PAP-001 Exam dumps PDF | Exam-Dumps.net (Page: 1)

QUESTION: 1

What is the purpose of the admin.auth configuration setting?

To configure SSO for the administrative user interface.
To define the method to use for authenticating to the administrative API.
To override the SSO configuration for the administrative user interface.
To enable automatic authentication to the PingAccess administrative console.

Answer(s): C

Explanation:

The admin.auth setting in the run.properties file is used to specify a fallback authentication method for the administrative console.
Exact Extract from official documentation:
"To define a fallback administrator authentication method if the OIDC token provider is unreachable, enable the admin.auth=native property in the run.properties file. This overrides any configured administrative authentication to basic authentication." This makes it clear that the purpose of admin.auth is to override any configured SSO for the admin UI and enforce native (basic) authentication instead.
Option A is incorrect because the admin.auth setting does not configure SSO. SSO for the admin UI is configured separately.
Option B is incorrect because this setting does not apply to the administrative API; it specifically applies to the admin UI console.
Option C is correct because it directly reflects the documented behavior: admin.auth overrides SSO configuration for the administrative UI and enables native authentication. Option D is incorrect because the setting does not enable automatic authentication. It still requires credentials, but falls back to basic auth.

Reference:

PingAccess User Interface Reference Guide Configuring Admin UI SSO Authentication

Reveal Solution Next Question

QUESTION: 2

An administrator is setting up a new PingAccess cluster with the following:

· Administrative node hostname: pa-admin.company.com
· Replica administrative node hostname: pa-admin2.company.com Which two options in the certificate would be valid for the administrative node key pair? (Choose 2.)

Issuer = pa-admin.company.com
Subject = *.company.com
Subject = pa-admin.company.com
Subject Alternative Names = pa-admin.company.com, pa-admin2.company.com
Subject = pa-admin2.company.com

Answer(s): B,D

Explanation:

Exact Extract (from PingAccess documentation):
"The key pair that you create for the CONFIG QUERY listener must include both the administrative node and the replica administrative node. To make sure the replica administrative node is included, you can either use a wildcard certificate or define subject alternative names in the key pair that use the replica administrative node's DNS name."
Why B and D are correct:
*B . Subject = .company.com -- A wildcard certificate for *.company.com is valid for both pa- admin.company.com and pa-admin2.company.com, satisfying the documented requirement that the key pair include both hostnames for the CONFIG QUERY listener. D . Subject Alternative Names = pa-admin.company.com, pa-admin2.company.com -- Explicitly placing both DNS names in the SAN extension also satisfies the requirement that the certificate cover both the administrative node and the replica administrative node.

Why the other options are incorrect:
A . Issuer = pa-admin.company.com -- The Issuer field identifies the certificate authority (CA) that signed the certificate, not the service hostname. Setting the issuer to a host value is not how X.509 server certificates are validated and would not meet the hostname matching requirement. C . Subject = pa-admin.company.com -- While this covers the administrative node, it does not include the replica administrative node. Without a wildcard or SAN entries, it fails the requirement that the key pair include both hostnames.
E . Subject = pa-admin2.company.com -- Similarly, this would only cover the replica administrative node and not the primary administrative node, failing the requirement.

Reference:

Configuring replica administrative nodes (PingAccess User Interface Reference Guide) Configuring a PingAccess cluster (PingAccess documentation) Certificates (PingAccess User Interface Reference Guide)

Reveal Solution Next Question

QUESTION: 3

An organization wants to take advantage of a new product feature that requires upgrading the PingAccess cluster from 7.3 to the current version. The administrator downloads the required files and places the files on the PingAccess servers.
What should the administrator do next?

Upgrade the Admin Console.
Disable cluster communication.
Disable Key Rolling.
Upgrade the Replica Admin.

Answer(s): A

Explanation:

When upgrading a PingAccess cluster, the Admin Console node must always be upgraded first before any replica admin or engine nodes. This ensures that the configuration and schema changes introduced in the new version are properly applied and replicated.
Exact Extract (from PingAccess documentation):
"In a clustered environment, you must first upgrade the administrative console node before upgrading any replica administrative nodes or engine nodes." Why A is correct:
A . Upgrade the Admin Console -- This is correct because the admin console node acts as the configuration master in a PingAccess cluster. Upgrading it first ensures the new version schema is available to replicas and engines.
Why the other options are incorrect:
B . Disable cluster communication -- This is not required for standard upgrades. Cluster communication remains in place to synchronize changes after the upgrade. C . Disable Key Rolling -- Key rolling is unrelated to the upgrade process. It is a feature used for key rotation, not version upgrades.
D . Upgrade the Replica Admin -- This is incorrect because upgrading a replica admin before the primary administrative console is against the documented procedure and would cause replication issues.

