I85PREP
⌘ K
PingFederate study materials
PingFederate study resources

PingFederate practice questions

One question at a time. Build your PingFederate understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1PingFederate Administration

In PingFederate, which component is responsible for issuing and signing assertions to service providers in an SP-initiated SSO flow?

  1. The STS token processor
  2. The identity provider (IdP) server Correct answer.
  3. The service provider (SP) adapter
  4. The PingFederate administrative console

Explanation

In an SP-initiated flow the SP sends an AuthnRequest to the IdP, and the IdP is the party that authenticates the user and issues the signed assertion. The IdP role in PingFederate is fulfilled by the runtime server configured with the relevant IdP connection.

Question 2PingFederate Administration

Which PingFederate artifact stores the runtime configuration that the engine reads, as opposed to the console's editable data?

  1. The run.properties file
  2. The server.log file
  3. The pingfederate.lic license file
  4. The data.zip archive Correct answer.

Explanation

PingFederate persists configuration into the data.zip archive, which the runtime engine loads. Administrators edit configuration through the console, and changes are committed to this archive.

Question 3PingFederate Administration

An administrator wants PingFederate to authenticate users directly against an LDAP directory for an IdP connection. Which configuration object should be created first?

  1. A metadata signing certificate
  2. A password credential validator Correct answer.
  3. A JWT access token mapping
  4. An OAuth client

Explanation

A password credential validator (PCV) defines how PingFederate checks credentials against a store such as LDAP. The IdP adapter then references the PCV to perform authentication.

Question 4PingFederate Administration

Which file extension identifies SAML metadata that PingFederate can import directly to create a connection?

  1. .p12
  2. .pem
  3. .xml Correct answer.
  4. .jks

Explanation

SAML metadata is expressed as an XML document with a standard schema, so PingFederate imports it as an .xml file. The other extensions represent certificate or keystore formats rather than metadata.

Question 5PingFederate Administration

What is the primary purpose of a PingFederate authentication policy contract?

  1. To schedule metadata refresh intervals
  2. To define the attributes returned to the SP after authentication Correct answer.
  3. To encrypt the SAML assertion with the SP certificate
  4. To store OAuth refresh tokens

Explanation

An authentication policy contract specifies the set of attributes that an authentication policy must supply to the connection. It acts as the interface between policy evaluation and attribute fulfillment.

Question 6PingFederate Administration

Which PingFederate feature lets an administrator test an IdP connection end-to-end without a real SP?

  1. The certificate expiry monitor
  2. The IdP connection test in the administrative console Correct answer.
  3. The OAuth Playground
  4. The cluster replication status page

Explanation

PingFederate provides a built-in connection test that simulates an SSO transaction to validate configuration. It exercises the adapter, policy, and mapping without requiring a live SP.

Question 7PingFederate Administration

Which protocol does PingFederate use by default to receive SAML assertions at an SP connection's assertion consumer service?

  1. HTTP-Artifact binding
  2. SOAP over JMS
  3. HTTP-POST binding Correct answer.
  4. SAML over WebSocket

Explanation

The default assertion consumer service uses the HTTP-POST binding, in which the assertion is delivered as a form parameter. HTTP-Artifact is an alternative binding that requires a back-channel resolution step.

Question 8PingFederate Administration

Which certificate does PingFederate use to sign SAML assertions sent to an SP connection?

  1. The connection's signing certificate Correct answer.
  2. The administrative console certificate
  3. The OAuth client secret
  4. The SSL server certificate

Explanation

Each connection references a signing certificate used to sign assertions or responses. The SP must trust this certificate, typically delivered through metadata.

Question 9PingFederate Administration

An administrator needs PingFederate to release the department attribute to a specific SP but not to others. Where should this be configured?

  1. In the attribute contract and fulfillment of that SP connection Correct answer.
  2. In the license file
  3. In the global system settings
  4. In the server.log configuration

Explanation

Attribute release is scoped per connection through the attribute contract and attribute fulfillment configuration. This lets each SP receive only the attributes it is entitled to.

