Ping Identity PT-AM-CPE Certification Exam Dumps with 102 Practice Test Questions [Q43-Q58]

PT-AM-CPE Ping Identity

admin • September 12, 2026

Ping Identity PT-AM-CPE Certification Exam Dumps with 102 Practice Test Questions [Q43-Q58]

Rate this post

Ping Identity PT-AM-CPE Certification Exam Dumps with 102 Practice Test Questions

New PT-AM-CPE Exam Dumps with High Passing Rate

Ping Identity PT-AM-CPE Exam Syllabus Topics:

Topic	Details
Topic 1	Extending Services Using OAuth2-Based Protocols: This domain addresses integrating applications with OAuth 2.0 and OpenID Connect, securing OAuth2 clients with mutual TLS and proof-of-possession, transforming OAuth2 tokens, and implementing social authentication.
Topic 2	Improving Access Management Security: This domain focuses on strengthening authentication security, implementing context-aware authentication experiences, and establishing continuous risk monitoring throughout user sessions.
Topic 3	Federating Across Entities Using SAML2: This domain covers implementing single sign-on using SAML v2.0 and delegating authentication responsibilities between SAML2 entities.
Topic 4	Enhancing Intelligent Access: This domain covers implementing authentication mechanisms, using PingGateway to protect websites, and establishing access control policies for resources.
Topic 5	Installing and Deploying AM: This domain encompasses installing and upgrading PingAM, hardening security configurations, setting up clustered environments, and deploying PingOne Advanced Identity Platform to the cloud.

NEW QUESTION 43
Which statement does not reflect best practice when configuring a PingAM cluster for secure communication with external servers?

Create the new truststore as a copy of the JVM container truststore to isolate the PingAM truststore from changes to the JVM container’s truststore when the JVM container’s truststore is updated

Create a new truststore with the certificates needed in the environment, and configure the container to use it

Create a new truststore using a copy of the JVM container truststore and add the PingDS instances certificates to the new truststore

Don’t add PingDS instances certificates to the JVM container truststore

NEW QUESTION 44
If PingAM is deployed in Apache Tomcat under /openam, what file system backups should be taken when PingAM needs to be upgraded?

Back up /path/to/tomcat/webapps/openam/ only

No explicit backups are required for PingAM as this is done automatically

Back up /path/to/tomcat/webapps/openam/, <home directory>/openam/ and <home directory>/.openamcfg/

Execute the PingAM backup script in /path/to/tomcat/webapps/openam/

According to the PingAM 8.0.2 Upgrade Guide and the “Plan the upgrade” documentation, a successful upgrade and potential rollback strategy rely on capturing the complete state of the application across three distinct locations on the filesystem. When PingAM is deployed in a container like Apache Tomcat, the configuration is not stored within the WAR file itself but is distributed to maintain persistence across redeployments.
The three critical areas that must be backed up are:
The Web Application Directory (/path/to/tomcat/webapps/openam/): This contains the expanded binaries, JSPs, and web-level configurations. While the upgrade involves replacing the openam.war file, backing up this folder preserves any manual customizations made to the UI, CSS, or specific library additions (JARs) in the WEB-INF/lib folder.
The Configuration Directory (<home directory>/openam/ or similar): This is the most vital component. By default, PingAM stores its instance-specific configuration, cryptographic keys (keystores), and internal metadata here. For file-based configurations (FBC), this directory holds the entire system state. Even with an external PingDS configuration store, this directory contains the bootstrap file and security secrets required to connect to that store.
The Bootstrap Configuration File (<home directory>/.openamcfg/): This hidden directory contains a file (usually named after the deployment path, e.g., am or openam) that tells the PingAM binaries where the actual configuration directory is located. Without this pointer, a restored PingAM instance will behave like a fresh installation and prompt for a new setup.
The documentation explicitly warns: “Always back up your deployment before you upgrade… For AM servers, you can roll back by restoring from a file system backup of the deployed servers and their configuration directories.” Relying only on the webapps folder (Option A) or assuming automatic backups (Option B) will lead to data loss or an unrecoverable state.

NEW QUESTION 45
Consider the following LDAP connection string:
DS1.example.com:389|01, DS2.example.com:389|01, DS2.example.com:389|02, DS1.example.com:389|02 This connection string can be used in:
A . Identity Store
B . Core Token Service
C . Configuration Data Store
Which of the above options are correct?

Only A is correct

Only B is correct

Only C is correct

A, B, and C are correct

NEW QUESTION 46
If the session cookie is configured as a domain based cookie for the am.example.com domain, in which of the following domains is the cookie visible?
A . example.com
B . am.example.com
C . sub.am.example.com
D . login.am.example.com

B only

A and B

B and C

B and D

NEW QUESTION 47
Which statements are correct about PingAM sessions?
A) When a web browser is involved, the web browser is instructed to set a cookie as the session reference.
B) When no browser is involved, PingAM returns the session reference in the JSON response.
C) PingAM can only track the session in the Core Token Service store.
D) The default session cookie name created in a web browser is iPlanetDirectoryPro.

