[Jul-2026 Newly Released] PT-AM-CPE Dumps for Ping Identity Certifications Certified [Q56-Q72]

Rate this post

[Jul-2026 Newly Released] PT-AM-CPE Dumps for Ping Identity Certifications Certified

Updated Verified PT-AM-CPE dumps Q&As – 100% Pass

Ping Identity PT-AM-CPE Exam Syllabus Topics:

Topic	Details
Topic 1	Enhancing Intelligent Access: This domain covers implementing authentication mechanisms, using PingGateway to protect websites, and establishing access control policies for resources.
Topic 2	Improving Access Management Security: This domain focuses on strengthening authentication security, implementing context-aware authentication experiences, and establishing continuous risk monitoring throughout user sessions.
Topic 3	Installing and Deploying AM: This domain encompasses installing and upgrading PingAM, hardening security configurations, setting up clustered environments, and deploying PingOne Advanced Identity Platform to the cloud.
Topic 4	Federating Across Entities Using SAML2: This domain covers implementing single sign-on using SAML v2.0 and delegating authentication responsibilities between SAML2 entities.
Topic 5	Extending Services Using OAuth2-Based Protocols: This domain addresses integrating applications with OAuth 2.0 and OpenID Connect, securing OAuth2 clients with mutual TLS and proof-of-possession, transforming OAuth2 tokens, and implementing social authentication.

QUESTION 56
Which of the following multi-factor authentication protocols are supported by PingAM?
A) Open authentication
B) Security questions
C) Web authentication
D) Universal 2nd factor authentication
E) Push authentication

B, C, and D

A, B, and E

A, C, and E

A, B, and C

QUESTION 57
In the default Cloud Developer Kit (CDK) deployment of the forgeops repository, which pods provide the user interface functionality?

admin-ui, end-user-ui, login-ui

amadmin-ui, idmadmin-ui, login-ui

am-ui, idm-ui, login-ui

am-ui, idm-ui, end-user-ui

The Cloud Developer Kit (CDK), part of the forgeops repository, represents the modern approach to deploying the Ping Identity Platform (including PingAM 8.0.2) in a containerized, Kubernetes-native environment. According to the PingAM deployment and ForgeOps documentation, the platform has transitioned from a monolithic architecture-where the user interface was embedded within the AM web application-to a decoupled, microservices-aligned architecture. In a standard CDK deployment, the user interface components are separated into their own distinct pods to allow for independent scaling, updates, and management.
The three specific pods that provide user interface functionality in a default CDK environment are:
admin-ui: This pod hosts the administrative console. It is the centralized interface that administrators use to configure realms, manage identity stores, define authentication trees, and oversee the general health of both PingAM and PingIDM. By separating the administrative UI from the core engine, the platform reduces the attack surface and allows for more granular resource allocation.
end-user-ui: This pod serves the self-service portal for end-users. It is responsible for providing the interface where users can manage their own profiles, update passwords, register Multi-Factor Authentication (MFA) devices, and manage their consent for OAuth2/UMA applications. This UI interacts with the back-end via REST APIs to ensure a seamless and responsive user experience.
login-ui: This is a specialized pod dedicated to the authentication journey. When a user interacts with an “Intelligent Access” tree, the login-ui pod renders the callbacks (such as username prompts, password fields, or MFA challenges). This pod ensures that the presentation layer of the authentication process is modernized and distinct from the heavy processing logic of the PingAM core.
Collectively, these three pods ensure that the “User Interface” layer of the deployment is modular. This architecture is a prerequisite for high-availability deployments and is the standard configuration verified in the ForgeOps documentation for version 8.0.2 deployments.

QUESTION 58
In order to secure a PingAM deployment with an external configuration data store and user data store using server-side sessions, which of the following should be considered?

Changing the default iPlanetDirectoryPro cookie name, Using your own key for signing, Using a specific bind account for LDAP connections, Renaming and reducing the assigned privileges of the amAdmin account

Encrypting the iPlanetDirectoryPro cookie contents, Changing the default iPlanetDirectoryPro cookie name, Using your own key for signing, Using a specific bind account for LDAP connections

Changing the default iPlanetDirectoryPro cookie name, Using your own key for signing, Using a specific bind account for LDAP connections, Creation of a top-level administrator other than amAdmin

Changing the default iPlanetDirectoryPro cookie name, Using your own key for signing, Using a specific bind account for LDAP connections, Reducing the privileges of the amAdmin user in production

