最新の2026年03月16日 PAP-001問題集は学習ガイドは試験合格するための秘訣
PAP-001問題集の無料PDFをゲットせよ！最近更新された問題
Ping Identity PAP-001 認定試験の出題範囲：
| トピック | 出題範囲 |
|---|---|
| トピック 1 |
|
| トピック 2 |
|
| トピック 3 |
|
| トピック 4 |
|
| トピック 5 |
|
| トピック 6 |
|
質問 # 13
A change is made to the configuration that prevents user access to an application. No one claims to have made the change. Which log file should the administrator use to determine who made the change?
- A. pingaccess_engine_audit.log
- B. pingaccess_agent_audit.log
- C. pingaccess_api_audit.log
- D. pingaccess.log
正解：C
解説：
All administrative API calls that change PingAccess configuration are logged inpingaccess_api_audit.log.
This allows administrators to track who made configuration changes.
Exact Extract:
"Thepingaccess_api_audit.logfile contains entries for all administrative API calls and is used to audit configuration changes."
* Option A (pingaccess.log)contains runtime system messages but not detailed API audit entries.
* Option B (pingaccess_engine_audit.log)is specific to engine request/response audit logging.
* Option C (pingaccess_agent_audit.log)is used for PingAccess Agent traffic auditing, not administrative changes.
* Option D (pingaccess_api_audit.log)is correct - it tracks admin API modifications.
Reference:PingAccess Administration Guide -Log Files
質問 # 14
How many administrators are supported using HTTP Basic Authentication in the Administrative Console?
- A. 0
- B. 1
- C. 2
- D. 3
正解：B
解説：
When usingHTTP Basic Authentication(admin.auth=native), PingAccess only supports asingle administrative account(the default admin user). For multiple administrators, SSO integration (e.g., OIDC) is required.
Exact Extract:
"When admin authentication is set to native (HTTP Basic), only one administrative user is supported. For multiple admins, configure UI authentication with an OIDC provider."
* Option A (1000)is incorrect.
* Option B (1)is correct - only one basic auth admin account.
* Option C (10)andOption D (100)are incorrect.
Reference:PingAccess Administration Guide -Admin Authentication
質問 # 15
An administrator is setting up PingAccess to terminate SSL for a proxied application. What action must the administrator take to configure an existing certificate for that application?
- A. Enable Require HTTPS in the Application configuration
- B. Assign the Key Pair to the Virtual Host
- C. Assign the Key Pair to the Agent Listener
- D. Set the secure flag to Yes in the Site configuration
正解：B
解説：
PingAccess terminates SSL at theVirtual Hostlevel. To configure an existing certificate, the administrator must assign the appropriateKey Pair(which contains the certificate and private key) to the Virtual Host.
Exact Extract:
"SSL termination occurs on the engine listener through virtual hosts. Assign the certificate's key pair to the virtual host to secure proxied applications."
* Option Ais correct - assign the key pair to the Virtual Host for SSL termination.
* Option Bis incorrect - Require HTTPS enforces secure access but does not configure SSL termination.
* Option Cis incorrect - Agent Listener is for PingAccess Agents, not proxied apps.
* Option Dis incorrect - secure flag affects cookie settings, not SSL certificates.
Reference:PingAccess Administration Guide -Virtual Hosts and Key Pairs
質問 # 16
A PingAccess API deployment requires multiple Access Token Managers to maintain compliance with customer requirements. Which feature must be set on the Token Provider configuration?
- A. Send Audience
- B. Client Secret
- C. Use Token Introspection Endpoint
- D. Subject Attribute Name
正解：A
解説：
When using multiple Access Token Managers, theSend Audienceoption ensures that tokens are scoped properly and validated against the intended resource/application.
Exact Extract:
"EnableSend Audiencein the token provider configuration to support environments with multiple Access Token Managers and enforce correct audience restrictions."
* Option A (Subject Attribute Name)is unrelated - it maps user identity but not token manager selection.
* Option B (Send Audience)is correct - required when multiple ATMs are in use.
* Option C (Use Token Introspection Endpoint)is optional and depends on deployment, not mandatory for multiple ATMs.
* Option D (Client Secret)is part of OAuth client credentials, not specific to multiple ATMs.
Reference:PingAccess Administration Guide -Access Token Management
質問 # 17
Which two browsers are supported for the PingAccess Admin console? (Choose 2 answers.)
