The ForceAuth=true query parameter instructs PingAM to challenge the user for credentials, regardless of whether they have an existing valid session. This ensures that the user re-authenticates for the current transaction. This mechanism is commonly used to step-up security for accessing sensitive resources or performing critical actions, guaranteeing the user's presence at that specific moment. It effectively ignores the single sign-on (SSO) state for that one request.

B. This parameter forces a full re-authentication from the beginning of the configured chain or tree, not necessarily just a second factor.

C. ForceAuth is a recognized and processed parameter within PingAM for controlling authentication behavior.

D. This describes a multi-factor authentication enrollment prompt, which is a different function from forcing re-authentication.

1. Ping Identity, PingAM 7.3 Documentation, "Authentication," Section: "Authentication request parameters." (This section details parameters like ForceAuth that can be appended to the authentication URL to modify the authentication process).

2. ForgeRock, Access Management 6.5 Documentation, "Authentication," Section: "Authentication Endpoint Parameters." (PingAM is based on ForgeRock AM, and this documentation explicitly states: "If the value of this parameter is true, the user must reauthenticate, even if they have a valid session.").

When configuring an LDAP data store in PingAM, the LDAP Users Search Attribute specifies the attribute in user entries that contains the login ID (e.g., uid, cn, or sAMAccountName). PingAM uses this attribute to search the directory and locate the correct user profile during the authentication process. Changing this value allows an administrator to adapt to different LDAP schemas where the username is stored in a different attribute.

B. LDAP Users Index Attribute is not a standard configuration term; indexing is a backend LDAP performance feature, not a search attribute setting in AM.

C. LDAP Users Bind Attribute is not a setting; the Bind DN is a full distinguished name, not a single attribute used for searching for users.

D. LDAP Users Find Attribute is not the correct name for the property in the PingAM data store configuration UI or its underlying properties.

1. Ping Identity, Access Management Documentation, "Configuring an LDAP data store", Section: "User Configuration". The documentation explicitly lists the field "LDAP Users Search Attribute" and describes it as "The attribute on user entries that contains the user's login ID."

2. Ping Identity, Access Management Documentation, "Create and configure data stores", Section: "LDAPv3 data store properties". This section details the properties for LDAP data stores, where the user search attribute is a key configurable element for defining how user identities are located.

This statement is not true because the PingAM tree designer enforces a Directed Acyclic Graph (DAG) structure. This means that creating loops, where a node's output path connects back to a preceding node in the same execution path, is explicitly prevented by the platform. This design constraint is crucial to avoid infinite loops during the authentication process, which would result in a denial of service for the user. While complex, branching logic is supported, cyclical paths are not.

A. This is true. Authentication trees must terminate, and they do so with "Success" or "Failure" nodes, or can redirect to another tree.

C. This is true. The tree designer is extensible and will display any correctly installed custom nodes or nodes from the Ping Identity Marketplace.

D. This is true. The "Inner Tree Evaluator" node is a standard component used to call and execute another tree as a modular part of the main flow.

1. Ping Identity Documentation, PingAM > Authenticate > "Journeys," Section "About authentication journeys," describes the flow and structure of trees, which inherently follow a DAG model without loops.

2. Ping Identity Documentation, PingAM > Authenticate > "Nodes," Section "Inner Tree Evaluator node," describes the functionality for integrating one tree within another.

PingAM offers two primary methods for performing the initial, basic configuration after deployment. Administrators can use a web-based graphical user interface (GUI) by navigating to the deployment URL in a browser, which provides a step-by-step wizard. Alternatively, for automated or headless environments, PingAM provides a command-line interface (CLI) tool named amsetup. This dual approach provides flexibility for different deployment and operational models.

B: This is incorrect because it omits the command-line amsetup tool, which is a fully supported method for initial configuration.

C: This is incorrect because a basic configuration is mandatory to set up administrator passwords, configuration stores, and user data stores.

D: This is incorrect because it omits the graphical user interface, which is a common and fully supported method for initial configuration.

Ping Identity, PingAM Documentation, "Setup and Maintenance Guide," Chapter: "Configuring AM," Section: "To Configure AM." The documentation explicitly states: "You can configure AM by using either the graphical user interface (GUI) configurator, or the amsetup command-line tool."

The recommended procedure for a PingAM upgrade using a replicated PingDS backend is to create an isolated environment to ensure a rollback path. This involves stopping replication between the two PingDS servers and shutting down one instance. This offline instance serves as a clean, pre-upgrade backup. The upgrade is then performed against the single active instance. If the upgrade fails, the modified instance can be discarded, and the untouched, shutdown instance can be brought back online to restore the previous state, effectively rolling back the changes.

A. Upgrading against both active instances simultaneously provides no rollback path, as both would be modified. The uninstall.sh script removes the product, it does not roll back data.

B. This is incorrect; a rollback path is a critical feature of enterprise software upgrade procedures and is supported.

C. This option is incomplete. Simply starting the shutdown instance is not the full rollback procedure; the failed instance must be taken out of service.

1. Ping Identity Documentation, PingAM > Installation > Upgrading AM > Preparing for an upgrade. The documentation explicitly states: "To provide a backout plan, you can break replication between two configuration stores before you upgrade. Upgrade one of the servers, and if the upgrade is successful, re-enable replication. If the upgrade fails, you can revert to the server that you did not upgrade."

