Which of the following needs to be configured in order to use social authentication in PingAM?
Correct Answer: C
Social Authentication in PingAM 8.0.2 allows users to log in using identities from external providers like Google, Apple, or LinkedIn. This process relies on PingAM acting as an OAuth2 Client or OpenID Connect Relying Party (RP) toward the social provider. According to the PingAM "Social Authentication" and "Social Identity Provider Client Configuration" documentation, for PingAM to successfully hand off authentication to a social provider, you must configure an OAuth2 Client (specifically a Social Identity Provider client) within the PingAM realm. This configuration includes: Client ID and Client Secret: Obtained from the social provider's developer console (e.g., Google Cloud Console). Endpoints: The authorization, token, and UserInfo endpoints of the social provider. Scopes: The permissions PingAM is requesting (e.g., openid, profile, email). Once this "Social Client" is configured, it is used by a Social Provider Handler node (or the legacy Social Authentication module) within an authentication tree. When the user clicks "Login with Google," PingAM uses these client credentials to initiate the OIDC flow with Google. Why other options are not the primary requirement: While a Data Store (A) is eventually used to save the linked user profile, the mechanism of social auth itself is driven by the OAuth2 client configuration. A realm service (B) is too broad; while social auth is a service within a realm, the specific configuration object required is the client. A realm policy (D) governs authorization after login, but does not enable the social login process itself. Therefore, the OAuth2 client configuration is the technical prerequisite for establishing the trust relationship with the external provider.
Question 17
Which of the following statements are correct regarding session upgrades in PingAM? A) An authenticated user is required to authenticate again either to the same or a different authentication service. B) The user must not change for the session upgrade to succeed. C) The only PingAM mechanism to do a session upgrade is the ForceAuth=true request parameter. D) A session upgrade is PingAM's mechanism to perform what is called step-up authentication.1
Correct Answer: C
In PingAM 8.0.2, Session Upgrade (often referred to as Step-up Authentication) is the process of increasing the "Authentication Level" (Auth Level) associated with a user's session.2 This is common when a user has logged in with a basic method (like username/password) but attempts to access a resource that requires a stronger method (like MFA). Regarding the statements: Statement A is correct: To upgrade a session, PingAM requires the user to satisfy the requirements of an authentication tree or module that has a higher Auth Level than the current session.3 This technically involves a "re-authentication" event specifically for the higher-level requirement. Statement B is correct: Crucially, the identity authenticated during the upgrade must match the identity of the existing session. If a different user attempts to authenticate during an upgrade process, PingAM will reject the upgrade to prevent session hijacking or identity swapping.4 Statement D is correct: Session upgrade is indeed the technical implementation of the industry-standard "step-up authentication" concept. Statement C is incorrect because ForceAuth=true is not the only mechanism for a session upgrade. While ForceAuth=true (in SAML2 or OIDC) or the prompt=login parameter can force a fresh authentication, PingAM also supports upgrades via Policy Advice.5 When a policy engine determines that a resource requires a higher Auth Level, it sends an "advice" to the client, triggering a session upgrade journey.6 Additionally, authentication trees can be configured to perform upgrades natively using the Session Upgrade configuration in the realm settings. Therefore, since A, B, and D are technically accurate descriptions of the AM 8.0.2 lifecycle, Option C is the correct choice.
Question 18
What happens when an end user accesses the following login page: .../XUI/?ForceAuth=true#login?
Correct Answer: A
The ForceAuth=true parameter is a standard directive used in various authentication protocols (specifically SAML2 and OIDC) and is natively supported by the PingAM 8.0.2 XUI (the modern End-User User Interface). According to the "Authentication and SSO" documentation: Normally, if a user has an active, valid session cookie (iPlanetDirectoryPro), and they navigate to the AM login URL, PingAM will recognize the session and automatically redirect the user to their destination (the "Success URL") without prompting for credentials. This is the core benefit of Single Sign-On. However, when the ForceAuth=true parameter is appended to the query string, it instructs the PingAM authentication engine to bypass the session check for the purpose of re-authentication. The engine will: Ignore the existing valid session cookie. Force the user back to the login page (rendering the initial nodes of the configured authentication tree). Require the user to provide their credentials again. This is a critical security feature for high-value transactions. For instance, if a user is already logged in but attempts to change their bank transfer details, the application can redirect them to AM with ForceAuth=true to ensure the person sitting at the computer is indeed the authorized user. Option B is incorrect because ForceAuth only forces a re-authentication; whether that includes MFA depends on the tree configuration, not the parameter itself. Option C is incorrect as PingAM explicitly processes this parameter. Therefore, the primary outcome is the redirection to the login page regardless of the current session state.
Question 19
Which of the following multi-factor authentication protocols are supported by PingAM? A) Open authentication B) Security questions C) Web authentication D) Universal 2nd factor authentication E) Push authentication
Correct Answer: C
PingAM 8.0.2 provides a robust framework for Multi-Factor Authentication (MFA) centered around modern, secure protocols and the Intelligent Access (Authentication Trees) engine. When discussing supported "protocols" in the context of MFA in PingAM documentation, the focus is on standardized methods for secondary verification. The primary supported MFA pillars in PingAM 8.0.2 are: Open Authentication (OATH): AM supports the OATH standards, specifically TOTP (Time-based One-Time Password) and HOTP (HMAC-based One-Time Password). This is implemented through the "OATH" authentication nodes, allowing users to use apps like ForgeRock Authenticator, Google Authenticator, or YubiKeys in OATH mode. Web Authentication (WebAuthn): This is the implementation of the FIDO2 standard. It allows for passwordless and secure second-factor authentication using biometrics (like TouchID/FaceID) or hardware security keys (like YubiKeys). It is the successor to older standards and is natively supported via WebAuthn nodes. Push Authentication: This is a proprietary but highly secure protocol used specifically with the ForgeRock/Ping Authenticator app. It allows a "Push" notification to be sent to a registered mobile device, which the user then approves or denies. Why others are excluded from the selection: While PingAM supports Security Questions (KBA) and Universal 2nd Factor (U2F), they are often categorized differently in the 8.0.2 documentation. Security Questions are considered a "User Self-Service" or "Legacy" validation method rather than a modern MFA protocol. U2F is technically superseded by and included within the WebAuthn framework in PingAM 8.0.2. Thus, the most accurate grouping of distinct, core MFA protocols supported in the current version is A, C, and E, making Option C the correct answer.
Question 20
What scope is required to be included in a client's request if you wish to utilize the OpenID Connect capabilities of PingAM's OAuth2 implementation?
Correct Answer: C
PingAM 8.0.2 implements OpenID Connect (OIDC) 1.0 as an identity layer on top of the OAuth 2.0 protocol. While OAuth 2.0 is designed for authorization (accessing resources), OIDC is designed for authentication (verifying who the user is). According to the "OpenID Connect 1.0" documentation in PingAM, the presence of a specific scope in the Authorization Request is what signals to the AM server that the request should be treated as an OIDC flow rather than a standard OAuth2 flow. This mandatory scope is openid. When PingAM receives an /oauth2/authorize request containing the scope=openid parameter: It triggers the OIDC processing logic. It ensures that an ID Token (a signed JWT containing user identity information) is generated alongside (or instead of) the Access Token. It allows the client to later access the UserInfo Endpoint to retrieve further claims about the authenticated user. Other scopes like profile (Option A), email, or address are optional OIDC scopes used to request specific sets of user claims, but they do not "activate" OIDC on their own. openid+connect and id (Options B and D) are not recognized standard scopes in the OIDC specification. Therefore, openid is the fundamental requirement for any OIDC interaction in PingAM 8.0.2.
