BONUS!!! Download part of PassCollection PT-AM-CPE dumps for free: https://drive.google.com/open?id=1SNJ_Cyyr0q64lYEXxW-FiKarQ3T9t8bD
Perhaps you still cannot believe in our Ping Identity PT-AM-CPE study materials. You can browser our websites to see other customers real comments. Almost all customers highly praise our Ping Identity PT-AM-CPE Exam simulation. In short, the guidance of our PT-AM-CPE practice questions will amaze you. Put down all your worries and come to purchase our PT-AM-CPE learning quiz!
| Certification Vendor: | Ping Identity |
|---|---|
| Exam Name: | Ping Identity Certified Professional - PingAM Exam |
| Exam Number: | PT-AM-CPE |
| Exam Format: | Multiple choice, Scenario-based questions |
| Available Languages: | English |
| Related Certifications: | Ping Identity Certified Professional - PingDirectory Ping Identity Certified Professional - PingFederate |
| Sample Questions: | Ping Identity PT-AM-CPE Sample Questions |
| Exam Way: | Proctored online or authorized testing center (varies by region and delivery provider) |
| Pre Condition: | Recommended prior experience with identity and access management concepts and Ping Identity products. No strict mandatory prerequisites published. |
>> PT-AM-CPE Latest Exam Price <<
Since the PT-AM-CPE study quiz is designed by our professionals who had been studying the exam all the time according to the changes of questions and answers. Our PT-AM-CPE simulating exam is definitely making your review more durable. To add up your interests and simplify some difficult points, our experts try their best to simplify our PT-AM-CPE Study Material and help you understand the learning guide better.
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
NEW QUESTION # 50
What scope is required to be included in a client's request if you wish to utilize the OpenID Connect capabilities of PingAM's OAuth2 implementation?
Answer: A
Explanation:
PingAM 8.0.2 implements OpenID Connect (OIDC) 1.0 as an identity layer on top of the OAuth 2.0 protocol. While OAuth 2.0 is designed for authorization (accessing resources), OIDC is designed for authentication (verifying who the user is).
According to the "OpenID Connect 1.0" documentation in PingAM, the presence of a specific scope in the Authorization Request is what signals to the AM server that the request should be treated as an OIDC flow rather than a standard OAuth2 flow. This mandatory scope is openid.
When PingAM receives an /oauth2/authorize request containing the scope=openid parameter:
It triggers the OIDC processing logic.
It ensures that an ID Token (a signed JWT containing user identity information) is generated alongside (or instead of) the Access Token.
It allows the client to later access the UserInfo Endpoint to retrieve further claims about the authenticated user.
Other scopes like profile (Option A), email, or address are optional OIDC scopes used to request specific sets of user claims, but they do not "activate" OIDC on their own. openid+connect and id (Options B and D) are not recognized standard scopes in the OIDC specification. Therefore, openid is the fundamental requirement for any OIDC interaction in PingAM 8.0.2.
NEW QUESTION # 51
Which of the following best describes the relationship between users and realms?
Answer: D
Explanation:
In PingAM 8.0.2, Realms are the primary organizational units used to group configuration, policies, and identities.13 A common misconception is that a user is "locked" into a single realm. However, according to the "Realms" and "Identity Stores" documentation, the relationship is highly flexible.
A Realm does not actually "contain" users in a physical sense; instead, a realm is configured with one or more Identity Stores (such as an LDAP directory or a database). Multiple realms can be configured to point to the same underlying Identity Store. Therefore, if a user profile exists in an LDAP directory that is shared by "Realm A" and "Realm B," that user is effectively a member of both realms. They can authenticate to either realm and receive different policies or session properties based on the realm-specific configuration.
Key points from the documentation:
Logical Partitioning: Realms provide a way to apply different authentication logic (different trees) to the same set of users.14 Multi-tenancy: An organization can create separate realms for different departments or customer groups, even if they overlap in the back-end user database.
Identity Store Mapping: Because a realm maps to an identity store, and an identity store can be reused across realms, a user's membership is determined by where the realm is "looking" for data.
Thus, Option A is the correct description of the architecture: a user can be a member of one or more realms depending on how the administrator has mapped the identity repositories.
Would you like me to proceed with more questions, or would you like to focus on a specific area such as OAuth2 Grant Flows?
NEW QUESTION # 52
Which of the following are existing script types in PingAM?
A) Decision node script for authentication trees
B) End User user interface theme script
C) OpenID Connect claims script
D) Policy condition script
Answer: A
Explanation:
PingAM 8.0.2 is highly extensible through its Scripting Engine, which supports Groovy and JavaScript. However, scripts can only be applied to specific "hooks" or "extension points" defined by the platform.
