Free PT-AM-CPE Practice Test Questions and Answers (2026) | Cert Empire Practice Questions

For edge-initiated step-up or transactional authorization, the client must indicate which higher authentication context to invoke by supplying the query parameters authIndexType (typically set to service or module) and authIndexValue (the name of that service/module). No other parameters are mandatory.

B – “service” is not a separate parameter; it is the value of authIndexType.

C – ForceAuth is optional; only authIndexType/value are required.

D – Lacks the mandatory authIndexValue and misuses “service”.

1. ForgeRock Access Management 7.3 Authentication & SSO Guide, §6.6.4 “Requesting Step-Up Authentication” (authIndexType & authIndexValue required).

2. ForgeRock Identity Gateway 7.2 User Guide, §“Step-Up Authentication with AM” (lists mandatory parameters).

The error "user requires profile to login" occurs when PingAM is configured in a mode where it does not manage user profiles within its own data store, but an authentication journey attempts an action that requires one. This happens when the realm's "User Profile" setting is "Ignored". In this mode, AM expects the identity repository (e.g., an external LDAP) to be the sole source of truth. If a node in the authentication tree (e.g., "Data Store Decision" or "Attribute Collector") tries to read from or write to a local AM profile that doesn't exist, this specific error is triggered.

A. Policy misconfiguration would typically result in an authorization failure or "Access Denied" message, not a profile-specific error during login.

C. If a user has not filled in required profile information, the journey would typically direct them to a profile completion page or fail with a different message.

D. Incorrect credentials would result in a clear "Authentication Failed" or "Invalid username or password" error message.

1. Ping Identity Access Management Documentation, "Realms > To Create a Realm". In the "Identity Store" section, the "User Profile" property is described. Setting this to "Ignored" can lead to the specified error if authentication journeys are not designed accordingly.

2. Ping Identity Access Management Documentation, "Troubleshooting > Authentication". This section details common authentication errors. The error "user requires profile to login" is explicitly linked to the realm's user profile configuration being set to "Ignored" while a journey requires a profile write.

The forgeops delete command is designed to remove the specific Ping Identity Platform deployment created by the Cloud Developer Kit (CDK). This includes the Kubernetes resources that constitute the platform stack, such as the pods, services, and deployments for Access Management, Identity Management, and Directory Services. It also removes the associated Persistent Volume Claims (PVCs) and configuration artifacts. The command's scope is intentionally limited to the application stack itself and does not remove shared, cluster-level prerequisites.

A. The ingress controller is a cluster-level prerequisite and is not removed by the forgeops delete command.

B. The certificate manager and secret agent are cluster-level prerequisites and are not removed by the forgeops delete command.

C. The ingress controller, DS operator, certificate manager, and secret agent are all cluster-level prerequisites not managed by the CDK deployment lifecycle.

1. Ping Identity DevOps Documentation, forgeops > Get started > Clean up your CDK deployment. The documentation states: "When you're finished with your CDK deployment, run the forgeops delete command. This command deletes the Ping Identity Platform deployment and the persistent volume claims from your Kubernetes cluster." It makes no mention of removing cluster prerequisites like ingress or cert-manager.

Extended metadata in PingAM is a proprietary extension to the standard SAML 2.0 metadata format. Its purpose is to store and communicate additional configuration information specific to PingAM that is not covered by the SAML standard. This can include settings for attribute mapping, transient user creation, account linking, and other specific processing rules that are necessary for federation partnerships to function correctly within a PingAM environment (formerly a "Circle of Trust"). This allows for richer integration and configuration than standard metadata alone permits.

A. It specifies the certificates and keys for the SAML2 entity: Certificates and keys are part of the standard SAML 2.0 metadata specification within the KeyDescriptor element.

B. It specifies the policy to invoke during SAML2 federation: While this is an example of information that can be in extended metadata, it is not the overall purpose. Option D is a more accurate, general definition.

C. It is a standard way to communicate supported SAML2 features: Extended metadata is, by definition, non-standard and specific to PingAM. Standard features are communicated through standard metadata elements and protocol messages.

Ping Identity Documentation, PingAM > Federation > SAML v2.0 Guide for Administrators > The Extended Metadata Template. The guide states: "AM uses an extended metadata file to store information that is not included in the standard SAML v2.0 metadata."

