TorrentVCE is an authoritative study platform to provide our customers with different kinds of PT-AM-CPE practice torrent to learn, and help them accumulate knowledge and enhance their ability to pass the exam as well as get their expected scores. There are three different versions of our PT-AM-CPE Study Guide: the PDF, the Software and the APP online. To establish our customers' confidence and avoid their loss for choosing the wrong exam material, we offer related free demos of PT-AM-CPE exam questions for our customers to download before purchase.
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
>> PT-AM-CPE Valid Dumps Pdf <<
The web-based Ping Identity PT-AM-CPE practice exam does not require special plugins and creates a PT-AM-CPE testing atmosphere that removes candidates exam anxiety. "TorrentVCE" web-based Certified Professional - PingAM Exam (PT-AM-CPE) practice test tracks your progress and helps you overcome mistakes. Our Ping Identity PT-AM-CPE practice exam software displays results at the end of each attempt.
NEW QUESTION # 11
Which of the following tab pages in the PingAM admin UI can be used to configure the OAuth2 and OpenID Connect may act scripts used for token exchange requests?
A) The OAuth2 provider service > Advanced tab page
B) The OAuth2 provider service > Core tab page
C) The OAuth2 client profile > Advanced tab page
D) The OAuth2 client profile > OAuth2 Provider Overrides tab page
Answer: D
Explanation:
The May Act script is a critical component of the OAuth 2.0 Token Exchange implementation in PingAM 8.0.2. It allows for the validation of impersonation or delegation requests. Because token exchange can be configured both globally for all clients and specifically for individual applications, the script can be attached at two different levels in the Administrative UI.
OAuth2 Provider Service > Advanced Tab (A): This is the global configuration level. If you want to apply a standard "May Act" validation script across the entire realm for any client performing a token exchange, you configure it here. This script will be the default unless specifically overridden.
OAuth2 Client Profile > OAuth2 Provider Overrides Tab (D): PingAM allows for granular control per client. If a specific "Confidential Client" (like a backend microservice) requires unique logic for determining who it can act as, you can specify a different script or override the global setting. This is done in the "OAuth2 Provider Overrides" tab within that specific client's configuration profile.
Why other options are incorrect: The Core tab (B) is used for basic settings like issuer names and token lifetimes, not for advanced scripting hooks. The Advanced tab of the Client Profile (C) contains settings like TTLs and Logout URLs, but the specific ability to override "Provider" level logic (like the May Act script) is moved to the specialized Overrides tab to keep the interface organized. Therefore, the correct locations are A and D, as identified in the "Token Exchange Configuration" guide for version 8.0.2.
NEW QUESTION # 12
In PingAM, which OpenID Connect endpoint can be used to validate an unencrypted ID token?
Answer: D
Explanation:
While OpenID Connect (OIDC) is built on top of OAuth2, it introduces specific endpoints for handling ID Tokens (the identity layer). In PingAM 8.0.2, when a client receives an ID Token, it is recommended to validate it locally using the provider's public keys. However, PingAM also provides a convenience endpoint for validation.
According to the "OpenID Connect 1.0 Endpoints" documentation:
/oauth2/idtokeninfo (Option A): This is the dedicated endpoint designed to receive an ID Token as a parameter.8 It validates the token's signature, checks the expiration and audience, and returns the claims contained within the token in a JSON format. This is specifically used for unencrypted ID tokens.
/oauth2/userinfo (Option B): This endpoint returns claims about the authenticated user but requires a valid Access Token in the authorization header, not an ID Token.9
/oauth2/introspect (Option C): This is a standard OAuth2 endpoint (RFC 7662) used to check the metadata and "activeness" of Access Tokens or Refresh Tokens, not the internal identity claims of an OIDC ID Token.10
/oauth2/tokeninfo (Option D): This is a legacy/non-standard endpoint that was used in older versions for Access Token validation and is not the primary OIDC validation endpoint in version 8.0.2.11 Therefore, for the specific task of validating an ID Token and retrieving its claims, /oauth2/idtokeninfo is the correct and authoritative endpoint in the PingAM 8.0.2 OIDC implementation.
NEW QUESTION # 13
To ensure the user's full name is displayed on the consent screen for an OpenID Connect application, which string should be added into the Support Claims property on the OpenID Connect tab page of the OAuth2 Provider service in PingAM?
Answer: B
Explanation:
When a client requests an OpenID Connect (OIDC) scope (like profile), PingAM 8.0.2 may present a Consent Screen to the user, asking permission to share specific claims. To make this screen user-friendly, PingAM allows administrators to map technical claim names to human-readable labels and specify localizations.
