Which statements are correct about PingAM sessions? A) When a web browser is involved, the web browser is instructed to set a cookie as the session…

PingAM's session management is flexible. For traditional web browser clients, it establishes a session by instructing the browser to set a cookie containing the session reference (A). The default name for this cookie is iPlanetDirectoryPro, a legacy from its Sun Microsystems origins (D). For non-browser clients, such as mobile apps making REST API calls, the session reference is returned within the JSON payload of the authentication response (B). Statement (C) is incorrect as PingAM is not limited to only the Core Token Service (CTS) for session storage; it can also use in-memory stores, although CTS is recommended for clustered deployments.

B. This option is incorrect because it includes statement (C), which is false. PingAM can use session stores other than CTS.

C. This option is incorrect because it includes statement (C), which is false.

D. This option is incorrect because it omits statement (D), which is true regarding the default session cookie name.

1. Ping Identity Documentation, PingAM > Security > "Securing Cookies," describes the session cookie and its properties.

2. Ping Identity Documentation, PingAM > Authenticate > "Authentication REST API," Section "Authenticate to a realm," shows the tokenId (session reference) returned in the JSON response for API-based authentication.

3. Ping Identity Documentation, PingAM > Setup > "Prepare for installation," Section "Session failover," discusses session storage options including CTS and in-memory.