Free Oct-2026 PT-AM-CPE Dumps are Available for Instant Access [Q43-Q66]

Rate this post

Free Oct-2026 PT-AM-CPE Dumps are Available for Instant Access

View All PT-AM-CPE Actual Exam Questions Answers and Explanations for Free

Ping Identity PT-AM-CPE Exam Syllabus Topics:

Topic	Details
Topic 1	Improving Access Management Security: This domain focuses on strengthening authentication security, implementing context-aware authentication experiences, and establishing continuous risk monitoring throughout user sessions.
Topic 2	Federating Across Entities Using SAML2: This domain covers implementing single sign-on using SAML v2.0 and delegating authentication responsibilities between SAML2 entities.
Topic 3	Extending Services Using OAuth2-Based Protocols: This domain addresses integrating applications with OAuth 2.0 and OpenID Connect, securing OAuth2 clients with mutual TLS and proof-of-possession, transforming OAuth2 tokens, and implementing social authentication.
Topic 4	Installing and Deploying AM: This domain encompasses installing and upgrading PingAM, hardening security configurations, setting up clustered environments, and deploying PingOne Advanced Identity Platform to the cloud.
Topic 5	Enhancing Intelligent Access: This domain covers implementing authentication mechanisms, using PingGateway to protect websites, and establishing access control policies for resources.

Q43. Charlotte wants to query all the authentication tree configuration details in the alpha realm using an Amster command.7 After connecting to the PingAM instance in Amster, which command should Charlotte enter?

query AuthenticationTree –realm /alpha –query all

query AuthenticationTree –realm /alpha –filter true

query AuthTree –realm /alpha –filter true

query AuthTree –realm /alpha –query all

Q44. A user’s SSOTokenID is stored in a cookie when they successfully log in. What is the name of the PingAM property used to configure this cookie?

com.iplanet.am.cookie.name

iPlanetDirectoryPro

comIplanetAmSessionCookieName

com.sun.identity.agents.config.cookie.name

Q45. Which set of Directory Server stores can be enabled for affinity in a PingAM cluster configuration?

Identity Store, Configuration Store, Policy Data Store, Application Data Store

Core Token Service Store, Identity Store, Policy Data Store, Application Data Store

Core Token Service Store, Identity Stores, Configuration Store, Application Data Store

Core Token Service Store, Identity Stores, Configuration Store, Policy Data Store

In a high-availability PingAM 8.0.2 cluster, Affinity Load Balancing is a mechanism used to ensure that requests related to a specific session or configuration are routed to the same Directory Server (DS) instance to avoid issues with replication lag. This is particularly important for stores where data changes frequently or where consistent reads are required immediately after a write.
According to the PingAM documentation on “Load Balancing” and “External Data Stores,” affinity can be configured for the following primary stores:
Core Token Service (CTS) Store: This is the most critical area for affinity. Since the CTS handles stateful data like session tokens and OAuth2 tokens that are updated constantly, ensuring that an AM server consistently communicates with a specific DS node (using the HOST:PORT|SERVERID|SITEID syntax) prevents “token not found” errors that might occur if a request reached a DS node before the token was replicated.
Configuration Store: This store holds the central configuration for the AM deployment. In multi-server environments, affinity ensures that configuration changes are read consistently across the cluster.
Identity Stores: These hold the user profiles. While often read-heavy, affinity is used here to improve caching efficiency and ensure that profile updates (like password changes or attribute updates) are reflected immediately in subsequent authentication steps within the same cluster.
Policy Data Store: This stores authorization policies. Similar to configuration, affinity ensures consistent policy evaluation.
Option D is the correct answer because it includes the Core Token Service, Identity Stores, Configuration Store, and Policy Data Store. The “Application Data Store” (mentioned in other options) is often logically grouped with or replaced by the Policy Data Store in many 8.0.2 configurations, but the four stores listed in Option D are the specific ones explicitly called out in the “External Data Stores” secondary configuration documentation for supporting affinity settings.

Q46. Which statements are correct about PingAM sessions?
A) When a web browser is involved, the web browser is instructed to set a cookie as the session reference.
B) When no browser is involved, PingAM returns the session reference in the JSON response.
C) PingAM can only track the session in the Core Token Service store.
D) The default session cookie name created in a web browser is iPlanetDirectoryPro.

A, B, and D only

A, B, and C only

A, C, and D only

A and B only

Q47. Which area of PingAM does affinity mode relate to?

Authentication

Load balancing

Self-service

Authorization

Q48. When defining a policy and specifying a resource pattern, which of the following statements is true concerning the difference between the wildcards * and -*-?

The wildcard * will match query parameters, whereas -*- will not match query parameters.

The wildcard * will match multiple levels in a path, whereas -*- will match only a single level

The wildcard * and the wildcard -*- can be mixed liberally within the same pattern

Neither the * wildcard nor the -*- wildcard can be used to match the port number

Q49. An administrator has a requirement to reconfigure the attribute used to search for users in a LDAP Data Store. What Data Store configuration attribute would they need to change?

LDAP Users Search Attribute

LDAP Users Index Attribute

LDAP Users Bind Attribute

LDAP Users Find Attribute

Q50. Which authentication nodes can be used for risk analysis related to device context?
A) Device Profile Collector node1
B) Device GeoFencing node2
C) Device Profile Save node3
D) Device Tampering Verification node
E) Device Location Match node4
F) Device Match node
Multiple Choice Options:

A, B, C, and D

B, D, E, and F

B, C, D, and F

A, C, D, and E

Q51. To ensure the user’s full name is displayed on the consent screen for an OpenID Connect application, which string should be added into the Support Claims property on the OpenID Connect tab page of the OAuth2 Provider service in PingAM?

name|en|Full name

Full name|en|name

full_name|Full name

name|en|given_name+’ ‘+family_name

Q52. What is the Default Failure Login URL?