Reference:

Upgrading PingAccess in a Clustered Environment (PingAccess Upgrade Guide) PingAccess Administration Guide Upgrade Process

Reveal Solution Next Question

QUESTION: 4

Where in the administrative console should an administrator make user attributes available as HTTP request headers?

Site Authenticators
Identity Mappings
Web Sessions
HTTP Requests

Answer(s): B

Explanation:

PingAccess uses Identity Mappings to take identity attributes provided by the authentication source

(e.g., PingFederate, OpenID Connect) and map them into HTTP request headers for back-end applications.
Exact Extract:
"An identity mapping allows you to map identity attributes from the user's session to HTTP headers, cookies, or query parameters that are then forwarded to the target application." Option A (Site Authenticators) is incorrect because Site Authenticators configure how PingAccess communicates with applications requiring authentication, not how attributes are inserted into headers.
Option B (Identity Mappings) is correct -- this is the feature designed specifically to expose user attributes to applications via HTTP headers.
Option C (Web Sessions) manages how sessions are stored and validated, but not the mapping of attributes into requests.
Option D (HTTP Requests) refers to request/response processing rules, but attributes are not mapped here.

Reference:

PingAccess Administration Guide Identity Mapping

Reveal Solution Next Question

QUESTION: 5

An application requires MFA for URLs that are considered high risk.
Which action should the administrator take to meet this requirement?

Create an Authentication Requirement named MFA_Required.
Apply an Authentication Requirements rule to the resource.
Apply a Web Session Attribute rule to the resource.
Apply an HTTP Request Parameter rule to the resource.

Answer(s): B

Explanation:

PingAccess allows fine-grained authentication enforcement by applying Authentication Requirement rules at the resource level. These rules can invoke MFA flows based on request context or policy.
Exact Extract:
"Authentication requirement rules determine whether PingAccess challenges a user to authenticate again (for example, with MFA) before allowing access to a protected resource."

Option A is incomplete. Creating a requirement does nothing unless it is applied. Option B is correct because applying the Authentication Requirement rule to the specific resource (URL) enforces MFA only for that resource.
Option C is incorrect; Web Session Attribute rules are about evaluating existing session attributes, not triggering MFA.
Option D is incorrect; HTTP Request Parameter rules are used to evaluate request data, not enforce MFA policies.

Reference:

PingAccess Administration Guide Authentication Requirements

Reveal Solution Next Question

QUESTION: 6

All style sheets should be accessible to all users without authentication across all applications.
Which configuration option should the administrator use?

Define a Protocol Source for the resource.
Define Authentication Challenge Policy of none for the resource.
Define Global Unprotected Resources for the resource.
Define a Default Availability Profile of on-demand for the resource.

Answer(s): C

Explanation:

The correct way to ensure resources such as CSS files, images, or JavaScript are accessible without authentication across all applications is to configure Global Unprotected Resources.
Exact Extract:
"Global unprotected resources define resources that do not require authentication and are accessible to all clients across applications."
Option A is incorrect; Protocol Sources define back-end host connections, not authentication. Option B would apply only per-resource, not across all applications. Option C is correct -- Global Unprotected Resources are designed for this exact purpose. Option D (Availability Profile) is related to application health checks and availability, not authentication.

Reference:

PingAccess Administration Guide Global Unprotected Resources

Reveal Solution Next Question

QUESTION: 7

An administrator is preparing to rebuild an unrecoverable primary console and must promote the replica admin node.
Which two actions must the administrator take? (Choose 2 answers.)

Change pa.operational.mode to CLUSTERED_CONSOLE_REPLICA on one of the engine nodes.
Restart all nodes in the cluster.
Change pa.operational.mode to CLUSTERED_CONSOLE on the replica admin node.
Restart the replica admin node.
Modify bootstrap.properties and set the engine.admin.configuration.host value to point at the replica admin node.

