Free Practice Questions for Ping Identity PT-AM-CPE Exam

Answer : A

According to the PingAM 8.0.2 Installation Guide, once the am.war file has been deployed into a web container (such as Apache Tomcat), the administrator must perform an initial configuration to set up the configuration store and the primary administrative user (amAdmin). PingAM provides two primary pathways for this 'basic' configuration to accommodate different environment needs:

GUI-based Configuration (Interactive): By accessing the AM deployment URL (e.g., https://auth.example.com:8443/am) in a standard web browser, the administrator is presented with an interactive setup wizard. This wizard guides the user through the license agreement, setting the amAdmin password, and defining the connection details for the Configuration Store (typically PingDS). This is the preferred method for single-instance setups or initial trials.

Command-Line Configuration (Automated/Passive): For DevOps-centric deployments, headless environments, or automated scripts, PingAM provides the configurator.jar (often used for 'Passive' installations). Additionally, for version 8 deployments, Amster is the primary command-line interface (CLI) tool. Amster allows administrators to import a full configuration state from JSON files, bypassing the GUI entirely. This is crucial for CI/CD pipelines and Kubernetes-based deployments (like the ForgeOps CDK/CDP).

The flexibility to use either the browser-based GUI or command-line tools ensures that PingAM can be deployed efficiently across diverse infrastructures, from traditional on-premises servers to modern cloud-native orchestration platforms. Therefore, Option A is the correct answer as it recognizes both valid administrative interfaces for the initial setup.

Answer : D

In a high-availability PingAM 8.0.2 cluster, Affinity Load Balancing is a mechanism used to ensure that requests related to a specific session or configuration are routed to the same Directory Server (DS) instance to avoid issues with replication lag. This is particularly important for stores where data changes frequently or where consistent reads are required immediately after a write.

According to the PingAM documentation on 'Load Balancing' and 'External Data Stores,' affinity can be configured for the following primary stores:

Core Token Service (CTS) Store: This is the most critical area for affinity. Since the CTS handles stateful data like session tokens and OAuth2 tokens that are updated constantly, ensuring that an AM server consistently communicates with a specific DS node (using the HOST:PORT|SERVERID|SITEID syntax) prevents 'token not found' errors that might occur if a request reached a DS node before the token was replicated.

Configuration Store: This store holds the central configuration for the AM deployment. In multi-server environments, affinity ensures that configuration changes are read consistently across the cluster.

Identity Stores: These hold the user profiles. While often read-heavy, affinity is used here to improve caching efficiency and ensure that profile updates (like password changes or attribute updates) are reflected immediately in subsequent authentication steps within the same cluster.

Policy Data Store: This stores authorization policies. Similar to configuration, affinity ensures consistent policy evaluation.

Option D is the correct answer because it includes the Core Token Service, Identity Stores, Configuration Store, and Policy Data Store. The 'Application Data Store' (mentioned in other options) is often logically grouped with or replaced by the Policy Data Store in many 8.0.2 configurations, but the four stores listed in Option D are the specific ones explicitly called out in the 'External Data Stores' secondary configuration documentation for supporting affinity settings.

Answer : D

When PingAM is installed, it creates a specific directory structure within its Configuration Directory (also known as the AM_HOME or .openamcfg pointer target). This structure is standardized across versions to ensure that administrators and automated scripts can locate critical files.

According to the PingAM 8.0.2 'File System Reference' and 'Debug Logging' documentation:

The primary directory for engine-level troubleshooting files (debug logs) is named debug.17 This directory is located immediately within the root of the configuration directory. Therefore, if the configuration path is explicitly set to /home/forgerock/am, the resulting path for debug files will be /home/forgerock/am/debug (Option D).

It is important to distinguish between Audit Logs and Debug Logs:

Audit Logs: (e.g., access.audit.json) are usually found in the .../openam/log or .../openam/logs directory (making Option A a common distractor).

Debug Logs: (e.g., amAuth, amSession, amCore) are strictly stored in the debug directory.

The var directory (Options B and C) is a convention used in some ForgeRock 'ForgeOps' containerized deployments (like those in Kubernetes) to separate variable data from static config. However, in a standard standalone installation as described in the question, the direct .../debug path is the verified default behavior of the PingAM installation wizard and configurator tool.

Answer : C

In PingAM 8.0.2, choosing the correct OAuth2 grant flow depends entirely on the type of client and the nature of the resource access. For a microservice (a machine-to-machine scenario), the Client Credentials Flow (defined in RFC 6749) is the industry-standard and documented best practice.

A microservice is categorized as a Confidential Client because it runs on a secure server where it can safely store its own credentials (client_id and client_secret). In a microservice-to-microservice interaction, there is no 'end-user' present to provide consent or enter a password. Instead, the microservice authenticates as itself to the PingAM token endpoint.

According to the PingAM 'OAuth 2.0 Grant Flows' documentation:

The microservice sends a POST request to the /oauth2/access_token endpoint.

The request includes the grant_type=client_credentials parameter along with the client's own authentication (such as Basic Auth with secret, or mTLS).

PingAM validates the client's credentials and scopes.

Since this is a machine-to-machine flow, PingAM bypasses the user authorization (consent) step and issues an Access Token directly to the service.

Why other options are incorrect:

Implicit flow (A) and Authorization code flow (B) are designed for scenarios where a human user is present to authenticate and authorize access.

Resource owner flow (D) (also known as the Password grant) requires the service to handle a user's cleartext credentials, which is a major security risk and is deprecated in modern security architectures.

The Client Credentials flow ensures that microservices can securely obtain the tokens necessary to communicate with other protected APIs within the ecosystem without requiring human intervention.

Answer : B

CSRF stands for Cross-Site Request Forgery.8 It is a common web security vulnerability where an attacker tricks a victim's browser into performing an unwanted action on a different website where the victim is currently authenticated.9

In the context of PingAM 8.0.2 and the OAuth 2.0 /authorize endpoint, CSRF protection is vital.10 If an attacker can forge an authorization request, they might be able to inject their own authorization code into a victim's session or link a victim's account to an attacker-controlled client.

To mitigate this, the OAuth 2.0 protocol uses a parameter (often named state in the RFC, but referred to in PingAM's security configuration and logging as a CSRF-related check) to ensure that the request returning to the client is the same one that the client initiated.11 PingAM's 'Security Considerations' documentation explains that the server enforces Cross-Site Request Forgery protection by verifying that requests originate from trusted sources and include unpredictable tokens that an external malicious site could not guess or recreate.12

In AM 8.0.2, you can configure the 'CSRF Protection Filter' which can be applied to various endpoints to prevent unauthorized state-changing commands.13 This is particularly important for the administration UI and the authentication endpoints where a user's session is active. Understanding that CSRF stands for Cross-Site Request Forgery is a fundamental requirement for any security professional working with identity protocols and PingAM hardening.