Question 10PingFederate Administration

A user authenticates at the IdP but the SP rejects the assertion because the audience does not match. Which configuration should be corrected?

  1. The cluster node ID
  2. The IdP adapter's password policy
  3. The metadata refresh interval
  4. The SP connection's expected audience setting Correct answer.

Explanation

The audience restriction in the assertion must match the value the SP expects. In PingFederate, the SP connection defines the audience it will accept, so that value must align with the SP's entity ID.

Question 11PingFederate Administration

Which PingFederate object maps IdP adapter attributes into the SAML assertion's attribute statement for an IdP connection?

  1. The attribute contract fulfillment Correct answer.
  2. The SSL certificate alias
  3. The session validity setting
  4. The OAuth scope

Explanation

Attribute contract fulfillment defines how each contracted attribute is populated from sources such as adapter results or lookup tables. It is the mechanism that places values into the assertion.

Question 12PingFederate Administration

For an OIDC provider configuration, what does PingFederate require to sign ID tokens?

  1. An SP adapter
  2. A SAML metadata file
  3. A signing certificate and key pair Correct answer.
  4. An LDAP bind password

Explanation

OIDC ID tokens are signed with a key pair so relying parties can verify integrity via published JWKS. PingFederate references a signing certificate for this purpose.

Question 13PingFederate Administration

An administrator wants to limit the maximum session lifetime for an IdP connection to eight hours. Which setting is adjusted?

  1. OAuth refresh token lifetime
  2. Attribute masking rules
  3. Idle timeout and maximum session timeout Correct answer.
  4. Metadata validity period

Explanation

Session lifetime is governed by idle timeout and maximum session timeout settings on the connection. The maximum session timeout caps total session duration regardless of activity.

Question 14PingFederate Administration

Which action is required on the SP side after PingFederate rotates its signing certificate and publishes new metadata?

  1. Restart the PingFederate runtime engine
  2. Reissue the license file
  3. Clear the PingFederate data.zip
  4. Import the updated metadata to trust the new signing certificate Correct answer.

Explanation

The SP must trust the new signing certificate, which is distributed through updated metadata. Importing the metadata updates the SP's trusted certificate configuration.

Question 15PingFederate Administration

In a PingFederate cluster, how do administrative configuration changes reach other nodes?

  1. Through the OAuth Playground
  2. Through cluster replication that distributes committed configuration Correct answer.
  3. Through manual file copy on each node
  4. Through the load balancer's session affinity

Explanation

PingFederate clusters replicate committed configuration from the admin node to the engine nodes. This keeps runtime behavior consistent across the cluster.

Question 16PingFederate Administration

Which log file should an administrator inspect first when troubleshooting a failed SSO transaction in PingFederate?

  1. pingfederate.lic
  2. data.zip
  3. run.properties
  4. server.log Correct answer.

Explanation

server.log records runtime events, including SSO processing details and errors. It is the primary diagnostic source for transaction failures.

Question 17PingFederate Administration

An administrator must ensure that only users in a specific group can access an SP. Which PingFederate mechanism enforces this?

  1. An OAuth refresh token
  2. An authentication policy with a group membership condition Correct answer.
  3. A connection template
  4. A metadata signing certificate

Explanation

Authentication policies evaluate conditions such as group membership to decide whether authentication succeeds for a user. Failing the condition prevents assertion issuance.

Question 18PingFederate Administration

Which PingFederate component translates between different token types when integrating with WS-Trust clients?

  1. The password credential validator
  2. The STS token processor Correct answer.
  3. The SP adapter
  4. The metadata exporter

Explanation

The security token service (STS) token processor handles WS-Trust token exchange and translation. It allows clients to obtain tokens in a different format than the source.

Question 19PingFederate Administration

An IdP connection is configured with an adapter that returns no user identifier. What is the most likely result during SSO?

  1. Attribute fulfillment fails and the transaction errors Correct answer.
  2. PingFederate silently issues an anonymous assertion
  3. The signing certificate is regenerated
  4. The SP automatically falls back to basic authentication

Explanation

Attribute fulfillment depends on source values such as the user identifier from the adapter. When a required value is missing, fulfillment cannot complete and the transaction fails with an error.

