PAP-001 Exam Preparation Material | Certified Professional - PingAccess

Explanation:
For SSL termination, PingAccess requires a Key Pair (certificate + private key). During a POC/demo, when a self-signed certificate is used, the administrator can create it directly in the Key Pairs section of the console.
Exact Extract:
“Use the Key Pairs section to create self-signed certificates for testing or proof-of-concept deployments. For production, import a PKCS#12 file containing a certificate chain and private key.”
Option A is incorrect ― Certificates store trust anchors (CAs), not SSL termination certs.
Option B is incorrect ― an internal CA-signed cert requires PKCS#12 import, not self-signed creation.
Option C is incorrect ― a publicly trusted CA is not used for a demo phase.
Option D is correct ― creating a new certificate in Key Pairs generates a self-signed cert suitable for demos.
Reference: PingAccess Administration Guide C Key Pairs and Certificates

Explanation:
The pa.operational.mode property in run.properties defines the role of the node in a PingAccess deployment (e.g., STANDALONE, CLUSTERED_CONSOLE, CLUSTERED_CONSOLE_REPLICA, ENGINE).
Exact Extract:
“The pa.operational.mode property determines the role of the server in the cluster, such as standalone, console, console replica, or engine.”
Option A is incorrect ― replication is implicit in certain roles, not controlled directly.
Option B is correct ― the setting specifies whether the node is admin console, replica, or engine.
Option C is incorrect ― development vs production is not a function of this setting.
Option D is incorrect ― it does not enable/disable nodes.
Reference: PingAccess Administration Guide C run.properties

Explanation:
To enable Single Logout (SLO), the SLO scope must be defined in the PingAccess Web Session configuration. This determines which sessions are ended when a logout request occurs.
Exact Extract:
“The SLO scope option in a web session specifies which applications are included in a logout event when Single Logout is triggered.”
Option A (SLO scope) is correct; it explicitly enables SLO support by linking session termination across apps.
Option B (Idle timeout) is unrelated; this controls session expiration, not SLO.
Option C (Validate Session) ensures session state is synchronized but does not configure SLO.
Option D (Refresh User Attributes) is unrelated; it only controls whether attributes are reloaded.
Reference: PingAccess Administration Guide C Configuring Web Sessions

Explanation:
PingAccess uses Engine Listeners for SSL termination of proxied applications.
To minimize the number of certificates, administrators can:
Use a wildcard certificate (e.g., *.customer.com) on the engine listener.
Use a Subject Alternative Name (SAN) certificate that covers multiple FQDNs under the customer.com domain.
Exact Extract:
“PingAccess engine listeners can use certificates containing either wildcard entries or Subject Alternative Names to secure multiple applications under a single domain.”
Option A is incorrect ― assigning unique key pairs increases, not decreases, certificate management overhead.
Option B is correct ― a wildcard certificate covers all subdomains (e.g., app1.customer.com, app2.customer.com).
Option C is correct ― a SAN certificate lists multiple FQDNs explicitly.
Option D is incorrect ― agent listeners don’t handle SSL termination for proxied apps.
Option E is incorrect for the same reason ― agent listeners aren’t used for SSL.
Reference: PingAccess Administration Guide C Certificates and Engine Listeners

Explanation:
Exact Extract (from PingAccess documentation):
“The key pair that you create for the CONFIG QUERY listener must include both the administrative node and the replica administrative node. To make sure the replica administrative node is included, you can either use a wildcard certificate or define subject alternative names in the key pair that use the replica administrative node’s DNS name.”
Why B and D are correct:
* B. Subject = .company.com ― A wildcard certificate for *.company.com is valid for both pa-admin. company.com and pa-admin2.company.com, satisfying the documented requirement that the key pair include both hostnames for the CONFIG QUERY listener.
D. Subject Alternative Names = pa-admin.company.com, pa-admin2.company.com ― Explicitly placing both DNS names in the SAN extension also satisfies the requirement that the certificate cover both the administrative node and the replica administrative node.
Why the other options are incorrect:
A. Issuer = pa-admin.company.com ― The Issuer field identifies the certificate authority (CA) that signed the certificate, not the service hostname. Setting the issuer to a host value is not how X.509 server certificates are validated and would not meet the hostname#matching requirement.
C. Subject = pa-admin.company.com ― While this covers the administrative node, it does not include the replica administrative node. Without a wildcard or SAN entries, it fails the requirement that the key pair include both hostnames.
E. Subject = pa-admin2.company.com ― Similarly, this would only cover the replica administrative node and not the primary administrative node, failing the requirement.
Reference: Configuring replica administrative nodes (PingAccess User Interface Reference Guide)
Configuring a PingAccess cluster (PingAccess documentation)
Certificates (PingAccess User Interface Reference Guide)