Question 1

In the context of Identity Gateway (IG) architecture discussed in IG430 Day 2, which specific object is used within a route to capture and store information from an incoming request so it can be utilized later in the filter chain?

Accepted Answer

Attributes

Answer

Heap

Answer

Scripts

Answer

Metadata

Question 2

When configuring a 'JwtValidationFilter' in Identity Gateway to ensure the integrity of a session token, which component is primarily responsible for resolving the public keys required for signature verification?

Accepted Answer

Secrets Guy

Answer

Token Introspection Handler

Answer

Trust Anchor Service

Answer

KeyStore Manager

Question 3

During Day 2 of the IG430 course, when implementing 'Post-man-in-the-middle' patterns for credential injection, which filter is commonly used to extract a password from a secure secret store and inject it into a request header before it reaches the protected application?

Accepted Answer

AssignmentFilter

Answer

SwitchFilter

Answer

ThrottlingFilter

Answer

HeaderRemovalFilter

Question 4

In the IG430 Day 2 curriculum regarding policy enforcement, which specialized object within the 'AmService' configuration is responsible for defining how Identity Gateway maps the resource URI to the policy set defined in AM?

Accepted Answer

ResourceSet

Answer

RouteMatcher

Answer

PolicyCondition

Answer

AuthExtractor

Question 5

In Identity Gateway (IG430 Day 2), when configuring a 'StaticResponseHandler' for testing purposes, which mandatory field defines the integer value representing the HTTP response code returned to the client?

Accepted Answer

"status"

Answer

"responseCode"

Answer

"code"

Answer

"httpStatus"

Question 6

In Identity Gateway (IG430 Day 2) configuration, when using the 'OAuth2ClientFilter' to protect a route, which object is responsible for defining the 'client_id' and 'client_secret' used to authenticate the Gateway to the Authorization Server?

Accepted Answer

ClientRegistration

Answer

AuthenticationHandler

Answer

AccessTokenResolver

Answer

IssuerConfig

Question 7

In Identity Gateway (IG430 Day 2), when implementing 'ScriptableFilter' or 'ScriptableHandler' using Groovy, which global variable is automatically available to the script to access the current request, response, and shared state attributes?

Accepted Answer

exchange

Answer

session

Answer

request

Answer

context

Question 8

In Identity Gateway (IG430 Day 2), when configuring a 'CaptureFilter' to debug the traffic flowing through a route, where does the filter typically output the captured request and response data by default?

Accepted Answer

The system console or standard output (stdout)

Answer

The audit database

Answer

A dedicated capture.log file in the user home directory

Answer

The /tmp directory as raw binary files

Question 9

In Identity Gateway (IG430 Day 2), when implementing 'Single Sign-On' (SSO) with the 'AmService' component, which property within the session configuration determines the cookie name used by Access Management (AM) to track the user session?

Accepted Answer

"sessionCookieName"

Answer

"ssoHeaderToken"

Answer

"amTokenName"

Answer

"cookieIdentifier"

Question 10

In the Identity Gateway (IG430 Day 2) architecture, when configuring an 'EntityExtractFilter' to pull data from a JSON response body, which tool is used to identify and map the specific JSON fields to exchange attributes?

Accepted Answer

JsonPointer

Answer

JmesPath

Answer

RegEx

Answer

XPath

Question 11

When configuring PingAccess or a similar Identity Gateway to work with an Access Management (AM) solution, what is the primary role of the 'Token Exchange' or 'OIDC flow' between the two components?

Accepted Answer

To convert an external session or OIDC token into a site-specific token or header for the backend application.

Answer

To act as a primary certificate authority for public web traffic.

Answer

To provide physical layer encryption for the database server.

Answer

To manage the firewall rules for the local area network.

Question 12

In a typical ForgeRock Identity Gateway (IG) architecture, which object is responsible for defining the sequence of filters and the final handler to process an incoming HTTP request?

Accepted Answer

The Route

Answer

The TrustStore

Answer

The Expression Handler

Answer

The Keychain

Question 13

When configuring an Identity Gateway (IG) to protect a resource via Access Management (AM), which filter is primarily used to redirect unauthenticated users to the AM login page and subsequently validate the SSO token?

Accepted Answer

OAuth2ClientFilter or OpenIdConnectClientFilter

Answer

NetworkThrottlingFilter

Answer

SqlAuthorizationFilter

Answer

StaticResponseFilter

Question 14

In the context of Identity Gateway (IG) integration with Access Management (AM), what is the function of 'Policy Enforcement' when utilizing the 'AmService' or specialized policy filters?

Accepted Answer

To delegate authorization decisions to AM by evaluating specific policies and attributes before granting access to a resource.

Answer

To bypass the need for any HTTP headers during the request cycle.

Answer

To automatically generate new TLS certificates for the backend server on every request.

Answer

To store user passwords in a local plaintext file for faster retrieval.

Question 15

When configuring the Identity Gateway (IG) in a 'Sidecar' deployment model to work with Access Management (AM), what is the primary architectural advantage?

Accepted Answer

It provides a dedicated gateway instance for each application pod, allowing for localized traffic management and isolation.

Answer

It replaces the Access Management server's internal database with a local text file.

Answer

It requires a single centralized gateway to handle all global organizational traffic in one process.

Answer

It eliminates the need for any network encryption between the client and the load balancer.

Question 16

When configuring an Identity Gateway to leverage Access Management (AM) via the 'AmService' object, what is the significance of the 'ssoToken' in the heap configuration?

Accepted Answer

It represents the session identifier used to verify the user's authentication state against the AM session registry.

Answer

It is the physical MAC address of the gateway server used for hardware identification.

Answer

It is a temporary database key for storing the application's CSS files.