- A. Brave
- B. Opera
- C. Microsoft Edge
- D. Google Chrome
- E. Apple Safari
正解：C、D
解説：
PingAccess officially supportsGoogle ChromeandMicrosoft Edgefor the administrative console. Other browsers (Safari, Opera, Brave) may work but are not officially supported.
Exact Extract:
"The PingAccess administrative console is supported on current versions of Google Chrome and Microsoft Edge."
* Option A (Safari)is not officially supported.
* Option B (Opera)is not supported.
* Option C (Google Chrome)is correct.
* Option D (Microsoft Edge)is correct.
* Option E (Brave)is not officially supported.
Reference:PingAccess Release Notes -System Requirements
質問 # 18
PingAccess will terminate SSL for multiple proxied applications that share thecustomer.comURL domain.
The administrator needs different ways to minimize the number of SSL certificates to manage these user- facing applications.
What are two ways this requirement can be met? (Choose 2 answers.)
- A. Assign a Subject Alternative Name Certificate to the Agent Listener
- B. Assign a wildcard certificate to the Engine Listener
- C. Assign unique Key Pairs to each Virtual Host
- D. Assign a wildcard certificate to the Agent Listener
- E. Assign a Subject Alternative Name Certificate to the Engine Listener
正解：B、E
解説：
PingAccess usesEngine Listenersfor SSL termination of proxied applications. To minimize the number of certificates, administrators can:
* Use awildcard certificate(e.g.,*.customer.com) on the engine listener.
* Use aSubject Alternative Name (SAN) certificatethat covers multiple FQDNs under thecustomer.
comdomain.
Exact Extract:
"PingAccess engine listeners can use certificates containing either wildcard entries or Subject Alternative Names to secure multiple applications under a single domain."
* Option Ais incorrect - assigning unique key pairs increases, not decreases, certificate management overhead.
* Option Bis correct - a wildcard certificate covers all subdomains (e.g.,app1.customer.com,app2.
customer.com).
* Option Cis correct - a SAN certificate lists multiple FQDNs explicitly.
* Option Dis incorrect - agent listeners don't handle SSL termination for proxied apps.
* Option Eis incorrect for the same reason - agent listeners aren't used for SSL.
Reference:PingAccess Administration Guide -Certificates and Engine Listeners
質問 # 19
Where in the administrative console should an administrator make user attributes available as HTTP request headers?
- A. Identity Mappings
- B. Web Sessions
- C. Site Authenticators
- D. HTTP Requests
正解：A
解説：
PingAccess usesIdentity Mappingsto take identity attributes provided by the authentication source (e.g., PingFederate, OpenID Connect) and map them into HTTP request headers for back-end applications.
Exact Extract:
"An identity mapping allows you to map identity attributes from the user's session to HTTP headers, cookies, or query parameters that are then forwarded to the target application."
* Option A (Site Authenticators)is incorrect because Site Authenticators configure how PingAccess communicates with applications requiring authentication, not how attributes are inserted into headers.
* Option B (Identity Mappings)is correct - this is the feature designed specifically to expose user attributes to applications via HTTP headers.
* Option C (Web Sessions)manages how sessions are stored and validated, but not the mapping of attributes into requests.
* Option D (HTTP Requests)refers to request/response processing rules, but attributes are not mapped here.
Reference:PingAccess Administration Guide -Identity Mapping
質問 # 20
An administrator needs to configure a protected web application using theAuthorization Codelogin flow.
Which two configuration parameters must be set? (Choose 2 answers.)
- A. OAuth Token Introspection Endpoint
- B. OpenID Connect Login Type
- C. OAuth Client ID
- D. OpenID Connect Issuer
- E. Virtual Host
正解：B、C
解説：
When using theAuthorization Code Flowfor authentication, PingAccess must be configured with:
* AnOAuth Client IDthat identifies the application to the IdP.
* TheOpenID Connect Login Typeset to Authorization Code.
Exact Extract:
"When configuring an OIDC web session, specify the OAuth client ID and select the OpenID Connect login type (Authorization Code, Hybrid, or Implicit)."
* Option A (OAuth Token Introspection Endpoint)is not required for Authorization Code flow - token introspection is used in other cases.
* Option B (OAuth Client ID)is correct - required for OIDC authorization requests.
* Option C (OpenID Connect Issuer)is discovered automatically via metadata when you configure the token provider.
* Option D (Virtual Host)is required for application exposure but not specific to OIDC flow.
