Free PAP-001 Practice Test Questions and Answers (2026) | Cert Empire Practice Questions

The run.properties file, located in the pingaccess/conf directory, is used to configure various runtime settings for the PingAccess server. To manage the number of configuration backups stored in the data/archive folder, the administrator must modify the pa.archive.backup.retained.count property within this file. By default, PingAccess retains 10 backups. Adjusting this value allows an administrator to increase or decrease the number of historical configuration archives that are kept.

A. log4j2.db.properties: This file is used to configure properties for database-specific logging with the Log4j2 framework, not for managing configuration archives.

B. jvm-memory.options: This file exclusively controls the Java Virtual Machine (JVM) memory settings, such as heap size, for the PingAccess process.

D. log4j2.xml: This is the main configuration file for the Log4j2 service, which manages the generation, rotation, and formatting of PingAccess application log files.

1. Ping Identity PingAccess Administrator Guide 7.3, Section: "Managing configuration archive backups", Page 31. "PingAccess automatically backs up the H2 database file, data/pa.h2.db, to the data/archive directory... The number of backups to retain is configurable in the run.properties file."

2. Ping Identity PingAccess Administrator Guide 7.3, Section: "Modifying the run.properties file", Page 29. This section details the purpose of the run.properties file and lists pa.archive.backup.retained.count as a key property for "The number of configuration backups to retain."

The PingAccess installation directory structure designates the data directory as the location for storing persistent application data. This includes the embedded H2 database files (pa.h2.db) and, by default, the configuration archives (.zip files) that are generated when using the backup and restore utilities. This separation ensures that runtime configuration (conf), executable scripts (bin), and persistent data (data) are kept in distinct, manageable locations.

A. tools: This directory contains command-line utilities and scripts, such as export-admin-config.sh, which are used to create the archives, but it does not store the archive files themselves.

B. conf: This directory holds the active configuration files that PingAccess uses at runtime, such as run.properties and bootstrap.properties, not historical configuration backups or archives.

D. bin: This directory contains the primary executable scripts for starting and stopping the PingAccess server, such as run.sh and run.bat.

1. Ping Identity PingAccess Documentation: Server file reference. This document outlines the top-level directories in a PingAccess installation. It explicitly states: "data - Contains the H2 database files and configuration archives." (Accessed under the "Administration" section of the relevant PingAccess version documentation).

2. Ping Identity PingAccess Documentation: Backing up and restoring a configuration. This guide describes the process of using the export-admin-config tool. While the tool is in the tools directory, the output archive is, by convention and default behavior, placed in the data directory to separate it from the tooling itself.

PingAccess can inject user attributes into requests only if those attributes are present in the OIDC/JWT presented by the IdP.

1) The IdP (token provider) therefore must be configured to add the required claims to the ID token (A).

2) After the claims exist, the PingAccess administrator must modify the Identity Mapping to pull the new claims from the ID token and place them into HTTP headers, cookies, or query parameters forwarded to the protected web application (B).

No changes to the Site Authenticator, Web Session, or access token are needed for attribute-injection in a browser-based OIDC-protected application.

C. Site Authenticator only governs how PingAccess sends credentials to the target site; it does not expose additional user attributes.

D. PingAccess injects attributes from the ID token, not the access token, for web applications; changing the access token would have no effect.

E. Web Session controls token caching/lifetime, not which attributes become available or forwarded.

1. Ping Identity, “PingAccess Administration Guide 2023 R1,” Section “Identity Mapping,” pp. 64-67: “PingAccess can map ID token claims to headers… ensure the IdP includes the required claims.”

2. Ping Identity, “PingFederate Server Guide 11.3,” Chap. 15 “OIDC Token Attribute Contract,” p. 454: “Add attributes to the ID token so relying parties can consume them.”

3. Ping Identity, “PingAccess OIDC Integration Overview,” v1.2, §3.2 “ID Token Claims as Attributes,” p. 10.

When PingAccess protects an API as an OAuth Resource Server, it must validate the access token presented with each request. This validation often involves a call to the authorization server (e.g., PingFederate) for token introspection. For an API in a remote datacenter, the added latency of this validation call for every API request can significantly degrade performance. Enabling "Cache Token" on the resource configuration allows PingAccess to cache the token validation result. For subsequent requests using the same token, PingAccess uses the cached result, eliminating the need for a new introspection call and thereby reducing overall response time.

