PAP-001
Certified Professional - PingAccess
Part of Certified Professional - PingAccess
Proctored by Kryterion (remote or testing center). Credential valid for 3 years. Validates basic installation and configuration of PingAccess. Official recommended training: Introduction to PingAccess; Getting Started With PingAccess; PingAccess Administration Training.
Independent study aid built from the public exam blueprint. Not affiliated with, authorized by, or endorsed by ping. Objectives are transcribed and mapped by hand, so this page may contain mistakes or may have fallen behind the vendor's current material: exam objectives, versions, numbering and availability all change without notice. Treat ping's own certification portal as the source of truth and verify against it before you book anything.
Section 1: Product Overview
1.01 Describe the product’s features, functionality, and basic use cases.
What to know:- Identity-aware gateway and agent model for web apps and APIs
- Centralized policy: URL-level access control after authentication
- Works with PingFederate or PingOne as the token/identity provider
- Gateway (reverse proxy) vs agent (in-webserver) deployment shapes
1.02 Describe the use cases for integration with other Ping products.
What to know:- PingFederate as OIDC provider and token issuer
- PingOne as cloud token provider
- Sideband/API mode alongside web access management
- Where PingAccess ends and the provider begins: authentication happens upstream
Section 2: Installation and Initial Configuration
2.01 Outline the installation requirements.
What to know:- Java runtime and OS support matrix
- Ports: 3000 admin, 3030 engine (defaults), configurable listeners
- Sizing: engines scale out, console stays singular
2.02 Explain how to install and remove the product using command-line and graphical installation tools.
What to know:- Command-line installer and service registration
- Graphical installer for interactive setups
- Clean removal: services, files, and license artifacts
2.03 Demonstrate an understanding of how to set and obfuscate configuration database passwords.
What to know:- obfuscate utility wraps sensitive run.properties values
- OBF: prefix marks obfuscated (NOT encrypted) values
- Regenerate obfuscation after host moves - it is host-tied
2.04 Define the purpose of specified run.properties configuration entries.
What to know:- admin.port / clusterconfig.* / engine listener entries
- pa.operational.mode: STANDALONE, CLUSTERED_CONSOLE, CLUSTERED_CONSOLE_REPLICA, CLUSTERED_ENGINE
- Changes take effect on restart of that node only
2.05 Explain the elements and basic configuration of an on-premise PingAccess cluster.
What to know:- One admin console, one optional console replica, N engines
- Engines pull configuration from the console over the admin channel
- Engine key pairs and the cluster's shared configuration state
- Load balancer fronts the engines; console is management-only
Section 3: Security
3.01 Explain how to import and manage certificates and certificate groups.
What to know:- Key pairs vs certificates vs certificate groups
- Trusted certificate groups: Java trust store vs custom groups
- Import PEM/PKCS#12; rotation without engine restarts
On this site: PEM, DER ve sertifika dosya biçimleriTools: x5093.02 Explain the ways a certificate can be associated with a virtual host or a listener.
What to know:- Virtual host binding selects the served certificate
- Engine listeners carry their own key pairs
- SNI-driven selection across multiple virtual hosts
3.03 Describe how to use roles in the context of administrator authentication.
What to know:- Administrator vs Auditor roles in the admin console
- Auditor is read-only by design
- Admin authentication: local, LDAP, or OIDC SSO to the console
Section 4: Integrations
4.01 Explain the different configuration options used to configure PingAccess to use a token provider.
What to know:- Token provider types: PingFederate runtime, PingOne, common OIDC
- Introspection vs JWT validation for access tokens
- Shared secret / client credentials between PingAccess and the provider
Tools: oauth-flow-chooser4.02 Define the OAuth authorization pre-requisites and settings for protecting APIs.
What to know:- API applications validate OAuth access tokens per request
- Required scopes and audience checks at the resource
- 401 vs 403 semantics: missing token vs insufficient scope
On this site: OAuth flows: choosing the grant in 2026, Erişim token'ları, yenileme token'ları ve kimlik token'larıTools: oauth-flow-chooser4.03 Define the OpenID Connect pre-requisites and settings for protecting web applications.
