It-PassportsのPT-AM-CPE問題集を買ったら1年間の無料オンラインのアップデートを提供する一方で、試験に失敗したら、お客様に全額で返金いたします。
| トピック | 出題範囲 |
|---|---|
| トピック 1 |
|
| トピック 2 |
|
| トピック 3 |
|
| トピック 4 |
|
| トピック 5 |
|
It-Passportsは、最新のテクノロジーに遅れずについていき、コンテンツだけでなくディスプレイでも試験の質問と回答にそれらを適用しようとしています。それが、私たちの合格率が98％から100％と高い理由です。データはユニークで、このキャリアに特有です。 PT-AM-CPE勉強のトレントを使用すると、レジャーの学習体験を楽しむことができ、PT-AM-CPE試験に合格すると確実に合格します。 PT-AM-CPE準備資料の内容については、専門家によって簡素化され、ディスプレイは効果的に設計されています。試して楽しんでください！
質問 # 21
Which of the following parameters must be provided by the edge client when requesting step-up authentication or transactional authorization?
正解：C
解説：
In PingAM 8.0.2, when a client needs to trigger a specific authentication path-such as a higher-level tree for step-up authentication or a specific module for transactional authorization-it must tell the /authenticate endpoint which "Index" to use.
According to the PingAM "Authenticate over REST" and "Session Upgrade" documentation, these are governed by two mandatory parameters:
authIndexType: This defines the category of the authentication mechanism being requested. Valid values include service (for Authentication Trees/Chains), module (for individual modules), or level (to request any mechanism that meets a specific Auth Level).
authIndexValue: This defines the name of the specific instance. For example, if authIndexType is service, the authIndexValue would be the name of the Authentication Tree (e.g., StepUpMFA).
For a step-up or transactional request to succeed, the client must send these two parameters. While service (Option B and D) is a common value for authIndexType, it is not a parameter name itself. ForceAuth (Option C and D) is an optional boolean used to force a fresh login even if a session exists, but it is not a requirement for the basic routing of the request to the correct tree. Therefore, authIndexType and authIndexValue (Option A) are the fundamental parameters required by the AM engine to identify and initiate the intended authentication journey.7
質問 # 22
Which is the correct simplified TLS handshake sequence needed to authenticate clients using a mutual TLS exchange?
正解：D
解説：
Mutual TLS (mTLS) is a security enhancement where both the client and the server provide X.509 certificates to prove their identities.9 In PingAM 8.0.2, mTLS is frequently used for secure "Machine-to-Machine" (M2M) communication, such as between an OAuth2 client and the token endpoint, or between AM and a Directory Server (PingDS).
According to the PingAM documentation on "Secure Network Communication" and "mTLS for OAuth2," the handshake sequence for mTLS follows these logical steps:
Client Hello: The client initiates the request to the server.10
Server Hello & Certificate: The server responds by presenting its own certificate (verifying the server's identity to the client).11 In an mTLS scenario, the server also includes a CertificateRequest message.12 Client Certificate & Key Exchange: The client validates the server's certificate. If valid, the client then sends its own Client Certificate to the server, along with the encrypted pre-master secret or key exchange data.
Verification and Establishment: The server validates the client's certificate against its truststore. If the certificate is trusted and the cryptographic signatures match, the mutually secure connection is established.
Option D represents the most accurate "simplified" sequence. Option A is incorrect because the server presents its certificate before the client sends its own certificate. Option B and C are incorrect because the server always responds to the initial "Client Hello" with its own identity (Server Certificate) before the client proceeds with identity submission. This "handshake" ensures that no data is transmitted until both parties have cryptographically verified each other.
質問 # 23
What should be configured in PingAM if you are using an LDAP directory service that does not support persistent search?
正解：C
解説：
Persistent Search is an LDAP control that allows a client (like PingAM) to receive real-time notifications from the Directory Server (like PingDS) whenever a user record is modified. PingAM 8.0.2 uses this to maintain its User Data Cache.
According to the "Identity Store Configuration" and "Tuning AM" documentation:
When persistent search is supported, PingAM caches user profile data in memory to speed up authentication and authorization decisions. When a change happens in the LDAP store, the directory server "pushes" the update to AM via the persistent search connection, and AM updates its cache immediately.