A. Reduce the Key Roll Interval on the web session: This setting pertains to the security of PingAccess web sessions, not API access token validation. Reducing the interval would increase overhead, not improve performance.

B. Move the API to a separate Virtual Host: Virtual Hosts are used to segregate configurations and listen on different host/port combinations. This does not address the network latency of validating a token or calling the remote API.

C. Reduce the number of attributes in the ID Token: The ID Token is for client-side authentication and is not typically sent to the API. The Access Token is used for API authorization, and its validation is the performance bottleneck addressed by caching.

1. Ping Identity PingAccess 7.3 Documentation, "Resources" section, "Add a resource" subsection.

Reference: "For an OAuth resource, you can enable token caching to improve performance. When token caching is enabled, PingAccess caches the token introspection result from PingFederate. Subsequent requests that use the same access token can be validated using the cached result, avoiding a call to PingFederate." This directly states that token caching is a performance-improving feature that avoids repeated validation calls.

2. Ping Identity PingAccess 7.3 Documentation, "Performance Tuning" section.

Reference: The performance tuning guide often highlights caching mechanisms as a primary method to reduce latency. It explains that minimizing external calls, such as token validation requests to PingFederate, is critical for high-throughput scenarios. Caching the access token validation is a key recommendation.

The HTTP Basic Authentication method for the PingAccess Administrative Console supports only a single administrator account. This method is configured by defining a single username and password (or password hash) within the run.properties configuration file. It is intended for initial setup, emergency access, or simple deployments where a single administrator is sufficient. For environments requiring multiple distinct administrator accounts with features like Single Sign-On (SSO), PingAccess must be configured to use an external OpenID Connect (OIDC) Provider, such as PingFederate.

A. 1000: This is incorrect. The HTTP Basic method is not designed for managing multiple users and has no capacity for this scale.

C. 10: This is incorrect. The configuration parameters in run.properties only allow for the definition of one username and password pair.

D. 100: This is incorrect. The built-in HTTP Basic authentication mechanism does not support multiple accounts.

1. Ping Identity PingAccess 7.3 Documentation, "Configuring administrative authentication," Section: "Configure HTTP Basic administrative authentication." The documentation details the configuration using the singular properties pa.admin.username and pa.admin.password in the /conf/run.properties file, which demonstrates that only one set of credentials can be defined.

2. Ping Identity PingAccess 7.3 Documentation, "Configuring administrative authentication," Section: "Configure single sign-on for administrative authentication." This section explicitly states that to support multiple administrators, an external identity provider using OpenID Connect (like PingFederate) should be configured, reinforcing that the built-in HTTP Basic method is not intended for this purpose.

An Authentication Challenge Policy is the specific mechanism within PingAccess designed to enforce step-up authentication. An administrator can create this policy and apply it via a rule to a select group of resources. When a user attempts to access one of these protected resources, the policy triggers a new authentication event with PingFederate, which can be configured to require a higher level of assurance (e.g., MFA). This directly meets the requirement of applying stronger authentication to specific resources while leaving others under the existing authentication context.

B. Use context root as reserved resource base path: This is an application-level setting that prevents conflicts between the application's URLs and PingAccess's own internal URLs, and is unrelated to authentication policy.

C. Change the Context Root: This action modifies the base URL path for the entire application. It does not selectively apply different authentication requirements to specific resources within that application.

D. Manual Resource Ordering: This feature controls the evaluation priority when a request matches multiple resource paths. While potentially needed for complex rule sets, it does not create the step-up authentication requirement itself.

1. Ping Identity PingAccess 7.3 Administrator's Guide, Section: "Policy", Subsection: "Authentication Challenge Policy".

Quote/Concept: This section explicitly states, "The Authentication Challenge policy forces reauthentication for a request... This policy is useful for step-up authentication scenarios where access to a resource requires a different authentication level or context than the one associated with the existing PingAccess session."

2. Ping Identity PingAccess 7.3 Administrator's Guide, Section: "Configuring rules", Subsection: "Add a rule".

Quote/Concept: This section details the process of creating a rule and selecting a policy type, such as an Authentication Challenge Policy. It also shows how rules are associated with specific resources, demonstrating the granular control required by the scenario.

3. Ping Identity PingAccess 7.3 Administrator's Guide, Section: "Configuring applications", Subsection: "Add an application".