Ping Identity Documentation, PingAM > Administration > Realms > Realm > Applications > Federation > Entity Providers. The configuration options for SAML2 entity providers detail numerous settings (e.g., Attribute Mapper, NameID format) that are stored in this extended metadata.

In PingAM authentication trees, the sharedState is the designated mechanism for passing information between nodes within a single authentication transaction. For a mobile device, a device profiling node can collect context data and write it to the sharedState. A subsequent node, such as one performing risk analysis, can then read this data from the sharedState to inform its decision. This approach is best practice because the data is transient, scoped only to the current authentication flow, and does not permanently alter the user's profile.

A. The session state is generally created after a successful authentication journey, not for passing data between nodes during it.

C. The user profile is for storing persistent identity attributes, not for temporary, transactional context data like device information.

D. Storing potentially sensitive, server-side context data in a client-side browser cookie is insecure and not a viable pattern for trees.

1. Ping Identity Documentation, PingAM > Develop > "Custom nodes," Section "How state is passed between nodes," describes the use of sharedState and transientState for communication between nodes.

2. Ping Identity Documentation, PingAM > Authenticate > "Nodes," describes how various nodes (e.g., Device Profile Collector) place information into the shared state for consumption by other nodes.

PingAM supports a wide range of multi-factor authentication (MFA) mechanisms through its authentication tree framework. The options listed in C represent three distinct and modern MFA methods: Open Authentication (OATH) for Time-based One-Time Passwords (TOTP), Web Authentication (WebAuthn) for FIDO2/passkeys, and Push Authentication for mobile device notifications. While Security Questions (B) and U2F (D) are also supported, the combination in C provides a strong representation of contemporary MFA protocols and methods available in PingAM. U2F is an older standard largely superseded by WebAuthn.

A, B, and D: These options are incomplete or include less common/older methods. While all individual items (A, B, C, D, E) are supported by PingAM, the question seeks the best combination representing its MFA capabilities.

Ping Identity, PingAM Documentation, "Authentication nodes," Section: "Node Groups." This section lists available nodes including "OATH Authenticator Node," "Push Sender Node," "WebAuthn Authentication Node," "U2F Registration Node," and "Knowledge-Based Authentication Node," confirming support for all listed mechanisms.

Ping Identity, PingAM Documentation, "About multi-factor authentication." This guide provides an overview of MFA concepts and highlights the use of OATH, Push, and WebAuthn as primary methods.

The "Set Session Properties" node is a component within PingAM authentication trees specifically designed to add or update key-value pairs in the authenticated user's session. After this node executes successfully within a journey, the specified properties become available in the session state. This data can then be retrieved by other nodes later in the flow, used by policy conditions, or passed to applications in tokens, enabling dynamic and stateful authentication experiences.

A. The Get Session Data node: This node retrieves existing data from the session to make decisions; it does not set or add new properties.

B. You have to use a webhook, not a node: While a webhook can interact with external systems, PingAM provides a dedicated, internal node for this common task, making it the direct and correct answer.

C. The Provision Dynamic Account node: This node is used for just-in-time user provisioning into a data store, not for manipulating session state.

PingAM Documentation, "Authentication and single sign-on Guide" -> "Nodes reference" -> "Set Session Properties node". The documentation states, "Use this node to add properties to the user's session. The properties are stored as key-value pairs in the session properties."

Both Push notifications and Open Authentication (OATH) typically require a separate physical device, such as a smartphone, and a specific application installed on it. For Push, an application like PingID receives a notification to approve or deny a login attempt. For OATH (specifically TOTP/HOTP), an authenticator application (e.g., PingID, Google Authenticator) on the device generates a one-time passcode. Both methods fulfill the dual requirement of a separate device and a dedicated application.

A. Push, WebAuthn: WebAuthn does not always require a separate device; it supports platform authenticators (e.g., Windows Hello, Touch ID) built into the primary device.

B. Push, WebAuthn, Open Authentication: This option is incorrect because WebAuthn does not strictly meet the criteria, as explained above.

C. WebAuthn, Open Authentication: This option is incorrect because WebAuthn can use same-device platform authenticators, thus not requiring a separate device.

1. Ping Identity Documentation, PingID, "PingID authentication methods". This documentation describes Push notifications as requiring the PingID mobile app on a paired device. It also describes OATH TOTP support via the same app or other third-party authenticator apps.

