PAP-001
Certified Professional - PingAccess
Parte de Certified Professional - PingAccess
Proctored by Kryterion (remote or testing center). Credential valid for 3 years. Validates basic installation and configuration of PingAccess. Official recommended training: Introduction to PingAccess; Getting Started With PingAccess; PingAccess Administration Training.
Material de estudo independente, construído a partir do blueprint público da prova. Sem afiliação, autorização ou endosso da ping. Os objetivos são transcritos e mapeados à mão, então esta página pode conter erros ou estar defasada em relação ao material atual do fabricante: objetivos, versões, numeração e disponibilidade mudam sem aviso. Trate o portal de certificação da própria ping como a fonte da verdade e confira nele antes de agendar qualquer coisa.
Section 1: Product Overview
1.01 Describe the product’s features, functionality, and basic use cases.
O que saber:- Identity-aware gateway and agent model for web apps and APIs
- Centralized policy: URL-level access control after authentication
- Works with PingFederate or PingOne as the token/identity provider
- Gateway (reverse proxy) vs agent (in-webserver) deployment shapes
1.02 Describe the use cases for integration with other Ping products.
O que saber:- PingFederate as OIDC provider and token issuer
- PingOne as cloud token provider
- Sideband/API mode alongside web access management
- Where PingAccess ends and the provider begins: authentication happens upstream
Section 2: Installation and Initial Configuration
2.01 Outline the installation requirements.
O que saber:- Java runtime and OS support matrix
- Ports: 3000 admin, 3030 engine (defaults), configurable listeners
- Sizing: engines scale out, console stays singular
2.02 Explain how to install and remove the product using command-line and graphical installation tools.
O que saber:- Command-line installer and service registration
- Graphical installer for interactive setups
- Clean removal: services, files, and license artifacts
2.03 Demonstrate an understanding of how to set and obfuscate configuration database passwords.
O que saber:- obfuscate utility wraps sensitive run.properties values
- OBF: prefix marks obfuscated (NOT encrypted) values
- Regenerate obfuscation after host moves - it is host-tied
2.04 Define the purpose of specified run.properties configuration entries.
O que saber:- admin.port / clusterconfig.* / engine listener entries
- pa.operational.mode: STANDALONE, CLUSTERED_CONSOLE, CLUSTERED_CONSOLE_REPLICA, CLUSTERED_ENGINE
- Changes take effect on restart of that node only
2.05 Explain the elements and basic configuration of an on-premise PingAccess cluster.
O que saber:- One admin console, one optional console replica, N engines
- Engines pull configuration from the console over the admin channel
- Engine key pairs and the cluster's shared configuration state
- Load balancer fronts the engines; console is management-only
Section 3: Security
3.01 Explain how to import and manage certificates and certificate groups.
O que saber:- Key pairs vs certificates vs certificate groups
- Trusted certificate groups: Java trust store vs custom groups
- Import PEM/PKCS#12; rotation without engine restarts
Neste site: PEM, DER e os formatos de arquivo de certificadoFerramentas: x5093.02 Explain the ways a certificate can be associated with a virtual host or a listener.
O que saber:- Virtual host binding selects the served certificate
- Engine listeners carry their own key pairs
- SNI-driven selection across multiple virtual hosts
3.03 Describe how to use roles in the context of administrator authentication.
O que saber:- Administrator vs Auditor roles in the admin console
- Auditor is read-only by design
- Admin authentication: local, LDAP, or OIDC SSO to the console
Section 4: Integrations
4.01 Explain the different configuration options used to configure PingAccess to use a token provider.
O que saber:- Token provider types: PingFederate runtime, PingOne, common OIDC
- Introspection vs JWT validation for access tokens
- Shared secret / client credentials between PingAccess and the provider
Ferramentas: oauth-flow-chooser4.02 Define the OAuth authorization pre-requisites and settings for protecting APIs.
O que saber:- API applications validate OAuth access tokens per request
- Required scopes and audience checks at the resource
- 401 vs 403 semantics: missing token vs insufficient scope
Neste site: Fluxos OAuth: escolhendo o grant em 2026, Tokens de acesso, tokens de atualização e tokens de IDFerramentas: oauth-flow-chooser4.03 Define the OpenID Connect pre-requisites and settings for protecting web applications.
