Free IBM C1000-130 Practice Exam with Questions & Answers | Set: 3

In Lightweight Directory Access Protocol (LDAP) configuration, the Base Distinguished Name (Base DN) specifies the starting point in the directory tree where searches for user authentication and group information begin. It acts as the root of the LDAP directory structure for queries.

Defines the scope of LDAP searches for user authentication.

Helps locate users, groups, and other directory objects within the directory hierarchy.

Ensures that authentication requests are performed within the correct organizational unit (OU) or domain.

Example: If users are stored in ou=users,dc=example,dc=com, then the Base DN would be:

Key Role of Base DN in Authentication:dc=example,dc=com

When an authentication request is made, LDAP searches for user entries within this Base DN to validate credentials.

A. Path to the server containing the Directory.

Incorrect, because the server path (LDAP URL) is defined separately, usually in the format:

Why Other Options Are Incorrect:ldap://ldap.example.com:389

C. Name of the database.

Incorrect, because LDAP is not a traditional relational database; it uses a hierarchical structure.

D. Configuration file path.

Incorrect, as LDAP configuration files (e.g., slapd.conf for OpenLDAP) are separate from the Base DN and are used for server settings, not authentication scope.

IBM Cloud Pak for Integration (CP4I) v2021.2 Administration References:

IBM Documentation: LDAP Authentication Configuration

IBM Cloud Pak for Integration - Configuring LDAP

Understanding LDAP Distinguished Names (DNs)

Single Sign-On (SSO) is an authentication mechanism that allows users to log in once and gain access to multiple applications without re-entering credentials. In IBM Cloud Pak for Integration (CP4I), Enterprise LDAP and OpenShift authentication both support SSO.

Enterprise LDAP (B) – ✅ Supports SSO

Lightweight Directory Access Protocol (LDAP) is commonly used in enterprises for centralized authentication.

CP4I can integrate with Enterprise LDAP, allowing users to authenticate once and access multiple cloud services without needing separate logins.

OpenShift Authentication (E) – ✅ Supports SSO

OpenShift provides OAuth-based authentication, enabling SSO across multiple OpenShift-integrated services.

CP4I uses OpenShift’s built-in identity provider to allow seamless user authentication across different Cloud Pak components.

A. 2FA (Incorrect):

Two-Factor Authentication (2FA) enhances security by requiring an additional verification step but does not inherently support SSO.

C. Plain Text over HTTPS (Incorrect):

Plain text authentication is insecure and does not support SSO.

D. Enterprise SSH (Incorrect):

SSH authentication is used for remote access to servers but is not related to SSO.

Analysis of the Incorrect Options:

IBM Cloud Pak for Integration Authentication & SSO Guide

Red Hat OpenShift Authentication and Identity Providers

IBM Cloud Pak - Integrating with Enterprise LDAP

IBM Cloud Pak for Integration (CP4I) v2021.2 Administration References:

In IBM Cloud Pak for Integration (CP4I) v2021.2, ensuring high availability (HA) requires certain components to maintain a quorum. A quorum is a mechanism where a majority of nodes or instances must agree on a state to prevent split-brain scenarios and ensure consistency.

IBM MQ Multi-instance Queue Manager is designed for high availability.

It runs in an active-standby configuration where a shared storage is required, and a quorum ensures that failover occurs correctly.

If the primary queue manager fails, quorum logic ensures that another instance assumes control without data corruption.

API Connect operates in a distributed cluster architecture where multiple components (such as the API Manager, Analytics, and Gateway) work together.

A quorum is required to ensure consistency and avoid conflicts in API configurations across multiple instances.

API Connect uses MongoDB as its backend database, and MongoDB requires a replica set quorum for high availability and failover.

Why "Multi-instance Queue Manager" (A) Requires a Quorum?Why "API Management (API Connect)" (B) Requires a Quorum?

Why Not the Other Options?Option

Reason for Exclusion

C. Application Integration (App Connect)

While App Connect can be deployed in HA mode, it does not require a quorum. It uses Kubernetes scaling and load balancing instead.

D. Event Gateway Service

Event Gateway is stateless and relies on horizontal scaling rather than quorum-based HA.

E. Automation Assets

This component stores automation-related assets but does not require quorum for HA. It typically relies on persistent storage replication.

Thus, Multi-instance Queue Manager (IBM MQ) and API Management (API Connect) require quorum to ensure high availability in Cloud Pak for Integration.

IBM MQ Multi-instance Queue Manager HA

IBM API Connect High Availability and Quorum

CP4I High Availability Architecture

MongoDB Replica Set Quorum in API Connect

IBM Cloud Pak for Integration (CP4I) v2021.2 Administration References:

In IBM API Connect, an Authentication URL user registry is a type of user registry that allows authentication by delegating user verification to an external identity provider. This is typically used when API Connect needs to integrate with custom authentication mechanisms, such as OAuth, OpenID Connect, or SAML-based identity providers.

When configured, API Connect does not store user credentials locally. Instead, it redirects authentication requests to the specified external authentication URL, and if the response is valid, the user is authenticated.

The Authentication URL user registry is specifically designed to reference an external custom identity provider.

This enables API Connect to integrate with external authentication systems like LDAP, Active Directory, OAuth, and OpenID Connect.

It is commonly used for single sign-on (SSO) and enterprise authentication strategies.