Question 20PingFederate Administration

Which configuration allows PingFederate to serve as an SP that consumes assertions from an external IdP?

  1. An IdP connection with a password credential validator
  2. An SP connection with an IdP adapter or assertion mapping Correct answer.
  3. An OAuth authorization server configuration
  4. A cluster node definition

Explanation

When PingFederate acts as the SP, it is configured with an SP connection that defines how incoming assertions are validated and mapped. The IdP connection is used when PingFederate issues assertions.

Question 21PingFederate Administration

A SAML assertion is signed but not encrypted. Which risk does this present when the assertion traverses an untrusted browser via HTTP-POST?

  1. The assertion audience is ignored
  2. The SP cannot verify the IdP identity
  3. Assertion contents are readable by the browser even though integrity is protected Correct answer.
  4. The signature becomes invalid at the SP

Explanation

Signing protects integrity and authenticity but not confidentiality, so the assertion payload remains readable. Encryption is required when the contents must be hidden from the browser or intermediaries.

Question 22PingFederate Administration

During a metadata import, PingFederate finds a certificate whose key usage lacks digital signature. What is the most appropriate administrative response?

  1. Replace the partner's certificate with the local SSL certificate
  2. Request corrected metadata from the partner with a properly purposed signing certificate Correct answer.
  3. Switch the connection to the HTTP-Artifact binding
  4. Disable signature validation on the connection

Explanation

A signing certificate must carry the digital signature key usage for signatures to validate correctly. The proper fix is to obtain corrected metadata from the partner rather than weakening validation.

Question 23PingFederate Administration

An organization runs two PingFederate engine nodes behind a load balancer without session affinity. Which issue is most likely during SSO?

  1. The user's session state may not be found when a later request lands on a different node Correct answer.
  2. The signing certificate is automatically revoked
  3. OAuth scopes are silently expanded
  4. Metadata import fails on both nodes

Explanation

PingFederate tracks session state, and without session affinity a subsequent request may reach a node that lacks that state. Configuring session affinity or shared session storage addresses this.

Question 24PingFederate Administration

An administrator observes that an SP rejects assertions because the NotBefore condition is in the future relative to the SP clock. Which remediation is most appropriate?

  1. Synchronize clocks and allow a small clock skew in the connection settings Correct answer.
  2. Disable assertion signing
  3. Shorten the assertion validity window to zero
  4. Remove the audience restriction

Explanation

Time-bound conditions such as NotBefore depend on synchronized clocks between parties. Allowing a small clock skew tolerance absorbs minor drift without compromising the validity model.

Question 25PingFederate Administration

An administrator needs to expose a subset of IdP connection attributes to an OIDC client as claims. Which configuration area governs this mapping?

  1. The OIDC policy's attribute contract and claim mapping Correct answer.
  2. The SAML metadata signing settings
  3. The cluster replication settings
  4. The password credential validator

Explanation

OIDC policies define the attribute contract and how attributes map to ID token or userinfo claims. This controls which claims an OIDC client receives.

Question 26PingFederate Administration

An administrator wants PingFederate to validate incoming SAML assertions from an external IdP against a partner's published signing certificate. Which configuration artifact supplies that trusted certificate and endpoint metadata to PingFederate?

  1. A local signing certificate keystore entry on the runtime server
  2. A password credential validator mapped to the IdP connection
  3. An imported partner metadata file or metadata URL on the IdP connection Correct answer.
  4. A connection template applied to the SP adapter

Explanation

PingFederate consumes partner metadata, either uploaded as a file or retrieved from a metadata URL, to learn the partner's signing certificates, SSO endpoints, and entity ID. The connection uses those trusted certificates to verify incoming signatures rather than relying on local keystore entries.

Question 27PingFederate Administration

Which PingFederate administrative console area is used to create and manage the runtime and administrative keystores that hold certificates for signing, encryption, and TLS?

  1. System > Server Settings
  2. Applications > OAuth Clients
  3. Authentication > Adapters
  4. Security > Certificate Management Correct answer.