Answer

It is a cryptographic salt used exclusively for hashing the user's local password.

Question 17

In an Identity Gateway (IG) and Access Management (AM) integration, what is the primary purpose of using 'SecretStores' within the IG heap configuration?

Accepted Answer

To securely manage and retrieve credentials, such as client secrets and private keys, used for authenticating with the AM server.

Answer

To serve as the primary database for storing permanent user profiles and passwords.

Answer

To archive historical log files and audit trails locally for compliance.

Answer

To store the cached HTML content of the protected backend application.

Question 18

In an Identity Gateway (IG) route configuration integrated with Access Management (AM), what is the function of the 'HeaderFilter' when passing identity information to a legacy backend application?

Accepted Answer

It maps attributes from the user's AM session or OIDC userinfo profile into HTTP headers that the backend application can consume for authorization.

Answer

It encrypts the entire HTTP body using a symmetric key shared with the client's browser.

Answer

It serves as a primary firewall to block incoming traffic based on the source IP address.

Answer

It removes all User-Agent headers to hide the client's browser type from the server.

Question 19

In an Identity Gateway (IG) configuration, when 'Throttling' is applied in conjunction with Access Management (AM) session validation, what is the primary objective?

Accepted Answer

To limit the rate of requests for protected resources to prevent overwhelming the backend application or the AM server.

Answer

To automatically delete user sessions that have been idle for more than five minutes.

Answer

To compress the size of the HTTP headers before they are sent to the client browser.

Answer

To increase the speed of the CPU by reducing the clock cycle during peak hours.

Question 20

When configuring an Identity Gateway (IG) to interact with an Access Management (AM) instance over a secure connection, what is the purpose of the 'TrustManager' configuration within the gateway's ClientHandler?

Accepted Answer

To specify the certificates that the gateway should trust when validating the SSL/TLS identity of the AM server.

Answer

To define the session timeout duration for the gateway's administrative console.

Answer

To generate public-private key pairs for the end-user's mobile device.

Answer

To manage the passwords of all users currently logged into the AM portal.

Question 21

In PingIdentity's Identity Gateway (IG), when configuring an AmService object to interact with Access Management (AM), what happens if the 'realm' property is not explicitly defined?

Accepted Answer

IG defaults to the top-level realm, denoted by a single forward slash ('/')

Answer

IG will fail to initialize the route and throw a 'NullPointerException'

Answer

IG uses 'root' as the literal string name for the default realm

Answer

IG will automatically inherit the realm name from the 'ssoToken' header

Question 22

When configuring the 'AmService' heap object in PingFederate's Identity Gateway to connect to a specific AM realm, which property is used to define the location of the AM instance?

Accepted Answer

url

Answer

gatewayHost

Answer

amUri

Answer

serverEndpoint

Question 23

When configuring the 'realm' property in an Identity Gateway (IG) route to point to a sub-realm named 'Internal' located under the top-level realm, what is the correct string format to use?

Accepted Answer

"/Internal"

Answer

"realm=Internal"

Answer

"root/Internal"

Answer

"Internal"

Question 24

When utilizing the 'AmService' to protect a resource in Identity Gateway, which component is primarily responsible for redirecting unauthenticated users to the specific AM realm login page?

Accepted Answer

SingleSignOnFilter

Answer

OAuth2ClientFilter

Answer

ChainHandler

Answer

AssignmentHandler

Question 25

When Identity Gateway (IG) acts as a Policy Enforcement Point (PEP) for a specific AM realm, which heap object is typically used to authorize requests based on the policies defined within that realm?

Accepted Answer

PolicyEnforcementFilter

Answer

CrossDomainSingleSignOnFilter

Answer

CaptureFilter

Answer

ScriptableFilter

Question 26

When defining multiple 'AmService' objects in Ping Identity Gateway to support cross-realm authentication, what is the primary reason for configuring a specific 'realm' property in each object?

Accepted Answer

To ensure IG targets the correct AM organizational structure for session validation and policy evaluation

Answer

To define the encryption key used for specific HTTP methods within that route

Answer

To map the IG's internal heap memory to the AM database schema

Answer

To enable the IG to automatically create new realms in AM if they do not exist

Question 27

In Ping Identity Gateway, when a 'realm' property is configured in an 'AmService' to a value like '/partners/extranet', what does this path indicate regarding the organizational structure in Access Management (AM)?

Accepted Answer

It specifies a nested sub-realm where 'extranet' is a child of the 'partners' realm

Answer

It indicates a physical file path on the IG server where session tokens are stored

Answer

It defines a URL rewrite rule that redirects traffic to an external domain named 'extranet'

Answer

It represents a load-balancing group consisting of two separate AM clusters

Question 28

Which specific configuration attribute within an Identity Gateway 'AmService' determines the AM realm for which the service is valid?

Accepted Answer

realm

Answer

amRealm

Answer

orgPath

Answer

tenantId

Question 29

When configuring the 'AmService' in Identity Gateway to handle requests for a specific realm, what is the role of the 'ssoTokenHeader' property in the communication with PingAM?

Accepted Answer

It specifies the name of the header that contains the session token for that realm, defaulting to 'iplanetDirectoryPro'

Answer

It determines the URL of the realm's login page for redirection

Answer

It sets the duration for which the realm's session remains cached in IG memory

Answer

It defines the cryptographic algorithm used to sign the realm's JWT

Question 30

When working with the PingAM realm hierarchy in Identity Gateway, which configuration property in the 'AmService' object is used to specify the 'sessionService' and 'policyService' endpoints relative to the AM base 'url'?

Accepted Answer

version

Answer

serviceContext

Answer

realmPath

Answer

apiVersion

Related quizzes

Related quizzes