ronutz
← All study guides

CP-PingAM

Certified Professional - PingAM

Part of Certified Professional - PingAM

Proctored by Kryterion. Credential valid for 3 years. Validates install, configure, administer, troubleshoot, and maintain for PingAM (formerly ForgeRock Access Management). Official recommended training: PingAM Deep Dive; PingAM: Customization and APIs.

Independent study aid built from the public exam blueprint. Not affiliated with, authorized by, or endorsed by ping. Objectives are transcribed and mapped by hand, so this page may contain mistakes or may have fallen behind the vendor's current material: exam objectives, versions, numbering and availability all change without notice. Treat ping's own certification portal as the source of truth and verify against it before you book anything.

Section 1: Enhancing Intelligent Access

  • 1.01 Exploring authentication mechanisms

    What to know:
    • Authentication journeys (trees) composed of nodes
    • Realms partition configuration and identities
    • Node types: collectors, deciders, verifiers
    • Success/failure paths and inner-tree nesting

  • 1.02 Protecting a website with PingGateway

    What to know:
    • PingGateway as the reverse-proxy policy-enforcement point
    • Routes protect legacy apps without code changes
    • Gateway consumes AM sessions/tokens to gate access

  • 1.03 Controlling access

    What to know:
    • Authorization: policy sets, resource types, policies
    • Subjects, environment conditions, and response attributes
    • Policy decision via the policies endpoint or agents

Section 2: Improving Access Management Security

  • 2.01 Increasing authentication security

    What to know:
    • MFA nodes: OATH, push, WebAuthn in journeys
    • Account lockout and intelligent throttling
    • Device profiling and trusted-device marking

  • 2.02 Modifying a user’s authentication experience based on context

    What to know:
    • Contextual branching: IP range, device, time, user attributes
    • Scripted decision nodes for custom context
    • Different journeys per persona or channel

  • 2.03 Checking risk continuously

    What to know:
    • Continuous risk: evaluate mid-session, not only at login
    • Transactional authorization for sensitive actions
    • Step-up when the risk signal changes

Section 3: Extending Services Using OAuth2-Based Protocols

  • 3.01 Integrating applications with OAuth 2.0 (OAuth2)

    What to know:
    • AM as the OAuth2 authorization server per realm
    • Client registration: confidential vs public, grants, scopes
    • Token endpoint auth methods; token lifetimes
    On this site: OAuth flows: choosing the grant in 2026, Açık ile gizli istemciler ve PKCE'nin yeri
    Tools: oauth-flow-chooser

  • 3.02 Integrating applications with OpenID Connect (OIDC)

    What to know:
    • OIDC provider atop OAuth2: id_token issuance
    • Claims mapping from identity attributes
    • Discovery and JWKS endpoints per realm
    On this site: The OIDC Authorization Code Flow, OAuth flows: choosing the grant in 2026
    Tools: oauth-flow-chooser

  • 3.03 Authenticating OAuth2 clients and using mutual TLS (mTLS) in OAuth2 for proof-of-possession (PoP)

    What to know:
    • Client auth: secret, private_key_jwt, mutual TLS
    • mTLS certificate-bound access tokens (proof-of-possession)
    • Sender-constrained tokens defeat token replay
    On this site: Sertifika doğrulaması aslında nasıl çalışır
    Tools: x509

  • 3.04 Transforming OAuth2 tokens

    What to know:
    • Token exchange/transformation between formats and audiences
    • Scripted token modification for claim shaping
    • When a downstream needs a different token than the client holds
    Tools: jwt

  • 3.05 Implementing social authentication

    What to know:
    • Social identity provider nodes in journeys
    • Provider client credentials and redirect wiring
    • Account linking to existing identities
    On this site: OAuth flows: choosing the grant in 2026

Section 4: Federating Across Entities Using SAML2

Section 5: Installing and Deploying AM

  • 5.01 Installing and upgrading AM

    What to know:
    • Deploy the AM WAR on a servlet container
    • Configuration and identity stores on PingDS
    • Upgrade path: config export, amupgrade tooling, version order

  • 5.02 Hardening AM security

    What to know:
    • Change default admin credentials and cookie names
    • Restrict endpoints; secure cookies; CSRF protections
    • Secret stores for keys instead of inline config

  • 5.03 Clustering AM

    What to know:
    • Multiple AM servers behind a load balancer per site
    • CTS-based sessions make instances stateless
    • Sticky vs stateless routing considerations

  • 5.04 Deploying PingOne Advanced Identity Platform to the Cloud

    What to know:
    • PingOne Advanced Identity Platform: AM/IDM/DS as managed cloud
    • Tenant environments replace self-managed infrastructure
    • Config-as-code promotion between tenant environments

Public sources, used in good faith

These guides are independent study aids built from publicly available material: published exam blueprints, official product documentation, and vendor training catalogues. Product names, exam codes, and trademarks belong to their owners and are used only to identify the subject being taught. This site is not affiliated with or endorsed by any vendor named here. If you hold rights in material published on this page and believe it should be removed or corrected, please send the exact URL and a short note on the issue through the contact page; requests are reviewed promptly and in good faith. Read the full disclaimer →