[2026年10月12日] 最新をゲットせよ！PT-AM-CPE認定練習テスト問題と試験問題集 [Q41-Q61]

Rate this post

[2026年10月12日] 最新をゲットせよ！PT-AM-CPE認定練習テスト問題と試験問題集

リアルPT-AM-CPE試験問題集解答で有効なPT-AM-CPE問題集PDF

Ping Identity PT-AM-CPE 認定試験の出題範囲：

トピック	出題範囲
トピック 1	Installing and Deploying AM: This domain encompasses installing and upgrading PingAM, hardening security configurations, setting up clustered environments, and deploying PingOne Advanced Identity Platform to the cloud.
トピック 2	Improving Access Management Security: This domain focuses on strengthening authentication security, implementing context-aware authentication experiences, and establishing continuous risk monitoring throughout user sessions.
トピック 3	Enhancing Intelligent Access: This domain covers implementing authentication mechanisms, using PingGateway to protect websites, and establishing access control policies for resources.
トピック 4	Federating Across Entities Using SAML2: This domain covers implementing single sign-on using SAML v2.0 and delegating authentication responsibilities between SAML2 entities.
トピック 5	Extending Services Using OAuth2-Based Protocols: This domain addresses integrating applications with OAuth 2.0 and OpenID Connect, securing OAuth2 clients with mutual TLS and proof-of-possession, transforming OAuth2 tokens, and implementing social authentication.

新問題 41
Which statement does not reflect best practice when configuring a PingAM cluster for secure communication with external servers?

Create the new truststore as a copy of the JVM container truststore to isolate the PingAM truststore from changes to the JVM container’s truststore when the JVM container’s truststore is updated

Create a new truststore with the certificates needed in the environment, and configure the container to use it

Create a new truststore using a copy of the JVM container truststore and add the PingDS instances certificates to the new truststore

Don’t add PingDS instances certificates to the JVM container truststore

新問題 42
If PingAM is deployed in Apache Tomcat under /openam, what file system backups should be taken when PingAM needs to be upgraded?

Back up /path/to/tomcat/webapps/openam/ only

No explicit backups are required for PingAM as this is done automatically

Back up /path/to/tomcat/webapps/openam/, <home directory>/openam/ and <home directory>/.openamcfg/

Execute the PingAM backup script in /path/to/tomcat/webapps/openam/

According to the PingAM 8.0.2 Upgrade Guide and the “Plan the upgrade” documentation, a successful upgrade and potential rollback strategy rely on capturing the complete state of the application across three distinct locations on the filesystem. When PingAM is deployed in a container like Apache Tomcat, the configuration is not stored within the WAR file itself but is distributed to maintain persistence across redeployments.
The three critical areas that must be backed up are:
The Web Application Directory (/path/to/tomcat/webapps/openam/): This contains the expanded binaries, JSPs, and web-level configurations. While the upgrade involves replacing the openam.war file, backing up this folder preserves any manual customizations made to the UI, CSS, or specific library additions (JARs) in the WEB-INF/lib folder.
The Configuration Directory (<home directory>/openam/ or similar): This is the most vital component. By default, PingAM stores its instance-specific configuration, cryptographic keys (keystores), and internal metadata here. For file-based configurations (FBC), this directory holds the entire system state. Even with an external PingDS configuration store, this directory contains the bootstrap file and security secrets required to connect to that store.
The Bootstrap Configuration File (<home directory>/.openamcfg/): This hidden directory contains a file (usually named after the deployment path, e.g., am or openam) that tells the PingAM binaries where the actual configuration directory is located. Without this pointer, a restored PingAM instance will behave like a fresh installation and prompt for a new setup.
The documentation explicitly warns: “Always back up your deployment before you upgrade… For AM servers, you can roll back by restoring from a file system backup of the deployed servers and their configuration directories.” Relying only on the webapps folder (Option A) or assuming automatic backups (Option B) will lead to data loss or an unrecoverable state.

新問題 43
Which area of PingAM does affinity mode relate to?

Authentication

Load balancing

Self-service

Authorization

新問題 44
Which type of logs are written by PingAM?

Debug logs and Java logs

Audit logs and Java logs

Debug logs and audit logs

Java logs, debug logs, and audit logs

新問題 45
When developing a PingAM may act script for OAuth2 token exchange patterns, which variables are made available for use in the script?

clientProperties, identity, logger, requestProperties, scopes, scriptName, session, token

clientProperties, identity, logger, requestProperties, scopes, scriptName, session, requestedToken

clientProperties, identity, logger, requestProperties, scopeList, scriptName, session, requestedToken

clientProperties, identity, logger, requestProperties, scopeList, scriptName, session, token

新問題 46
What is a SAML2 artifact?

The SAML2 assertion

The SAML2 binding name

The name of a specific attribute in the assertion

A value sent by the service provider to retrieve the assertion

新問題 47
Which of the following approaches can be used to configure a basic installation of PingAM?

Either the graphical user interface in a browser, or a command-line program

The graphical user interface in a browser

There is no basic configuration needed

A command-line program

新問題 48
An OpenID Connect application makes a request for an ID token with the openid and profile scope. Which set of claim attributes are available with the profile scope?

givenName, familyName, preferredLocale, name

givenname, family_name, locale, name

given_name, family_name, locale, name

given_name, family_name, preferred_locale, name

新問題 49
A multi-server PingAM deployment is scheduled for upgrade. What measure can be implemented to prevent external user access during this process?

Shut down the PingAM instances

Shut down the PingDS instances

Disable access from the firewall

Disable access from the load balancer

新問題 50
What happens when an end user accesses the following login page: …/XUI/?ForceAuth=true#login?

