We all know that the importance of the Certified Professional - PingAM Exam (PT-AM-CPE) certification exam has increased. Many people remain unsuccessful in its PT-AM-CPE exam because of using invalid PT-AM-CPE Practice Test material. If you want to avoid failure and loss of money and time, download actual PT-AM-CPE Questions of ValidBraindumps.
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
>> Valid PT-AM-CPE Test Pdf <<
It’s universally acknowledged that have the latest information of the exam is of great significance for the candidates. Our PT-AM-CPE study guide has the free update for365 days after the purchasing. Besides the PT-AM-CPE study guide is compiled by the experts of the industry who know the information of the exam center very clearly, and this PT-AM-CPE Study Guide will help you to have a better understanding of the exam, therefore you can pass the exam more easily.
NEW QUESTION # 50
Which statements are correct in relation to an OAuth2 token exchange impersonation pattern?
A) The client may want to act as the subject on another service.
B) The client is used by a subject to act on behalf of another subject.
C) The requested token exchange involves a subject token only.
D) The requested token exchange involves a subject and actor token.
Answer: A
Explanation:
In PingAM 8.0.2, the OAuth 2.0 Token Exchange (RFC 8693) supports two primary patterns: delegation and impersonation. Understanding the difference between these is critical for secure microservices architecture.
According to the "Demonstrate Impersonation" section of the PingAM documentation, impersonation is a pattern where a client (the "Actor") acts as another identity (the "Subject") in a way that the downstream resource server sees only the Subject's identity.
Statement A is correct: In an impersonation flow, the client (which has been authorized by the user or is a trusted service) requests a token where it effectively "becomes" the subject to interact with another service. The downstream service treats the request as if it were coming directly from the subject, often with the same set of permissions.
Statement D is correct: To perform a token exchange for impersonation, the client must provide specific parameters to the /oauth2/access_token endpoint. It provides the subject_token (representing the identity to be impersonated) and the actor_token (representing the identity of the client/service that is performing the impersonation). PingAM validates both tokens to ensure the "Actor" has the permission to impersonate the "Subject." Why other statements are incorrect: Statement B describes delegation (where an actor acts on behalf of a subject but maintains their own identity in the act claim). Statement C is incorrect because a token exchange inherently requires proving who the requester is (the actor) and whom they represent (the subject). Without both tokens, the AM server cannot verify the authorization relationship required for impersonation. Therefore, the combination of A and D accurately reflects the impersonation pattern in PingAM 8.0.2.
NEW QUESTION # 51
A customer wishes to customize the OpenID Connect (OIDC) id_token JSON Web Token (JWT) to include the subject's employee number. Which of the following scripts should be customized to meet this requirement?
Answer: B
Explanation:
In PingAM 8.0.2, the OpenID Connect (OIDC) Claims Script is the specific extensibility point designed to govern how user information is mapped and transformed into claims within an OIDC ID token or the UserInfo response. While PingAM supports standard scopes like profile and email out of the box, specialized business requirements-such as including an "employee number" which might be stored as employeenumber in an LDAP directory-require a custom transformation.
According to the "OIDC Claims Script" reference in the PingAM documentation:
The script acts as a bridge between the Identity Store (the source of truth) and the OIDC Provider (the issuer). When a client requests a token, PingAM executes this script, providing it with a claimObjects map and the userProfile. The developer can then write Groovy or JavaScript logic to retrieve the employeeNumber attribute from the user's profile and add it to the resulting claims set.
The script typically follows this logical flow:
Identify the requested claims from the OIDC scope.
Fetch the corresponding raw attributes from the Identity Store (e.g., PingDS or AD).
Format and name the claim as per the OIDC specification or the specific client requirement (e.g., mapping LDAP employeenumber to OIDC claim emp_id).
Return the claims to be signed and embedded into the JWT.
Why other options are incorrect: Options A, C, and D reference script types that do not exist under those specific names in the standard PingAM 8.0.2 scripting engine. While there are "Access Token Modification" scripts and "Client Registration" scripts, the OIDC Claims Script is the only one authorized and designed to manage the payload of the id_token.
NEW QUESTION # 52
When developing a PingAM may act script for OAuth2 token exchange patterns, which variables are made available for use in the script?
Answer: A
Explanation:
The OAuth2 May Act script type in PingAM 8.0.2 allows administrators to programmatically determine if a token exchange request (impersonation or delegation) should be allowed by adding a may_act claim to the token.
