CP-PingOne

Certified Professional - PingOne

Part of Certified Professional - PingOne

Targets: Product version not specified in the blueprint
Format: 60-70 multiple-choice questions (single- and multiple-selection)
Time limit: 90 minutes
Pass mark: not stated in the official study guide
Exam fee: USD 395 - purchased through the Ping Identity Certification Center; each voucher is valid for a single attempt
Blueprint source: Official exam description, training.pingidentity.com/certification (verified 2026-07-22); a Professional Practice Exam is offered and topics are published on the exam details page; format facts not fully captured from official sources this session; detailed objectives transcribed in full below from the official Certified Professional Study Guide PDF (relayed by PRIME 2026-07-22); per-objective study pointers authored in the enrichment wave (E2, 2026-07-22) - pointers are ANVIL-authored study aids, not PDF content ↗

Proctored exam; no prerequisites. Official recommended training: Getting Started With PingOne SSO; Getting Started With PingOne MFA; PingOne Administration.

Independent study aid built from the public exam blueprint. Not affiliated with, authorized by, or endorsed by ping. Objectives are transcribed and mapped by hand, so this page may contain mistakes or may have fallen behind the vendor's current material: exam objectives, versions, numbering and availability all change without notice. Treat ping's own certification portal as the source of truth and verify against it before you book anything.

Section 1: PingOne SSO

1.01 Describe how to configure the different application types available in PingOne
What to know:
- OIDC Web App, Native, SPA, Worker, and SAML application types
- Redirect URIs, token auth method, and grant selection per type
- Worker apps: no user context - management-API clients
- Attribute mappings from directory to tokens/assertions
On this site: OAuth flows: choosing the grant in 2026, The OIDC Authorization Code Flow
Tools: oauth-flow-chooser
1.02 Describe the Application Catalog
What to know:
- Pre-built templates for common SaaS integrations
- Catalog entries pre-fill protocol settings and mappings
- Custom apps when the catalog has no match
On this site: Açık ile gizli istemciler ve PKCE'nin yeri
1.03 Describe the Application Portal
What to know:
- End-user dock of assigned applications
- Portal access controlled by group/population assignment
- Branding follows the environment theme
1.04 Utilize certificates and keypairs
What to know:
- Signing keypairs for tokens and SAML assertions
- Certificate import for verification and encryption
- Rotation: issue new key, keep old for validation window
- Expiry visibility and admin alerts
On this site: PEM, DER ve sertifika dosya biçimleri
Tools: x509
1.05 Explain the function of resources in PingOne
What to know:
- Resources model protected APIs and their scopes
- Custom scopes attached to access tokens
- Audience values the resource server validates
- openid/profile built-ins vs custom resources
On this site: Erişim token'ları, yenileme token'ları ve kimlik token'ları
Tools: jwt
1.06 Describe how to configure policies in PingOne
What to know:
- Authentication policies: steps, conditions, and outcomes
- Single-factor vs step-up composition
- Policy assignment per application
- Default environment policy as the fallback
On this site: The OIDC Authorization Code Flow

Section 2: PingOne Directory Management

2.01 Describe how to manage users in the PingOne Directory
What to know:
- User lifecycle: create, update, disable, delete
- Password state: set, force-change, unlock
- Identity attributes and custom schema extension
- Bulk import options and CSV formats
On this site: LDAP Fundamentals: The Directory Model Behind Identity Systems
Tools: ldap-filter-explainer
2.02 Manage user groups
What to know:
- Static membership managed directly
- Dynamic groups via filter expressions
- Groups drive application access and role assignment
- Nested strategy: keep flat where possible
On this site: LDAP Fundamentals: The Directory Model Behind Identity Systems
2.03 Explain the purpose and limitations of populations
What to know:
- Populations partition users within one environment
- One population per user - hard boundary
- Per-population password policies
- Populations are not groups: no app-assignment semantics

Section 3: PingOne MFA

3.01 Describe how to configure MFA policies
What to know:
- MFA policies select allowed methods and ordering
- FIDO2, TOTP authenticator, SMS/voice/email OTP, mobile push
- Device limits and pairing rules per policy
Tools: totp-hotp
3.02 Describe how to integrate MFA into an authentication policy
What to know:
- MFA appears as a step inside an authentication policy
- Condition-gated step-up (risk, group, application)
- Remember-device semantics and bypass windows
Tools: totp-hotp
3.03 Describe how to manage a user’s MFA device
What to know:
- Admin view of a user's paired devices
- Unpair/block a lost device; user re-pairs on next login
- Device nickname and usage metadata
Tools: totp-hotp
3.04 Explain PingOne MFA settings
What to know:
- Environment-level MFA settings vs per-policy choices
- Pairing limits, OTP lifetimes, and lockout thresholds
- Notification templates the methods consume
Tools: totp-hotp

Section 4: PingOne Administration

4.01 Explain how to configure administrative roles for environments and organizations
What to know:
- Organization vs environment role scopes
- Built-ins: Organization Admin, Environment Admin, Identity Data Admin, Client App Developer
- Least privilege: scope admin roles to specific environments
- Role assignment to users or worker applications
4.02 Describe how to manage PingOne environments
What to know:
- Environment as the isolation unit (sandbox vs production)
- Region, license, and service (SSO/MFA/DaVinci) composition
- Environment properties, deletion protection
4.03 Describe how to access and collect environment audit logs
What to know:
- Audit log stream of admin and runtime events
- Console viewing with filters; export via API
- Webhook/SIEM forwarding patterns
4.04 Describe the different types of alerts available in PingOne
What to know:
- Alerts for certificate expiry, license, and key events
- Delivery to configured admin emails
- Acting before expiry: pair alerts with keypair rotation
4.05 Describe how to configure custom domains and email trust
What to know:
- Custom domain (CNAME) for auth endpoints
- Certificate provisioning for the custom domain
- Email trust: sending domain verification (SPF/DKIM alignment)
On this site: Sertifika doğrulaması aslında nasıl çalışır
Tools: x509
4.06 Describe how to configure email and SMS options
What to know:
- Email/SMS sender configuration and templates
- Custom SMTP vs Ping-provided sending
- Per-language template variants
4.07 Describe metrics on user activities
What to know:
- Dashboards: sign-ons, MFA usage, active users
- Time-window filtering and CSV export
- Reading trends: adoption and failure spikes
4.08 Utilize agreements and implement them in authentication policies
What to know:
- Agreements hold versioned consent text
- Localized agreement content per language
- Enforced as an authentication-policy step - consent gate before access
4.09 Describe the options available for customizing branding and themes
What to know:
- Themes: logo, colors, backgrounds for hosted pages
- Per-environment theme defaults
- Preview before publish; template overrides for full control
4.10 Explain how to enable and add languages
What to know:
- Enable languages per environment
- Locale detection and user override
- Translated notification and agreement content pairs with themes

Public sources, used in good faith

These guides are independent study aids built from publicly available material: published exam blueprints, official product documentation, and vendor training catalogues. Product names, exam codes, and trademarks belong to their owners and are used only to identify the subject being taught. This site is not affiliated with or endorsed by any vendor named here. If you hold rights in material published on this page and believe it should be removed or corrected, please send the exact URL and a short note on the issue through the contact page; requests are reviewed promptly and in good faith. Read the full disclaimer →