According to the PingAM 8.0.2 documentation on "OAuth 2.0 Client Authentication," clients are categorized into two types based on their ability to maintain the confidentiality of their credentials: Public and Confidential.

A Confidential Client is defined as an application that is capable of securely storing a client_secret or a private key. 1 These are typically applications where the code and configuration are not exposed to the end user. Web Applications (Option D) are the classic example of confidential clients because they run on a secure back-end server. 2 The server-side code can store and use a secret to authenticate with PingAM's token endpoint without the risk of the secret being leaked to the user-agent or a third party.

In contrast:

Web Browsers (Option C) and JavaScript clients (Option B) are considered Public Clients . 3 Since the code runs within the user's browser, any secret embedded in the application would be visible to the user via "View Source" or developer tools. 4

Desktop clients (Option A) and native mobile apps are also categorized as public clients in the OAuth2 specification (RFC 6749) because they are distributed to end-user devices. 5 Even if the secret is obfuscated, it can be extracted through reverse engineering or decompilation.

For confidential clients, PingAM 8.0.2 supports various authentication methods at the token endpoint, including client_secret_basic, client_secret_post, and more secure options like Mutual TLS (mTLS) or Private Key JWT . By correctly identifying a client as confidential, administrators can enforce these stronger authentication requirements, ensuring that the client is indeed the entity it claims to be before granting access or refresh tokens.

In PingAM 8.0.2, once a user successfully completes an authentication journey, the server issues a session token. For browser-based clients, this token is typically delivered via an HTTP cookie. The server-side property that defines the name of this specific cookie is com.iplanet.am.cookie.name.

According to the "Global Properties" and "System Configuration" documentation, this property is found under the Session service settings. By default, its value is set to iPlanetDirectoryPro (Option B). While iPlanetDirectoryPro is the default value of the cookie name, the question asks for the name of the property used to configure it.

Administrators often modify this property for security reasons to hide the fact that they are using PingAM or to avoid conflicts with other legacy systems. It is important to note that if this property is changed in the AM server, the corresponding configuration in all Policy Agents (Web or Java Agents) must also be updated to look for the new cookie name, otherwise, the agents will not be able to find the user's session and will redirect them to login repeatedly. Option D refers to an agent-side configuration key, but the central "Source of Truth" for the session cookie name within the AM platform is the server-side property com.iplanet.am.cookie.name.

Mutual TLS (mTLS) is a security enhancement where both the client and the server provide X.509 certificates to prove their identities.9 In PingAM 8.0.2, mTLS is frequently used for secure "Machine-to-Machine" (M2M) communication, such as between an OAuth2 client and the token endpoint, or between AM and a Directory Server (PingDS).

According to the PingAM documentation on "Secure Network Communication" and "mTLS for OAuth2," the handshake sequence for mTLS follows these logical steps:

Client Hello : The client initiates the request to the server. 10

Server Hello & Certificate : The server responds by presenting its own certificate (verifying the server's identity to the client). 11 In an mTLS scenario, the server also includes a CertificateRequest message. 12

Client Certificate & Key Exchange : The client validates the server's certificate. If valid, the client then sends its own Client Certificate to the server, along with the encrypted pre-master secret or key exchange data.

Verification and Establishment : The server validates the client's certificate against its truststore. If the certificate is trusted and the cryptographic signatures match, the mutually secure connection is established.

Option D represents the most accurate "simplified" sequence. Option A is incorrect because the server presents its certificate before the client sends its own certificate. Option B and C are incorrect because the server always responds to the initial "Client Hello" with its own identity (Server Certificate) before the client proceeds with identity submission. This "handshake" ensures that no data is transmitted until both parties have cryptographically verified each other.

In PingAM 8.0.2, the OAuth 2.0 Token Exchange (RFC 8693) implementation allows for complex identity delegation scenarios. The may_act claim is a specific claim used to indicate that one entity is authorized to act on behalf of another. When customizing the behavior of token exchange via the OAuth2 Token Exchange Script, developers interact with specific scriptable objects provided by the PingAM engine.

According to the "Scripting API" for OAuth2 and the "Token Exchange" developer guide, the requestedToken object is the primary interface used to modify the structure of the token being issued during the exchange. To insert the may_act claim, the API provides the addMayAct() method.

The may_act claim is technically a JSON object that contains a sub (subject) claim of the entity that is allowed to act as the subject of the token. In the scripting environment:

The requestedToken variable represents the token currently being minted.

The .addMayAct() method is the defined function signature to append this delegation metadata.

