2026 Latest BraindumpStudy PT-AM-CPE PDF Dumps and PT-AM-CPE Exam Engine Free Share: https://drive.google.com/open?id=16vTAdV9jbvSF-7sAne4b8bavljSFJB9X
You have the option to change the topic and set the time according to the actual Certified Professional - PingAM Exam (PT-AM-CPE) exam. The Certified Professional - PingAM Exam (PT-AM-CPE) practice questions give you a feeling of a real exam which boost confidence. Practice under real Certified Professional - PingAM Exam (PT-AM-CPE) exam situations is an excellent way to learn more about the complexity of the Certified Professional - PingAM Exam (PT-AM-CPE) exam dumps.
| Section | Weight | Objectives |
|---|---|---|
| Extending Services with OAuth 2.0 and OIDC | 17% | - Configure OAuth 2.0 authorization server and resource server - Manage scopes, claims and token policies - Implement OpenID Connect authentication flows |
| Enhancing Intelligent Access | 20% | - Define and manage access control policies - Implement authentication mechanisms - Use PingGateway to protect applications and resources |
| Federation with SAML 2.0 | 18% | - Manage trust relationships and attribute mapping - Implement SAML 2.0 single sign-on and single logout - Configure identity provider and service provider roles |
| Improving Security with Adaptive Authentication | 20% | - Monitor and enforce security policies during sessions - Configure context-aware and risk-based authentication - Implement multi-factor authentication flows |
| Installing, Deploying and Configuring PingAM | 25% | - Install, upgrade and migrate PingAM environments - Deploy to cloud and containerized environments - Harden security configurations and apply best practices - Configure high availability and clustered deployments |
>> Latest PT-AM-CPE Exam Question <<
Are you still worrying about how to safely pass Ping Identity certification PT-AM-CPE exams? Do you have thought to select a specific training? Choosing a good training can effectively help you quickly consolidate a lot of IT knowledge, so you can be well ready for Ping Identity certification PT-AM-CPE exam. BraindumpStudy's expert team used their experience and knowledge unremitting efforts to do research of the previous years exam, and finally have developed the best pertinence training program about Ping Identity Certification PT-AM-CPE Exam. Our training program can effectively help you have a good preparation for Ping Identity certification PT-AM-CPE exam. BraindumpStudy's training program will be your best choice.
NEW QUESTION # 58
A customer wishes to customize the OpenID Connect (OIDC) id_token JSON Web Token (JWT) to include the subject's employee number. Which of the following scripts should be customized to meet this requirement?
Answer: A
Explanation:
In PingAM 8.0.2, the OpenID Connect (OIDC) Claims Script is the specific extensibility point designed to govern how user information is mapped and transformed into claims within an OIDC ID token or the UserInfo response. While PingAM supports standard scopes like profile and email out of the box, specialized business requirements-such as including an "employee number" which might be stored as employeenumber in an LDAP directory-require a custom transformation.
According to the "OIDC Claims Script" reference in the PingAM documentation:
The script acts as a bridge between the Identity Store (the source of truth) and the OIDC Provider (the issuer). When a client requests a token, PingAM executes this script, providing it with a claimObjects map and the userProfile. The developer can then write Groovy or JavaScript logic to retrieve the employeeNumber attribute from the user's profile and add it to the resulting claims set.
The script typically follows this logical flow:
Identify the requested claims from the OIDC scope.
Fetch the corresponding raw attributes from the Identity Store (e.g., PingDS or AD).
Format and name the claim as per the OIDC specification or the specific client requirement (e.g., mapping LDAP employeenumber to OIDC claim emp_id).
Return the claims to be signed and embedded into the JWT.
Why other options are incorrect: Options A, C, and D reference script types that do not exist under those specific names in the standard PingAM 8.0.2 scripting engine. While there are "Access Token Modification" scripts and "Client Registration" scripts, the OIDC Claims Script is the only one authorized and designed to manage the payload of the id_token.
NEW QUESTION # 59
Why should module-based authentication be disabled in production?
Answer: A
Explanation:
In PingAM 8.0.2, there is a critical distinction between Tree-based (or Chain-based) authentication and Module-based authentication. Module-based authentication is a legacy feature that allows a user to target an individual authentication module directly (e.g., .../UI/Login?module=DataStore).
According to the "Security Considerations" and "Hardening PingAM" documentation, module-based authentication poses a significant security risk and should be disabled in production. This is because it allows a user to bypass steps in an authentication chain (Option C).
If an administrator has designed a secure "Chain" that requires both a DataStore (password) check AND a One-Time Password (MFA) check, the intention is for these to be inseparable. However, if module-based authentication is enabled, a malicious user or a tester could bypass the MFA requirement by crafting a URL that calls only the "DataStore" module. This effectively circumvents the multi-factor security logic intended by the administrator.
To mitigate this, PingAM provides a global and realm-level setting to "Disable Module-based Authentication." Once disabled, PingAM will only process authentication requests that target a named Authentication Tree or Chain, ensuring that the user is forced through the entire sequence of nodes and logic defined by the security architect.