In a PingAM cluster, debug levels are configured dynamically through the administrative console on a per-server (instance) basis. This allows an administrator to enable detailed logging for a specific service on a single server to troubleshoot an issue without affecting the performance of other servers in the cluster. The settings are stored in the configuration data store and applied to the selected server instance, providing granular control over logging.

A. Editing debug.properties directly is not the recommended method in a cluster, as changes can be overwritten by the central configuration.

C. Debug levels are set at the more granular server-instance level, not for an entire site, which is a logical grouping of servers.

D. Changing debug levels is a fundamental and necessary administrative task for diagnosing and resolving issues in any environment.

1. Ping Identity, PingAM Documentation, "Setup and Maintenance Guide," Chapter: "Monitoring Servers," Section: "To Configure Debug Logging for Troubleshooting." This section details the process of setting debug levels for specific services on individual servers through the admin console.

2. Ping Identity, PingAM Documentation, "Administration Guide," Chapter: "Server and Site Configuration," Section: "Configuring Server Defaults." This section explains that debug settings are part of the server-specific configuration managed within the UI.

In the OAuth 2.0 framework, clients are categorized based on their ability to maintain the confidentiality of their credentials. A confidential client is an application capable of securely storing its credentials, such as a client secret. Web applications, which run on a secure server, fit this definition perfectly. The server-side nature allows them to protect their credentials from exposure to end-users or other unauthorized parties. This is in contrast to public clients, which cannot guarantee the secrecy of their credentials.

A. Desktop clients run on a user's machine where credentials cannot be securely stored, making them public clients.

B. JavaScript clients run entirely within a user's browser, and their source code is accessible, so they cannot protect a client secret.

C. Web browsers are user-agents that render applications; the client is the application itself, which can be public (JavaScript) or confidential (server-side).

1. Ping Identity Documentation, PingAM > OAuth 2.0 and OIDC > Clients and applications. This section defines client types, stating, "Confidential clients can keep their credentials secret. For example, a Java web application that runs on a server can be a confidential client."

2. Internet Engineering Task Force (IETF), RFC 6749: The OAuth 2.0 Authorization Framework, Section 2.1, "Client Types". This RFC defines confidential clients as "clients capable of maintaining the confidentiality of their credentials (e.g., client secret) or capable of secure client authentication using other means."

The session denylist is a security mechanism used to ensure that logouts are immediately effective. When a user logs out, their session ID is added to the denylist. If PingAM later receives a request with a session ID that is on this list, it will reject the session as invalid, even if the session's expiration time has not yet been reached. This prevents the replay of a stolen session cookie after the legitimate user has explicitly logged out, closing a critical security window.

A: Session inactivity is managed by the idle timeout property of a session, not the denylist.

B: Restricted sessions refer to sessions bound to an IP address, a separate feature from the denylist.

D: Absolute session timeouts are managed by the maximum session time property, which causes sessions to be purged upon expiry.

Ping Identity, PingAM Documentation, "Session Management," Chapter: "Session denylist service." The documentation states: "The session denylist service stores information about logged out sessions... When a user logs out, AM adds their session to the denylist. When a request arrives with a session from the denylist, AM considers it invalid."

ForgeRock AM’s device-registration flow employs the specific registration nodes that actually enroll authenticators: OATH Registration Node (OTP tokens), Push Registration Node (AM Push), and WebAuthn Registration Node (FIDO2). MFA Registration Options is a routing node only and does not perform registration, so the required set is D.

A – Lacks WebAuthn Registration; MFA Registration Options is not a registration node.

B – Replaces Push Registration with WebAuthn; still contains non-registration MFA Options node.

C – Contains MFA Options (not a registration node) and omits OATH Registration.

1. ForgeRock AM 7.3 Authentication Trees Nodes Reference, “OATH Registration Node”, “Push Registration Node”, “WebAuthn Registration Node”. (docs.am/7.3/trees-ref)

2. ForgeRock AM 7.3 Authentication Trees Guide, §2.3 “Registering Devices”.

The "Token Exchange May Act Script" is used to determine if a client is permitted to impersonate another identity during an OAuth2 token exchange. This script can be configured globally for all clients under the realm's OAuth2 Provider service on the "Advanced" tab. To provide more granular control, this global setting can be overridden for a specific client within that client's profile on the "OAuth2 Provider Overrides" tab page. This dual-level configuration allows for both a default policy and client-specific exceptions.

A and C only: This option incorrectly includes the client's "Advanced" tab and omits the correct global configuration location on the provider's "Advanced" tab.

B and D only: This is the correct combination of options.

D and C only: This option incorrectly includes the provider's "Core" tab and the client's "Advanced" tab, neither of which is used for configuring this script.

1. Ping Identity Access Management Documentation, "OAuth 2.0 Provider Service advanced settings". This page details the "Token Exchange May Act Script" setting on the Advanced tab of the OAuth2 Provider service.

2. Ping Identity Access Management Documentation, "OAuth 2.0 Provider Overrides tab". This page explains that settings from the OAuth2 Provider service, including scripts, can be overridden for individual clients on this tab.