Answer(s): C,E

Explanation:

From the "Promoting the replica administrative node" documentation:
Exact Extract:
"Open the <PA_HOME>/conf/run.properties file in a text editor. Locate the pa.operational.mode line and change the value from CLUSTERED_CONSOLE_REPLICA to CLUSTERED_CONSOLE. These properties are case-sensitive. Do not restart the replica node during the promotion process." Ping Identity Documentation
Also from the documentation under "Next steps" / manual promotion / "Using the admin API ..." When promoting the replica, there is also mention of setting the new host-port in the primary admin configuration so that engine nodes and configuration references now point to the promoted replica. One of the API properties is editRunPropertyFile (to flip the mode), another is editPrimaryHostPort, which causes the primary-admin host setting to be updated. Ping Identity Documentation Using those facts:
Why C is correct:
Option C says: Change pa.operational.mode to CLUSTERED_CONSOLE on the replica admin node. This directly matches the documented manual promotion step: switch pa.operational.mode from CLUSTERED_CONSOLE_REPLICA CLUSTERED_CONSOLE. Ping Identity Documentation+1 This is essential for promoting the replica to primary console.
Why E is correct:
Option E: Modify bootstrap.properties and set the engine.admin.configuration.host value to point at the replica admin node.
While the documentation doesn't always name the exact property engine.admin.configuration.host, the "promote via admin API" includes updating the "primary host:port" in the configuration so that engine nodes' configuration queries (or whatever is used by engines) point to the new primary. This maps to ensuring that engine nodes know that the promoted replica is now the administrative node. This requiring modifying the bootstrap or configuration that engine nodes use to find the administrative host is essential. Ping Identity Documentation Why the other options are incorrect:
A . Change pa.operational.mode to CLUSTERED_CONSOLE_REPLICA on one of the engine nodes. No. Engine nodes should have pa.operational.mode = CLUSTERED_ENGINE, not console modes. CLUSTERED_CONSOLE_REPLICA is an admin/replica console mode, not applicable for engines.
docs.ping.directory+2Ping Identity Documentation+2
B . Restart all nodes in the cluster.
The documentation explicitly says do not restart the replica node during the promotion process because restart can cause file corruption or failure to properly promote. Only certain restarts are needed after configuration updates. So restarting all nodes is not a correct required action. Ping Identity Documentation
D . Restart the replica admin node.
As above, for manual promotion, a restart of the replica admin node is not required (and is even discouraged during the promotion process). The change in run.properties is detected without restarting. Ping Identity Documentation

Reference:

PingAccess Reference Guide Promoting the replica administrative node / Manually promoting the replica administrative node Ping Identity Documentation+1

Reveal Solution Next Question

QUESTION: 8

An administrator needs to reduce the number of archive backups that are maintained in the data/archive folder.
Which file does the administrator need to modify to make this change?

log4j2.db.properties
jvm-memory.options
run.properties
log4j2.xml

Answer(s): C

Explanation:

PingAccess retains backup archives of its configuration in the data/archive directory. The number of retained backups is controlled in the run.properties file.
Exact Extract:
"The number of configuration backups retained in the data/archive directory is controlled by the archive.maxCount property in run.properties."
Option A (log4j2.db.properties) is incorrect; this file controls database logging, not archive retention. Option B (jvm-memory.options) is incorrect; this file sets JVM heap and memory arguments. Option C (run.properties) is correct -- it contains system-level settings including archive.maxCount. Option D (log4j2.xml) is incorrect; this file configures log appenders and levels, not archive backups.

Reference:

PingAccess Administration Guide Configuration Backup Management

Reveal Solution Next Question

Ping Identity PAP-001 Exam (page: 1)
Ping Identity Certified Professional - PingAccess
Updated on: 24-Mar-2026

Access free PAP-001 actual exam questions, answers, explanations and user discussions.

QUESTION: 1

Explanation:

Reference:

QUESTION: 2

Explanation:

Reference:

QUESTION: 3

Explanation:

Reference:

QUESTION: 4

Explanation:

Reference:

QUESTION: 5

Explanation:

Reference:

QUESTION: 6

Explanation:

Reference:

QUESTION: 7

Explanation:

Reference:

QUESTION: 8

Explanation:

Reference:

Ping Identity PAP-001 Exam (page: 1) Ping Identity Certified Professional - PingAccess Updated on: 24-Mar-2026

Access free PAP-001 actual exam questions, answers, explanations and user discussions.

QUESTION: 1

Explanation:

Reference:

QUESTION: 2

Explanation:

Reference:

QUESTION: 3

Explanation:

Reference:

QUESTION: 4

Explanation:

Reference:

QUESTION: 5

Explanation:

Reference:

QUESTION: 6

Explanation:

Reference:

QUESTION: 7

Explanation:

Reference:

QUESTION: 8

Explanation:

Reference:

Ping Identity PAP-001 Exam (page: 1)
Ping Identity Certified Professional - PingAccess
Updated on: 24-Mar-2026