NEW QUESTION # 60
A user's SSOTokenID is stored in a cookie when they successfully log in. What is the name of the PingAM property used to configure this cookie?
Answer: B
Explanation:
In PingAM 8.0.2, once a user successfully completes an authentication journey, the server issues a session token. For browser-based clients, this token is typically delivered via an HTTP cookie. The server-side property that defines the name of this specific cookie is com.iplanet.am.cookie.name.
According to the "Global Properties" and "System Configuration" documentation, this property is found under the Session service settings. By default, its value is set to iPlanetDirectoryPro (Option B). While iPlanetDirectoryPro is the default value of the cookie name, the question asks for the name of the property used to configure it.
Administrators often modify this property for security reasons to hide the fact that they are using PingAM or to avoid conflicts with other legacy systems. It is important to note that if this property is changed in the AM server, the corresponding configuration in all Policy Agents (Web or Java Agents) must also be updated to look for the new cookie name, otherwise, the agents will not be able to find the user's session and will redirect them to login repeatedly. Option D refers to an agent-side configuration key, but the central "Source of Truth" for the session cookie name within the AM platform is the server-side property com.iplanet.am.cookie.name.
NEW QUESTION # 61
In a multi-server deployment, what is the impact of not ensuring stickiness in the load balancer configuration?
Answer: B
Explanation:
In a high-availability PingAM 8.0.2 cluster, the Load Balancer (LB) is responsible for distributing traffic across multiple AM instances. Session Stickiness (also known as session affinity) ensures that all requests from a specific user session are routed to the same AM server that initially created the session.
According to the PingAM "Deployment Planning" and "Load Balancing" documentation, PingAM is designed to be "sticky-preferred" but not "sticky-required" if the Core Token Service (CTS) is used. If stickiness is not ensured:
Performance Impact: Every time a user request lands on a different AM server (Server B) than the one that holds the session in local memory (Server A), Server B must query the CTS (External Store) to retrieve the session details, deserialize the object, and reconstruct the session state. This cross-server look-up introduces significant latency and increases the load on the PingDS instances hosting the CTS.
CTS Load: Without stickiness, every single request becomes a "Global" session lookup. This drastically increases the I/O and CPU overhead on the back-end directory servers, potentially leading to performance degradation of the entire identity platform.
Why other options are incorrect:
Option A: Session failover requires the CTS, but stickiness actually minimizes the need for failover logic during normal operation. Failover still works without stickiness, it just becomes the "default" behavior for every request.
Option B: AM servers in a cluster share the same encryption keys and back-end stores. Any server can technically validate a session by looking it up in the CTS; the browser doesn't "know" which server is correct.
Option C: Redirects are handled at the application logic level. While some internal processing changes, it doesn't necessarily result in extra browser-level HTTP redirects.
Thus, the primary negative impact of lacking stickiness in a correctly configured cluster is a decrease in performance (Option D) due to the constant session synchronization overhead.
NEW QUESTION # 62
Which of the following code examples inserts a may_act claim to the resulting token in a PingAM implementation?
Answer: C
Explanation:
In PingAM 8.0.2, the OAuth 2.0 Token Exchange (RFC 8693) implementation allows for complex identity delegation scenarios. The may_act claim is a specific claim used to indicate that one entity is authorized to act on behalf of another. When customizing the behavior of token exchange via the OAuth2 Token Exchange Script, developers interact with specific scriptable objects provided by the PingAM engine.
According to the "Scripting API" for OAuth2 and the "Token Exchange" developer guide, the requestedToken object is the primary interface used to modify the structure of the token being issued during the exchange. To insert the may_act claim, the API provides the addMayAct() method.
The may_act claim is technically a JSON object that contains a sub (subject) claim of the entity that is allowed to act as the subject of the token. In the scripting environment:
The requestedToken variable represents the token currently being minted.
The .addMayAct() method is the defined function signature to append this delegation metadata.
Why other options are incorrect:
Options A and D: The object name token is not the standard binding used for the target token in the Token Exchange script context; requestedToken is the correct binding.
Option C: The method name setMayAct is incorrect. The PingAM API uses the add prefix for these types of claims (similar to addActor), reflecting the underlying structure where these claims are added to the claim set of the JWT.
Using the correct syntax requestedToken.addMayAct(mayAct) ensures that the resulting Access Token or ID Token contains the correctly formatted delegation information required by resource servers to validate that the "Actor" has the permission to represent the "Subject."
NEW QUESTION # 63
......
Our company is trying to satisfy every customer’s demand. Of course, we also attach great importance on the quality of our PT-AM-CPE real test. Every product will undergo a strict inspection process. In addition, there will have random check among different kinds of PT-AM-CPE Study Materials. The quality of our PT-AM-CPE exam quiz deserves your trust. Most of our customers are willing to introduce their friends to purchase our PT-AM-CPE learning dumps.
Test PT-AM-CPE Cram: https://www.braindumpstudy.com/PT-AM-CPE_braindumps.html
DOWNLOAD the newest BraindumpStudy PT-AM-CPE PDF dumps from Cloud Storage for free: https://drive.google.com/open?id=16vTAdV9jbvSF-7sAne4b8bavljSFJB9X