PAP-001 Exam Questions and Answers | Exam-Dumps (Page: 2)

QUESTION: 9

Which two options can be changed in the run.properties file? (Choose 2 answers.)

Default logs location
URL for heartbeat endpoint
Operational mode for PingAccess
X-Frame-Options header
Logging levels

Answer(s): C,E

Explanation:

The run.properties file in PingAccess is the primary configuration file that defines system-level runtime behavior. According to PingAccess documentation:
Exact Extract:
"The run.properties file contains configuration properties for PingAccess, including operational mode, logging levels, admin authentication fallback, cluster settings, and system defaults." (PingAccess Administrator's Guide run.properties Reference) From this, we can determine:
C . Operational mode for PingAccess Correct
The property pa.operational.mode in run.properties defines whether the node operates as STANDALONE, CLUSTERED_CONSOLE, CLUSTERED_CONSOLE_REPLICA, or CLUSTERED_ENGINE. This is one of the core configurable options.

E . Logging levels Correct
Properties such as log.level and other logging configurations are explicitly defined in run.properties, allowing administrators to adjust the verbosity of logs (DEBUG, INFO, WARN, ERROR).

Why the others are incorrect:
A . Default logs location Incorrect
The log file path is not controlled via run.properties. It is defined in log4j2.xml, not in run.properties.
B . URL for heartbeat endpoint Incorrect
The heartbeat endpoint (/pa/heartbeat.ping) is a fixed system endpoint and is not configurable in run.properties.
D . X-Frame-Options header Incorrect
Security headers like X-Frame-Options are managed under application security policies or global response headers, not in run.properties.

Reference:

PingAccess Administrator's Guide run.properties Reference (section describing pa.operational.mode and logging configuration properties).

Reveal Solution Next Question

QUESTION: 10

An administrator needs to support SLO (Single Logout) for a protected web application.
What must be configured in a PingAccess Web Session in this situation?

SLO scope
Idle timeout
Validate Session
Refresh User Attributes

Answer(s): A

Explanation:

To enable Single Logout (SLO), the SLO scope must be defined in the PingAccess Web Session configuration. This determines which sessions are ended when a logout request occurs.
Exact Extract:

"The SLO scope option in a web session specifies which applications are included in a logout event when Single Logout is triggered."
Option A (SLO scope) is correct; it explicitly enables SLO support by linking session termination across apps.
Option B (Idle timeout) is unrelated; this controls session expiration, not SLO. Option C (Validate Session) ensures session state is synchronized but does not configure SLO. Option D (Refresh User Attributes) is unrelated; it only controls whether attributes are reloaded.

Reference:

PingAccess Administration Guide Configuring Web Sessions

Reveal Solution Next Question

QUESTION: 11

According to a new business requirement, critical applications require dual-factor authentication when specific resources are accessed in those applications.
Which configuration object should the administrator use in the applications?

UI Authentication
Auth Token Management
Authentication Requirements
Authentication Challenge Policy

Answer(s): C

Explanation:

PingAccess enforces step-up or multi-factor authentication using Authentication Requirements, which can be applied to specific resources within an application.
Exact Extract:
"Authentication requirements allow administrators to configure additional authentication (for example, MFA) when accessing sensitive application resources." Option A (UI Authentication) applies to access to the admin console, not application resources. Option B (Auth Token Management) relates to OAuth token lifetimes and refresh, not MFA enforcement.
Option C (Authentication Requirements) is correct -- these rules enforce MFA or step-up auth for specific URLs/resources.
Option D (Authentication Challenge Policy) governs how failed auth challenges are presented but does not enforce MFA.

Reference:

PingAccess Administration Guide Authentication Requirements

Reveal Solution Next Question

QUESTION: 12

During a business review of an application, the administrator needs to change the Resource Authentication to anonymous.
What are the two effects of making this change to the resource? (Choose 2 answers.)

The resource requires no further authentication, and no rules will apply.
The resource requires no further authentication, and Identity Mappings still apply.
The resource requires no further authentication, and Processing rules still apply.
Requests to this resource are not logged, and Identity Mappings are applied.
The resource requires no further authentication, and all Access Control rules still apply.

Answer(s): B,C

Explanation:

When a resource is configured as anonymous, PingAccess does not challenge the user for authentication. However, certain processing and identity propagation still occur.

Exact Extract:
"Anonymous resources do not require authentication. Identity mappings and request/response processing rules still apply."
Option A is incorrect because rules such as identity mappings and processing still apply. Option B is correct -- Identity Mappings can still forward attributes, even for anonymous access. Option C is correct -- Processing rules (e.g., request/response modifications) still apply. Option D is incorrect -- requests are logged; anonymous does not disable logging. Option E is incorrect -- access control rules (authorization) are not evaluated for anonymous resources.

Reference:

PingAccess Administration Guide Resource Authentication

Reveal Solution Next Question

QUESTION: 13

An administrator is integrating a new PingAccess Proxied Application. The application will use an SSL certificate issued by a publicly trusted Certificate Authority. PingAccess is terminating SSL and is responsible for loading the SSL certificate for that application.
What initial action must the administrator take in PingAccess in this situation?

