PAICE-001
Certified Expert - PingOne Advanced Identity Cloud Exam
Parte de Certified Expert - PingOne Advanced Identity Cloud
Remotely proctored (per the official testing guide). Each voucher code is valid for a single exam attempt only; once redeemed it cannot be reused.
Material de estudo independente, construído a partir do blueprint público da prova. Sem afiliação, autorização ou endosso da ping. Os objetivos são transcritos e mapeados à mão, então esta página pode conter erros ou estar defasada em relação ao material atual do fabricante: objetivos, versões, numeração e disponibilidade mudam sem aviso. Trate o portal de certificação da própria ping como a fonte da verdade e confira nele antes de agendar qualquer coisa.
Section 1: Tenant Administration
PAICE-001.1.01 Configure promotions and rollback.
O que saber:- Advanced Identity Cloud tenants come as a set (development, staging, production) and configuration moves between them by promotion.
- Promotion is config-only: journeys, scripts, ESVs, and service settings move; identity data does not.
- Run the promotion report first - it is the dry run that shows what would change.
- Rollback restores the previous promoted state; know its limits and why a tested lower environment matters more than the rollback button.
PAICE-001.1.02 Create and integrate environment secrets and variables (ESVs).
O que saber:- ESVs externalize per-tenant values so the same promoted config works in each environment.
- Variables carry non-secret values; secrets carry credentials and are write-only once set.
- ESVs require a restart/apply cycle to take effect - a changed value is not live until applied.
- Reference ESVs from scripts and service config by their placeholder syntax rather than hardcoding.
PAICE-001.1.03 Configure and troubleshoot custom domains and certificates.
O que saber:- A custom domain replaces the vendor hostname on the login experience; it needs DNS records plus a certificate.
- Certificate chain completeness and expiry are the two failure modes worth checking first.
- Changing the domain changes cookie scope and every registered redirect URI - update the applications too.
- Validate with an external TLS check, not just the browser, to catch missing intermediates.
PAICE-001.1.04 Demonstrate proper security hardening.
O que saber:- Restrict administrative access, enforce MFA for administrators, and prune unused API keys and service accounts.
- Review CORS, CSP, and cookie settings on hosted pages as part of hardening, not as a separate task.
- Scope OAuth clients narrowly and rotate secrets on a schedule.
- Follow the vendor tenant hardening checklist for the current release - cloud hardening guidance changes more often than on-prem.
PAICE-001.1.05 Configure and troubleshoot federated access for tenant administration.
O que saber:- Administrators can themselves federate in from a corporate IdP rather than using local accounts.
- Map IdP groups or claims onto tenant administrative roles.
- Keep a documented break-glass local administrator path for when federation itself breaks.
Section 2: Identity Management
PAICE-001.2.01 Set up delegated administration for identity management.
O que saber:- Delegated administration grants scoped administrative rights over a subset of identities, typically by organization.
- Privilege assignment defines which objects and which operations a delegated admin may perform.
- Test as the delegated admin - the console hides what the role cannot do, which is the point.
PAICE-001.2.02 Extend IDM functionality through customization.
O que saber:- Scripts (server-side JavaScript or Groovy) hook into events such as onCreate, onUpdate, and onSync.
- Custom endpoints expose bespoke logic over REST when a stock endpoint does not fit.
- Keep customization minimal and promotable; heavy customization is what makes upgrades painful.
PAICE-001.2.03 Configure data synchronization through connectors and mappings.
O que saber:- Connectors talk to external systems; mappings define attribute translation and the sync direction.
- Reconciliation compares full data sets; LiveSync consumes incremental change logs.
- Situations and actions (ABSENT, FOUND, MISSING, UNQUALIFIED) are the decision table of any mapping.
- Correlation queries decide what counts as 'the same person' across systems - the single highest-value design choice.
PAICE-001.2.04 Determine appropriate organizational-based configurations.
O que saber:- Organizations model tenants-within-a-tenant: hierarchical groupings of identities with their own admins.
- Membership drives delegated administration scope and can drive journey behavior.
- Model the org tree to match the real administrative boundary, not the marketing org chart.
PAICE-001.2.05 Apply best practices for remote connector server (RCS) deployment.
O que saber:- RCS runs inside the customer network so the cloud tenant can reach on-premises systems without inbound firewall holes.
- The RCS initiates the outbound connection; sizing and high availability mean running more than one.
- Connector libraries are installed on the RCS, and version compatibility with the tenant matters.
- Monitor RCS liveness - a silent RCS looks exactly like an empty source system.
