Certified Professional - PingAccess PAP-001 Exam Questions
An administrator needs to configure a signed JWT identity mapping for an application that expects to be able to validate the signature. Which endpoint does the application need to access to validate the signature?
Correct Answer: A
Applications consuming signed JWTs need the JSON Web Key Set (JWKS) endpoint to retrieve the public keys used for validating JWT signatures. PingAccess exposes this at /pa/authtoken/JWKS .
Exact Extract:
“When using JWT identity mapping, applications can obtain the signing keys from the /pa/authtoken/JWKS endpoint to validate the JWT signature.”
Option A is correct — /pa/authtoken/JWKS provides the key set for signature validation.
Option B is incorrect — that’s an administrative API for configuring identity mappings, not a runtime validation endpoint.
Option C is incorrect — /pa/aidc/cb is the OIDC callback endpoint.
Option D is incorrect — /pa-admin-api/v3/authTokenManagement is for admin token management, not JWT validation.
An administrator needs to configure an application that uses a backend web server that has its own authentication mechanism. Which type of object must be configured for PingAccess to provide access to the target server?
Correct Answer: C
When a backend application requires its own authentication (e.g., Basic Auth or mutual TLS), PingAccess uses a Site Authenticator to inject the necessary credentials.
Exact Extract:
“Site Authenticators provide the credentials PingAccess uses when authenticating to target applications that require their own authentication mechanisms.”
Option A (Token Provider) is incorrect — this is used for OIDC/OAuth tokens, not site-level authentication.
Option B (Web Session) manages end-user sessions, not backend site authentication.
Option C (Site Authenticator) is correct — it handles authentication between PingAccess and the backend.
Option D (Access Control Rule) enforces authorization, not backend authentication.
A protected web application requires that additional attributes be provided once the user is authenticated. Which two steps must the administrator perform to meet this requirement? (Choose 2 answers.)
Correct Answer: B, E
When applications require additional attributes:
The Web Session must be configured to retrieve those attributes from the token provider (OIDC or PingFederate).
The Identity Mapping must be updated to forward those attributes to the application (e.g., as headers).
Exact Extract:
“Web sessions define how user attributes are retrieved from the token provider. Identity mappings determine how those attributes are inserted into requests to applications.”
Option A is not necessarily required; attributes can be retrieved via userinfo endpoint or access token, not only ID tokens.
Option B is correct — Identity Mappings must be updated to pass attributes to the app.
Option C is incorrect — Site Authenticators define how PingAccess authenticates to apps, not attribute handling.
Option D is incorrect unless the architecture specifically requires access token updates; PingAccess often uses the Web Session to fetch attributes.
Option E is correct — Web Session must be updated to retrieve additional attributes.
An API is hosted onsite and is using only header-based Identity Mapping. It is exposed to all clients running on the corporate network. How should the administrator prevent a malicious actor from bypassing PingAccess and spoofing the headers to gain unauthorized access to the API?
Correct Answer: A
When applications depend solely on header-based identity mapping , attackers can attempt to bypass PingAccess by injecting headers directly into requests sent to the backend. To prevent spoofing, PingAccess should be configured to pass cryptographically verifiable tokens (e.g., ID tokens from OIDC ) instead of relying on plain headers.
Exact Extract:
“Headers can be spoofed if not protected. Use signed tokens, such as ID tokens or JWTs, to provide strong identity assurance and prevent header injection attacks.”
Option A (Use ID Tokens) is correct — ID tokens are signed and verifiable, preventing spoofing.
Option B (Add Site Authenticator) protects PingAccess-to-site authentication, not client-to-API spoofing.
Option C (Require HTTPS) prevents eavesdropping but does not stop header spoofing from inside the network.
Option D (Use Target Host Header) ensures host header integrity but not user identity.
Refer to the following applications:
hr.company.com
finance.company.com
customer.order.company.com
Which action should be taken to allow these applications to share the same web session?
Correct Answer: B
For multiple subdomains to share the same PingAccess session, the Cookie Domain must be configured so that the session cookie is valid across all listed applications.
Exact Extract:
“Set the Cookie Domain in the web session configuration to a parent domain (for example, .company.com) to enable applications in different subdomains to share the same session.”
Option A (Set Audience option) applies to OAuth token validation, not cookie sharing.
Option B (Set Cookie Domain option) is correct — e.g., setting .company.com allows session cookies to be shared.
Option C (Rewrite Cookie Domain rule) modifies upstream cookies for back-end applications, not PingAccess session cookies.
Option D (Rewrite Cookie Path rule) is unrelated; it modifies paths for cookies, not domains.