2026 Latest PassTestking PT-AM-CPE PDF Dumps and PT-AM-CPE Exam Engine Free Share: https://drive.google.com/open?id=16fkKXa4X14dMZITLsVzdYv8Njhy1NXVQ
Use this PT-AM-CPE practice material to ensure your exam preparation is successful. Mock exams at PassTestking are available in PT-AM-CPE desktop software and web-based format. Bothย Ping Identity PT-AM-CPEย self-assessment exams have similar features. They create an Ping Identity PT-AM-CPE actual test-like scenario, point out your mistakes, and offer customizable sessions.
| Section | Weight | Objectives |
|---|---|---|
| Topic 1: Extending Services Using OAuth2-Based Protocols | 35% | - OAuth2 configuration - Token endpoint configuration - Scope management - API integration - Third-party application integration - Authorization flow troubleshooting |
| Topic 2: Improving Access Management Security | 35% | - Password policy enforcement - Authentication methods - Multi-factor authentication implementation - Suspicious access pattern response - Session management - Threat detection |
| Topic 3: Enhancing Intelligent Access | 30% | - Device posture evaluation - Contextual access decisions - Dynamic policy configuration - Risk signals integration |
>> PT-AM-CPE Pass Test Guide <<
The Ping Identity PT-AM-CPE certification exam is one of the top-rated career booster certifications in the market. This Certified Professional - PingAM Exam (PT-AM-CPE) certification offers a great opportunity for Ping Identity aspirants to validate their skills and knowledge. By doing this they can gain several personal and professional benefits. These PT-AM-CPE Certification benefits help them not only prove their expertise but also enable them to gain multiple career opportunities in the highly competitive market.
NEW QUESTION # 100
Which of the following are existing script types in PingAM?
A) Decision node script for authentication trees
B) End User user interface theme script
C) OpenID Connect claims script
D) Policy condition script
Answer: B
Explanation:
PingAM 8.0.2 is highly extensible through its Scripting Engine, which supports Groovy and JavaScript. However, scripts can only be applied to specific "hooks" or "extension points" defined by the platform.
According to the "Scripting" and "Script Types" reference in the PingAM 8.0.2 documentation, the standard supported script types are:
Decision node script (A): Used within Authentication Trees via the "Scripted Decision Node." These scripts allow for complex logic, such as checking user attributes, calling external APIs, or evaluating risk before deciding which path a user should take in their journey.
OpenID Connect claims script (C): This script type is used to customize the claims returned in OIDC ID Tokens or at the UserInfo endpoint. It allows administrators to transform internal LDAP attributes into the specific JSON format required by OIDC clients.
Policy condition script (D): Used within Authorization Policies. These scripts define custom logic for granting or denying access (e.g., "Allow access only if the user is connecting from a specific IP range and it is between 9 AM and 5 PM").
Why Statement B is incorrect: There is no such thing as an "End User user interface theme script" in the PingAM scripting engine. UI customization (Themeing) in PingAM 8.0.2 is handled through the XUI framework using CSS, HTML templates, and configuration JSON files, or by building a custom UI using the Ping SDKs. It does not use the server-side Groovy/JavaScript scripting engine that governs authentication and authorization logic. Therefore, the valid script types are A, C, and D, making Option D the correct choice.
NEW QUESTION # 101
Examine the following JWT client assertion in JSON format. From the subset of claims listed below, which claim can be optional?
JSON
JSON
{
"iss": "myClient",
"sub": "myClient",
"aud": "https://am.example.com/login/oauth2/access_token",
"jti": "id012345",
"exp": 1633363568,
"iat": 1633356368
}
Answer: C
Explanation:
When an OAuth2 client uses Private Key JWT or Client Secret JWT for authentication at the PingAM 8.0.2 token endpoint, it must present a JWT (JSON Web Token) containing specific claims that identify and authorize the client. This is governed by the OIDC and OAuth2 JWT Profile specifications (RFC 7523).
According to the PingAM documentation on "OAuth 2.0 Client Authentication" and the "JWT Profile for Client Authentication":
iss (Issuer): Mandatory. This must be the client_id of the OAuth2 client.
sub (Subject): Mandatory. This must also be the client_id of the OAuth2 client (as the client is the subject of the authentication).
aud (Audience): Mandatory. This must be the URL of the PingAM OAuth2 service (the token endpoint) or the issuer URL.
exp (Expiration Time): Mandatory. This protects against the long-term use of intercepted assertions.
The jti (JWT ID) (Option A) provides a unique identifier for the token. In the context of standard JWT validation, jti is used to prevent replay attacks by ensuring that a specific token is only processed once. While highly recommended for security hardening, the PingAM 8.0.2 technical reference for OAuth2 client assertions marks jti as optional unless the server is explicitly configured to require it for replay detection. Without a jti, PingAM will still validate the iss, sub, aud, and exp claims to authenticate the client. Therefore, among the choices provided, jti is the claim that can be omitted without inherently violating the base OAuth2 JWT authentication request requirements.
NEW QUESTION # 102
Which PingAM feature only uses the PingAM keystore?
