Ping Identity PT-AM-CPE Dumps - Pass Certified Professional - PingAM Exam in 2026

In PingAM 8.0.2, the term Affinity Mode (or session affinity) is strictly related to Load Balancing (Option B). It describes a configuration where a load balancer ensures that all requests belonging to a specific user session are consistently routed to the same PingAM server instance in a cluster.

According to the 'Load Balancing' and 'Deployment Planning' documentation:

Affinity is critical for performance in stateful deployments. While PingAM can operate in a 'stateless' manner by retrieving sessions from the Core Token Service (CTS) on every request, this creates unnecessary overhead. Affinity Mode allows the AM server to satisfy requests using its local 'In-memory' session cache.

There are two primary levels of affinity discussed in PingAM documentation:

Client-to-AM Affinity: Usually handled by the load balancer using a cookie (like the AMLB cookie) to keep the user on the same AM node.

AM-to-DS Affinity: Used when AM connects to the CTS (PingDS). This ensures that an AM server always talks to the same directory server node to avoid 'replication lag' where a session might be written to one DS node but not yet visible on another.

Without affinity, the system remains functional due to the CTS, but performance decreases as every request requires a cross-network database lookup. Therefore, affinity is a core concept of the Load Balancing and high-availability architecture.

In PingAM 8.0.2, when a client needs to trigger a specific authentication path---such as a higher-level tree for step-up authentication or a specific module for transactional authorization---it must tell the /authenticate endpoint which 'Index' to use.

According to the PingAM 'Authenticate over REST' and 'Session Upgrade' documentation, these are governed by two mandatory parameters:

authIndexType: This defines the category of the authentication mechanism being requested. Valid values include service (for Authentication Trees/Chains), module (for individual modules), or level (to request any mechanism that meets a specific Auth Level).

authIndexValue: This defines the name of the specific instance. For example, if authIndexType is service, the authIndexValue would be the name of the Authentication Tree (e.g., StepUpMFA).

For a step-up or transactional request to succeed, the client must send these two parameters. While service (Option B and D) is a common value for authIndexType, it is not a parameter name itself. ForceAuth (Option C and D) is an optional boolean used to force a fresh login even if a session exists, but it is not a requirement for the basic routing of the request to the correct tree. Therefore, authIndexType and authIndexValue (Option A) are the fundamental parameters required by the AM engine to identify and initiate the intended authentication journey.7

The connection string format HOST:PORT|SERVERID|SITEID is a specific syntax used in PingAM 8.0.2 for Affinity Load Balancing, a feature almost exclusively associated with the Core Token Service (CTS). In high-volume deployments, the CTS handles thousands of session updates per second. To avoid replication lag issues---where an AM server might try to read a session token from a directory server (DS) before the update has replicated from another DS node---PingAM uses 'Affinity.'16

According to the 'CtsDataStoreProperties' and 'CTS Deployment Architectures' documentation, this specialized string allows the AM instance to prioritize connections based on the Server ID and Site ID.17 The pipe (|) characters signify the optional affinity parameters:

01/02: These represent the Server IDs of the underlying Directory Servers.

Affinity Logic: By providing these IDs, PingAM can ensure that it always routes requests for the same CTS token to the same directory server node.18

While standard Identity Stores (Option A) and the Configuration Data Store (Option C) use LDAP connection strings, they typically utilize a comma-separated list of host:port pairs or rely on a hardware load balancer. The specific use of server and site IDs within the connection string itself to manage LDAP request routing is a hallmark of the CTS affinity configuration.19 The documentation explicitly states that 'Each connection string is composed as follows: HOST:PORT[|SERVERID[|SITEID]]' within the context of CTS external store configuration.20 Therefore, this complex string is specifically designed for the Core Token Service to ensure data consistency and high performance in clustered environments.

In PingAM 8.0.2, troubleshooting complex issues often requires moving beyond audit logs to Debug Logs. These logs capture the internal operations of the AM engine and its various components (e.g., Authentication, Core Token Service, Session Management).7

According to the 'Debug Logging' section of the PingAM 8.0.2 Maintenance Guide, the standard format for a debug log entry is designed to provide maximum context for support engineers and developers. A typical entry includes:

Time and Date Header: Precise timestamp of when the event occurred.

The Component (Category): Identifies which part of the code issued the message (e.g., amAuth, amSession, amOAuth2).

The Debug Level: Indicates the verbosity/severity, such as ERROR, WARNING, INFO, MESSAGE, or OFF.

The Thread ID: Crucial for multi-threaded environments like Tomcat, allowing administrators to trace a single user's request across multiple log entries.

The Message: A descriptive string explaining the internal operation or the error encountered.

Stack Trace: If the entry is recording an exception, a full Java stack trace is optionally included to pinpoint the exact line of code where the failure occurred.

Option A is the most complete and accurate representation of this structured output. Options B, C, and D are incorrect because they omit essential troubleshooting fields like the Thread ID or the Component name, which are necessary for correlating logs in a high-concurrency production environment. Understanding this structure is fundamental for any administrator using tools like ssoadm or the REST API to capture and analyze troubleshooting information.

According to the PingAM 8.0.2 'Maintenance and Troubleshooting' documentation, the system generates two primary, distinct categories of logs for monitoring and problem-solving: Audit Logs and Debug Logs.

Audit Logs: These are high-level logs intended for security auditing, compliance, and reporting. They record specific 'business events' or 'state changes' within the system. Examples include successful logins, failed authentication attempts, administrative configuration changes (logged in config.audit.json), and policy evaluation decisions (logged in access.audit.json). These logs are structured (often in JSON) to be easily consumed by SIEM (Security Information and Event Management) tools.

Debug Logs: These are low-level, highly verbose logs intended for developers and support engineers. They record the internal 'thought process' of the PingAM engine. They track the execution of specific Java classes, the results of LDAP queries, and the movement of data between authentication nodes. These logs are stored in the /debug directory and can be adjusted to different levels of verbosity (Error, Warning, Message, Info).

While PingAM runs within a Java Virtual Machine (JVM), and you may see container logs (like catalina.out in Tomcat) or 'Java logs' from the underlying web server, these are technically external to the PingAM application itself. The PingAM application's internal logging framework is strictly split between Audit (what happened at a functional level) and Debug (why it happened at a code level). Therefore, Option C is the most accurate technical description of the logs natively managed and written by the PingAM service.