PAP-001 Exam Questions & Answers

When upgrading a PingAccess cluster, the Admin Console node must always be upgraded first before any replica admin or engine nodes. This ensures that the configuration and schema changes introduced in the new version are properly applied and replicated.

Exact Extract (from PingAccess documentation):

''In a clustered environment, you must first upgrade the administrative console node before upgrading any replica administrative nodes or engine nodes.''

Why A is correct:

A . Upgrade the Admin Console --- This is correct because the admin console node acts as the configuration master in a PingAccess cluster. Upgrading it first ensures the new version schema is available to replicas and engines.

Why the other options are incorrect:

B . Disable cluster communication --- This is not required for standard upgrades. Cluster communication remains in place to synchronize changes after the upgrade.

C . Disable Key Rolling --- Key rolling is unrelated to the upgrade process. It is a feature used for key rotation, not version upgrades.

D . Upgrade the Replica Admin --- This is incorrect because upgrading a replica admin before the primary administrative console is against the documented procedure and would cause replication issues.

Upgrading PingAccess in a Clustered Environment (PingAccess Upgrade Guide)

PingAccess Administration Guide -- Upgrade Process

The correct way to ensure resources such as CSS files, images, or JavaScript are accessible without authentication across all applications is to configure Global Unprotected Resources.

Exact Extract:

''Global unprotected resources define resources that do not require authentication and are accessible to all clients across applications.''

Option A is incorrect; Protocol Sources define back-end host connections, not authentication.

Option B would apply only per-resource, not across all applications.

Option C is correct --- Global Unprotected Resources are designed for this exact purpose.

Option D (Availability Profile) is related to application health checks and availability, not authentication.

When using the Authorization Code Flow for authentication, PingAccess must be configured with:

An OAuth Client ID that identifies the application to the IdP.

The OpenID Connect Login Type set to Authorization Code.

Exact Extract:

''When configuring an OIDC web session, specify the OAuth client ID and select the OpenID Connect login type (Authorization Code, Hybrid, or Implicit).''

Option A (OAuth Token Introspection Endpoint) is not required for Authorization Code flow --- token introspection is used in other cases.

Option B (OAuth Client ID) is correct --- required for OIDC authorization requests.

Option C (OpenID Connect Issuer) is discovered automatically via metadata when you configure the token provider.

Option D (Virtual Host) is required for application exposure but not specific to OIDC flow.

Option E (OpenID Connect Login Type) is correct --- must be set to ''Authorization Code.''

PingAccess uses Engine Listeners for SSL termination of proxied applications. To minimize the number of certificates, administrators can:

Use a wildcard certificate (e.g., *.customer.com) on the engine listener.

Use a Subject Alternative Name (SAN) certificate that covers multiple FQDNs under the customer.com domain.

Exact Extract:

''PingAccess engine listeners can use certificates containing either wildcard entries or Subject Alternative Names to secure multiple applications under a single domain.''

Option A is incorrect --- assigning unique key pairs increases, not decreases, certificate management overhead.

Option B is correct --- a wildcard certificate covers all subdomains (e.g., app1.customer.com, app2.customer.com).

Option C is correct --- a SAN certificate lists multiple FQDNs explicitly.

Option D is incorrect --- agent listeners don't handle SSL termination for proxied apps.

Option E is incorrect for the same reason --- agent listeners aren't used for SSL.

PingAccess automatically creates configuration archive backups whenever changes are made. These are stored in the data/archive directory.

Exact Extract:

''PingAccess stores configuration archive files in the PA_HOME/data/archive directory.''

Option A (tools) is incorrect --- contains administrative scripts.

Option B (conf) is incorrect --- holds configuration files like run.properties.

Option C (data) is correct --- archives are stored under data/archive.

Option D (bin) is incorrect --- contains executables and scripts.