What to know:- Web applications ride an OIDC login flow via the provider
- Web session created after code exchange
- Redirect/callback endpoints PingAccess reserves
On this site: The OIDC Authorization Code Flow4.04 Describe the purpose of site authenticators.
What to know:- Site authenticators prove PingAccess to the protected site
- Basic, mutual TLS, and token mediation options
- When the backend must not be reachable except via the gateway
4.05 Explain how to configure PingAccess to use an agent.
What to know:- Agent model: policy enforcement inside the web server
- Agent properties file bootstraps the console connection
- Gateway vs agent trade-offs: latency, topology, TLS termination
4.06 Define the OpenID Connect/OAuth pre-requisites and settings for protecting Web+API applications.
What to know:- Web+API applications serve browsers AND bearer-token clients on one base path
- Content negotiation decides interactive redirect vs 401 challenge
- One application, two credential styles, single policy set
On this site: OAuth flows: choosing the grant in 2026Tools: oauth-flow-chooser
Section 5: Policies and Rules
5.01 Explain how PingAccess evaluates paths to apply policy and select the appropriate application or resource.
What to know:- Longest-path match selects application, then resource
- Context root and case sensitivity rules
- Resource ordering inside an application
5.02 Define the purpose of the different types of rules.
What to know:- Access control rules: authentication requirements, network range, time, OAuth scope/attribute
- Processing rules: rewrites, headers, redirects
- Criteria vs action: what a rule tests vs what it does
5.03 Explain how to configure different rules.
What to know:- Rule configuration lives per rule type with typed fields
- Attribute rules read identity attributes from the session/token
- Rejection handling: redirect vs error template
5.04 Explain the usage of rule sets and rule set groups.
What to know:- Rule sets: ALL (every rule passes) vs ANY (one suffices)
- Rule set groups compose sets for reuse
- Order of evaluation and first-failure behavior
Section 6: General Maintenance and File System
6.01 Explain the following basic maintenance tasks:
What to know:- Managing licenses
- Managing backups
- Configuration import/export
- Enabling resource auditing
- Upgrading
6.02 Explain the purpose of various PingAccess log files.
What to know:- pingaccess.log for runtime, admin logs for console actions
- Audit logs: engine and admin API trails
- log4j2 configuration and per-category levels
6.03 Describe the product’s file system structure and important configuration files.
What to know:- conf/ holds run.properties and bootstrap files
- data/ carries the configuration database and archives
- upgrade/ and log/ layout for operations
Section 7: General Configuration
7.01 Explain the different object types (such as application, virtual host, web session) and how they relate to each other.
What to know:- Applications bind virtual hosts, contexts, sites/agents, and web sessions together
- Sites describe the protected backends; virtual hosts describe the front door
- Web sessions define the browser-facing cookie and its crypto
7.02 Explain how to create and manage application resource properties.
What to know:- Resource path patterns, methods, and per-resource policy
- Anonymous vs protected resources within one application
- Resource-level overrides of application defaults
7.03 Explain how to create or manage a web session.
What to know:- Cookie type (signed/encrypted), timeouts idle vs max
- Refresh behavior against the token provider
- Same-site and secure attributes for the session cookie
7.04 Explain how to configure header-based and JWT identity mappings.
What to know:- Header identity mappings inject user attributes to the backend
- JWT identity mappings mint a signed token for the site
- Audience, signing key pair, and attribute selection
7.05 Describe the functionality and how to navigate the administrative console
What to know:- Applications, Sites, Rules, Security, Settings navigation map
- Where clustering status and engine health surface
- Import/export of configuration from the console
Public sources, used in good faith
These guides are independent study aids built from publicly available material: published exam blueprints, official product documentation, and vendor training catalogues. Product names, exam codes, and trademarks belong to their owners and are used only to identify the subject being taught. This site is not affiliated with or endorsed by any vendor named here. If you hold rights in material published on this page and believe it should be removed or corrected, please send the exact URL and a short note on the issue through the contact page; requests are reviewed promptly and in good faith. Read the full disclaimer →