CP-PingDirectory
Certified Professional - PingDirectory
Part of Certified Professional - PingDirectory
Proctored exam; no prerequisites. Official recommended training: Introduction to PingDirectory; Getting Started With PingDirectory; PingDirectory Administration Training.
Independent study aid built from the public exam blueprint. Not affiliated with, authorized by, or endorsed by ping. Objectives are transcribed and mapped by hand, so this page may contain mistakes or may have fallen behind the vendor's current material: exam objectives, versions, numbering and availability all change without notice. Treat ping's own certification portal as the source of truth and verify against it before you book anything.
Section 1: Installation and Initial Configuration
1.01 Identify the system requirements.
What to know:- Java 17+ runtime and supported OS baselines
- File-descriptor and vm.max_map_count tuning
- Memory sizing: DB cache vs JVM heap
- Disk layout for db, logs, and changelog
1.02 Describe how to install PingDirectory.
What to know:- setup tool: interactive vs non-interactive (--cli --no-prompt)
- Initial root DN and base-entry creation
- Listener ports: LDAP 389/636, HTTPS, JMX
- dsstatus / server status verification after install
1.03 Describe the product’s file system structure.
What to know:- bin/ and lib/ vs config/ vs db/ layout
- config/config.ldif is generated - never hand-edit
- logs/ family: access, errors, config-audit
- bak/, ldif/, and locks/ working directories
1.04 Demonstrate how to perform an upgrade of the product.
What to know:- update tool with the new package in place
- --serverRoot pointing at the live install
- Reversion support via revert-update
- Replication-aware upgrade ordering (one server at a time)
1.05 Describe the product’s data storage engine.
What to know:- Berkeley DB JE - log-structured append-only storage
- Backends map suffixes to databases (userRoot)
- DB cache percent and checkpointing behavior
- Why compaction/cleanup runs in background threads
Section 2: Administrative Tools
2.01 Describe the functionality of the administrative console.
What to know:- HTTPS administrative console served by the server itself
- Console authenticates as a directory user with privileges
- Status, monitoring, and config editing scopes
- When the console writes, config-audit.log records it
2.02 Describe the use purpose of various command-line utilities included with the product.
What to know:- ldapsearch / ldapmodify / ldapdelete for data
- dsconfig for configuration, dsreplication for topology
- import-ldif / export-ldif, backup / restore
- collect-support-data, summarize-access-log, status
2.03 Describe how to use the dsconfig command and its options to configure the PingDirectory server.
What to know:- Interactive menu mode vs single-command batch mode
- --batch-file for repeatable, reviewable changes
- Every dsconfig change is an LDAP mod under the covers
- Offline vs online configuration considerations
2.04 Describe how to review configuration changes.
What to know:- config-audit.log: every change, timestamped, with the reverting command
- Comparing config.ldif snapshots across time
- Who changed what: the authenticated identity is recorded
2.05 Demonstrate how to update server profiles.
What to know:- Server profile = versionable directory of config, dsconfig batches, and setup arguments
- manage-profile generate-profile / replace-profile
- The GitOps pattern: profiles in source control
- Variables files for per-environment differences
Section 3: Data Management
3.01 Explain how to perform management tasks for entries.
What to know:- ldapmodify with LDIF change records (add/modify/delete/modrdn)
- Schema enforcement on every write
- Operational attributes: createTimestamp, modifiersName
- Soft-delete and undelete capabilities
On this site: LDAP search filters: reading the parentheses, LDAP Fundamentals: The Directory Model Behind Identity SystemsTools: ldap-filter-explainer3.02 Describe different data types and their uses.
What to know:- Attribute syntaxes: DirectoryString, Integer, GeneralizedTime, Boolean, DN
- Matching rules drive comparison and indexing
- userPassword storage schemes vs plain attributes
- Binary attributes and ;binary transfer
3.03 Describe how to import and export data.
What to know:- import-ldif rebuilds the backend (offline, fast, destructive)
- export-ldif for full or filtered exports
- --includeBranch / --excludeAttribute shaping
- Compressed and encrypted LDIF handling
3.04 Describe the use of the make-ldif template.
What to know:- make-ldif templates generate realistic sample data
- Template variables, branches, and per-entry randomization
- The bundled example.template as the starting point
- Load-testing datasets without production data
3.05 Explain how to create and manage indexes.
What to know:- Index types: equality, presence, substring, ordering, approximate
- Unindexed searches: who may run them, and why they hurt
- rebuild-index after adding or changing an index
- Index entry limit and its exceeded-cost behavior
On this site: LDAP search filters: reading the parenthesesTools: ldap-filter-explainer3.06 Describe the different group types and their uses.