2. Ping Identity Documentation, PingID, "FIDO2 authenticators". This source explains that WebAuthn (part of FIDO2) supports both roaming authenticators (separate devices like security keys) and platform authenticators (built into the user's computer or phone).

The "Default Failure Login URL" is a configurable property within a PingAM realm's authentication settings. Its purpose is to serve as the fallback redirection target when a user's authentication process fails. This URL is used only when a more specific failure URL has not been provided, for instance, through a policy configuration or as a gotoOnFail parameter in the initial authentication request. It ensures a consistent and predictable user experience for unhandled authentication failures.

A: It is the URL used when the gotoOnFail parameter is absent, not the default value of the parameter itself.

C: The "Failure URL" node in an authentication tree is for defining a specific, non-default failure path and must be configured manually by the administrator.

D: This describes the content of the destination page, whereas the "Default Failure Login URL" is the configuration setting for the redirection URL itself.

1. Ping Identity, PingAM Documentation, "Authentication and single sign-on guide" > "Configuring realms" > "Authentication settings". (The documentation for realm properties describes the "Default Failure Login URL" as the URL to which users are redirected if authentication fails).

2. Ping Identity, PingAM Documentation, "Authentication and single sign-on guide" > "Authentication services" > "Service configuration properties". (Describes the "Login Failure URL" property at the service level, which functions similarly).

In a SAML 2.0 federation, a Service Provider (SP) must establish a local session for a user who has authenticated at a remote Identity Provider (IdP). The account mapper on the SP is responsible for this linkage. It uses information from the incoming SAML assertion (the "remote user" identity), such as the NameID or other attributes, to find or create a corresponding user account in the SP's local data store (the "local user profile"). This mapping is a crucial step before a local session can be created.

A: This is incorrect. The account mapper processes a single assertion at a time to map one remote identity to one local account.

B: This describes account linking, a different feature for consolidating multiple local accounts. The SAML mapper's purpose is to link a remote identity to a local one.

C: This describes the process in reverse. The mapper uses attributes from the remote user's assertion to find and map to a local user profile.

1. Ping Identity Access Management Documentation, "Federation and single sign-on > Configuring SAML v2.0 > How AM processes assertions at a service provider." The documentation states, "AM uses the contents of the NameID or other attributes in the assertion to map the remote identity to a user in its local data store."

The ForceAuth=true query parameter instructs PingAM to challenge the user for credentials, regardless of whether they have an existing valid session. This ensures that the user re-authenticates for the current transaction. This mechanism is commonly used to step-up security for accessing sensitive resources or performing critical actions, guaranteeing the user's presence at that specific moment. It effectively ignores the single sign-on (SSO) state for that one request.

B. This parameter forces a full re-authentication from the beginning of the configured chain or tree, not necessarily just a second factor.

C. ForceAuth is a recognized and processed parameter within PingAM for controlling authentication behavior.

D. This describes a multi-factor authentication enrollment prompt, which is a different function from forcing re-authentication.

1. Ping Identity, PingAM 7.3 Documentation, "Authentication," Section: "Authentication request parameters." (This section details parameters like ForceAuth that can be appended to the authentication URL to modify the authentication process).

2. ForgeRock, Access Management 6.5 Documentation, "Authentication," Section: "Authentication Endpoint Parameters." (PingAM is based on ForgeRock AM, and this documentation explicitly states: "If the value of this parameter is true, the user must reauthenticate, even if they have a valid session.").

When configuring an LDAP data store in PingAM, the LDAP Users Search Attribute specifies the attribute in user entries that contains the login ID (e.g., uid, cn, or sAMAccountName). PingAM uses this attribute to search the directory and locate the correct user profile during the authentication process. Changing this value allows an administrator to adapt to different LDAP schemas where the username is stored in a different attribute.

B. LDAP Users Index Attribute is not a standard configuration term; indexing is a backend LDAP performance feature, not a search attribute setting in AM.

C. LDAP Users Bind Attribute is not a setting; the Bind DN is a full distinguished name, not a single attribute used for searching for users.

D. LDAP Users Find Attribute is not the correct name for the property in the PingAM data store configuration UI or its underlying properties.

