Quiz PAP-001: Ping Identity Certified Professional - PingAccess

The admin.auth setting in the run.properties file is used to specify a fallback authentication method
for the administrative console.
Exact Extract from official documentation:
“To define a fallback administrator authentication method if the OIDC token provider is unreachable,
enable the admin.auth=native property in the run.properties file. This overrides any configured
administrative authentication to basic authentication.”
This makes it clear that the purpose of admin.auth is to override any configured SSO for the admin UI
and enforce native (basic) authentication instead.
Option A is incorrect because the admin.auth setting does not configure SSO. SSO for the admin UI is
configured separately.
Option B is incorrect because this setting does not apply to the administrative API; it specifically
applies to the admin UI console.
Option C is correct because it directly reflects the documented behavior: admin.auth overrides SSO
configuration for the administrative UI and enables native authentication.
Option D is incorrect because the setting does not enable automatic authentication. It still requires
credentials, but falls back to basic auth.
Reference: PingAccess User Interface Reference Guide – Configuring Admin UI SSO Authentication

Exact Extract (from PingAccess documentation):
“The key pair that you create for the CONFIG QUERY listener must include both the administrative
node and the replica administrative node. To make sure the replica administrative node is included,
you can either use a wildcard certificate or define subject alternative names in the key pair that use
the replica administrative node’s DNS name.”
Why B and D are correct:
*B . Subject = .company.com — A wildcard certificate for *.company.com is valid for both pa-
admin.company.com and pa-admin2.company.com, satisfying the documented requirement that the
key pair include both hostnames for the CONFIG QUERY listener.
D . Subject Alternative Names = pa-admin.company.com, pa-admin2.company.com — Explicitly
placing both DNS names in the SAN extension also satisfies the requirement that the certificate cover
both the administrative node and the replica administrative node.
Why the other options are incorrect:
A . Issuer = pa-admin.company.com — The Issuer field identifies the certificate authority (CA) that
signed the certificate, not the service hostname. Setting the issuer to a host value is not how X.509
server certificates are validated and would not meet the hostname matching requirement.
C . Subject = pa-admin.company.com — While this covers the administrative node, it does not
include the replica administrative node. Without a wildcard or SAN entries, it fails the requirement
that the key pair include both hostnames.
E . Subject = pa-admin2.company.com — Similarly, this would only cover the replica administrative
node and not the primary administrative node, failing the requirement.
Reference:
Configuring replica administrative nodes (PingAccess User Interface Reference Guide)
Configuring a PingAccess cluster (PingAccess documentation)
Certificates (PingAccess User Interface Reference Guide)

When upgrading a PingAccess cluster, the Admin Console node must always be upgraded first before
any replica admin or engine nodes. This ensures that the configuration and schema changes
introduced in the new version are properly applied and replicated.
Exact Extract (from PingAccess documentation):
“In a clustered environment, you must first upgrade the administrative console node before
upgrading any replica administrative nodes or engine nodes.”
Why A is correct:
A . Upgrade the Admin Console — This is correct because the admin console node acts as the
configuration master in a PingAccess cluster. Upgrading it first ensures the new version schema is
available to replicas and engines.
Why the other options are incorrect:
B . Disable cluster communication — This is not required for standard upgrades. Cluster
communication remains in place to synchronize changes after the upgrade.
C . Disable Key Rolling — Key rolling is unrelated to the upgrade process. It is a feature used for key
rotation, not version upgrades.
D . Upgrade the Replica Admin — This is incorrect because upgrading a replica admin before the
primary administrative console is against the documented procedure and would cause replication
issues.
Reference:
Upgrading PingAccess in a Clustered Environment (PingAccess Upgrade Guide)
PingAccess Administration Guide – Upgrade Process

PingAccess uses Identity Mappings to take identity attributes provided by the authentication source
(e.g., PingFederate, OpenID Connect) and map them into HTTP request headers for back-end
applications.
Exact Extract:
“An identity mapping allows you to map identity attributes from the user’s session to HTTP headers,
cookies, or query parameters that are then forwarded to the target application.”
Option A (Site Authenticators) is incorrect because Site Authenticators configure how PingAccess
communicates with applications requiring authentication, not how attributes are inserted into
headers.
Option B (Identity Mappings) is correct — this is the feature designed specifically to expose user
attributes to applications via HTTP headers.
Option C (Web Sessions) manages how sessions are stored and validated, but not the mapping of
attributes into requests.
Option D (HTTP Requests) refers to request/response processing rules, but attributes are not mapped
here.
Reference: PingAccess Administration Guide – Identity Mapping

PingAccess allows fine-grained authentication enforcement by applying Authentication Requirement
rules at the resource level. These rules can invoke MFA flows based on request context or policy.
Exact Extract:
“Authentication requirement rules determine whether PingAccess challenges a user to authenticate
again (for example, with MFA) before allowing access to a protected resource.”
Option A is incomplete. Creating a requirement does nothing unless it is applied.
Option B is correct because applying the Authentication Requirement rule to the specific resource
(URL) enforces MFA only for that resource.
Option C is incorrect; Web Session Attribute rules are about evaluating existing session attributes,
not triggering MFA.
Option D is incorrect; HTTP Request Parameter rules are used to evaluate request data, not enforce
MFA policies.
Reference: PingAccess Administration Guide – Authentication Requirements

The correct way to ensure resources such as CSS files, images, or JavaScript are accessible without
authentication across all applications is to configure Global Unprotected Resources.
Exact Extract:
“Global unprotected resources define resources that do not require authentication and are accessible
to all clients across applications.”
Option A is incorrect; Protocol Sources define back-end host connections, not authentication.
Option B would apply only per-resource, not across all applications.
Option C is correct — Global Unprotected Resources are designed for this exact purpose.
Option D (Availability Profile) is related to application health checks and availability, not
authentication.
Reference: PingAccess Administration Guide – Global Unprotected Resources