O que saber:- Web applications ride an OIDC login flow via the provider
- Web session created after code exchange
- Redirect/callback endpoints PingAccess reserves
Neste site: O fluxo authorization code do OIDC4.04 Describe the purpose of site authenticators.
O que saber:- Site authenticators prove PingAccess to the protected site
- Basic, mutual TLS, and token mediation options
- When the backend must not be reachable except via the gateway
4.05 Explain how to configure PingAccess to use an agent.
O que saber:- Agent model: policy enforcement inside the web server
- Agent properties file bootstraps the console connection
- Gateway vs agent trade-offs: latency, topology, TLS termination
4.06 Define the OpenID Connect/OAuth pre-requisites and settings for protecting Web+API applications.
O que saber:- Web+API applications serve browsers AND bearer-token clients on one base path
- Content negotiation decides interactive redirect vs 401 challenge
- One application, two credential styles, single policy set
Neste site: Fluxos OAuth: escolhendo o grant em 2026Ferramentas: oauth-flow-chooser
Section 5: Policies and Rules
5.01 Explain how PingAccess evaluates paths to apply policy and select the appropriate application or resource.
O que saber:- Longest-path match selects application, then resource
- Context root and case sensitivity rules
- Resource ordering inside an application
5.02 Define the purpose of the different types of rules.
O que saber:- Access control rules: authentication requirements, network range, time, OAuth scope/attribute
- Processing rules: rewrites, headers, redirects
- Criteria vs action: what a rule tests vs what it does
5.03 Explain how to configure different rules.
O que saber:- Rule configuration lives per rule type with typed fields
- Attribute rules read identity attributes from the session/token
- Rejection handling: redirect vs error template
5.04 Explain the usage of rule sets and rule set groups.
O que saber:- Rule sets: ALL (every rule passes) vs ANY (one suffices)
- Rule set groups compose sets for reuse
- Order of evaluation and first-failure behavior
Section 6: General Maintenance and File System
6.01 Explain the following basic maintenance tasks:
O que saber:- Managing licenses
- Managing backups
- Configuration import/export
- Enabling resource auditing
- Upgrading
6.02 Explain the purpose of various PingAccess log files.
O que saber:- pingaccess.log for runtime, admin logs for console actions
- Audit logs: engine and admin API trails
- log4j2 configuration and per-category levels
6.03 Describe the product’s file system structure and important configuration files.
O que saber:- conf/ holds run.properties and bootstrap files
- data/ carries the configuration database and archives
- upgrade/ and log/ layout for operations
Section 7: General Configuration
7.01 Explain the different object types (such as application, virtual host, web session) and how they relate to each other.
O que saber:- Applications bind virtual hosts, contexts, sites/agents, and web sessions together
- Sites describe the protected backends; virtual hosts describe the front door
- Web sessions define the browser-facing cookie and its crypto
7.02 Explain how to create and manage application resource properties.
O que saber:- Resource path patterns, methods, and per-resource policy
- Anonymous vs protected resources within one application
- Resource-level overrides of application defaults
7.03 Explain how to create or manage a web session.
O que saber:- Cookie type (signed/encrypted), timeouts idle vs max
- Refresh behavior against the token provider
- Same-site and secure attributes for the session cookie
7.04 Explain how to configure header-based and JWT identity mappings.
O que saber:- Header identity mappings inject user attributes to the backend
- JWT identity mappings mint a signed token for the site
- Audience, signing key pair, and attribute selection
7.05 Describe the functionality and how to navigate the administrative console
O que saber:- Applications, Sites, Rules, Security, Settings navigation map
- Where clustering status and engine health surface
- Import/export of configuration from the console
Fontes públicas, usadas de boa-fé
Estes guias são materiais de estudo independentes, montados a partir de conteúdo publicamente disponível: blueprints de exame publicados, documentação oficial de produto e catálogos de treinamento dos fabricantes. Nomes de produtos, códigos de exame e marcas pertencem a seus titulares e são usados apenas para identificar o assunto ensinado. Este site não é afiliado a nenhum fabricante aqui citado nem endossado por ele. Se você detém direitos sobre material publicado nesta página e entende que ele deve ser removido ou corrigido, envie a URL exata e uma breve nota sobre o problema pela página de contato; os pedidos são analisados com rapidez e boa-fé. Ler o aviso legal completo →