When defining a policy and specifying a resource pattern, which of the following statements is true concerning the difference between the wildcards *…

The fundamental difference between wildcards in PingAM policy resource patterns concerns path hierarchy matching. One wildcard type matches within a single path segment (level), while the other matches across multiple segments. Option B correctly identifies this distinction. Specifically, the wildcard matches zero or more characters but does not cross a path separator (/), effectively limiting it to a single level. The wildcard (sometimes represented as -- in older or different contexts) matches zero or more characters, including path separators, allowing it to span multiple levels.

A. Both and a multi-level wildcard can match characters in a query parameter string; the distinction is not about query parameters but path hierarchy.

C. While wildcards can often be mixed, this describes a syntactic capability, not the core functional difference in their matching behavior as requested by the question.

D. This is a true statement, as the resource pattern applies to the URL's path and query, not the port. However, it describes a similarity, not a difference.

1. Ping Identity Access Management Documentation, Authorization Guide, "Defining resources for policies". This section details the behavior of and wildcards, stating, "The asterisk () wildcard character matches zero or more characters, but does not cross a path hierarchy separator (/)." and "The double asterisk () wildcard character matches zero or more characters, including path hierarchy separators."