From the “Promoting the replica administrative node” documentation:
Exact Extract:
“Open the <PA_HOME>/conf/run.properties file in a text editor. Locate the pa.operational.mode line
and change the value from CLUSTERED_CONSOLE_REPLICA to CLUSTERED_CONSOLE. These
properties are case-sensitive. Do not restart the replica node during the promotion process.” Ping
Identity Documentation
Also from the documentation under “Next steps” / manual promotion / “Using the admin API …”
When promoting the replica, there is also mention of setting the new host-port in the primary admin
configuration so that engine nodes and configuration references now point to the promoted replica.
One of the API properties is editRunPropertyFile (to flip the mode), another is editPrimaryHostPort,
which causes the primary-admin host setting to be updated. Ping Identity Documentation
Using those facts:
Why C is correct:
Option C says: Change pa.operational.mode to CLUSTERED_CONSOLE on the replica admin node.
This directly matches the documented manual promotion step: switch pa.operational.mode from
CLUSTERED_CONSOLE_REPLICA → CLUSTERED_CONSOLE. Ping Identity Documentation+1
This is essential for promoting the replica to primary console.
Why E is correct:
Option E: Modify bootstrap.properties and set the engine.admin.configuration.host value to point at
the replica admin node.
While the documentation doesn’t always name the exact property engine.admin.configuration.host,
the “promote via admin API” includes updating the “primary host:port” in the configuration so that
engine nodes’ configuration queries (or whatever is used by engines) point to the new primary. This
maps to ensuring that engine nodes know that the promoted replica is now the administrative node.
This requiring modifying the bootstrap or configuration that engine nodes use to find the
administrative host is essential. Ping Identity Documentation
Why the other options are incorrect:
A . Change pa.operational.mode to CLUSTERED_CONSOLE_REPLICA on one of the engine nodes.
No. Engine nodes should have pa.operational.mode = CLUSTERED_ENGINE, not console modes.
CLUSTERED_CONSOLE_REPLICA is an admin/replica console mode, not applicable for engines.
docs.ping.directory+2Ping Identity Documentation+2
B . Restart all nodes in the cluster.
The documentation explicitly says do not restart the replica node during the promotion process
because restart can cause file corruption or failure to properly promote. Only certain restarts are
needed after configuration updates. So restarting all nodes is not a correct required action. Ping
Identity Documentation
D . Restart the replica admin node.
As above, for manual promotion, a restart of the replica admin node is not required (and is even
discouraged during the promotion process). The change in run.properties is detected without
restarting. Ping Identity Documentation
Reference:
PingAccess Reference Guide – Promoting the replica administrative node / Manually promoting the
replica administrative node Ping Identity Documentation+1

PingAccess retains backup archives of its configuration in the data/archive directory. The number of
retained backups is controlled in the run.properties file.
Exact Extract:
“The number of configuration backups retained in the data/archive directory is controlled by the
archive.maxCount property in run.properties.”
Option A (log4j2.db.properties) is incorrect; this file controls database logging, not archive retention.
Option B (jvm-memory.options) is incorrect; this file sets JVM heap and memory arguments.
Option C (run.properties) is correct — it contains system-level settings including archive.maxCount.
Option D (log4j2.xml) is incorrect; this file configures log appenders and levels, not archive backups.
Reference: PingAccess Administration Guide – Configuration Backup Management

The run.properties file in PingAccess is the primary configuration file that defines system-level
runtime behavior. According to PingAccess documentation:
Exact Extract:
“The run.properties file contains configuration properties for PingAccess, including operational
mode, logging levels, admin authentication fallback, cluster settings, and system defaults.”
(PingAccess Administrator’s Guide – run.properties Reference)
From this, we can determine:
C . Operational mode for PingAccess → Correct
The property pa.operational.mode in run.properties defines whether the node operates as
STANDALONE, CLUSTERED_CONSOLE, CLUSTERED_CONSOLE_REPLICA, or CLUSTERED_ENGINE. This
is one of the core configurable options.
E . Logging levels → Correct
Properties such as log.level and other logging configurations are explicitly defined in run.properties,
allowing administrators to adjust the verbosity of logs (DEBUG, INFO, WARN, ERROR).
Why the others are incorrect:
A . Default logs location → Incorrect
The log file path is not controlled via run.properties. It is defined in log4j2.xml, not in run.properties.
B . URL for heartbeat endpoint → Incorrect
The heartbeat endpoint (/pa/heartbeat.ping) is a fixed system endpoint and is not configurable in
run.properties.
D . X-Frame-Options header → Incorrect
Security headers like X-Frame-Options are managed under application security policies or global
response headers, not in run.properties.
Reference:
PingAccess Administrator’s Guide – run.properties Reference (section describing
pa.operational.mode and logging configuration properties).

To enable Single Logout (SLO), the SLO scope must be defined in the PingAccess Web Session
configuration. This determines which sessions are ended when a logout request occurs.
Exact Extract:
“The SLO scope option in a web session specifies which applications are included in a logout event
when Single Logout is triggered.”
Option A (SLO scope) is correct; it explicitly enables SLO support by linking session termination across
apps.
Option B (Idle timeout) is unrelated; this controls session expiration, not SLO.
Option C (Validate Session) ensures session state is synchronized but does not configure SLO.
Option D (Refresh User Attributes) is unrelated; it only controls whether attributes are reloaded.
Reference: PingAccess Administration Guide – Configuring Web Sessions