Quote/Concept: This section describes the "Context Root" and "Use Context Root as Reserved Resource Base Path" fields as foundational URL path settings for an entire application, confirming they are not used for per-resource authentication logic.

In PingAccess, a Virtual Host defines the specific hostname and port that PingAccess listens on for incoming client requests. To terminate SSL/TLS for a proxied application, PingAccess must present the correct server certificate to the client. This is achieved by associating a pre-imported Key Pair (which contains the certificate and its private key) with the Virtual Host that corresponds to the application's public-facing hostname. This action configures the HTTPS listener for that specific host, enabling secure communication between the client and the PingAccess proxy.

B. Enable Require HTTPS in the Application configuration: This setting enforces that clients must use HTTPS to access the application, but it does not configure the certificate itself. The certificate must first be assigned to a listener.

C. Assign the Key Pair to the Agent Listener: Agent Listeners are for secure communication between a PingAccess Agent and the PingAccess server, not for terminating SSL from an end-user's client connection to the proxy.

D. Set the secure flag to Yes in the Site configuration: This flag configures whether PingAccess uses HTTPS to connect to the backend web server (the Site). It does not affect the client-to-PingAccess SSL termination.

---

1. Ping Identity PingAccess 7.3 Administrator's Guide, Section: Configuring virtual hosts.

Reference Detail: The guide states, "Virtual hosts define the host and port combinations that PingAccess listens on for client requests... If you want to enable HTTPS for a virtual host, you must select a key pair." This directly confirms that assigning the Key Pair to the Virtual Host is the required action.

2. Ping Identity PingAccess 7.3 Administrator's Guide, Section: Adding an application.

Reference Detail: The description for the "Require HTTPS" setting is: "Select this check box to require that requests for this application use a secure connection." This clarifies its role as an enforcement mechanism, not a configuration step for the certificate.

3. Ping Identity PingAccess 7.3 Administrator's Guide, Section: Adding a site.

Reference Detail: The documentation for the "Secure" option within a Site's configuration states: "Select this check box if the site requires an HTTPS connection." This confirms the setting applies to the connection between PingAccess and the backend server.

To configure PingAccess to write logs to an external database like Oracle, two primary actions are required. First, the Java Database Connectivity (JDBC) driver for the specific database must be made available to the PingAccess application. This is accomplished by placing the driver's JAR file into the PAHOME/lib directory. Second, the PingAccess logging framework, Log4j2, must be configured to use this driver and connect to the database. This involves modifying log4j2.xml to define a JDBC appender and editing log4j2.db.properties to specify the database connection URL, credentials, and other parameters.

B. Removing existing log files is a file system maintenance task and does not configure or enable logging to a new destination.

C. The Audit flag within a Resource's configuration controls whether access to that specific resource is logged, not where the log data is sent.

E. Importing a database certificate is only required if the connection to the database is secured with TLS and the certificate is not already trusted by PingAccess's Java runtime.

1. PingAccess Administrator's Guide, Section: Configuring database logging.

This section explicitly outlines the required steps. It states: "1. Copy the JDBC driver JAR file for your database to the /lib directory." This directly supports answer D.

It continues with: "2. Configure the database connection properties in /conf/log4j2.db.properties." and "3. Configure the JDBC appender in /conf/log4j2.xml." These two points collectively support answer A.

In the PingAccess object model, the "Application" is the primary container for all related configurations. Before defining specific paths (Resources) or applying rules, an administrator must first create the Application object. This object defines the application's main entry point, including its virtual host and context root. All subsequent configurations, such as resources, identity mappings, and policy rules, are nested within this parent Application. Therefore, creating the Application is the foundational first step for onboarding.

A. Identity mapping: Identity mappings are configured within an Application or a Resource to pass user attributes to the backend; they cannot be created before the Application itself exists.

B. Web session: A Web Session is a required component that an Application is associated with, but the first step in onboarding the specific application is to define it, not the session it will use.

D. Resource: Resources represent specific URL paths under an Application. A Resource cannot be defined without first creating the parent Application to which it belongs.

1. PingAccess 7.3 Administrator's Guide, "Applications" section: "Applications are the top-level objects in the PingAccess policy model. An application represents a web application that you want to protect... You must define an application before you can define resources, rules, or other policy elements for it." (This establishes the hierarchy and confirms Application is the first step).