Import the SSL public key with the full certificate chain into the Certificates.
Import the PKCS#12 file with the full certificate chain into the Certificates.
Import the SSL public key with the full certificate chain into the Key Pairs.
Import the PKCS#12 file with the full certificate chain into the Key Pairs.

Answer(s): D

Explanation:

For PingAccess to terminate SSL for a proxied application, it requires access to the private key and certificate chain. These are stored as Key Pairs.
Exact Extract:
"For SSL termination, you must import the server certificate and its private key as a PKCS#12 file into Key Pairs."
Option A is incorrect -- a public key alone cannot terminate SSL. Option B is incorrect -- PKCS#12 files must go into Key Pairs, not Certificates. Option C is incorrect -- public keys alone are insufficient; PingAccess must have the private key.

Option D is correct -- the PKCS#12 file with full chain and private key is imported into Key Pairs.

Reference:

PingAccess Administration Guide Managing Certificates and Key Pairs

Reveal Solution Next Question

QUESTION: 14

An administrator needs to prevent PingAccess from automatically starting on a Windows Server.
Which command would accomplish this task?

init.bat
uninstall-service.bat
remove-install.bat
wrapper-service.bat

Answer(s): B

Explanation:

PingAccess installs as a Windows service. To remove or prevent automatic startup, the uninstall- service.bat script is used.
Exact Extract:
"On Windows, use install-service.bat to install PingAccess as a service and uninstall-service.bat to remove the service."
Option A (init.bat) initializes environment variables but does not manage services. Option B (uninstall-service.bat) is correct -- it removes the Windows service, preventing auto-start. Option C (remove-install.bat) is not a valid PingAccess script. Option D (wrapper-service.bat) configures wrapper options, not service removal.

Reference:

PingAccess Installation Guide Windows Service Scripts

Reveal Solution Next Question

QUESTION: 15

A protected web application requires that additional attributes be provided once the user is authenticated.
Which two steps must the administrator perform to meet this requirement? (Choose 2 answers.)

Request that the token provider update the ID token with the additional attributes.
Update the Identity Mapping.
Update the Site Authenticator.
Request that the token provider update the access token with the additional attributes.
Update the Web Session.

Answer(s): B,E

Explanation:

When applications require additional attributes:
The Web Session must be configured to retrieve those attributes from the token provider (OIDC or PingFederate).
The Identity Mapping must be updated to forward those attributes to the application (e.g., as headers).
Exact Extract:
"Web sessions define how user attributes are retrieved from the token provider. Identity mappings determine how those attributes are inserted into requests to applications." Option A is not necessarily required; attributes can be retrieved via userinfo endpoint or access token, not only ID tokens.
Option B is correct -- Identity Mappings must be updated to pass attributes to the app. Option C is incorrect -- Site Authenticators define how PingAccess authenticates to apps, not attribute handling.
Option D is incorrect unless the architecture specifically requires access token updates; PingAccess often uses the Web Session to fetch attributes.
Option E is correct -- Web Session must be updated to retrieve additional attributes.

Reference:

PingAccess Administration Guide Web Sessions and Identity Mapping

Reveal Solution Next Question

QUESTION: 16

A modified application now requires additional attributes to be passed in the headers.
What needs to be modified in order to pass the additional attributes?

HTTP Request Header Rule
Header Identity Mapping
JWT Identity Mapping
Web Session Attribute Rule

Answer(s): B

Explanation:

To pass user attributes into HTTP headers for applications, PingAccess uses Identity Mappings.
When attributes need to be passed specifically as headers, the administrator must update the Header Identity Mapping.
Exact Extract:
"Header identity mappings map attributes from a user's web session to HTTP headers that are then sent to the back-end application."
Option A (HTTP Request Header Rule) is incorrect -- this adds or modifies static request headers, not user attributes.
Option B (Header Identity Mapping) is correct -- this maps identity attributes into headers dynamically.
Option C (JWT Identity Mapping) is incorrect -- that's used for passing attributes as claims in JWTs. Option D (Web Session Attribute Rule) is incorrect -- that is for access control evaluation, not propagation of attributes.

Reference:

PingAccess Administration Guide Identity Mapping (Header Identity Mapping)

Reveal Solution Next Question

Ping Identity PAP-001 Exam (page: 2) Ping Identity Certified Professional - PingAccess Updated on: 07-Feb-2026

QUESTION: 9

Explanation:

Reference:

QUESTION: 10

Explanation:

Reference:

QUESTION: 11

Explanation:

Reference:

QUESTION: 12

Explanation:

Reference:

QUESTION: 13

Explanation:

Reference:

QUESTION: 14

Explanation:

Reference:

QUESTION: 15

Explanation:

Reference:

QUESTION: 16

Explanation:

Reference:

Ping Identity PAP-001 Exam (page: 2)
Ping Identity Certified Professional - PingAccess
Updated on: 07-Feb-2026