If the LDAP directory does not support persistent search (common in some legacy or highly restricted environments):
Cache Inconsistency: If caching were enabled, PingAM would not know when a user's attribute (like a group membership) had changed in the back-end. The cache would become "stale," leading to incorrect authorization decisions.
Required Configuration: The administrator must Disable user data caching to ensure that every request results in a direct query to the LDAP server, ensuring "Read-through" accuracy.
Performance Impact: Disabling the cache has a negative impact on performance (Option D) because every policy evaluation or session check now requires a synchronous network round-trip to the LDAP server, increasing latency and putting higher CPU/IO load on the directory.
Therefore, for directories lacking persistent search, disabling the cache is necessary for data integrity but comes at a significant performance cost.
質問 # 24
Which feature of PingAM protects against cookie hijacking in a cross-domain single sign-on environment?
正解：C
解説：
In a Cross-Domain Single Sign-On (CDSSO) environment, PingAM must manage session cookies across multiple distinct DNS domains.2 By default, a standard SSO token could potentially be stolen and reused by a malicious actor to gain access to other domains within the same realm.3 To mitigate this specific threat, PingAM 8.0.2 utilizes Restricted Tokens.4 According to the documentation on "Securing CDSSO session cookies," a restricted token is a unique SSO token issued for each specific application or policy agent after successful user authentication.5 When CDSSO is active with cookie hijacking protection enabled, PingAM issues a "master" SSO token for the domain where AM resides and separate restricted tokens for the other fully qualified domain names (FQDNs) where web or Java agents are located.6 The restricted token is "restricted" because it is inextricably linked to the specific agent and application that initiated the redirection. Internally, AM stores a correlation between the master session and these restricted tokens.7 If an attacker attempts to hijack a restricted token and use it to access a different application or a different domain, the AM server performs a validation check on the constraint associated with the token (such as the agent's DN or IP). If the request does not originate from the authorized entity, a security violation is triggered, and access is denied. This mechanism ensures that even if a cookie is stolen in one domain, its utility is confined strictly to that domain and cannot be used for "lateral movement" across the enterprise's other protected resources. It is important to note that restricted tokens require server-side sessions to function; they are not supported for client-side (JWT-based) sessions.8
質問 # 25
When developing a PingAM may act script for OAuth2 token exchange patterns, which variables are made available for use in the script?
正解：B
解説：
The OAuth2 May Act script type in PingAM 8.0.2 allows administrators to programmatically determine if a token exchange request (impersonation or delegation) should be allowed by adding a may_act claim to the token.
According to the "Scripting" and "Token Exchange Scripting API" documentation, when this script is executed, the AM engine provides a specific set of "Bindings" or variables. These allow the script to inspect the context of the request before deciding to modify the token. The documented variables for the OAuth2 May Act script are:
clientProperties: A map of the OAuth2 client's configuration properties.
identity: The identity object for the user/subject.
logger: The logging object for debugging within the script.
requestProperties: Properties of the incoming HTTP request.
scopes: The set of scopes requested or associated with the token.
scriptName: The name of the script being executed.
session: The user's SSO session (if available).
requestedToken: This is the most important variable; it represents the token being issued. Methods like .addMayAct() or .setMayAct() are called on this specific object.
Why other options are incorrect:
Option B correctly lists the bindings.
Options A and D are incorrect because they use the variable name token. While token is a common variable name in other OAuth2 script types (like the Access Token Modification script), the Token Exchange script specifically uses requestedToken to distinguish the new token from the subject_token or actor_token provided in the request.
Option C uses scopeList, which is not the standard variable name for the scopes in this specific script context; the documentation defines it as scopes.
質問 # 26
......
時々重要な試験に合格するために大量の問題をする必要があります。我々の提供するソフトはこの要求をよく満たして専門的な解答の分析はあなたの理解にヘルプを提供できます。Ping IdentityのPT-AM-CPE試験の資料のいくつかのバーションのデモは我々のウェブサイトで無料でダウンロードできます。あなたの愛用する版をやってみよう。我々の共同の努力はあなたに順調にPing IdentityのPT-AM-CPE試験に合格させることができます。
PT-AM-CPE模擬問題集: https://www.it-passports.com/PT-AM-CPE.html