* Option E (OpenID Connect Login Type)is correct - must be set to "Authorization Code." Reference:PingAccess Administration Guide -Configuring OIDC Web Sessions
質問 # 21
An application is hosted on a server that requires clients to authenticate using a username:password pair. This application is behind PingAccess, which is acting as a gateway. What action should the administrator take to allow PingAccess to access the application?
- A. Configure a Basic Authentication Site Authenticator to the Site
- B. Apply an Identity Mapping that includes the username and password
- C. Apply a valid Web Session that contains the username and password
- D. Configure a Mutual TLS Site Authenticator to the Site
正解：A
解説：
When a back-end site requires HTTP Basic Authentication, PingAccess supports this via aBasic Authentication Site Authenticator. The authenticator is configured with credentials so that PingAccess can successfully authenticate to the target site.
Exact Extract:
"PingAccess can authenticate to target sites using a Site Authenticator. Use the Basic Authentication Site Authenticator when the site requires a username and password."
* Option Ais incorrect - identity mappings are used to forward user attributes, not for site-to-site authentication.
* Option Bis incorrect - web sessions represent end-user sessions, not back-end credentials.
* Option Cis correct - the Basic Authentication Site Authenticator should be configured on the Site.
* Option Dis incorrect - mTLS authenticates with certificates, not username/password.
Reference:PingAccess Administration Guide -Site Authenticators
質問 # 22
All access requests to the existing/adminresource must be captured in the audit log. How should this be accomplished?
- A. Set Splunk audit logging for/admin
- B. Enable the Audit option for the/adminresource
- C. Enable the Audit option for the/*resource
- D. Setlog4j2.xmlaudit logging for/admin
正解：B
解説：
PingAccess resources have anAudit flag. When enabled, all access attempts (allowed or denied) are recorded in the audit logs.
Exact Extract:
"To audit access requests to a specific resource, enable the Audit option on that resource in the application configuration."
* Option Ais correct - enabling audit for/adminensures its access requests are logged.
* Option Bis incorrect - enabling audit for/*is overly broad and logs everything, not just/admin.
* Option Cis incorrect - Splunk integration is for log forwarding, not per-resource auditing.
* Option Dis incorrect -log4j2.xmlcontrols log destinations/levels, not resource-specific auditing.
Reference:PingAccess Administration Guide -Resource Audit Logging
質問 # 23
During a business review of an application, the administrator needs to change the Resource Authentication to anonymous. What are the two effects of making this change to the resource? (Choose 2 answers.)
- A. The resource requires no further authentication, and Identity Mappings still apply.
- B. The resource requires no further authentication, and no rules will apply.
- C. The resource requires no further authentication, and Processing rules still apply.
- D. Requests to this resource are not logged, and Identity Mappings are applied.
- E. The resource requires no further authentication, and all Access Control rules still apply.
正解：A、C
解説：
When a resource is configured asanonymous, PingAccess does not challenge the user for authentication.
However, certain processing and identity propagation still occur.
Exact Extract:
"Anonymous resources do not require authentication. Identity mappings and request/response processing rules still apply."
* Option Ais incorrect because rules such as identity mappings and processing still apply.
* Option Bis correct - Identity Mappings can still forward attributes, even for anonymous access.
* Option Cis correct - Processing rules (e.g., request/response modifications) still apply.
* Option Dis incorrect - requestsarelogged; anonymous does not disable logging.
* Option Eis incorrect - access control rules (authorization) are not evaluated for anonymous resources.
Reference:PingAccess Administration Guide -Resource Authentication
質問 # 24
A business requires logs to be written to a centralized Oracle database. Which two actions must the PingAccess administrator take to enable this? (Choose 2 answers.)
- A. Remove the logs located in PA_HOME/log.
- B. Copy the database driver JAR file to the PA_HOME/lib directory.
- C. Configure log4j2.xml and log4j2.db.properties.
- D. Enable the Audit flag in the Resource.
- E. Import the database certificate into the Trusted Certificate Group.
正解：B、C
解説：
PingAccess supports logging directly to a relational database usingLog4j database appenders. To enable this:
* Configurelog4j2.xmlto use a JDBC Appender.
* Configurelog4j2.db.propertieswith the database connection information.
* Provide the appropriate database driver in thePA_HOME/libdirectory.
Exact Extract:
"To log to a database, configure log4j2.xml and log4j2.db.properties, and place the JDBC driver JAR file in PA_HOME/lib."
* Option Ais correct - both files must be configured.
* Option Bis incorrect - existing logs do not need removal.
* Option Cis incorrect - enabling audit is unrelated to database logging.