Why other options are incorrect:

Options A and D: The object name token is not the standard binding used for the target token in the Token Exchange script context; requestedToken is the correct binding.

Option C: The method name setMayAct is incorrect. The PingAM API uses the add prefix for these types of claims (similar to addActor), reflecting the underlying structure where these claims are added to the claim set of the JWT.

Using the correct syntax requestedToken.addMayAct(mayAct) ensures that the resulting Access Token or ID Token contains the correctly formatted delegation information required by resource servers to validate that the "Actor" has the permission to represent the "Subject."

The connection string format HOST:PORT|SERVERID|SITEID is a specific syntax used in PingAM 8.0.2 for Affinity Load Balancing, a feature almost exclusively associated with the Core Token Service (CTS). In high-volume deployments, the CTS handles thousands of session updates per second. To avoid replication lag issues—where an AM server might try to read a session token from a directory server (DS) before the update has replicated from another DS node—PingAM uses "Affinity."16

According to the "CtsDataStoreProperties" and "CTS Deployment Architectures" documentation, this specialized string allows the AM instance to prioritize connections based on the Server ID and Site ID . 17 The pipe (|) characters signify the optional affinity parameters:

01/02 : These represent the Server IDs of the underlying Directory Servers.

Affinity Logic : By providing these IDs, PingAM can ensure that it always routes requests for the same CTS token to the same directory server node. 18

While standard Identity Stores (Option A) and the Configuration Data Store (Option C) use LDAP connection strings, they typically utilize a comma-separated list of host:port pairs or rely on a hardware load balancer. The specific use of server and site IDs within the connection string itself to manage LDAP request routing is a hallmark of the CTS affinity configuration. 19 The documentation explicitly states that "Each connection string is composed as follows: HOST:PORT[|SERVERID[|SITEID]]" within the context of CTS external store configuration . 20 Therefore, this complex string is specifically designed for the Core Token Service to ensure data consistency and high performance in clustered environments.

To implement Step-up Authentication in PingAM 8.0.2, you typically use Authorization Policies that include "Environment Conditions."14 These conditions check the "quality" of the user's current session. If the session does not meet the specified condition, PingAM generates an Advice, which triggers the step-up process.

According to the "Condition Types" reference in the PingAM 8 documentation, the conditions used specifically to evaluate how a user authenticated are:

Authentication Level (greater than or equal to) : This is the most common condition for step-up. It checks if the session's Auth Level is at least a certain value (e.g., Level 2). If the user only has a Level 1 session, the policy fails and triggers an upgrade.

Authentication by Service : This condition checks if the user authenticated using a specific Authentication Tree or Chain (e.g., the user must have used the "SecureBankMFA" tree).

Authentication by Module Instance : This is used for legacy deployments where individual modules are used instead of trees. It verifies that the user successfully completed a specific module (e.g., the "DataStore" module).

Authentication to a Realm (Option D) is generally not a condition used for step-up authentication. While a policy exists within a realm, the "step-up" logic is focused on the method or level of authentication within that realm, not the fact that they are in the realm itself (which is already a prerequisite for reaching the policy engine). Therefore, the combination of A, B, and C (Option B) represents the specific environment conditions designed to evaluate the authentication context for step-up or "Quality of Service" (QoS) requirements.

PingAM 8.0.2 supports the OAuth 2.0 Token Exchange specification (RFC 8693), which allows a client to exchange one type of security token for another.1 This is commonly used in microservices architectures where a service needs to exchange an incoming access token for a more specific token to call a downstream service (impersonation or delegation).

According to the PingAM documentation on "Token Exchange," the request is made to the /oauth2/access_token (or /oauth2/token) endpoint.2 As per the RFC 8693 standard strictly implemented by PingAM, the mandatory grant_type parameter must be set to exactly:

urn:ietf:params:oauth:grant-type:token-exchange

However, there is a common discrepancy in documentation versus implementation strings. Reviewing the PingAM 8.0.2 OAuth2 Developer Guide , the engine recognizes the standard IETF URN. Looking at the options provided, Option B contains the string urn:ietf:params:oauth:grant-type:token-exchange (noting that "oauth2" is often used in descriptive text but the URI is technically oauth).

Note: There is a minor typo in the standard option C which is actually the standard. However, within the context of Ping Identity's specific documentation and certification exams, the URI urn:ietf:params:oauth:grant-type:token-exchange is the correct identifier.

This grant type enables the subject_token and actor_token parameters to be processed. If the client specifically wants an ID Token in return, they must ensure the requested_token_type is set to urn:ietf:params:oauth:token-type:id_token, but the grant_type itself remains the universal token-exchange URI.

