6l3HHBOanVhD-xu