Prepare Smarter for the PT-AM-CPE Exam

The forgeops command-line tool is used to manage the lifecycle of the Ping Identity Platform in Kubernetes environments.9 When using the Cloud Developer Kit (CDK) for version 8.0.2, the delete subcommand is used to tear down the environment.

According to the "ForgeOps CLI Reference" and "CDK Shutdown and Removal" documentation:

The forgeops delete command (without additional flags like --force or specific component names) is designed to remove the Ping Identity Platform pods. This includes the core applications like PingAM, PingIDM, and PingDS, as well as the specialized UI pods (login-ui, etc.). It also removes the standard CDK artifacts and configuration manifests associated with that specific namespace.

However, the command follows a "safe delete" philosophy regarding infrastructure-level components:

Ingress Controllers, Certificate Managers (cert-manager), and the DS Operator are considered part of the "Base" or "Infrastructure" layer. These are typically installed once per cluster or namespace and are shared across multiple deployments. The forgeops delete command does not remove these by default, as doing so could disrupt other services.

PVCs (Persistent Volume Claims) and Secrets are also preserved unless the --force or -f flag is explicitly added to the command.

Thus, the answer is D . The command focuses strictly on the platform pods and their immediate deployment artifacts. If a developer wishes to perform a "deep clean" that removes the ingress and operators, they would need to use more specific commands like forgeops delete base or kubectl commands. 10 This distinction is vital for developers to avoid accidentally deleting shared cluster infrastructure when they only intended to restart the Ping platform.

PingAM 8.0.2 is strictly compliant with various identity standards to ensure interoperability between different vendors and platforms. The Security Assertion Markup Language (SAML) V2.0 is the cornerstone of modern XML-based federation.7

According to the PingAM "SAML 2.0 Introduction" and "Supported Standards" documentation, the SAML 2.0 standard is developed and maintained by OASIS (the Organization for the Advancement of Structured Information Standards). 8 Specifically, the OASIS Security Services Technical Committee (SSTC) is responsible for the specifications that define the SAML core (assertions and protocols), bindings (how SAML messages are mapped onto transport protocols like HTTP), and profiles (how SAML is used to solve specific use cases like Web Browser SSO).

Knowing the governing body is important for administrators when reviewing the "Technical Metadata" and "Schema" sections of PingAM, as AM’s implementation follows the OASIS SAML 2.0 standards for XML signing, encryption, and assertion structure. Other organizations listed, such as the IETF (Internet Engineering Task Force), govern protocols like OAuth2 and OpenID Connect, while the W3C (World Wide Web Consortium) handles general web standards like XML and WebAuthn. However, for SAML2, OASIS remains the authoritative governing body.

According to the PingAM 8.0.2 documentation on "OAuth 2.0 Client Authentication," clients are categorized into two types based on their ability to maintain the confidentiality of their credentials: Public and Confidential.

A Confidential Client is defined as an application that is capable of securely storing a client_secret or a private key. 1 These are typically applications where the code and configuration are not exposed to the end user. Web Applications (Option D) are the classic example of confidential clients because they run on a secure back-end server. 2 The server-side code can store and use a secret to authenticate with PingAM's token endpoint without the risk of the secret being leaked to the user-agent or a third party.

In contrast:

Web Browsers (Option C) and JavaScript clients (Option B) are considered Public Clients . 3 Since the code runs within the user's browser, any secret embedded in the application would be visible to the user via "View Source" or developer tools. 4

Desktop clients (Option A) and native mobile apps are also categorized as public clients in the OAuth2 specification (RFC 6749) because they are distributed to end-user devices. 5 Even if the secret is obfuscated, it can be extracted through reverse engineering or decompilation.

For confidential clients, PingAM 8.0.2 supports various authentication methods at the token endpoint, including client_secret_basic, client_secret_post, and more secure options like Mutual TLS (mTLS) or Private Key JWT . By correctly identifying a client as confidential, administrators can enforce these stronger authentication requirements, ensuring that the client is indeed the entity it claims to be before granting access or refresh tokens.

In PingAM 8.0.2, especially when utilizing File-Based Configuration (FBC), the startup sequence relies on a "bootstrap" phase to locate the system's configuration. According to the "Installation Guide" and "Configuration Directory Structure," the primary file involved in this process is named boot.json.

The boot.json file contains the essential connection details required for the AM binaries to find and unlock the configuration store (usually PingDS). This includes the LDAP host, port, bind DN, and references to the secret stores needed to decrypt the configuration.

The location of this file is determined by the Configuration Directory path specified during the initial setup. By default, PingAM creates its configuration directory in the home directory of the user running the web container. The standard path structure is < user-home > / < am-instance-dir > /. Therefore, the boot.json file is located at the root of this instance directory: <</b> user-home > / <</b> am-instance-dir > /boot.json .

Options A and D are incorrect because they place the file inside a /config subdirectory; while AM has many config files in subdirectories, the boot.json sits at the root to be accessible as the first point of entry.

Option B is incorrect because it suggests the file is stored within the Tomcat webapps folder. PingAM specifically avoids storing configuration data within the web application binaries to ensure that configuration persists even if the .war file is deleted or redeployed.

Understanding the location of boot.json is vital for DevOps engineers who need to automate the deployment of PingAM using tools like Amster or when troubleshooting a "Failed to connect to the configuration store" error during server startup.

PingAM 8.0.2 provides a robust framework for Multi-Factor Authentication (MFA) centered around modern, secure protocols and the Intelligent Access (Authentication Trees) engine. When discussing supported "protocols" in the context of MFA in PingAM documentation, the focus is on standardized methods for secondary verification.

The primary supported MFA pillars in PingAM 8.0.2 are:

Open Authentication (OATH) : AM supports the OATH standards, specifically TOTP (Time-based One-Time Password) and HOTP (HMAC-based One-Time Password). This is implemented through the "OATH" authentication nodes, allowing users to use apps like ForgeRock Authenticator, Google Authenticator, or YubiKeys in OATH mode.

Web Authentication (WebAuthn) : This is the implementation of the FIDO2 standard. It allows for passwordless and secure second-factor authentication using biometrics (like TouchID/FaceID) or hardware security keys (like YubiKeys). It is the successor to older standards and is natively supported via WebAuthn nodes.

Push Authentication : This is a proprietary but highly secure protocol used specifically with the ForgeRock/Ping Authenticator app . It allows a "Push" notification to be sent to a registered mobile device, which the user then approves or denies.

Why others are excluded from the selection: While PingAM supports Security Questions (KBA) and Universal 2nd Factor (U2F), they are often categorized differently in the 8.0.2 documentation. Security Questions are considered a "User Self-Service" or "Legacy" validation method rather than a modern MFA protocol. U2F is technically superseded by and included within the WebAuthn framework in PingAM 8.0.2. Thus, the most accurate grouping of distinct, core MFA protocols supported in the current version is A, C, and E , making Option C the correct answer.