When configuring Authorization Policies in PingAM 8.0.2, defining the Resource Pattern is critical for determining which URLs the policy applies to. PingAM uses specific wildcard symbols to represent dynamic parts of a URI, but they behave differently regarding directory depth.

According to the PingAM documentation on "Policies and Resource Types":

The * Wildcard (One-Level Wildcard) : This wildcard matches characters within a single path level. It does not match forward slashes (/). For example, http://example.com/* will match http://example.com/page1 but will not match http://example.com/folder/page1.

The -*- Wildcard (Multi-Level Wildcard) : This wildcard is designed to match any number of characters, including forward slashes (/), effectively spanning multiple levels of a directory hierarchy. For example, http://example.com/-*- will match http://example.com/page1, http://example.com/folder/page1, and even http://example.com/deeply/nested/resource.

Statement B is the correct technical distinction. Statement A is incorrect because query parameters are typically handled by specifically enabling "Query Parameter Matching" in the Resource Type configuration, rather than being a primary distinction between these two wildcards. Statement C is technically discouraged because mixing them can lead to unpredictable or overly broad matches that are difficult to debug. Statement D is incorrect because wildcards can be used in the host/port portion of the URL if the resource type is configured to support it. Understanding the difference between single-level (*) and multi-level (-*-) matching is a fundamental skill for AM policy administrators to prevent security gaps.

============

PingAM 8.0.2 provides a robust framework for Multi-Factor Authentication (MFA) centered around modern, secure protocols and the Intelligent Access (Authentication Trees) engine. When discussing supported "protocols" in the context of MFA in PingAM documentation, the focus is on standardized methods for secondary verification.

The primary supported MFA pillars in PingAM 8.0.2 are:

Open Authentication (OATH) : AM supports the OATH standards, specifically TOTP (Time-based One-Time Password) and HOTP (HMAC-based One-Time Password). This is implemented through the "OATH" authentication nodes, allowing users to use apps like ForgeRock Authenticator, Google Authenticator, or YubiKeys in OATH mode.

Web Authentication (WebAuthn) : This is the implementation of the FIDO2 standard. It allows for passwordless and secure second-factor authentication using biometrics (like TouchID/FaceID) or hardware security keys (like YubiKeys). It is the successor to older standards and is natively supported via WebAuthn nodes.

Push Authentication : This is a proprietary but highly secure protocol used specifically with the ForgeRock/Ping Authenticator app . It allows a "Push" notification to be sent to a registered mobile device, which the user then approves or denies.

Why others are excluded from the selection: While PingAM supports Security Questions (KBA) and Universal 2nd Factor (U2F), they are often categorized differently in the 8.0.2 documentation. Security Questions are considered a "User Self-Service" or "Legacy" validation method rather than a modern MFA protocol. U2F is technically superseded by and included within the WebAuthn framework in PingAM 8.0.2. Thus, the most accurate grouping of distinct, core MFA protocols supported in the current version is A, C, and E , making Option C the correct answer.

In a high-availability PingAM 8.0.2 cluster, Affinity Load Balancing is a mechanism used to ensure that requests related to a specific session or configuration are routed to the same Directory Server (DS) instance to avoid issues with replication lag. This is particularly important for stores where data changes frequently or where consistent reads are required immediately after a write.

According to the PingAM documentation on "Load Balancing" and "External Data Stores," affinity can be configured for the following primary stores:

Core Token Service (CTS) Store : This is the most critical area for affinity. Since the CTS handles stateful data like session tokens and OAuth2 tokens that are updated constantly, ensuring that an AM server consistently communicates with a specific DS node (using the HOST:PORT|SERVERID|SITEID syntax) prevents "token not found" errors that might occur if a request reached a DS node before the token was replicated.

Configuration Store : This store holds the central configuration for the AM deployment. In multi-server environments, affinity ensures that configuration changes are read consistently across the cluster.

Identity Stores : These hold the user profiles. While often read-heavy, affinity is used here to improve caching efficiency and ensure that profile updates (like password changes or attribute updates) are reflected immediately in subsequent authentication steps within the same cluster.

Policy Data Store : This stores authorization policies. Similar to configuration, affinity ensures consistent policy evaluation.

Option D is the correct answer because it includes the Core Token Service, Identity Stores, Configuration Store, and Policy Data Store . The "Application Data Store" (mentioned in other options) is often logically grouped with or replaced by the Policy Data Store in many 8.0.2 configurations, but the four stores listed in Option D are the specific ones explicitly called out in the "External Data Stores" secondary configuration documentation for supporting affinity settings.