Securing a PingAM 8.0.2 environment involves hardening multiple layers of the architecture, particularly when using external data stores and stateful sessions. According to the “General Security Considerations” and “Hardening PingAM” documentation, several key “Best Practices” must be applied.
Changing the SSO Cookie Name: By default, AM uses iPlanetDirectoryPro. Attackers often scan for this specific cookie name to identify ForgeRock/PingAM installations. Changing it provides “security through obscurity” and prevents some automated attacks.
Using Your Own Keys: PingAM ships with default test keys in the keystore. For production, you must generate your own cryptographic keys for signing and encrypting tokens (SSO, OIDC, SAML) to ensure the integrity of the environment.
Specific Bind Accounts: When connecting to an external PingDS or Active Directory, PingAM should never use a highly privileged account (like cn=Directory Manager). Instead, a dedicated account with limited, specific permissions (ACLs) should be created for AM’s use.
Top-Level Administrator Management: The amAdmin account is the “root” of the AM system. In a production environment, it is considered a significant security risk to use this account for daily operations.
Why Option C is the correct answer: The documentation specifically recommends creating a new top-level administrator and then securing or disabling the default amAdmin. This is more effective than simply “renaming” it (Option A) or “reducing privileges” (Options B and D). In PingAM, amAdmin has hardcoded superuser capabilities in many areas; therefore, the best practice is to create a new administrative user with the necessary roles and then protect the amAdmin credentials in a vault. Option B is also incorrect because server-side sessions already store data on the server; the cookie only contains the session ID (the reference), so “encrypting the cookie contents” is redundant for server-side sessions compared to client-side sessions where the entire state is in the cookie.

QUESTION 59
Consider the following LDAP connection string:
DS1.example.com:389|01, DS2.example.com:389|01, DS2.example.com:389|02, DS1.example.com:389|02 This connection string can be used in:
A . Identity Store
B . Core Token Service
C . Configuration Data Store
Which of the above options are correct?

Only A is correct

Only B is correct

Only C is correct

A, B, and C are correct

QUESTION 60
The Core Token Service (CTS) can be used for storing which of the following?

Configuration

Users

Kerberos tokens

OAuth2 tokens

QUESTION 61
Which authentication node can you use in PingAM to add a key:value property to the user’s session after successful authentication?

The Get Session Data node

You have to use a webhook, not a node

The Provision Dynamic Account node

The Set Session Properties node

QUESTION 62
Which of the following is considered a confidential OAuth2 client?

Desktop clients

JavaScript clients

Web browsers

Web applications

QUESTION 63
Which area of PingAM does affinity mode relate to?

Authentication

Load balancing

Self-service

Authorization

QUESTION 64
To ensure the user’s full name is displayed on the consent screen for an OpenID Connect application, which string should be added into the Support Claims property on the OpenID Connect tab page of the OAuth2 Provider service in PingAM?

name|en|Full name

Full name|en|name

full_name|Full name

name|en|given_name+’ ‘+family_name

QUESTION 65
If PingAM is deployed in Apache Tomcat under /openam, what file system backups should be taken when PingAM needs to be upgraded?

Back up /path/to/tomcat/webapps/openam/ only

No explicit backups are required for PingAM as this is done automatically

Back up /path/to/tomcat/webapps/openam/, <home directory>/openam/ and <home directory>/.openamcfg/

Execute the PingAM backup script in /path/to/tomcat/webapps/openam/

According to the PingAM 8.0.2 Upgrade Guide and the “Plan the upgrade” documentation, a successful upgrade and potential rollback strategy rely on capturing the complete state of the application across three distinct locations on the filesystem. When PingAM is deployed in a container like Apache Tomcat, the configuration is not stored within the WAR file itself but is distributed to maintain persistence across redeployments.
The three critical areas that must be backed up are:
The Web Application Directory (/path/to/tomcat/webapps/openam/): This contains the expanded binaries, JSPs, and web-level configurations. While the upgrade involves replacing the openam.war file, backing up this folder preserves any manual customizations made to the UI, CSS, or specific library additions (JARs) in the WEB-INF/lib folder.
The Configuration Directory (<home directory>/openam/ or similar): This is the most vital component. By default, PingAM stores its instance-specific configuration, cryptographic keys (keystores), and internal metadata here. For file-based configurations (FBC), this directory holds the entire system state. Even with an external PingDS configuration store, this directory contains the bootstrap file and security secrets required to connect to that store.
The Bootstrap Configuration File (<home directory>/.openamcfg/): This hidden directory contains a file (usually named after the deployment path, e.g., am or openam) that tells the PingAM binaries where the actual configuration directory is located. Without this pointer, a restored PingAM instance will behave like a fresh installation and prompt for a new setup.
The documentation explicitly warns: “Always back up your deployment before you upgrade… For AM servers, you can roll back by restoring from a file system backup of the deployed servers and their configuration directories.” Relying only on the webapps folder (Option A) or assuming automatic backups (Option B) will lead to data loss or an unrecoverable state.