Explanation

Certificate Management under the Security menu is where administrators create signing and encryption keystores, import certificate authorities, and manage the SSL/TLS keystore used by the server. Server Settings covers runtime behavior such as ports and cluster communication, not key material.

Question 28PingFederate Administration

An administrator needs to define how PingFederate maps attributes returned by an IdP adapter into the attributes sent to a downstream SP connection. Which object performs this mapping?

  1. A session policy
  2. An authentication policy contract
  3. An IdP adapter mapping Correct answer.
  4. An access token manager

Explanation

An IdP adapter mapping maps an IdP adapter instance to an SP connection and fulfills the connection's assertion attribute contract using adapter values. An authentication policy contract can provide an intermediate attribute contract, but it does not itself perform this direct adapter-to-connection mapping.

Question 29PingFederate Administration

Which PingFederate setting on an SP connection determines the maximum allowed clock skew applied when validating the NotOnOrAfter and NotBefore conditions of incoming assertions?

  1. The server-wide idle session timeout under Session Management
  2. The OAuth access token lifetime on the access token manager
  3. The assertion validity and clock skew settings in the SP connection's assertion lifetime configuration Correct answer.
  4. The connection's SAML profile, which selects IdP-Initiated or SP-Initiated SSO

Explanation

PingFederate exposes assertion lifetime and clock skew controls within the SP connection so administrators can tolerate small time differences between partners. Adjusting skew widens the acceptance window around the assertion's validity conditions.

Question 30PingFederate Administration

An administrator wants PingFederate to authenticate users against an LDAP directory for an IdP connection. Which component should be configured to perform the credential check?

  1. A JDBC datastore used directly by the IdP connection
  2. An OAuth client with the resource owner password grant
  3. A WS-Trust token translator
  4. A password credential validator referencing the LDAP datastore Correct answer.

Explanation

Password credential validators are the PingFederate component that verifies usernames and passwords against a configured datastore such as LDAP or a JDBC database. The validator is then referenced by an adapter or policy so the result can drive SSO.

Question 31PingFederate Administration

Which PingFederate configuration object allows an administrator to define a reusable set of settings that prefill values when creating new SP or IdP connections?

  1. An authentication selector
  2. A session revocation policy
  3. A connection template Correct answer.
  4. A metadata export policy

Explanation

Connection templates store default configuration values that are applied when a new connection is created, reducing repetitive setup across many partners. They do not enforce runtime behavior on their own.

Question 32PingFederate Administration

An administrator must publish PingFederate's IdP metadata to partners at a stable URL. Which configuration controls the signing certificate and endpoint information included in that published metadata?

  1. The IdP connection's metadata export settings and its active signing certificate Correct answer.
  2. The connection's attribute contract fulfillment
  3. The administrative console's TLS certificate
  4. The OAuth authorization server settings

Explanation

Published IdP metadata is generated from the IdP connection's configured endpoints and the signing certificate marked active for that connection. Partners consume this metadata to establish trust and locate endpoints.

Question 33PingFederate Administration

Which PingFederate feature lets an administrator validate that an IdP connection can authenticate a user and produce a complete assertion before handing the connection to a partner?

  1. The license summary page
  2. The connection's attribute contract and adapter mapping test flow in the administrative console Correct answer.
  3. The OAuth client credentials test
  4. The cluster status page

Explanation

PingFederate provides in-console testing of connections so administrators can step through authentication and confirm that the attribute contract is fulfilled and the assertion builds correctly. This catches mapping problems before go-live.

Question 34PingFederate Administration

An administrator needs PingFederate to issue OAuth access tokens to a client application and later validate them at the resource server. Which component defines the token format, lifetime, and signing key?

  1. An access token manager Correct answer.
  2. A password credential validator
  3. An IdP adapter
  4. A connection template

Explanation

Access token managers define how OAuth access tokens are created and validated, including token format, lifetime, and the signing or encryption keys used. Resource servers and clients reference the same token manager so issuance and validation stay consistent.

