Updated Sep 14, 2026 Verified Pass PT-AM-CPE Exam in First Attempt Guaranteed [Q16-Q36]

Rate this post

Updated Sep 14, 2026 Verified Pass PT-AM-CPE Exam in First Attempt Guaranteed

Free PT-AM-CPE Sample Questions and 100% Cover Real Exam Questions (Updated 102 Questions)

NO.16 In which OAuth2 grant would you find a user code?

Client credentials grant

Authorization code grant

Resource owner password credentials grant

Device flow

NO.17 In PingAM, which OpenID Connect endpoint can be used to validate an unencrypted ID token?

/oauth2/idtokeninfo

/oauth2/userinfo

/oauth2/introspect

/oauth2/tokeninfo

NO.18 A PingAM administrator wants to deny access to an area of a protected application if the end user has been logged in for more than 10 minutes. How can this be achieved?

Use a policy with a Time environment condition

Use a policy with a Current session properties environment condition

Use a policy with a Scripted environment condition

Use a policy with an Active session time environment condition

NO.19 A SAML2 identity provider (IdP) is configured in a subrealm. Which of the following URLs can be used to export the IdP metadata?

It cannot be exported via a JSP, and the Amster tool has to be used

http://myserver.domain.com:8080/openam/saml2/jsp/exportmetadata.jsp

http://myserver.domain.com:8080/openam/saml2/jsp/exportmetadata.jsp?idp=http://myserver.domain.com:8080/openam&realm=/idprealm

http://myserver.domain.com:8080/openam/saml2/jsp/exportmetadata.jsp?entityid=http://myserver.domain.com:8080/openam&realm=/idprealm

NO.20 Which PingAM feature only uses the PingAM keystore?

Client-side sessions

Persistent Cookie node

Authentication trees

OAuth2 providers

NO.21 Which authentication node checks and validates a recovery code used during a multi-factor authentication challenge sequence?

Recovery Code Display node

Recovery Code Comparator node

Recovery Code Collector Decision node

Recovery Code Verifier node

NO.22 Which multi-factor authentication methods require a separate device and an application?

Push, WebAuthn

Push, WebAuthn, Open Authentication

WebAuthn, Open Authentication

Open Authentication, Push

NO.23 Which audit event handler is used by PingAM by default, when audit logging is enabled?

Elasticsearch audit event handler

CSV audit event handler

Syslog audit event handler

JSON audit event handler

NO.24 In an authentication tree process, considering best practice, where can the collected context data for mobile devices be persisted for subsequent risk analysis?

In the session state

In shared node state

With the user profile

In a browser cookie

NO.25 When the OATH Registration node’s OATH Algorithm property is set to TOTP in an authentication tree, which node needs to have the same value set?

OATH Token Verifier node

Recovery Code Collector Decision node11

MFA Registration Options node12

OATH Device Storage node13

NO.26 Which organization sets, maintains, and governs the SAML2 standard?

WC3

IETF

OASIS

ISC2

NO.27 Which area of PingAM does affinity mode relate to?

Authentication

Load balancing

Self-service

Authorization

NO.28 Which organization sets, maintains, and governs the SAML2 standard?

OASIS

ISC2

IETF

WC3

NO.29 When a user undergoes a session upgrade, what is the outcome?

A new session is created, and the original session is deleted

The session properties are copied to a new session, and a new session token is handed to the client

The session is updated with new properties, but the session token remains the same

A new session is created, and the original session properties are not copied

NO.30 When developing a PingAM may act script for OAuth2 token exchange patterns, which variables are made available for use in the script?

clientProperties, identity, logger, requestProperties, scopes, scriptName, session, token

clientProperties, identity, logger, requestProperties, scopes, scriptName, session, requestedToken

clientProperties, identity, logger, requestProperties, scopeList, scriptName, session, requestedToken

clientProperties, identity, logger, requestProperties, scopeList, scriptName, session, token

NO.31 Why should module-based authentication be disabled in production?

Module-based authentication allows a user to authenticate with the amAdmin account

Module-based authentication allows a user to select any authentication level

Module-based authentication allows a user to bypass steps in an authentication chain

Module-based authentication allows users to authenticate in any realm

NO.32 In a PingAM cluster, how is the debug level set?

On each server in the debug.properties file

On a per-instance basis in the admin console

On a per-site basis in the admin console

It is not recommended to change the level at all

NO.33 Which of the following needs to be configured in order to use social authentication in PingAM?

A data store

A realm service

An OAuth2 client

A realm policy

NO.34 Which OpenID Connect grant flow is best to use when the relying party knows the user’s identifier and wishes to gain consent for an operation from the user by means of a separate authentication device?

Implicit grant

Authorization code grant

Hybrid grant

Backchannel request grant

NO.35 A non-authenticated user requests a resource protected by PingGateway or a Web Agent. Put the following events of the authentication lifecycle in chronological order:
User answers the “questions asked” (callbacks) by PingAM.
User tries to access a resource protected by PingGateway or a Web Agent.
Session reaches a timeout value or user logs out.
PingGateway or the Web Agent validates the session.
User is redirected to the authentication user interface of PingAM.
User is redirected to the resource.

2-1-4-3-5-6

2-5-1-6-4-3

2-5-1-6-3-4

2-1-5-6-4-3

NO.36 In a default PingAM configuration, what type of keystore stores the secret ID named storepass, which contains the encrypted password of the default-keystore secret store?

Keystore secret store

Environment and system property secret store

Filesystem secret store

Hardware Security Module secret store

Ping Identity PT-AM-CPE Exam Syllabus Topics:

Topic	Details
Topic 1	Extending Services Using OAuth2-Based Protocols: This domain addresses integrating applications with OAuth 2.0 and OpenID Connect, securing OAuth2 clients with mutual TLS and proof-of-possession, transforming OAuth2 tokens, and implementing social authentication.
Topic 2	Federating Across Entities Using SAML2: This domain covers implementing single sign-on using SAML v2.0 and delegating authentication responsibilities between SAML2 entities.
Topic 3	Improving Access Management Security: This domain focuses on strengthening authentication security, implementing context-aware authentication experiences, and establishing continuous risk monitoring throughout user sessions.
Topic 4	Enhancing Intelligent Access: This domain covers implementing authentication mechanisms, using PingGateway to protect websites, and establishing access control policies for resources.
Topic 5	Installing and Deploying AM: This domain encompasses installing and upgrading PingAM, hardening security configurations, setting up clustered environments, and deploying PingOne Advanced Identity Platform to the cloud.