Section 3: Authentication and Journeys
PAICE-001.3.01 Design and build journeys using out-of-the-box (OOTB) capabilities.
O que saber:- Journeys are the cloud name for authentication trees: nodes, outcomes, and shared state.
- Stock nodes cover login, MFA, identity provider federation, progressive profiling, and consent.
- Start from a default journey and modify rather than building from an empty canvas.
PAICE-001.3.02 Manage, maintain, and troubleshoot journeys.
O que saber:- Journeys are versioned artifacts that promote between environments like any other config.
- Debug with the journey's own execution view plus tenant logs filtered by transaction ID.
- A journey that works in development and fails in production usually depends on an ESV or a connector that differs.
PAICE-001.3.03 Extend journey functionality through customization.
O que saber:- Scripted decision nodes carry custom logic; keep them small and unit-testable.
- Custom nodes and themed pages extend look and behavior beyond stock.
- Anything a script reaches (external API, secret) must exist in every environment the journey is promoted to.
Section 4: Integration
PAICE-001.4.01 Configure federation and single sign-on (SSO).
O que saber:- The tenant can act as IdP or SP over SAML2 and OIDC; hosted and remote provider config mirrors on-premises PingAM.
- Circle of trust, metadata, and attribute mapping are the same three concerns in cloud clothing.
- Session and cookie domain determine whether SSO actually feels seamless to the user.
PAICE-001.4.02 Secure hosted pages with Content Security Policy.
O que saber:- CSP restricts which script, style, and frame sources the hosted login pages may load.
- Custom themes that pull external fonts or analytics need those origins allow-listed explicitly.
- Start in report-only mode, read the violations, then enforce.
PAICE-001.4.03 Configure CORS for integration with custom applications.
O que saber:- CORS configuration lists the origins allowed to call tenant endpoints from a browser.
- Include the methods and headers the application actually sends, and allow credentials only when needed.
- A failing single-page-application integration is a CORS problem far more often than an authentication problem.
PAICE-001.4.04 Configure OAuth2 and OpenID Connect (OIDC) integration with applications.
O que saber:- Register the application as an OAuth2 client with the right type, grants, redirect URIs, and scopes.
- Authorization code with PKCE is the expected pattern for browser and native clients.
- Scope-to-claim mapping and token lifetimes are configured on the OAuth2 provider service.
Section 5: Monitoring and Troubleshooting
PAICE-001.5.01 Configure, manage, and monitor tenant configuration.
O que saber:- Tenant configuration is inspected and changed through the admin console and the REST API.
- Track configuration drift between environments - promotion reports are the audit trail.
- Monitor the tenant status and announced maintenance windows as part of routine operations.
PAICE-001.5.02 Configure log streaming from Advanced Identity Cloud to external monitoring tools.
O que saber:- Log streaming pushes tenant logs to an external SIEM or observability platform continuously.
- Choose the log sources deliberately: authentication, IDM activity, and access logs have very different volumes.
- Streaming avoids the retention limit of in-tenant logs, which is the usual reason to configure it.
PAICE-001.5.03 Configure log extraction.
O que saber:- The log API extracts logs on demand by source and time window, using an API key pair.
- Extraction is paginated and rate-limited; scripted pulls must handle both.
- Use extraction for incident forensics, streaming for continuous monitoring.
PAICE-001.5.04 Interpret and troubleshoot issues using logs.
O que saber:- Correlate by transaction ID across authentication, IDM, and access log sources to reconstruct one request.
- Distinguish user-caused failures (bad credentials) from platform failures (connector timeouts) before escalating.
- The first log line that differs from a working run is the one that matters.
PAICE-001.5.05 Configure and troubleshoot the platform using REST.
O que saber:- Nearly every console action has a REST equivalent - the API is the automation and the debugging surface.
- Authenticate API calls with an admin token or API key pair, scoped as narrowly as the task allows.
- Reproducing a failure with a raw REST call removes the console and the browser from the equation.
Fontes públicas, usadas de boa-fé
Estes guias são materiais de estudo independentes, montados a partir de conteúdo publicamente disponível: blueprints de exame publicados, documentação oficial de produto e catálogos de treinamento dos fabricantes. Nomes de produtos, códigos de exame e marcas pertencem a seus titulares e são usados apenas para identificar o assunto ensinado. Este site não é afiliado a nenhum fabricante aqui citado nem endossado por ele. Se você detém direitos sobre material publicado nesta página e entende que ele deve ser removido ou corrigido, envie a URL exata e uma breve nota sobre o problema pela página de contato; os pedidos são analisados com rapidez e boa-fé. Ler o aviso legal completo →