QUESTION 66
What should be executed to ensure a successful upgrade when PingAM requires a version upgrade?

Post-upgrade, run a set of functional tests

Post-upgrade, run a set of functional and non-functional tests

Post-upgrade, run a set of non-functional tests

Post-upgrade, set the PingAM Version Control Flag to the correct version

QUESTION 67
An OpenID Connect application makes a request for an ID token with the openid and profile scope. Which set of claim attributes are available with the profile scope?

givenName, familyName, preferredLocale, name

givenname, family_name, locale, name

given_name, family_name, locale, name

given_name, family_name, preferred_locale, name

QUESTION 68
What authentication tree nodes are provided for device registration in PingAM?

MFA Registration Options node, OATH Registration node, Push Registration node

MFA Registration Options node, OATH Registration node, WebAuthn Registration node

MFA Registration Options node, Push Registration node, WebAuthn Registration node

OATH Registration node, Push Registration node, WebAuthn Registration node

QUESTION 69
During the PingAM startup process, what is the location and name of the file that the PingAM bootstrap process uses to connect to the configuration Directory Services repository?

<user-home-dir>/.openam/config/boot.json

/path/to/tomcat/<tomcat-instance-dir>/webapps/<am-instance-dir>/boot.json

<user-home>/<am-instance-dir>/boot.json

<user-home-dir>/<am-instance-dir>/config/boot.json

QUESTION 70
In a multi-server deployment, what is the impact of not ensuring stickiness in the load balancer configuration?

Session failover will not work

The browser will not be able to validate the user session with the correct PingAM server

The user will see more redirects in their browser

Performance may decrease as load on the system will be higher

In a high-availability PingAM 8.0.2 cluster, the Load Balancer (LB) is responsible for distributing traffic across multiple AM instances. Session Stickiness (also known as session affinity) ensures that all requests from a specific user session are routed to the same AM server that initially created the session.
According to the PingAM “Deployment Planning” and “Load Balancing” documentation, PingAM is designed to be “sticky-preferred” but not “sticky-required” if the Core Token Service (CTS) is used. If stickiness is not ensured:
Performance Impact: Every time a user request lands on a different AM server (Server B) than the one that holds the session in local memory (Server A), Server B must query the CTS (External Store) to retrieve the session details, deserialize the object, and reconstruct the session state. This cross-server look-up introduces significant latency and increases the load on the PingDS instances hosting the CTS.
CTS Load: Without stickiness, every single request becomes a “Global” session lookup. This drastically increases the I/O and CPU overhead on the back-end directory servers, potentially leading to performance degradation of the entire identity platform.
Why other options are incorrect:
Option A: Session failover requires the CTS, but stickiness actually minimizes the need for failover logic during normal operation. Failover still works without stickiness, it just becomes the “default” behavior for every request.
Option B: AM servers in a cluster share the same encryption keys and back-end stores. Any server can technically validate a session by looking it up in the CTS; the browser doesn’t “know” which server is correct.
Option C: Redirects are handled at the application logic level. While some internal processing changes, it doesn’t necessarily result in extra browser-level HTTP redirects.
Thus, the primary negative impact of lacking stickiness in a correctly configured cluster is a decrease in performance (Option D) due to the constant session synchronization overhead.

QUESTION 71
After installing a PingAM instance with the configuration directory path set to /home/forgerock/am, where is the default directory that contains the debug log files?

/home/forgerock/am/logs

/home/forgerock/am/var/logs

/home/forgerock/am/var/debug

/home/forgerock/am/debug

QUESTION 72
In order to support rollback in case of a failed PingAM upgrade in a two server PingDS environment, what PingDS safety measure can be configured?

Keep both PingDS instances active, upgrade against both PingDS instances, and use the PingDS ./uninstall.sh backout script if required

A PingAM upgrade in a two server PingDS environment does not support rollback

Stop replication between the two PingDS servers, stop a PingDS instance, upgrade against the active PingDS instance, and simply start up the shutdown PingDS instance

Stop replication between the two PingDS servers, stop a PingDS instance, upgrade against the active PingDS instance, and use the shutdown instance in case of rollback