A, B, and D only

A, B, and C only

A, C, and D only

A and B only

NEW QUESTION 48
Which area of PingAM does affinity mode relate to?

Authentication

Load balancing

Self-service

Authorization

NEW QUESTION 49
In a default PingAM configuration, what type of keystore stores the secret ID named storepass, which contains the encrypted password of the default-keystore secret store?

Keystore secret store

Environment and system property secret store

Filesystem secret store

Hardware Security Module secret store

NEW QUESTION 50
What is the purpose of HTTP-only cookies?

Cookies can not be read by client-side scripts

Cookies can only be transmitted over HTTPS

Cookies can not be read by the server

Cookies can only be transmitted over HTTP

NEW QUESTION 51
Which of the following code examples inserts a may_act claim to the resulting token in a PingAM implementation?

var mayAct = /* is a JSON object with may act property data */ token.addMayAct(mayAct)

var mayAct = /* is a JSON object with may act property data */ requestedToken.addMayAct(mayAct)

var mayAct = /* is a JSON object with may act property data */ requestedToken.setMayAct(mayAct)

var mayAct = /* is a JSON object with may act property data */ token.setMayAct(mayAct)

NEW QUESTION 52
The OAuth2 authorize endpoint supports the CSRF parameter. What is CSRF?

Cross Script Response Feature

Cross Site Request Forgery

Cross System Rest Federation

NEW QUESTION 53
A non-authenticated user requests a resource protected by PingGateway or a Web Agent. Put the following events of the authentication lifecycle in chronological order:
User answers the “questions asked” (callbacks) by PingAM.
User tries to access a resource protected by PingGateway or a Web Agent.
Session reaches a timeout value or user logs out.
PingGateway or the Web Agent validates the session.
User is redirected to the authentication user interface of PingAM.
User is redirected to the resource.

2-1-4-3-5-6

2-5-1-6-4-3

2-5-1-6-3-4

2-1-5-6-4-3

NEW QUESTION 54
Which of the following best describes the relationship between users and realms?

A user can be a member of one or more realms

Users do not need to be a member of a realm

Users are never members of a realm

A user can be a member of exactly one realm

NEW QUESTION 55
Which of the following components is used to return data to PingGateway or the agent to be included with the policy decision?

Subjects

Resources

Response attributes

Actions

NEW QUESTION 56
When developing a PingAM may act script for OAuth2 token exchange patterns, which variables are made available for use in the script?

clientProperties, identity, logger, requestProperties, scopes, scriptName, session, token

clientProperties, identity, logger, requestProperties, scopes, scriptName, session, requestedToken

clientProperties, identity, logger, requestProperties, scopeList, scriptName, session, requestedToken

clientProperties, identity, logger, requestProperties, scopeList, scriptName, session, token

NEW QUESTION 57
Which set of Directory Server stores can be enabled for affinity in a PingAM cluster configuration?

Identity Store, Configuration Store, Policy Data Store, Application Data Store

Core Token Service Store, Identity Store, Policy Data Store, Application Data Store

Core Token Service Store, Identity Stores, Configuration Store, Application Data Store

Core Token Service Store, Identity Stores, Configuration Store, Policy Data Store

In a high-availability PingAM 8.0.2 cluster, Affinity Load Balancing is a mechanism used to ensure that requests related to a specific session or configuration are routed to the same Directory Server (DS) instance to avoid issues with replication lag. This is particularly important for stores where data changes frequently or where consistent reads are required immediately after a write.
According to the PingAM documentation on “Load Balancing” and “External Data Stores,” affinity can be configured for the following primary stores:
Core Token Service (CTS) Store: This is the most critical area for affinity. Since the CTS handles stateful data like session tokens and OAuth2 tokens that are updated constantly, ensuring that an AM server consistently communicates with a specific DS node (using the HOST:PORT|SERVERID|SITEID syntax) prevents “token not found” errors that might occur if a request reached a DS node before the token was replicated.
Configuration Store: This store holds the central configuration for the AM deployment. In multi-server environments, affinity ensures that configuration changes are read consistently across the cluster.
Identity Stores: These hold the user profiles. While often read-heavy, affinity is used here to improve caching efficiency and ensure that profile updates (like password changes or attribute updates) are reflected immediately in subsequent authentication steps within the same cluster.
Policy Data Store: This stores authorization policies. Similar to configuration, affinity ensures consistent policy evaluation.
Option D is the correct answer because it includes the Core Token Service, Identity Stores, Configuration Store, and Policy Data Store. The “Application Data Store” (mentioned in other options) is often logically grouped with or replaced by the Policy Data Store in many 8.0.2 configurations, but the four stores listed in Option D are the specific ones explicitly called out in the “External Data Stores” secondary configuration documentation for supporting affinity settings.

NEW QUESTION 58
What does the acronym SAML stand for?

Scoped Assertion Markup Language

Secure Assertion Markup Language

Security Assertion Markup Language

Strong Assertion Markup Language