1. Ping Identity, Access Management Documentation, "Configuring an LDAP data store", Section: "User Configuration". The documentation explicitly lists the field "LDAP Users Search Attribute" and describes it as "The attribute on user entries that contains the user's login ID."

2. Ping Identity, Access Management Documentation, "Create and configure data stores", Section: "LDAPv3 data store properties". This section details the properties for LDAP data stores, where the user search attribute is a key configurable element for defining how user identities are located.

This statement is not true because the PingAM tree designer enforces a Directed Acyclic Graph (DAG) structure. This means that creating loops, where a node's output path connects back to a preceding node in the same execution path, is explicitly prevented by the platform. This design constraint is crucial to avoid infinite loops during the authentication process, which would result in a denial of service for the user. While complex, branching logic is supported, cyclical paths are not.

A. This is true. Authentication trees must terminate, and they do so with "Success" or "Failure" nodes, or can redirect to another tree.

C. This is true. The tree designer is extensible and will display any correctly installed custom nodes or nodes from the Ping Identity Marketplace.

D. This is true. The "Inner Tree Evaluator" node is a standard component used to call and execute another tree as a modular part of the main flow.

1. Ping Identity Documentation, PingAM > Authenticate > "Journeys," Section "About authentication journeys," describes the flow and structure of trees, which inherently follow a DAG model without loops.

2. Ping Identity Documentation, PingAM > Authenticate > "Nodes," Section "Inner Tree Evaluator node," describes the functionality for integrating one tree within another.

PingAM offers two primary methods for performing the initial, basic configuration after deployment. Administrators can use a web-based graphical user interface (GUI) by navigating to the deployment URL in a browser, which provides a step-by-step wizard. Alternatively, for automated or headless environments, PingAM provides a command-line interface (CLI) tool named amsetup. This dual approach provides flexibility for different deployment and operational models.

B: This is incorrect because it omits the command-line amsetup tool, which is a fully supported method for initial configuration.

C: This is incorrect because a basic configuration is mandatory to set up administrator passwords, configuration stores, and user data stores.

D: This is incorrect because it omits the graphical user interface, which is a common and fully supported method for initial configuration.

Ping Identity, PingAM Documentation, "Setup and Maintenance Guide," Chapter: "Configuring AM," Section: "To Configure AM." The documentation explicitly states: "You can configure AM by using either the graphical user interface (GUI) configurator, or the amsetup command-line tool."

The recommended procedure for a PingAM upgrade using a replicated PingDS backend is to create an isolated environment to ensure a rollback path. This involves stopping replication between the two PingDS servers and shutting down one instance. This offline instance serves as a clean, pre-upgrade backup. The upgrade is then performed against the single active instance. If the upgrade fails, the modified instance can be discarded, and the untouched, shutdown instance can be brought back online to restore the previous state, effectively rolling back the changes.

A. Upgrading against both active instances simultaneously provides no rollback path, as both would be modified. The uninstall.sh script removes the product, it does not roll back data.

B. This is incorrect; a rollback path is a critical feature of enterprise software upgrade procedures and is supported.

C. This option is incomplete. Simply starting the shutdown instance is not the full rollback procedure; the failed instance must be taken out of service.

1. Ping Identity Documentation, PingAM > Installation > Upgrading AM > Preparing for an upgrade. The documentation explicitly states: "To provide a backout plan, you can break replication between two configuration stores before you upgrade. Upgrade one of the servers, and if the upgrade is successful, re-enable replication. If the upgrade fails, you can revert to the server that you did not upgrade."

In a PingAM cluster, debug levels are configured dynamically through the administrative console on a per-server (instance) basis. This allows an administrator to enable detailed logging for a specific service on a single server to troubleshoot an issue without affecting the performance of other servers in the cluster. The settings are stored in the configuration data store and applied to the selected server instance, providing granular control over logging.

A. Editing debug.properties directly is not the recommended method in a cluster, as changes can be overwritten by the central configuration.

C. Debug levels are set at the more granular server-instance level, not for an entire site, which is a logical grouping of servers.

D. Changing debug levels is a fundamental and necessary administrative task for diagnosing and resolving issues in any environment.

1. Ping Identity, PingAM Documentation, "Setup and Maintenance Guide," Chapter: "Monitoring Servers," Section: "To Configure Debug Logging for Troubleshooting." This section details the process of setting debug levels for specific services on individual servers through the admin console.

