PAICE-001
Certified Expert - PingOne Advanced Identity Cloud Exam
Part of Certified Expert - PingOne Advanced Identity Cloud
Remotely proctored (per the official testing guide). Each voucher code is valid for a single exam attempt only; once redeemed it cannot be reused.
Independent study aid built from the public exam blueprint. Not affiliated with, authorized by, or endorsed by ping. Objectives are transcribed and mapped by hand, so this page may contain mistakes or may have fallen behind the vendor's current material: exam objectives, versions, numbering and availability all change without notice. Treat ping's own certification portal as the source of truth and verify against it before you book anything.
Section 1: Tenant Administration
PAICE-001.1.01 Configure promotions and rollback.
What to know:- Advanced Identity Cloud tenants come as a set (development, staging, production) and configuration moves between them by promotion.
- Promotion is config-only: journeys, scripts, ESVs, and service settings move; identity data does not.
- Run the promotion report first - it is the dry run that shows what would change.
- Rollback restores the previous promoted state; know its limits and why a tested lower environment matters more than the rollback button.
PAICE-001.1.02 Create and integrate environment secrets and variables (ESVs).
What to know:- ESVs externalize per-tenant values so the same promoted config works in each environment.
- Variables carry non-secret values; secrets carry credentials and are write-only once set.
- ESVs require a restart/apply cycle to take effect - a changed value is not live until applied.
- Reference ESVs from scripts and service config by their placeholder syntax rather than hardcoding.
PAICE-001.1.03 Configure and troubleshoot custom domains and certificates.
What to know:- A custom domain replaces the vendor hostname on the login experience; it needs DNS records plus a certificate.
- Certificate chain completeness and expiry are the two failure modes worth checking first.
- Changing the domain changes cookie scope and every registered redirect URI - update the applications too.
- Validate with an external TLS check, not just the browser, to catch missing intermediates.
PAICE-001.1.04 Demonstrate proper security hardening.
What to know:- Restrict administrative access, enforce MFA for administrators, and prune unused API keys and service accounts.
- Review CORS, CSP, and cookie settings on hosted pages as part of hardening, not as a separate task.
- Scope OAuth clients narrowly and rotate secrets on a schedule.
- Follow the vendor tenant hardening checklist for the current release - cloud hardening guidance changes more often than on-prem.
PAICE-001.1.05 Configure and troubleshoot federated access for tenant administration.
What to know:- Administrators can themselves federate in from a corporate IdP rather than using local accounts.
- Map IdP groups or claims onto tenant administrative roles.
- Keep a documented break-glass local administrator path for when federation itself breaks.
Section 2: Identity Management
PAICE-001.2.01 Set up delegated administration for identity management.
What to know:- Delegated administration grants scoped administrative rights over a subset of identities, typically by organization.
- Privilege assignment defines which objects and which operations a delegated admin may perform.
- Test as the delegated admin - the console hides what the role cannot do, which is the point.
PAICE-001.2.02 Extend IDM functionality through customization.
What to know:- Scripts (server-side JavaScript or Groovy) hook into events such as onCreate, onUpdate, and onSync.
- Custom endpoints expose bespoke logic over REST when a stock endpoint does not fit.
- Keep customization minimal and promotable; heavy customization is what makes upgrades painful.
PAICE-001.2.03 Configure data synchronization through connectors and mappings.
What to know:- Connectors talk to external systems; mappings define attribute translation and the sync direction.
- Reconciliation compares full data sets; LiveSync consumes incremental change logs.
- Situations and actions (ABSENT, FOUND, MISSING, UNQUALIFIED) are the decision table of any mapping.
- Correlation queries decide what counts as 'the same person' across systems - the single highest-value design choice.
PAICE-001.2.04 Determine appropriate organizational-based configurations.
What to know:- Organizations model tenants-within-a-tenant: hierarchical groupings of identities with their own admins.
- Membership drives delegated administration scope and can drive journey behavior.
- Model the org tree to match the real administrative boundary, not the marketing org chart.
PAICE-001.2.05 Apply best practices for remote connector server (RCS) deployment.
What to know:- RCS runs inside the customer network so the cloud tenant can reach on-premises systems without inbound firewall holes.
- The RCS initiates the outbound connection; sizing and high availability mean running more than one.
- Connector libraries are installed on the RCS, and version compatibility with the tenant matters.
- Monitor RCS liveness - a silent RCS looks exactly like an empty source system.