Question 35PingFederate Administration

An administrator wants to enforce that only users satisfying a group membership condition proceed through an IdP connection. Where is this decision evaluated in PingFederate?

  1. In the SP connection's assertion encryption settings
  2. In an authentication policy that combines the adapter with a policy condition Correct answer.
  3. In the metadata export policy
  4. In the runtime server's TLS cipher configuration

Explanation

Authentication policies chain adapters and policy conditions so access decisions, such as group membership, are evaluated before an assertion is issued. A failed condition ends the flow rather than producing a token.

Question 36PingFederate Administration

Which PingFederate feature should an administrator use to define the set of claims returned to an OIDC client from an IdP connection?

  1. A SAML assertion lifetime setting
  2. A WS-Trust token translator
  3. An attribute contract and its associated attribute mappings on the IdP connection Correct answer.
  4. A cluster replication schedule

Explanation

OIDC clients receive claims derived from the attribute contract configured on the IdP connection, with mappings populating each attribute. The contract determines which claims are available to the client.

Question 37PingFederate Administration

An administrator observes that PingFederate engine nodes behind a load balancer return inconsistent SSO results because users are routed to different nodes. Which configuration most directly addresses this?

  1. Rotate the signing certificate on each node independently
  2. Increase the assertion lifetime on every SP connection
  3. Enable session affinity or shared session storage so a user's session is available on any node Correct answer.
  4. Disable the administrative console on all but one node

Explanation

In a cluster, sessions must either stick to a node through load balancer affinity or be shared so any node can serve the request. Without one of these, a user landing on a different node lacks session state and the flow fails or repeats authentication.

Question 38PingFederate Administration

An administrator needs to import a partner's SAML metadata that contains multiple signing certificates, one of which is a newly rotated key. How does PingFederate treat these certificates during signature validation?

  1. It trusts only the first certificate listed in the metadata
  2. It requires the partner to send the certificate inside each assertion
  3. It trusts the certificates presented in the imported metadata and accepts assertions signed by any of them Correct answer.
  4. It rejects metadata containing more than one certificate

Explanation

Imported metadata establishes trust for the certificates it contains, so assertions signed by any listed active certificate validate. This supports overlapping certificate rollover without downtime.

Question 39PingFederate Administration

Which PingFederate setting controls how long an authenticated user session remains valid before the user must reauthenticate, independent of SAML assertion lifetime?

  1. The OAuth refresh token lifetime
  2. The session lifetime configured in session management settings Correct answer.
  3. The metadata cache duration
  4. The assertion NotOnOrAfter value

Explanation

Session management settings define the maximum and idle lifetimes of the PingFederate user session, which is separate from the validity window stamped into a SAML assertion. Changing assertion conditions does not extend the underlying session.

Question 40PingFederate Administration

An administrator must ensure that all administrative configuration changes made on one cluster node are applied consistently across the cluster. Which mechanism accomplishes this in PingFederate?

  1. Configuration replication that propagates changes from the console node to engine nodes Correct answer.
  2. Manual file copy of the configuration archive to each node
  3. Load balancer health checks that restart nodes on change
  4. Per-node local configuration that is never synchronized

Explanation

PingFederate replicates administrative configuration across cluster members so engine nodes receive changes made through the console. Administrators do not manually copy configuration files between nodes.

Question 41PingFederate Administration

An administrator wants PingFederate to act as an OAuth authorization server that supports the authorization code grant for a web application. Which client setting must be configured to redirect the user agent back after authorization?

  1. An IdP adapter contract mapping
  2. A SAML assertion consumer service URL
  3. A registered redirect URI on the OAuth client Correct answer.
  4. A WS-Federation passive endpoint

Explanation

OAuth clients must register redirect URIs so the authorization server can validate where the user agent returns with the authorization code. Unregistered redirect targets are rejected to prevent code leakage.

Question 42PingFederate Administration

An administrator needs to configure PingFederate so a SAML SP connection accepts only assertions whose subject confirmation method is bearer. Which configuration area governs this requirement?