2. Ping Identity, PingAM Documentation, "Administration Guide," Chapter: "Server and Site Configuration," Section: "Configuring Server Defaults." This section explains that debug settings are part of the server-specific configuration managed within the UI.

In the OAuth 2.0 framework, clients are categorized based on their ability to maintain the confidentiality of their credentials. A confidential client is an application capable of securely storing its credentials, such as a client secret. Web applications, which run on a secure server, fit this definition perfectly. The server-side nature allows them to protect their credentials from exposure to end-users or other unauthorized parties. This is in contrast to public clients, which cannot guarantee the secrecy of their credentials.

A. Desktop clients run on a user's machine where credentials cannot be securely stored, making them public clients.

B. JavaScript clients run entirely within a user's browser, and their source code is accessible, so they cannot protect a client secret.

C. Web browsers are user-agents that render applications; the client is the application itself, which can be public (JavaScript) or confidential (server-side).

1. Ping Identity Documentation, PingAM > OAuth 2.0 and OIDC > Clients and applications. This section defines client types, stating, "Confidential clients can keep their credentials secret. For example, a Java web application that runs on a server can be a confidential client."

2. Internet Engineering Task Force (IETF), RFC 6749: The OAuth 2.0 Authorization Framework, Section 2.1, "Client Types". This RFC defines confidential clients as "clients capable of maintaining the confidentiality of their credentials (e.g., client secret) or capable of secure client authentication using other means."

The session denylist is a security mechanism used to ensure that logouts are immediately effective. When a user logs out, their session ID is added to the denylist. If PingAM later receives a request with a session ID that is on this list, it will reject the session as invalid, even if the session's expiration time has not yet been reached. This prevents the replay of a stolen session cookie after the legitimate user has explicitly logged out, closing a critical security window.

A: Session inactivity is managed by the idle timeout property of a session, not the denylist.

B: Restricted sessions refer to sessions bound to an IP address, a separate feature from the denylist.

D: Absolute session timeouts are managed by the maximum session time property, which causes sessions to be purged upon expiry.

Ping Identity, PingAM Documentation, "Session Management," Chapter: "Session denylist service." The documentation states: "The session denylist service stores information about logged out sessions... When a user logs out, AM adds their session to the denylist. When a request arrives with a session from the denylist, AM considers it invalid."

ForgeRock AM’s device-registration flow employs the specific registration nodes that actually enroll authenticators: OATH Registration Node (OTP tokens), Push Registration Node (AM Push), and WebAuthn Registration Node (FIDO2). MFA Registration Options is a routing node only and does not perform registration, so the required set is D.

A – Lacks WebAuthn Registration; MFA Registration Options is not a registration node.

B – Replaces Push Registration with WebAuthn; still contains non-registration MFA Options node.

C – Contains MFA Options (not a registration node) and omits OATH Registration.

1. ForgeRock AM 7.3 Authentication Trees Nodes Reference, “OATH Registration Node”, “Push Registration Node”, “WebAuthn Registration Node”. (docs.am/7.3/trees-ref)

2. ForgeRock AM 7.3 Authentication Trees Guide, §2.3 “Registering Devices”.

The "Token Exchange May Act Script" is used to determine if a client is permitted to impersonate another identity during an OAuth2 token exchange. This script can be configured globally for all clients under the realm's OAuth2 Provider service on the "Advanced" tab. To provide more granular control, this global setting can be overridden for a specific client within that client's profile on the "OAuth2 Provider Overrides" tab page. This dual-level configuration allows for both a default policy and client-specific exceptions.

A and C only: This option incorrectly includes the client's "Advanced" tab and omits the correct global configuration location on the provider's "Advanced" tab.

B and D only: This is the correct combination of options.

D and C only: This option incorrectly includes the provider's "Core" tab and the client's "Advanced" tab, neither of which is used for configuring this script.

1. Ping Identity Access Management Documentation, "OAuth 2.0 Provider Service advanced settings". This page details the "Token Exchange May Act Script" setting on the Advanced tab of the OAuth2 Provider service.

2. Ping Identity Access Management Documentation, "OAuth 2.0 Provider Overrides tab". This page explains that settings from the OAuth2 Provider service, including scripts, can be overridden for individual clients on this tab.