Section 3: Authentication and Journeys
PAICE-001.3.01 Design and build journeys using out-of-the-box (OOTB) capabilities.
What to know:- Journeys are the cloud name for authentication trees: nodes, outcomes, and shared state.
- Stock nodes cover login, MFA, identity provider federation, progressive profiling, and consent.
- Start from a default journey and modify rather than building from an empty canvas.
PAICE-001.3.02 Manage, maintain, and troubleshoot journeys.
What to know:- Journeys are versioned artifacts that promote between environments like any other config.
- Debug with the journey's own execution view plus tenant logs filtered by transaction ID.
- A journey that works in development and fails in production usually depends on an ESV or a connector that differs.
PAICE-001.3.03 Extend journey functionality through customization.
What to know:- Scripted decision nodes carry custom logic; keep them small and unit-testable.
- Custom nodes and themed pages extend look and behavior beyond stock.
- Anything a script reaches (external API, secret) must exist in every environment the journey is promoted to.
Section 4: Integration
PAICE-001.4.01 Configure federation and single sign-on (SSO).
What to know:- The tenant can act as IdP or SP over SAML2 and OIDC; hosted and remote provider config mirrors on-premises PingAM.
- Circle of trust, metadata, and attribute mapping are the same three concerns in cloud clothing.
- Session and cookie domain determine whether SSO actually feels seamless to the user.
PAICE-001.4.02 Secure hosted pages with Content Security Policy.
What to know:- CSP restricts which script, style, and frame sources the hosted login pages may load.
- Custom themes that pull external fonts or analytics need those origins allow-listed explicitly.
- Start in report-only mode, read the violations, then enforce.
PAICE-001.4.03 Configure CORS for integration with custom applications.
What to know:- CORS configuration lists the origins allowed to call tenant endpoints from a browser.
- Include the methods and headers the application actually sends, and allow credentials only when needed.
- A failing single-page-application integration is a CORS problem far more often than an authentication problem.
PAICE-001.4.04 Configure OAuth2 and OpenID Connect (OIDC) integration with applications.
What to know:- Register the application as an OAuth2 client with the right type, grants, redirect URIs, and scopes.
- Authorization code with PKCE is the expected pattern for browser and native clients.
- Scope-to-claim mapping and token lifetimes are configured on the OAuth2 provider service.
Section 5: Monitoring and Troubleshooting
PAICE-001.5.01 Configure, manage, and monitor tenant configuration.
What to know:- Tenant configuration is inspected and changed through the admin console and the REST API.
- Track configuration drift between environments - promotion reports are the audit trail.
- Monitor the tenant status and announced maintenance windows as part of routine operations.
PAICE-001.5.02 Configure log streaming from Advanced Identity Cloud to external monitoring tools.
What to know:- Log streaming pushes tenant logs to an external SIEM or observability platform continuously.
- Choose the log sources deliberately: authentication, IDM activity, and access logs have very different volumes.
- Streaming avoids the retention limit of in-tenant logs, which is the usual reason to configure it.
PAICE-001.5.03 Configure log extraction.
What to know:- The log API extracts logs on demand by source and time window, using an API key pair.
- Extraction is paginated and rate-limited; scripted pulls must handle both.
- Use extraction for incident forensics, streaming for continuous monitoring.
PAICE-001.5.04 Interpret and troubleshoot issues using logs.
What to know:- Correlate by transaction ID across authentication, IDM, and access log sources to reconstruct one request.
- Distinguish user-caused failures (bad credentials) from platform failures (connector timeouts) before escalating.
- The first log line that differs from a working run is the one that matters.
PAICE-001.5.05 Configure and troubleshoot the platform using REST.
What to know:- Nearly every console action has a REST equivalent - the API is the automation and the debugging surface.
- Authenticate API calls with an admin token or API key pair, scoped as narrowly as the task allows.
- Reproducing a failure with a raw REST call removes the console and the browser from the equation.
Public sources, used in good faith
These guides are independent study aids built from publicly available material: published exam blueprints, official product documentation, and vendor training catalogues. Product names, exam codes, and trademarks belong to their owners and are used only to identify the subject being taught. This site is not affiliated with or endorsed by any vendor named here. If you hold rights in material published on this page and believe it should be removed or corrected, please send the exact URL and a short note on the issue through the contact page; requests are reviewed promptly and in good faith. Read the full disclaimer →