2. PingAccess 7.3 Administrator's Guide, "Add an application" section: This section details the procedure for creating a new application, which is presented as the initial step before configuring its components. It states, "To protect a web application, you first add it to PingAccess." The steps then proceed to define the application's name, context root, and virtual host.

3. PingAccess 7.3 Administrator's Guide, "Resources" section: "A resource is a specific path within an application that you want to protect. Resources are defined as children of an application." (This explicitly states that Resources are subordinate to Applications, making Application creation a prerequisite).

In PingAccess, auditing is configured on a per-resource basis. To capture all access requests for a specific resource, such as /admin, the most direct and appropriate method is to enable the "Audit" option within the configuration settings for that particular resource. This setting instructs the PingAccess engine to generate an audit log entry for every policy evaluation related to that resource path, providing granular control over what is logged. This approach is precise and avoids generating unnecessary log entries for other resources.

B. Enabling the Audit option for the / resource is incorrect because it is too broad. This would capture audit events for all resources, not just the /admin resource as specified in the requirement.

C. Splunk is a log aggregation and analysis tool, a potential destination for logs. The generation of the audit event itself must first be configured within PingAccess, not in the external logging system.

D. The log4j2.xml file configures the logging framework's behavior, such as log levels, formats, and appenders (destinations). It does not control the application-level policy decision of which specific resources to audit.

1. PingAccess 7.3 Administrator's Guide, Section: "Defining resources". The documentation details the configuration fields available when creating or editing a resource. It explicitly lists an "Audit" checkbox with the description: "Select this check box to log all access attempts to this resource in the audit log." This confirms that auditing is a specific setting on the resource itself.

2. PingAccess 7.3 Administrator's Guide, Section: "Configuring audit logging". This section describes how to configure the destination for audit logs (e.g., file, syslog, Splunk) via the log4j2.xml file, but it clarifies that the decision to audit a request is made at the application/resource policy level, not within the logging framework configuration. This distinguishes the roles of resource configuration (Option A) from logging infrastructure configuration (Options C and D).

The engine.ssl.protocols property within the run.properties file is used to explicitly define the SSL/TLS protocol versions that the PingFederate runtime engine's listeners will support. Administrators use this property to enhance security by disabling older, vulnerable protocols (e.g., SSLv3, TLSv1.0, TLSv1.1) and enforcing the use of modern, secure versions like TLSv1.2 and TLSv1.3. The value is a comma-separated list of the desired protocol versions. This configuration applies to the main HTTPS listeners of the PingFederate server.

A. Supported ciphers are configured using a different property, typically pf.engine.ssl.ciphers.

B. The HTTPS port is configured using the pf.https.port property.

D. This property affects all engine listeners, not just clustering; specific clustering communication settings are managed elsewhere.

---

1. Ping Identity PingFederate Documentation, Server Administration > System Services > Configuring protocols and cipher suites. This section explicitly states: "To specify the protocols for the PingFederate runtime-engine listeners, edit the pf.engine.ssl.protocols property in the /pingfederate/bin/run.properties file."

2. Ping Identity PingFederate Documentation, Installation > Pre-installation planning > System requirements > Java virtual machine options. The documentation notes that the JVM's enabled protocols can be a limiting factor, but PingFederate's specific protocol configuration is managed in run.properties via pf.engine.ssl.protocols.

3. Ping Identity Knowledge Base, Article 000030400, How to change the default TLS protocol version of PingFederate. This official support article guides administrators to "Modify the pf.engine.ssl.protocols parameter in the /pingfederate/bin/run.properties file" to control the enabled TLS versions.

The admin.auth configuration setting, specifically admin.auth.type within the run.properties file, is designed as a failsafe mechanism for the PingAccess administrative console. When Single Sign-On (SSO) is configured as the primary authentication method for administrators, this setting allows for an alternative method, such as basic authentication, to be enabled. Its purpose is to override the SSO flow, ensuring that an administrator can still log in if the primary identity provider (e.g., PingFederate) is unavailable, thereby preventing administrative lockout.

A. SSO for the administrative UI is configured within the PingAccess console itself, not directly through this failsafe setting in the run.properties file.

B. Administrative API authentication is configured separately, typically using OAuth 2.0 client credentials or a dedicated basic authentication account, and is distinct from this UI-specific setting.

D. This setting configures an explicit, alternative authentication challenge (like a username/password prompt); it does not enable any form of automatic or passwordless sign-on.