Even if the end user is already authenticated, they will be redirected to the login page

The end user will be presented with second factor authentication

Nothing. ForceAuth is not a parameter that PingAM knows how to process

A screen is presented to the end user suggesting they enable second factor authentication

新問題 51
Which of the following tab pages in the PingAM admin UI can be used to configure the OAuth2 and OpenID Connect may act scripts used for token exchange requests?
A) The OAuth2 provider service > Advanced tab page
B) The OAuth2 provider service > Core tab page
C) The OAuth2 client profile > Advanced tab page
D) The OAuth2 client profile > OAuth2 Provider Overrides tab page

B and D only

A and D only

A and C only

B and C only

新問題 52
If there is a need to reset a registered device over the REST API, which one of the following statements is incorrect?

Administrators can provide authenticated users with a self-service page to reset their devices via the REST API

Administrators can call the REST API to reset a device that is out of sync, where the HOTP counter exceeds the HOTP threshold window and requires a reset

Only administrator accounts, not user accounts, have the ability to use the REST API for resetting a device profile

Administrators can call the REST API to reset a user’s device profile

新問題 53
Why should module-based authentication be disabled in production?

Module-based authentication allows a user to authenticate with the amAdmin account

Module-based authentication allows a user to select any authentication level

Module-based authentication allows a user to bypass steps in an authentication chain

Module-based authentication allows users to authenticate in any realm

新問題 54
Which multi-factor authentication methods require a separate device and an application?

Push, WebAuthn

Push, WebAuthn, Open Authentication

WebAuthn, Open Authentication

Open Authentication, Push

新問題 55
After installing a PingAM instance with the configuration directory path set to /home/forgerock/am, where is the default directory that contains the debug log files?

/home/forgerock/am/logs

/home/forgerock/am/var/logs

/home/forgerock/am/var/debug

/home/forgerock/am/debug

新問題 56
Which of the following needs to be configured in order to use social authentication in PingAM?

A data store

A realm service

An OAuth2 client

A realm policy

新問題 57
Charlotte wants to query all the authentication tree configuration details in the alpha realm using an Amster command.7 After connecting to the PingAM instance in Amster, which command should Charlotte enter?

query AuthenticationTree –realm /alpha –query all

query AuthenticationTree –realm /alpha –filter true

query AuthTree –realm /alpha –filter true

query AuthTree –realm /alpha –query all

新問題 58
What is the purpose of the extended metadata in PingAM?

It specifies the certificates and keys for the SAML2 entity

It specifies the policy to invoke during SAML2 federation

It is a standard way to communicate supported SAML2 features

It specifies additional information about a SAML2 entity specific to PingAM

新問題 59
Which of the following would be a possible combination of fields in the JSON body when making a policy evaluation via REST?

resources, subject, advices

resources, subject, application

resources, application, advices

subject, application, advices

新問題 60
In order to secure a PingAM deployment with an external configuration data store and user data store using server-side sessions, which of the following should be considered?

Changing the default iPlanetDirectoryPro cookie name, Using your own key for signing, Using a specific bind account for LDAP connections, Renaming and reducing the assigned privileges of the amAdmin account

Encrypting the iPlanetDirectoryPro cookie contents, Changing the default iPlanetDirectoryPro cookie name, Using your own key for signing, Using a specific bind account for LDAP connections

Changing the default iPlanetDirectoryPro cookie name, Using your own key for signing, Using a specific bind account for LDAP connections, Creation of a top-level administrator other than amAdmin

Changing the default iPlanetDirectoryPro cookie name, Using your own key for signing, Using a specific bind account for LDAP connections, Reducing the privileges of the amAdmin user in production

Securing a PingAM 8.0.2 environment involves hardening multiple layers of the architecture, particularly when using external data stores and stateful sessions. According to the “General Security Considerations” and “Hardening PingAM” documentation, several key “Best Practices” must be applied.
Changing the SSO Cookie Name: By default, AM uses iPlanetDirectoryPro. Attackers often scan for this specific cookie name to identify ForgeRock/PingAM installations. Changing it provides “security through obscurity” and prevents some automated attacks.
Using Your Own Keys: PingAM ships with default test keys in the keystore. For production, you must generate your own cryptographic keys for signing and encrypting tokens (SSO, OIDC, SAML) to ensure the integrity of the environment.
Specific Bind Accounts: When connecting to an external PingDS or Active Directory, PingAM should never use a highly privileged account (like cn=Directory Manager). Instead, a dedicated account with limited, specific permissions (ACLs) should be created for AM’s use.
Top-Level Administrator Management: The amAdmin account is the “root” of the AM system. In a production environment, it is considered a significant security risk to use this account for daily operations.
Why Option C is the correct answer: The documentation specifically recommends creating a new top-level administrator and then securing or disabling the default amAdmin. This is more effective than simply “renaming” it (Option A) or “reducing privileges” (Options B and D). In PingAM, amAdmin has hardcoded superuser capabilities in many areas; therefore, the best practice is to create a new administrative user with the necessary roles and then protect the amAdmin credentials in a vault. Option B is also incorrect because server-side sessions already store data on the server; the cookie only contains the session ID (the reference), so “encrypting the cookie contents” is redundant for server-side sessions compared to client-side sessions where the entire state is in the cookie.

新問題 61
Which of the following multi-factor authentication protocols are supported by PingAM?
A) Open authentication
B) Security questions
C) Web authentication
D) Universal 2nd factor authentication
E) Push authentication

B, C, and D

A, B, and E

A, C, and E

A, B, and C