Answer: A
Explanation:
In PingAM 8.0.2, the management of cryptographic material has evolved toward the Secret Store framework, which allows secrets to be stored in various locations (Filesystem, HSM, or Environment Variables). However, for specific core features, the internal PingAM keystore (historically keystore.jks) remains the primary repository for the keys used to protect session integrity.
According to the "Client-side Session Security" documentation, when a realm is configured for Client-side sessions, the entire state of the user's session is encapsulated within a signed and encrypted JSON Web Token (JWT). This JWT is then stored in the user's browser cookie. To ensure that this token cannot be tampered with or read by unauthorized parties, PingAM must sign and encrypt the payload. The AM engine is hardcoded to look for the specific aliases (such as am.services.session.encryption and am.services.session.signing) within the default-keystore secret store, which points directly to the PingAM keystore.
While other features like OAuth2 providers (Option D) and the Persistent Cookie node (Option B) utilize secret stores, they are designed to be highly flexible and can be configured to use keys from any defined secret store in the realm. Authentication trees (Option C) are logical constructs and do not "use" the keystore directly, although individual nodes within a tree might. The distinction for Client-side sessions is that the feature's fundamental security model is built specifically around the cryptographic keys managed within the AM keystore to provide "stateless" session management. Administrators must ensure that the same keystore and aliases are shared across all nodes in a cluster to allow any AM instance to validate a client-side session token issued by another node.
NEW QUESTION # 103
What is the purpose of the extended metadata in PingAM?
Answer: D
Explanation:
In SAML 2.0 Federation, there is a standard XML schema (defined by OASIS) that all vendors use to describe an Identity Provider (IdP) or Service Provider (SP). This is known as "Standard Metadata." However, standard metadata does not include every configuration option required to run a sophisticated Access Management server.
PingAM 8.0.2 uses Extended Metadata to store implementation-specific settings that fall outside the OASIS SAML 2.0 specification. According to the "SAML 2.0 Guide," extended metadata is stored as a separate configuration file (or JSON entry in newer versions) and includes parameters such as:
Identity Store Mapping: Which attribute in the local datastore matches the SAML NameID.
Session Information: How AM should handle the session lifecycle after a successful SAML assertion.
Attribute Mapping: Detailed instructions on how to transform local LDAP attributes into SAML attributes (and vice versa).
Authentication Trees: Which specific tree should be triggered when a request arrives at the IdP.
Option D is the correct description. Option C is incorrect because extended metadata is not a standard way to communicate features; in fact, other SAML products (like ADFS or Okta) cannot read or process PingAM's extended metadata. Option A is incorrect because basic certificates/keys are usually part of the standard metadata (KeyDescriptor), and Option B is incorrect because SAML federation usually triggers authentication journeys or attribute mapping rather than a standard authorization "policy."
NEW QUESTION # 104
Which of the following would be a possible combination of fields in the JSON body when making a policy evaluation via REST?
Answer: C
Explanation:
In PingAM 8.0.2, requesting policy decisions via the REST API involves sending a POST request to the policies endpoint with the _action=evaluate parameter. To receive an accurate decision, the request body must provide the context of the access attempt.
According to the "Request policy decisions over REST" documentation, the JSON body typically includes the following core fields:
resources: (Required) An array of strings representing the URIs the user is attempting to access.
application: (Required) This field specifies the name of the Policy Set (formerly known as the application) that contains the relevant policies for the evaluation.
subject: (Optional, but usually required for user-specific policies) This object identifies the user or entity requesting access. It can include the user's ssoToken or a set of claims if using JWT-based subjects.
Why other options are incorrect: Advices (Options A and C) are not inputs for a policy evaluation request. Instead, advices are returned by PingAM in the response if a policy condition fails (e.g., an AuthLevelConditionAdvice requesting the user to provide MFA). A request cannot "evaluate" an advice; it triggers one. Option D is incorrect because the resources field is a mandatory requirement for any evaluation; without a target resource, the engine has nothing to compare against the defined policy rules. Therefore, the combination of resources, subject, and application represents the standard, valid structure for a policy decision request in PingAM 8.0.2.
NEW QUESTION # 105
......
You may worry that you still fail PT-AM-CPE exam although you have made full preparation for the exam; or you may afraid that the exam software you purchased is not right for you. Our PT-AM-CPE exam software developed by our PassTestking will clear your worries. Our PT-AM-CPE exam software will provide two level of insurance for you: the first is the reassuring high pass rate; the second is full refund of your cost you purchased our exam software. Don't worry, if you fail PT-AM-CPE Exam with our software, we will refund the money you purchased our dumps. What you do is to prepare for the exam confidently, and our PassTestking will be in charge of other issues.
Testking PT-AM-CPE Exam Questions: https://www.passtestking.com/Ping-Identity/PT-AM-CPE-practice-exam-dumps.html
P.S. Free 2026 Ping Identity PT-AM-CPE dumps are available on Google Drive shared by PassTestking: https://drive.google.com/open?id=16fkKXa4X14dMZITLsVzdYv8Njhy1NXVQ