According to the PingAM 8.0.2 Installation Guide, once the am.war file has been deployed into a web container (such as Apache Tomcat), the administrator must perform an initial configuration to set up the configuration store and the primary administrative user (amAdmin). PingAM provides two primary pathways for this "basic" configuration to accommodate different environment needs:
GUI-based Configuration (Interactive): By accessing the AM deployment URL (e.g., https://auth.example.com:8443/am) in a standard web browser, the administrator is presented with an interactive setup wizard. This wizard guides the user through the license agreement, setting the amAdmin password, and defining the connection details for the Configuration Store (typically PingDS). This is the preferred method for single-instance setups or initial trials.
Command-Line Configuration (Automated/Passive): For DevOps-centric deployments, headless environments, or automated scripts, PingAM provides the configurator.jar (often used for "Passive" installations). Additionally, for version 8 deployments, Amster is the primary command-line interface (CLI) tool. Amster allows administrators to import a full configuration state from JSON files, bypassing the GUI entirely. This is crucial for CI/CD pipelines and Kubernetes-based deployments (like the ForgeOps CDK/CDP).
The flexibility to use either the browser-based GUI or command-line tools ensures that PingAM can be deployed efficiently across diverse infrastructures, from traditional on-premises servers to modern cloud-native orchestration platforms. Therefore, Option A is the correct answer as it recognizes both valid administrative interfaces for the initial setup.

In PingAM 8.0.2, once a user successfully completes an authentication journey, the server issues a session token. For browser-based clients, this token is typically delivered via an HTTP cookie. The server-side property that defines the name of this specific cookie is com.iplanet.am.cookie.name.
According to the "Global Properties" and "System Configuration" documentation, this property is found under the Session service settings. By default, its value is set to iPlanetDirectoryPro (Option B). While iPlanetDirectoryPro is the default value of the cookie name, the question asks for the name of the property used to configure it.
Administrators often modify this property for security reasons to hide the fact that they are using PingAM or to avoid conflicts with other legacy systems. It is important to note that if this property is changed in the AM server, the corresponding configuration in all Policy Agents (Web or Java Agents) must also be updated to look for the new cookie name, otherwise, the agents will not be able to find the user's session and will redirect them to login repeatedly. Option D refers to an agent-side configuration key, but the central "Source of Truth" for the session cookie name within the AM platform is the server-side property com.iplanet.am.cookie.name.

When an OAuth2 client uses Private Key JWT or Client Secret JWT for authentication at the PingAM 8.0.2 token endpoint, it must present a JWT (JSON Web Token) containing specific claims that identify and authorize the client. This is governed by the OIDC and OAuth2 JWT Profile specifications (RFC 7523).
According to the PingAM documentation on "OAuth 2.0 Client Authentication" and the "JWT Profile for Client Authentication":
iss (Issuer): Mandatory. This must be the client_id of the OAuth2 client.
sub (Subject): Mandatory. This must also be the client_id of the OAuth2 client (as the client is the subject of the authentication).
aud (Audience): Mandatory. This must be the URL of the PingAM OAuth2 service (the token endpoint) or the issuer URL.
exp (Expiration Time): Mandatory. This protects against the long-term use of intercepted assertions.
The jti (JWT ID) (Option A) provides a unique identifier for the token. In the context of standard JWT validation, jti is used to prevent replay attacks by ensuring that a specific token is only processed once. While highly recommended for security hardening, the PingAM 8.0.2 technical reference for OAuth2 client assertions marks jti as optional unless the server is explicitly configured to require it for replay detection. Without a jti, PingAM will still validate the iss, sub, aud, and exp claims to authenticate the client. Therefore, among the choices provided, jti is the claim that can be omitted without inherently violating the base OAuth2 JWT authentication request requirements.

When a client requests an OpenID Connect (OIDC) scope (like profile), PingAM 8.0.2 may present a Consent Screen to the user, asking permission to share specific claims. To make this screen user-friendly, PingAM allows administrators to map technical claim names to human-readable labels and specify localizations.
According to the PingAM documentation on "Supported Claims" in the OAuth2/OIDC Provider settings:
The format for the Supported Claims property entry is:
ClaimName|Locale|DisplayName
In this syntax:
ClaimName: The technical OIDC claim (e.g., name, email, given_name).
Locale: The ISO language code (e.g., en, fr).
DisplayName: The text that will actually appear on the UI (the "Full name" label).
Therefore, the string name|en|Full name (Option A) is the correct configuration.
Option B is incorrect because it reverses the technical name and the display name.
Option C is incorrect as it lacks the required locale component and uses full_name (which is not the standard OIDC claim name; the standard is name).
Option D attempts to perform a logic operation (+) within a configuration field where only static mapping strings are allowed. Claim composition (concatenating first and last names) is handled by the OIDC Claims Script, not by the Supported Claims UI property.