PT-AM-CPE Exam Questions & Answers

According to the PingAM 8.0.2 documentation on 'OAuth 2.0 Client Authentication,' clients are categorized into two types based on their ability to maintain the confidentiality of their credentials: Public and Confidential.

A Confidential Client is defined as an application that is capable of securely storing a client_secret or a private key.1 These are typically applications where the code and configuration are not exposed to the end user. Web Applications (Option D) are the classic example of confidential clients because they run on a secure back-end server.2 The server-side code can store and use a secret to authenticate with PingAM's token endpoint without the risk of the secret being leaked to the user-agent or a third party.

In contrast:

Web Browsers (Option C) and JavaScript clients (Option B) are considered Public Clients.3 Since the code runs within the user's browser, any secret embedded in the application would be visible to the user via 'View Source' or developer tools.4

Desktop clients (Option A) and native mobile apps are also categorized as public clients in the OAuth2 specification (RFC 6749) because they are distributed to end-user devices.5 Even if the secret is obfuscated, it can be extracted through reverse engineering or decompilation.

For confidential clients, PingAM 8.0.2 supports various authentication methods at the token endpoint, including client_secret_basic, client_secret_post, and more secure options like Mutual TLS (mTLS) or Private Key JWT. By correctly identifying a client as confidential, administrators can enforce these stronger authentication requirements, ensuring that the client is indeed the entity it claims to be before granting access or refresh tokens.

In PingAM 8.0.2, especially when utilizing File-Based Configuration (FBC), the startup sequence relies on a 'bootstrap' phase to locate the system's configuration. According to the 'Installation Guide' and 'Configuration Directory Structure,' the primary file involved in this process is named boot.json.

The boot.json file contains the essential connection details required for the AM binaries to find and unlock the configuration store (usually PingDS). This includes the LDAP host, port, bind DN, and references to the secret stores needed to decrypt the configuration.

The location of this file is determined by the Configuration Directory path specified during the initial setup. By default, PingAM creates its configuration directory in the home directory of the user running the web container. The standard path structure is <user-home>//. Therefore, the boot.json file is located at the root of this instance directory: <user-home>//boot.json.

Options A and D are incorrect because they place the file inside a /config subdirectory; while AM has many config files in subdirectories, the boot.json sits at the root to be accessible as the first point of entry.

Option B is incorrect because it suggests the file is stored within the Tomcat webapps folder. PingAM specifically avoids storing configuration data within the web application binaries to ensure that configuration persists even if the .war file is deleted or redeployed.

Understanding the location of boot.json is vital for DevOps engineers who need to automate the deployment of PingAM using tools like Amster or when troubleshooting a 'Failed to connect to the configuration store' error during server startup.

To enforce complex authorization logic based on session duration, PingAM 8.0.2 administrators must move beyond the static 'Out-of-the-Box' conditions.

Analysis of the options based on the 'Policy Conditions' documentation:

Time Condition (Option A): This condition is used to restrict access based on the clock time of day or day of the week (e.g., 'Allow access only between 9 AM and 5 PM'). It does not track the elapsed time of a specific user session.

Current Session Properties (Option B): This condition checks for the presence of specific key-value pairs in a session. While a session contains a startTime property, this condition is designed for matching static values (like department=HR), not for performing mathematical time calculations.

Active Session Time (Option D): This is not a standard default condition name in the PingAM 8.0.2 policy engine.

The Correct Approach (Option C): A Scripted Policy Condition is required for this use case. Within a Policy Condition script, the administrator has access to the session object. The script can retrieve the startTime (or creationTime) of the session and compare it against the current system time (currentTime).

Example logic in the script:

var sessionStartTime = session.getProperty('startTime');

var maxDuration = 10 * 60 * 1000; // 10 minutes in milliseconds

if ((currentTime - sessionStartTime) > maxDuration) { authorized = false; }

By using a script, PingAM can dynamically calculate the age of the session at the moment of the access request and return a 'Deny' decision if the 10-minute threshold has been exceeded. This provides the granular control needed for high-security environments where 'session freshness' is a requirement for specific sensitive resources.

When a client requests an OpenID Connect (OIDC) scope (like profile), PingAM 8.0.2 may present a Consent Screen to the user, asking permission to share specific claims. To make this screen user-friendly, PingAM allows administrators to map technical claim names to human-readable labels and specify localizations.

According to the PingAM documentation on 'Supported Claims' in the OAuth2/OIDC Provider settings:

The format for the Supported Claims property entry is:

ClaimName|Locale|DisplayName

In this syntax:

ClaimName: The technical OIDC claim (e.g., name, email, given_name).

Locale: The ISO language code (e.g., en, fr).

DisplayName: The text that will actually appear on the UI (the 'Full name' label).

Therefore, the string name|en|Full name (Option A) is the correct configuration.

Option B is incorrect because it reverses the technical name and the display name.

Option C is incorrect as it lacks the required locale component and uses full_name (which is not the standard OIDC claim name; the standard is name).

Option D attempts to perform a logic operation (+) within a configuration field where only static mapping strings are allowed. Claim composition (concatenating first and last names) is handled by the OIDC Claims Script, not by the Supported Claims UI property.

While several endpoints in PingAM 8.0.2 interact with tokens, only one is explicitly designed for the purpose of checking the metadata and validity of an opaque or structured OAuth2 token.

According to the 'OAuth 2.0 Endpoints' and 'Token Introspection' documentation:

/oauth2/introspect (Option B): This is the RFC 7662-compliant endpoint. It is used by resource servers (or other authorized clients) to determine the 'activeness' of a token. When a token is sent to this endpoint, PingAM returns a JSON object indicating if the token is valid, its scope, its expiration time, and the subject it represents. This is the standard way to validate tokens that are not self-validated (like opaque tokens stored in the CTS).

Why other options are incorrect:

/oauth2/userinfo (Option A): This endpoint is part of OpenID Connect. While it requires a valid token to function, its purpose is to return user claims, not to provide a 'valid/invalid' metadata check of the token itself.

/oauth2/validate (Option C): This is a legacy endpoint used in older versions of the product. In PingAM 8.0.2, introspection is the standardized replacement.

/oauth2/access_token (Option D): This is the Token Endpoint used to issue tokens, not to validate them.

Using the /oauth2/introspect endpoint is a best practice for security because it allows the authorization server (PingAM) to verify that a token has not been revoked in the Core Token Service (CTS) before a resource server grants access.