---

1. Ping Identity PingAccess 7.3 Documentation, Administrator Guide, "Configuring administrative authentication," Section: "Failsafe administrative sign on."

This section explicitly states, "To prevent being locked out of the PingAccess administrative console if PingFederate is unavailable, you can configure a failsafe authentication method... This is done by setting the admin.auth.type property in the run.properties file to basic." This directly supports the concept of an override or failsafe.

2. Ping Identity PingAccess 7.3 Documentation, Administrator Guide, "Getting Started," Section: "The run.properties file."

This section details the properties within the run.properties file. For admin.auth.type, it describes the available values (sso or basic) and clarifies that basic can be used as a fallback when SSO is the primary method, reinforcing its role as an override mechanism.

RFC-5280 (Section 6) specifies the algorithm for validating a certification path, which typically assumes a coherent, ordered chain from the end-entity certificate to a trusted root. When a legacy PKI solution does not adhere to this standard, it may present the certificates in the chain out of order. The "Validate disordered certificate chains" option in PingAccess is specifically designed to address this issue. When enabled, PingAccess will attempt to reorder the provided certificates to build a valid path to a trusted certificate authority, thereby accommodating the non-compliant behavior of the legacy system.

A. Use Java Trust Store: This option supplements the configured trust group with CAs from the JVM's default trust store; it does not alter the logic for validating the order of a certificate chain.

C. Skip Certificate Date Check: This option bypasses the notBefore and notAfter validity checks on a certificate, which is unrelated to the structural validation of the certificate path itself.

D. Deny when unable to determine revocation status: This setting controls behavior related to certificate revocation checking (CRL/OCSP), which is a separate process from the initial path construction and validation.

1. Ping Identity PingAccess 7.3 Documentation:

Source: PingAccess Administrator Guide > Configuring PingAccess > Configuring Trusted Certificate Groups.

Reference: In the "Trusted Certificate Group Fields" table, the description for Validate disordered certificate chains states: "Select this check box to allow PingAccess to validate certificate chains that are not in the correct order. This option is useful when working with older systems that do not order certificate chains correctly." This directly addresses the scenario of a legacy system not adhering to standard chain presentation.

To prevent PingAccess from starting automatically on a Windows Server, the associated Windows Service must be removed. PingAccess provides a specific batch script for this purpose. The uninstall-service.bat command, located in the /bin directory, unregisters the PingAccess service from the Windows Service Control Manager. Once the service is removed, it can no longer be started automatically by the operating system during boot-up.

A. init.bat: This is not a standard script provided with PingAccess for managing the Windows service. Its function is not related to service installation or removal.

C. remove-install.bat: This is not a valid or documented PingAccess command. There is no such script included in the standard PingAccess distribution for service management.

D. wrapper-service.bat: While this script interacts with the Java Service Wrapper, it is not the primary command intended for administrators. The uninstall-service.bat script is the designated high-level utility that calls the wrapper with the correct parameters for service removal.

1. Ping Identity PingAccess 7.3 Documentation, "Start and stop PingAccess," section "Running PingAccess as a service on Windows."

This official guide explicitly states: "To remove the PingAccess service, run /bin/uninstall-service.bat." This confirms that uninstall-service.bat is the correct command to unregister the service, thereby preventing it from starting automatically.

In PingAccess, the SameSite attribute for the session cookie (PA.user) is a global setting that dictates browser behavior for cross-site requests. This critical security setting is configured centrally within the Web Sessions section of the administrative console. This allows administrators to enforce a consistent session cookie policy (e.g., Lax, Strict, or None) across all applications and user sessions managed by that PingAccess instance, enhancing protection against cross-site request forgery (CSRF) attacks.

A. Rules: Rules are used to define the logic for granting or denying access to resources, not for configuring session cookie attributes.

B. Sites: Sites define the backend web servers that PingAccess protects; they do not control the properties of the PingAccess session cookie.

C. Applications: Applications define the specific resources being protected, but the fundamental behavior of the session cookie is managed globally under Web Sessions.

1. Ping Identity PingAccess 7.3 Administrator's Guide, Section: "Configuring Web Sessions". The configuration table in this section explicitly lists the "SameSite Cookie" setting and its available options (Disabled, Lax, Strict, None), confirming its location within the Web Sessions menu. (Accessed via Ping Identity Documentation portal).