According to the "Scripting" and "Token Exchange Scripting API" documentation, when this script is executed, the AM engine provides a specific set of "Bindings" or variables. These allow the script to inspect the context of the request before deciding to modify the token. The documented variables for the OAuth2 May Act script are:
clientProperties: A map of the OAuth2 client's configuration properties.
identity: The identity object for the user/subject.
logger: The logging object for debugging within the script.
requestProperties: Properties of the incoming HTTP request.
scopes: The set of scopes requested or associated with the token.
scriptName: The name of the script being executed.
session: The user's SSO session (if available).
requestedToken: This is the most important variable; it represents the token being issued. Methods like .addMayAct() or .setMayAct() are called on this specific object.
Why other options are incorrect:
Option B correctly lists the bindings.
Options A and D are incorrect because they use the variable name token. While token is a common variable name in other OAuth2 script types (like the Access Token Modification script), the Token Exchange script specifically uses requestedToken to distinguish the new token from the subject_token or actor_token provided in the request.
Option C uses scopeList, which is not the standard variable name for the scopes in this specific script context; the documentation defines it as scopes.
NEW QUESTION # 53
What happens when an end user accesses the following login page: .../XUI/?ForceAuth=true#login?
Answer: A
Explanation:
The ForceAuth=true parameter is a standard directive used in various authentication protocols (specifically SAML2 and OIDC) and is natively supported by the PingAM 8.0.2 XUI (the modern End-User User Interface).
According to the "Authentication and SSO" documentation:
Normally, if a user has an active, valid session cookie (iPlanetDirectoryPro), and they navigate to the AM login URL, PingAM will recognize the session and automatically redirect the user to their destination (the "Success URL") without prompting for credentials. This is the core benefit of Single Sign-On.
However, when the ForceAuth=true parameter is appended to the query string, it instructs the PingAM authentication engine to bypass the session check for the purpose of re-authentication. The engine will:
Ignore the existing valid session cookie.
Force the user back to the login page (rendering the initial nodes of the configured authentication tree).
Require the user to provide their credentials again.
This is a critical security feature for high-value transactions. For instance, if a user is already logged in but attempts to change their bank transfer details, the application can redirect them to AM with ForceAuth=true to ensure the person sitting at the computer is indeed the authorized user. Option B is incorrect because ForceAuth only forces a re-authentication; whether that includes MFA depends on the tree configuration, not the parameter itself. Option C is incorrect as PingAM explicitly processes this parameter. Therefore, the primary outcome is the redirection to the login page regardless of the current session state.
NEW QUESTION # 54
A user's SSOTokenID is stored in a cookie when they successfully log in. What is the name of the PingAM property used to configure this cookie?
Answer: D
Explanation:
In PingAM 8.0.2, once a user successfully completes an authentication journey, the server issues a session token. For browser-based clients, this token is typically delivered via an HTTP cookie. The server-side property that defines the name of this specific cookie is com.iplanet.am.cookie.name.
According to the "Global Properties" and "System Configuration" documentation, this property is found under the Session service settings. By default, its value is set to iPlanetDirectoryPro (Option B). While iPlanetDirectoryPro is the default value of the cookie name, the question asks for the name of the property used to configure it.
Administrators often modify this property for security reasons to hide the fact that they are using PingAM or to avoid conflicts with other legacy systems. It is important to note that if this property is changed in the AM server, the corresponding configuration in all Policy Agents (Web or Java Agents) must also be updated to look for the new cookie name, otherwise, the agents will not be able to find the user's session and will redirect them to login repeatedly. Option D refers to an agent-side configuration key, but the central "Source of Truth" for the session cookie name within the AM platform is the server-side property com.iplanet.am.cookie.name.
NEW QUESTION # 55
......
ValidBraindumps Ping Identity PT-AM-CPE exam information is proven. We can provide the questions based on extensive research and experience. ValidBraindumps has more than 10 years experience in IT certification PT-AM-CPE exam training, including questions and answers. On the Internet, you can find a variety of training tools. ValidBraindumps PT-AM-CPE Exam Questions And Answers is the best training materials. We offer the most comprehensive verification questions and answers, you can also get a year of free updates.
Frenquent PT-AM-CPE Update: https://www.validbraindumps.com/PT-AM-CPE-exam-prep.html