* Option Dis correct - the Oracle JDBC driver must be installed in PA_HOME/lib.
* Option Eis incorrect unless TLS is used to connect to the DB, but it is not required for standard DB logging setup.
Reference:PingAccess Administration Guide -Log Configuration
質問 # 25
A company has removed the requirement to record back-channel requests from PingAccess to PingFederate in the audit log.
Where should the administrator update this behavior without affecting existing applications?
- A. Token Provider
- B. Web Sessions
- C. Sites
- D. Token Validation
正解：D
解説：
PingAccess can be configured to log or suppress back-channel requests that occur duringtoken validation with an OAuth/OpenID Connect provider such as PingFederate. These requests happen when PingAccess calls PingFederate to validate access tokens or retrieve key material.
* Exact Extract from PingAccess documentation:
"Back-channel requests are logged during token validation by default. To prevent these requests from being written to the audit log, update theToken Validationsettings in PingAccess." This makesToken Validationthe correct location for changing the behavior without modifying application- specific configurations.
Why other options are wrong:
* B. Web Sessions
* Incorrect. Web Sessions control user session management and cookie handling, not back-channel token validation traffic.
* C. Sites
* Incorrect. Sites are the definitions of backend servers that PingAccess proxies to. This setting does not affect back-channel logging to PingFederate.
* D. Token Provider
* Incorrect. The Token Provider defines the OIDC/OAuth server (e.g., PingFederate) and its endpoints, but the logging of back-channel requests is not controlled here.
Thus, the correct answer isA. Token Validation.
Reference:PingAccess Administration Guide-Managing Token Validationsection.
質問 # 26
Which two options can be changed in therun.propertiesfile? (Choose 2 answers.)
- A. URL for heartbeat endpoint
- B. Logging levels
- C. Operational mode for PingAccess
- D. X-Frame-Options header
- E. Default logs location
正解：B、C
解説：
Therun.propertiesfile in PingAccess is the primary configuration file that defines system-level runtime behavior. According to PingAccess documentation:
* Exact Extract:
"Therun.propertiesfile contains configuration properties for PingAccess, including operational mode, logging levels, admin authentication fallback, cluster settings, and system defaults." (PingAccess Administrator's Guide -run.properties Reference) From this, we can determine:
* C. Operational mode for PingAccess#CorrectThe propertypa.operational.modeinrun.properties defines whether the node operates asSTANDALONE,CLUSTERED_CONSOLE, CLUSTERED_CONSOLE_REPLICA, orCLUSTERED_ENGINE. This is one of the core configurable options.
* E. Logging levels#CorrectProperties such aslog.leveland other logging configurations are explicitly defined inrun.properties, allowing administrators to adjust the verbosity of logs (DEBUG, INFO, WARN, ERROR).
Why the others are incorrect:
* A. Default logs location#IncorrectThe log file path is not controlled viarun.properties. It is defined in log4j2.xml, not inrun.properties.
* B. URL for heartbeat endpoint#IncorrectThe heartbeat endpoint (/pa/heartbeat.ping) is a fixed system endpoint and is not configurable inrun.properties.
* D. X-Frame-Options header#IncorrectSecurity headers likeX-Frame-Optionsare managed under application security policies or global response headers, not inrun.properties.
Reference:PingAccess Administrator's Guide -run.properties Reference(section describingpa.operational.
modeand logging configuration properties).
質問 # 27
What is the purpose of PingAccess processing rules?
- A. To collect data for offline processing
- B. To override upstream access control decisions
- C. To allow for more detailed auditing
- D. To modify web traffic in real time
正解：D
解説：
Processing Rulesin PingAccess apply transformations to HTTP traffic (requests or responses) in real time, such as modifying headers, handling CORS, or rewriting cookies.
Exact Extract:
"Processing rules allow PingAccess to modify HTTP requests and responses in real time, such as adding headers or enabling cross-origin requests."
* Option Ais incorrect - they are not for offline data collection.
* Option Bis correct - their purpose is real-time modification of web traffic.
* Option Cis incorrect - access control rules enforce or override authorization, not processing rules.
* Option Dis incorrect - auditing is handled in log configurations, not processing rules.
Reference:PingAccess Administration Guide -Rules Overview (Processing Rules)
質問 # 28
What information must be provided when setting the PingFederate Standard Token Provider for the Runtime engines?
- A. Host
- B. Client ID
- C. Port
- D. Issuer
正解：A
解説：
When configuring PingAccess to use PingFederate as theStandard Token Providerfor runtime engines, PingAccess must know how to contact PingFederate. The configuration requires theHost(PingFederate base URL).
