PAP-001 Exam Questions & Answers
Certified Professional - PingAccess • Ping Identity
100% money-back guarantee
Sample PAP-001 Questions
Practice with real exam-style questions, each with the verified correct answer and explanation.
An organization wants to take advantage of a new product feature that requires upgrading the PingAccess cluster from 7.3 to the current version. The administrator downloads the required files and places the files on the PingAccess servers. What should the administrator do next?
When upgrading a PingAccess cluster, the Admin Console node must always be upgraded first before any replica admin or engine nodes. This ensures that the configuration and schema changes introduced in the new version are properly applied and replicated.
Exact Extract (from PingAccess documentation):
''In a clustered environment, you must first upgrade the administrative console node before upgrading any replica administrative nodes or engine nodes.''
Why A is correct:
A . Upgrade the Admin Console --- This is correct because the admin console node acts as the configuration master in a PingAccess cluster. Upgrading it first ensures the new version schema is available to replicas and engines.
Why the other options are incorrect:
B . Disable cluster communication --- This is not required for standard upgrades. Cluster communication remains in place to synchronize changes after the upgrade.
C . Disable Key Rolling --- Key rolling is unrelated to the upgrade process. It is a feature used for key rotation, not version upgrades.
D . Upgrade the Replica Admin --- This is incorrect because upgrading a replica admin before the primary administrative console is against the documented procedure and would cause replication issues.
Upgrading PingAccess in a Clustered Environment (PingAccess Upgrade Guide)
PingAccess Administration Guide -- Upgrade Process
All style sheets should be accessible to all users without authentication across all applications. Which configuration option should the administrator use?
The correct way to ensure resources such as CSS files, images, or JavaScript are accessible without authentication across all applications is to configure Global Unprotected Resources.
Exact Extract:
''Global unprotected resources define resources that do not require authentication and are accessible to all clients across applications.''
Option A is incorrect; Protocol Sources define back-end host connections, not authentication.
Option B would apply only per-resource, not across all applications.
Option C is correct --- Global Unprotected Resources are designed for this exact purpose.
Option D (Availability Profile) is related to application health checks and availability, not authentication.
An administrator needs to configure a protected web application using the Authorization Code login flow. Which two configuration parameters must be set? (Choose 2 answers.)
When using the Authorization Code Flow for authentication, PingAccess must be configured with:
An OAuth Client ID that identifies the application to the IdP.
The OpenID Connect Login Type set to Authorization Code.
Exact Extract:
''When configuring an OIDC web session, specify the OAuth client ID and select the OpenID Connect login type (Authorization Code, Hybrid, or Implicit).''
Option A (OAuth Token Introspection Endpoint) is not required for Authorization Code flow --- token introspection is used in other cases.
Option B (OAuth Client ID) is correct --- required for OIDC authorization requests.
Option C (OpenID Connect Issuer) is discovered automatically via metadata when you configure the token provider.
Option D (Virtual Host) is required for application exposure but not specific to OIDC flow.
Option E (OpenID Connect Login Type) is correct --- must be set to ''Authorization Code.''
PingAccess will terminate SSL for multiple proxied applications that share the customer.com URL domain. The administrator needs different ways to minimize the number of SSL certificates to manage these user-facing applications.
What are two ways this requirement can be met? (Choose 2 answers.)
PingAccess uses Engine Listeners for SSL termination of proxied applications. To minimize the number of certificates, administrators can:
Use a wildcard certificate (e.g., *.customer.com) on the engine listener.
Use a Subject Alternative Name (SAN) certificate that covers multiple FQDNs under the customer.com domain.
Exact Extract:
''PingAccess engine listeners can use certificates containing either wildcard entries or Subject Alternative Names to secure multiple applications under a single domain.''
Option A is incorrect --- assigning unique key pairs increases, not decreases, certificate management overhead.
Option B is correct --- a wildcard certificate covers all subdomains (e.g., app1.customer.com, app2.customer.com).
Option C is correct --- a SAN certificate lists multiple FQDNs explicitly.
Option D is incorrect --- agent listeners don't handle SSL termination for proxied apps.
Option E is incorrect for the same reason --- agent listeners aren't used for SSL.
Under which top-level directory are PingAccess configuration archives stored?
PingAccess automatically creates configuration archive backups whenever changes are made. These are stored in the data/archive directory.
Exact Extract:
''PingAccess stores configuration archive files in the PA_HOME/data/archive directory.''
Option A (tools) is incorrect --- contains administrative scripts.
Option B (conf) is incorrect --- holds configuration files like run.properties.
Option C (data) is correct --- archives are stored under data/archive.
Option D (bin) is incorrect --- contains executables and scripts.
Get access to all 70 verified questions with detailed answers.
Unlock All PAP-001 Questions