According to the "Scripting" and "Script Types" reference in the PingAM 8.0.2 documentation, the standard supported script types are:
Decision node script (A): Used within Authentication Trees via the "Scripted Decision Node." These scripts allow for complex logic, such as checking user attributes, calling external APIs, or evaluating risk before deciding which path a user should take in their journey.
OpenID Connect claims script (C): This script type is used to customize the claims returned in OIDC ID Tokens or at the UserInfo endpoint. It allows administrators to transform internal LDAP attributes into the specific JSON format required by OIDC clients.
Policy condition script (D): Used within Authorization Policies. These scripts define custom logic for granting or denying access (e.g., "Allow access only if the user is connecting from a specific IP range and it is between 9 AM and 5 PM").
Why Statement B is incorrect: There is no such thing as an "End User user interface theme script" in the PingAM scripting engine. UI customization (Themeing) in PingAM 8.0.2 is handled through the XUI framework using CSS, HTML templates, and configuration JSON files, or by building a custom UI using the Ping SDKs. It does not use the server-side Groovy/JavaScript scripting engine that governs authentication and authorization logic. Therefore, the valid script types are A, C, and D, making Option D the correct choice.
NEW QUESTION # 53
Which feature of PingAM protects against cookie hijacking in a cross-domain single sign-on environment?
Answer: B
Explanation:
In a Cross-Domain Single Sign-On (CDSSO) environment, PingAM must manage session cookies across multiple distinct DNS domains.2 By default, a standard SSO token could potentially be stolen and reused by a malicious actor to gain access to other domains within the same realm.3 To mitigate this specific threat, PingAM 8.0.2 utilizes Restricted Tokens.4 According to the documentation on "Securing CDSSO session cookies," a restricted token is a unique SSO token issued for each specific application or policy agent after successful user authentication.5 When CDSSO is active with cookie hijacking protection enabled, PingAM issues a "master" SSO token for the domain where AM resides and separate restricted tokens for the other fully qualified domain names (FQDNs) where web or Java agents are located.6 The restricted token is "restricted" because it is inextricably linked to the specific agent and application that initiated the redirection. Internally, AM stores a correlation between the master session and these restricted tokens.7 If an attacker attempts to hijack a restricted token and use it to access a different application or a different domain, the AM server performs a validation check on the constraint associated with the token (such as the agent's DN or IP). If the request does not originate from the authorized entity, a security violation is triggered, and access is denied. This mechanism ensures that even if a cookie is stolen in one domain, its utility is confined strictly to that domain and cannot be used for "lateral movement" across the enterprise's other protected resources. It is important to note that restricted tokens require server-side sessions to function; they are not supported for client-side (JWT-based) sessions.8
NEW QUESTION # 54
Which statements are correct in relation to an OAuth2 token exchange impersonation pattern?
A) The client may want to act as the subject on another service.
B) The client is used by a subject to act on behalf of another subject.
C) The requested token exchange involves a subject token only.
D) The requested token exchange involves a subject and actor token.
Answer: D
Explanation:
In PingAM 8.0.2, the OAuth 2.0 Token Exchange (RFC 8693) supports two primary patterns: delegation and impersonation. Understanding the difference between these is critical for secure microservices architecture.
According to the "Demonstrate Impersonation" section of the PingAM documentation, impersonation is a pattern where a client (the "Actor") acts as another identity (the "Subject") in a way that the downstream resource server sees only the Subject's identity.
Statement A is correct: In an impersonation flow, the client (which has been authorized by the user or is a trusted service) requests a token where it effectively "becomes" the subject to interact with another service. The downstream service treats the request as if it were coming directly from the subject, often with the same set of permissions.
Statement D is correct: To perform a token exchange for impersonation, the client must provide specific parameters to the /oauth2/access_token endpoint. It provides the subject_token (representing the identity to be impersonated) and the actor_token (representing the identity of the client/service that is performing the impersonation). PingAM validates both tokens to ensure the "Actor" has the permission to impersonate the "Subject." Why other statements are incorrect: Statement B describes delegation (where an actor acts on behalf of a subject but maintains their own identity in the act claim). Statement C is incorrect because a token exchange inherently requires proving who the requester is (the actor) and whom they represent (the subject). Without both tokens, the AM server cannot verify the authorization relationship required for impersonation. Therefore, the combination of A and D accurately reflects the impersonation pattern in PingAM 8.0.2.
NEW QUESTION # 55
......
Latest PT-AM-CPE Test Objectives: https://www.passcollection.com/PT-AM-CPE_real-exams.html
BTW, DOWNLOAD part of PassCollection PT-AM-CPE dumps from Cloud Storage: https://drive.google.com/open?id=1SNJ_Cyyr0q64lYEXxW-FiKarQ3T9t8bD