Exact Extract:
"When configuring the Standard Token Provider, specify the PingFederate host to which PingAccess engines will connect for token validation."
* Option A (Issuer)is part of OIDC metadata but not required explicitly in this configuration.
* Option B (Client ID)is needed for OAuth clients but not when defining the token provider connection itself.
* Option C (Host)is correct - this is required to connect to PingFederate.
* Option D (Port)may be included within the host definition (host:port) but is not the required field.
Reference:PingAccess Administration Guide -Configuring PingFederate as a Token Provider
質問 # 29
A PingAccess administrator needs to configure PingAccess to validate tokens. Which two options can the administrator use? (Choose 2 answers)
- A. Common SAML provider
- B. PingAuthorize
- C. Kerberos
- D. PingFederate
- E. Common OIDC provider
正解：D、E
解説：
PingAccess validates access tokens usingAccess Token Managers, which are typically backed by PingFederateor ageneric OIDC provider.
Exact Extract:
"PingAccess validates tokens through Access Token Managers, which can be configured against PingFederate or a common OIDC provider."
* Option A (PingFederate)is correct - the most common token provider.
* Option B (Kerberos)is not supported for token validation.
* Option C (SAML provider)is incorrect - PingAccess does not natively consume SAML assertions.
* Option D (Common OIDC provider)is correct - tokens can be validated against any OIDC- compliant IdP.
* Option E (PingAuthorize)is an authorization engine, not a token provider.
Reference:PingAccess Administration Guide -Access Token Managers
質問 # 30
A business application must be accessible via two FQDNs. Which PingAccess functionality should an administrator use to meet this requirement?
- A. Virtual Hosts
- B. Applications
- C. Web Sessions
- D. Sites
正解：A
解説：
Virtual Hostsin PingAccess define the external FQDNs (and ports) through which applications are accessed.
An application can be bound to multiple virtual hosts to allow access via multiple FQDNs.
Exact Extract:
"A virtual host specifies the fully qualified domain name and port number through which an application is accessed."
* Option A (Virtual Hosts)is correct - multiple FQDNs can be supported by assigning multiple virtual hosts.
* Option B (Applications)define resource protection but do not manage FQDN binding.
* Option C (Sites)define back-end targets, not the public-facing FQDN.
* Option D (Web Sessions)handle authentication state, unrelated to hostnames.
Reference:PingAccess Administration Guide -Virtual Hosts
質問 # 31
An administrator needs to configure an application that uses a backend web server that has its own authentication mechanism. Which type of object must be configured for PingAccess to provide access to the target server?
- A. Token Provider
- B. Site Authenticator
- C. Web Session
- D. Access Control Rule
正解：B
解説：
When a backend application requires its own authentication (e.g., Basic Auth or mutual TLS), PingAccess uses aSite Authenticatorto inject the necessary credentials.
Exact Extract:
"Site Authenticators provide the credentials PingAccess uses when authenticating to target applications that require their own authentication mechanisms."
* Option A (Token Provider)is incorrect - this is used for OIDC/OAuth tokens, not site-level authentication.
* Option B (Web Session)manages end-user sessions, not backend site authentication.
* Option C (Site Authenticator)is correct - it handles authentication between PingAccess and the backend.
* Option D (Access Control Rule)enforces authorization, not backend authentication.
Reference:PingAccess Administration Guide -Site Authenticators
質問 # 32
Under which top-level directory are PingAccess configuration archives stored?
- A. bin
- B. data
- C. conf
- D. tools
正解：B
解説：
PingAccess automatically creates configurationarchive backupswhenever changes are made. These are stored in thedata/archivedirectory.
Exact Extract:
"PingAccess stores configuration archive files in thePA_HOME/data/archivedirectory."
* Option A (tools)is incorrect - contains administrative scripts.
* Option B (conf)is incorrect - holds configuration files likerun.properties.
* Option C (data)is correct - archives are stored underdata/archive.
* Option D (bin)is incorrect - contains executables and scripts.
Reference:PingAccess Administration Guide -Configuration Archives
質問 # 33
......
最新PAP-001試験問題集には高得点で一発合格：https://www.passtest.jp/Ping-Identity/PAP-001-shiken.html
PAP-001認定試験問題集には72練習テスト問題はこちら：https://drive.google.com/open?id=1m5sX00BnjU1WCO-kQA6C6HogDliroWwF