It is the default value of the gotoOnFail parameter

It is the URL where users are redirected by default in case of failed authentication

It is the URL value that is populated automatically when adding a Failure URL node to a tree

It is the default URL of the page that displays authentication error messages

Q53. When developing a PingAM may act script for OAuth2 token exchange patterns, which variables are made available for use in the script?

clientProperties, identity, logger, requestProperties, scopes, scriptName, session, token

clientProperties, identity, logger, requestProperties, scopes, scriptName, session, requestedToken

clientProperties, identity, logger, requestProperties, scopeList, scriptName, session, requestedToken

clientProperties, identity, logger, requestProperties, scopeList, scriptName, session, token

Q54. In a default PingAM configuration, what type of keystore stores the secret ID named storepass, which contains the encrypted password of the default-keystore secret store?

Keystore secret store

Environment and system property secret store

Filesystem secret store

Hardware Security Module secret store

Q55. Which is the correct simplified TLS handshake sequence needed to authenticate clients using a mutual TLS exchange?

1. Client sends a request to a server to establish a secure connection
2. The server requests the client certificate
3. The client sends its certificate and the session key to the server
4. The server sends its certificate to the client if the client certificate and key are valid
5. The mutually secure connection is established and the client is authenticated

1. Client sends a request to a server to establish a secure connection
2. The client sends its certificate to the server
3. The server presents its certificate in a response to the client
4. The client sends its session key to the server
5. The mutually secure connection is established and the client is authenticated

1. Client sends a certificate in the request to a server to establish a secure connection
2. The client sends its session key to the server
3. The server presents its certificate in a response to the client
4. The mutually secure connection is established and the client is authenticated

1. Client sends a request to a server to establish a secure connection
2. The server presents its certificate in a response to the client
3. The client sends its certificate to the server
4. The mutually secure connection is established and the client is authenticated

Q56. When removing a forgeops deployment created with the Cloud Developer Kit (CDK) with the following command:
$ /path/to/forgeops/bin/forgeops delete
What components are removed from the deployment?

The Ping Identity Platform (CDK artifacts, PVCs, and the Access Management and Identity Management configurations) and ingress controller pods

The Ping Identity Platform (CDK artifacts, PVCs, and the Access Management and Identity Management configurations), certificate manager, and secret agent pods

The Ping Identity Platform (CDK artifacts, PVCs, and the Access Management and Identity Management configurations), ingress controller, DS operator, certificate manager, and secret agent pods

The Ping Identity Platform (CDK artifacts, PVCs, and the Access Management and Identity Management configurations) pods

Q57. What is the purpose of HTTP-only cookies?

Cookies can not be read by client-side scripts

Cookies can only be transmitted over HTTPS

Cookies can not be read by the server

Cookies can only be transmitted over HTTP

Q58. To protect against cross-site request forgery attacks, a default PingAM installation requires that some requests, such as POST requests, include:

X-OpenAM-Password header

If-Match: _rev header

X-Requested-With or Accept-API-Version header

X-OpenAM-Username header

Q59. Sam wants to start a service provider-initiated single sign-on and redirect to their own application, myapp.com. Which of the following URLs is the correct one to perform this action?

http://sso.domain.com/openam/saml2/jsp/idpSSOInit.jsp&RelayState=http%3A%2F%2Fmyapp.com

http://sso.domain.com/openam/saml2/jsp/idpSSOInit.jsp&goto=http%3A%2F%2Fmyapp.com

http://sso.domain.com/openam/saml2/jsp/spSSOInit.jsp&goto=http%3A%2F%2Fmyapp.com

http://sso.domain.com/openam/saml2/jsp/spSSOInit.jsp&RelayState=http%3A%2F%2Fmyapp.com

Q60. What should be executed to ensure a successful upgrade when PingAM requires a version upgrade?

Post-upgrade, run a set of functional tests

Post-upgrade, run a set of functional and non-functional tests

Post-upgrade, run a set of non-functional tests

Post-upgrade, set the PingAM Version Control Flag to the correct version

Q61. A PingAM administrator wants to deny access to an area of a protected application if the end user has been logged in for more than 10 minutes. How can this be achieved?

Use a policy with a Time environment condition

Use a policy with a Current session properties environment condition

Use a policy with a Scripted environment condition

Use a policy with an Active session time environment condition

Q62. Which organization sets, maintains, and governs the SAML2 standard?

WC3

IETF

OASIS

ISC2

Q63. Which audit event handler is used by PingAM by default, when audit logging is enabled?

Elasticsearch audit event handler

CSV audit event handler

Syslog audit event handler

JSON audit event handler

Q64. When making a token exchange request for an ID token using the /oauth2/access_token endpoint, what is the value for the grant_type parameter?

urn:ietf:params:oidc:grant-type:token-exchange

urn:ietf:params:oauth2:grant-type:token-exchange

urn:ietf:params:oauth:grant-type:token-exchange

urn:ietf:params:oauth:grant-type:idtoken-exchange

Q65. In a PingAM cluster, how is the debug level set?

On each server in the debug.properties file

On a per-instance basis in the admin console

On a per-site basis in the admin console

It is not recommended to change the level at all

Q66. Which of the following needs to be configured in order to use social authentication in PingAM?

A data store

A realm service

An OAuth2 client

A realm policy

The Most In-Demand PT-AM-CPE Pass Guaranteed Quiz : https://www.real4dumps.com/PT-AM-CPE_examcollection.html

Free Oct-2026 PT-AM-CPE Dumps are Available for Instant Access [Q43-Q66]

Ping Identity PT-AM-CPE Exam Syllabus Topics:

Leave a Reply Cancel reply