According to the PingAM documentation on "Supported Claims" in the OAuth2/OIDC Provider settings:
The format for the Supported Claims property entry is:
ClaimName|Locale|DisplayName
In this syntax:
ClaimName: The technical OIDC claim (e.g., name, email, given_name).
Locale: The ISO language code (e.g., en, fr).
DisplayName: The text that will actually appear on the UI (the "Full name" label).
Therefore, the string name|en|Full name (Option A) is the correct configuration.
Option B is incorrect because it reverses the technical name and the display name.
Option C is incorrect as it lacks the required locale component and uses full_name (which is not the standard OIDC claim name; the standard is name).
Option D attempts to perform a logic operation (+) within a configuration field where only static mapping strings are allowed. Claim composition (concatenating first and last names) is handled by the OIDC Claims Script, not by the Supported Claims UI property.
NEW QUESTION # 14
In an authentication tree process, considering best practice, where can the collected context data for mobile devices be persisted for subsequent risk analysis?
Answer: D
Explanation:
In PingAM 8.0.2, the Intelligent Access engine (Authentication Trees) uses a specific data-passing mechanism to move information between individual nodes within a single journey. When a journey involves collecting context-such as device metadata (OS, version, screen resolution), location data (IP, geofencing), or risk signals-this information must be stored temporarily while the tree evaluates the next steps.
According to the "Authentication Node Development" and "Nodes and Trees" documentation, PingAM uses two primary transient storage objects during the authentication flow:
Shared State: This is the primary map used to share data between nodes in the same tree. Contextual data collected by nodes like the Device Profile Collector or Browser Capabilities nodes is stored here. It exists only for the duration of the authentication journey.
Transient State: Similar to shared state, but often used for sensitive data that should not be visible to certain types of nodes or scripts.
The documentation identifies Shared Node State (Option B) as the best practice for persisting collected context during the tree process.
Session State (Option A) is only available after the authentication is successful and a session has been created. It is not suitable for data needed by nodes within the tree to make a decision (like a risk engine node).
User Profile (Option C) is for long-term persistence (LDAP/PingDS). Storing transient device context there would cause unnecessary database write overhead and privacy concerns.
Browser Cookies (Option D) are limited in size and pose security risks if used to store raw device data that could be tampered with by the client.
Therefore, for real-time risk analysis within a journey, nodes write data to the shared state, where subsequent nodes (like a Scripted Decision Node or Adaptive Risk Node) can retrieve and analyze it.
NEW QUESTION # 15
For Proof of Possession OAuth2 tokens, in addition to the access token, what must be presented to the authorization server?
Answer: D
Explanation:
Proof of Possession (PoP) tokens, specifically Certificate-Bound Access Tokens as defined in RFC 8705 and supported by PingAM 8.0.2, are designed to prevent token misuse by binding the access token to a specific client's cryptographic material.9 According to the PingAM documentation on "Certificate-Bound Proof-of-Possession," when an OAuth2 client requests a token, PingAM retrieves the client's public key (either from a provided certificate or a JWK) and embeds a thumbprint (the cnf claim) of that material into the issued token. When the client subsequently presents this token to the Resource Server (or the Authorization Server's introspection endpoint), it must also provide "Proof" that it possesses the private key corresponding to that thumbprint.
In the Mutual TLS (mTLS) approach, this proof is provided by the Client private certificate presented during the TLS handshake.10 The server verifies that the certificate used to establish the secure connection matches the one bound to the token. Without presenting the certificate (Option D), the token is considered "unbound" or invalid, even if the token itself is otherwise well-formed. This mechanism effectively "pins" the token to the client, ensuring that if the token is stolen, it cannot be used by any other entity that does not possess the matching private key. Nonce and State (Options A and C) are used during the initial authorization request for different security purposes (replay protection and CSRF), and while a JWK (Option B) can be used to define the public key, the actual presentation of proof during an mTLS transaction is the certificate.
NEW QUESTION # 16
......
Certainly you have heard of TorrentVCE Ping Identity PT-AM-CPE Dumps. But have you tried it? We often hear this, “TorrentVCE questions and answers are really good reference materials, thanks to the dumps, I pass my exam successfully.” TorrentVCE has been favourably commented by the people who used its questions and answers. This is because it can really help students to save a lot of time, and ensure that everyone pass the exam successfully.
Books PT-AM-CPE PDF: https://www.torrentvce.com/PT-AM-CPE-valid-vce-collection.html