What to know:- Static groups (groupOfNames/member) vs dynamic groups (memberURL)
- Virtual static groups bridge the two models
- Nested membership and the isMemberOf virtual attribute
- Group performance at scale: prefer dynamic where possible
Tools: ldap-filter-explainer
Section 4: Maintenance
4.01 Explain how to enable logging and create retention/rotation policies for logs.
What to know:- Log publishers: access, error, audit - independently configured
- Rotation policies (size/time) vs retention policies (count/disk/age)
- Filtered and JSON-formatted access logging
- Sensitive-attribute redaction in logs
4.02 Identify how to install an updated PingDirectory license.
What to know:- Licenses installed at setup or via dsconfig update
- Expiration warnings surface in status and error logs
- New license file replaces the old in place
4.03 Define the purpose and use of the collect-support-data and summarize-access-log commands to generate a report for support purposes.
What to know:- collect-support-data bundles config, logs, and metrics for support
- summarize-access-log turns raw access logs into a performance report
- Unindexed-search and long-etime hunting starts here
4.04 Explain how to configure backup/restore for backends manually.
What to know:- backup / restore per backend, online-capable
- Incremental backups against a full base
- Encrypted and compressed backup options
- Restoring into a replicated topology: re-initialize after
4.05 Define the purpose of lockdown mode and describe how to enter/exit it.
What to know:- Lockdown mode: only root users over loopback may bind
- enter-lockdown-mode / leave-lockdown-mode tools
- Automatic lockdown on serious errors (e.g. schema problems)
- The safe room for repair work
4.06 Describe how to configure replication and define topologies.
What to know:- dsreplication enable / initialize between servers
- Replication is multi-master with per-attribute conflict resolution
- Topology registry stores the server relationships
- Monitoring: replication backlog and generation IDs
Section 5: Security
5.01 Describe how to create, export, or import encryption settings definitions.
What to know:- Encryption-settings definitions with a preferred (active) key
- export / import definitions to share across the topology
- What gets encrypted: backends, backups, logs, LDIF
- Key rotation: add new preferred, keep old for reads
5.02 Explain how to create password validators and define policies.
What to know:- Password validators: length, character sets, dictionary, history, similarity
- Password policies bind validators, lockout, and expiration together
- Per-user policy assignment via ds-pwp-password-policy-dn
- Deprecated vs allowed storage schemes on migration
5.03 Explain how to use the different features to manage accounts and view password and account policy properties for users.
What to know:- manage-account: view and operate on a single account's state
- Password/account state properties: locked, expired, disabled
- Administrative resets vs self-change semantics
- Account-status notifications for downstream systems
5.04 Demonstrate knowledge of how root and topology users and privileges are managed.
What to know:- Root users live under cn=Root DNs,cn=config - not in userRoot
- Privileges (bypass-acl, config-write, unindexed-search) are granted explicitly
- Topology administrators span the whole replicated topology
- Least privilege: task-specific admin accounts over one super-root
5.05 Describe the usage of certificate stores.
What to know:- JKS and PKCS#12 key/trust stores wired via dsconfig
- Key manager vs trust manager providers
- Server certificate rotation without downtime
- Client-cert (mutual TLS) trust configuration
Tools: x509
Section 6: Integrations
6.01 Describe how to configure additional attributes for SCIM.
What to know:- SCIM 2.0 endpoint maps directory attributes to SCIM schemas
- Custom attribute mappings extend the core user schema
- Resource types and schema endpoints for discovery
On this site: LDAP search filters: reading the parenthesesTools: ldap-filter-explainer6.02 Describe the purpose and use case for PingDirectoryProxy.
What to know:- PingDirectoryProxy: entry balancing, load balancing, and failover in front of stores
- Proxying transformations and request routing
- When to proxy: partitioned data or heterogeneous backends
6.03 Describe the purpose and use case for PingDataSync.
What to know:- PingDataSync: sync pipes between source and destination
- Sync classes map and transform attributes in flight
- Real-time change detection via changelog
- Directory-to-directory and directory-to-database patterns
Public sources, used in good faith
These guides are independent study aids built from publicly available material: published exam blueprints, official product documentation, and vendor training catalogues. Product names, exam codes, and trademarks belong to their owners and are used only to identify the subject being taught. This site is not affiliated with or endorsed by any vendor named here. If you hold rights in material published on this page and believe it should be removed or corrected, please send the exact URL and a short note on the issue through the contact page; requests are reviewed promptly and in good faith. Read the full disclaimer →