During a business review of an application, the administrator needs to change the Resource Authentication to anonymous. What are the two effects of…

In PingAccess, setting a resource's authentication method to "Anonymous" instructs PingAccess not to require a web session or an OAuth access token for the request. This bypasses the authentication check step. However, the request processing does not stop there. The request continues through the defined policy flow, which includes executing any configured Identity Mappings to add attributes and then evaluating the Processing (or Access Control) Rules to make a final authorization decision (allow or deny). Therefore, while authentication is not required, authorization rules and identity attribute processing are still applied to the request.

A. Incorrect because Processing/Access Control rules are a separate step in the policy flow and are still evaluated for anonymous resources.

D. Incorrect because PingAccess logs all proxied requests by default, including those for anonymous resources, for auditing and troubleshooting purposes.

E. This option is also correct, as "Access Control rules" and "Processing rules" (from option C) are synonymous terms in PingAccess for the rules that govern authorization. Since the question asks for two distinct effects, and options B and C describe two separate stages of the policy flow (Identity Mapping and Rule Processing), they represent the best pair of answers.

1. Ping Identity PingAccess 7.3 Documentation, "Defining a resource".

Section/Reference: In the "Defining a resource" section, the "Authentication" setting is described. The "Anonymous" option is defined as: "Select Anonymous if no PingAccess web session or OAuth 2.0 access token is required." This supports the first clause of the correct answers.

2. Ping Identity PingAccess 7.3 Documentation, "Understanding the request flow".

Section/Reference: This section details the sequence of events for a request. The flow explicitly shows that after the "Authentication requirement" is checked (and passed, in the case of Anonymous), the policy engine proceeds to "Apply identity mapping" and then "Evaluate rules". This confirms that both Identity Mappings (Option B) and Processing/Access Control Rules (Option C) are still applied.

3. Ping Identity PingAccess 7.3 Documentation, "Configuring identity mappings".

Section/Reference: The overview of this section explains that identity mappings are used to create attributes that can be consumed by rules or sent to backend applications. This process is independent of the initial authentication method and can use information from the request itself, which is applicable even in an anonymous scenario.