  1. The IdP adapter's password credential validator
  2. The OAuth access token manager mapping
  3. The administrative keystore alias
  4. The SP connection's assertion validation settings for subject confirmation Correct answer.

Explanation

SP connections include assertion validation controls that determine which subject confirmation methods are acceptable. Restricting to bearer rejects assertions using other confirmation methods.

Question 43PingFederate Administration

Which PingFederate component is responsible for converting a SAML assertion into a different token type for a legacy web service client using WS-Trust?

  1. A connection template
  2. An authentication selector
  3. A metadata export policy
  4. A token translator Correct answer.

Explanation

Token translators convert tokens between formats, such as exchanging a SAML assertion for a WS-Trust security token. They bridge protocols for clients that cannot consume SAML directly.

Question 44PingFederate Administration

An administrator must ensure that PingFederate can decrypt encrypted SAML assertions sent by a partner. Which key material must be available to the SP connection?

  1. The OAuth client secret
  2. The administrative console TLS private key
  3. The private key corresponding to the certificate the partner used to encrypt Correct answer.
  4. The partner's public signing certificate

Explanation

To decrypt an encrypted assertion, PingFederate needs the private key matching the certificate the partner encrypted to, typically held in the connection's decryption keystore. Without that private key the ciphertext cannot be opened.

Question 45PingFederate Administration

Which PingFederate log should an administrator enable at debug level to capture detailed SAML message processing during a failing SSO transaction?

  1. The server log configured for debug logging of the relevant component Correct answer.
  2. The administrative audit log
  3. The cluster replication log
  4. The OAuth client registration log

Explanation

The server log records runtime processing, and raising its level for the relevant components captures SAML message details needed for diagnosis. Audit logs record administrative actions rather than protocol exchange.

Question 46PingFederate Administration

An administrator must prevent PingFederate from accepting assertions from an IdP whose metadata has expired. Which practice ensures this control?

  1. Disable signature validation on the IdP connection
  2. Remove the IdP connection's attribute contract
  3. Keep partner metadata current and monitor its validity period before it expires Correct answer.
  4. Increase the assertion clock skew to a very large value

Explanation

Metadata carries a validity period, and stale metadata can cause trust or endpoint failures. Monitoring and refreshing partner metadata before expiry keeps the connection trustworthy.

Question 47PingFederate Administration

Which PingFederate object defines the endpoints and binding used when PingFederate acts as an SP receiving assertions from an external IdP?

  1. An access token manager
  2. A password credential validator
  3. An SP connection Correct answer.
  4. An IdP adapter

Explanation

An SP connection represents PingFederate's role as a service provider to an external IdP, defining the assertion consumer endpoint, bindings, and trust settings. IdP adapters instead authenticate users locally.

Question 48PingFederate Administration

An administrator wants to require that users reauthenticate for a sensitive SP connection even if they have an existing PingFederate session. Which approach accomplishes this?

  1. Configure a policy that forces fresh authentication for that connection Correct answer.
  2. Extend the session lifetime globally
  3. Disable assertion signing on the connection
  4. Increase the assertion NotOnOrAfter window

Explanation

PingFederate policies can require reauthentication so an existing session is not reused for sensitive resources. This enforces a fresh credential check at the point of access.

Question 49PingFederate Administration

Which setting on an IdP connection determines whether PingFederate signs the SAML response, the assertion, or both?

  1. The administrative keystore alias
  2. The signing options in the IdP connection's protocol settings Correct answer.
  3. The connection's session lifetime
  4. The OAuth client redirect URI

Explanation

IdP connection protocol settings let administrators choose whether the response, the assertion, or both are signed. This affects how partners validate the message.

Question 50PingFederate Administration

An administrator needs to troubleshoot why PingFederate rejects an assertion with an unknown issuer. Which configuration value must match the issuer in the incoming assertion?

  1. The OAuth client ID
  2. The partner entity ID configured on the SP connection Correct answer.
  3. The administrative console hostname
  4. The local IdP adapter ID

Explanation

The SP connection stores the expected partner entity ID, which PingFederate compares against the assertion issuer. A mismatch causes rejection as an untrusted issuer.