Why Answer D is Correct:

A. It authenticates Developer Portal sites. → Incorrect

The Developer Portal uses its own authentication mechanisms, such as LDAP, local user registries, and external identity providers, but the Authentication URL user registry does not authenticate Developer Portal users directly.

B. It authenticates users defined in a provider organization. → Incorrect

Users in a provider organization (such as API providers and administrators) are typically authenticated using Cloud Manager or an LDAP-based user registry, not via an Authentication URL user registry.

C. It authenticates Cloud Manager users. → Incorrect

Cloud Manager users are typically authenticated via LDAP or API Connect’s built-in user registry.

The Authentication URL user registry is not responsible for Cloud Manager authentication.

Explanation of Incorrect Answers:

IBM API Connect User Registry Types

IBM API Connect Authentication and User Management

IBM Cloud Pak for Integration Documentation

IBM Cloud Pak for Integration (CP4I) v2021.2 Administration References:

https://www.ibm.com/docs/SSMNED_v10/com.ibm.apic.cmc.doc/capic_cmc_registries_concepts.html

In IBM Cloud Pak for Integration (CP4I) v2021.2, only a Cluster Administrator has the necessary permissions to replace default keys and certificates. This is because modifying security components such as TLS certificates affects the entire cluster and requires elevated privileges.

Access to OpenShift and Cluster-Wide Resources:

The Cluster Administrator role has full administrative control over the OpenShift cluster where CP4I is deployed.

Replacing keys and certificates often involves interacting with OpenShift secrets and security configurations, which require cluster-wide access.

Management of Certificates and Encryption:

In CP4I, certificates are used for securing communication between integration components and external systems.

Updating or replacing certificates requires privileges to modify security configurations, which only a Cluster Administrator has.

Control Over Security Policies:

CP4I security settings, including certificates, are managed at the cluster level.

Cluster Administrators ensure compliance with security policies, including certificate renewal and management.

Why is "Cluster Administrator" the Correct Answer?

Why Not the Other Options?Option

Reason for Exclusion

A. Cluster Manager

This role is typically responsible for monitoring and managing cluster resources but does not have full administrative control over security settings.

B. Super-user

There is no predefined "Super-user" role in CP4I. If referring to an elevated user, it would still require a Cluster Administrator's permissions to replace certificates.

C. System User

System users often refer to service accounts or application-level users that lack the required cluster-wide security privileges.

Thus, the Cluster Administrator role is the only one with the required access to replace default keys and certificates in Cloud Pak for Integration.

IBM Cloud Pak for Integration Security Overview

Managing Certificates in Cloud Pak for Integration

OpenShift Cluster Administrator Role

IBM Cloud Pak for Integration - Replacing Default Certificates

IBM Cloud Pak for Integration (CP4I) v2021.2 Administration References:

In IBM Cloud Pak for Integration (CP4I) v2021.2, the Platform Navigator is the central UI for managing integration capabilities, including user and access control. To add users and user groups, the required permission level is Administrator.

User Management Capabilities:

The Administrator role in Platform Navigator has full access to user and group management functions, including:

Adding new users

Assigning roles

Managing access policies

RBAC (Role-Based Access Control) Enforcement:

CP4I enforces RBAC to restrict actions based on roles.

Only Administrators can modify user access, ensuring security compliance.

Access Control via OpenShift and IAM Integration:

User management in CP4I integrates with IBM Cloud IAM or OpenShift User Management.

The Administrator role ensures correct permissions for authentication and authorization.

Why is "Administrator" the Correct Answer?

Why Not the Other Options?Option

Reason for Exclusion

A. root

"root" is a Linux system user and not a role in Platform Navigator. CP4I does not grant UI-based root access.

B. Super-user

No predefined "Super-user" role exists in CP4I. If referring to an elevated user, it still does not match the Administrator role in Platform Navigator.

D. User

Regular "User" roles have view-only or limited permissions and cannot manage users or groups.

Thus, the Administrator role is the correct choice for adding users and user groups in Platform Navigator.

IBM Cloud Pak for Integration - Platform Navigator Overview

Managing Users in Platform Navigator

Role-Based Access Control in CP4I

OpenShift User Management and Authentication

IBM Cloud Pak for Integration (CP4I) v2021.2 Administration References:

When the API Connect operator is installed at the cluster scope, it means that the operator has permissions and visibility across the entire Kubernetes or OpenShift cluster, rather than being limited to a single namespace. This setup allows multiple namespaces to utilize the API Connect resources, effectively making the entire cluster behave as one large tenant.

Cluster-wide installation enables shared services across multiple namespaces, ensuring that API management is centralized.

Multi-tenancy behavior occurs because all API Connect components, such as the Gateway, Analytics, and Portal, can serve multiple teams or applications within the cluster.

Operator Lifecycle Manager (OLM) governs how the API Connect operator is deployed and managed across namespaces, reinforcing the unified behavior across the cluster.

IBM API Connect Operator Documentation

IBM Cloud Pak for Integration - Installing API Connect

IBM Redbook - Cloud Pak for Integration Architecture Guide

IBM Cloud Pak for Integration (CP4I) v2021.2 Administration References:

When troubleshooting an IBM Cloud Pak for Integration (CP4I) v2021.2 instance, IBM Support requires diagnostic data that provides insights into the system’s performance, errors, and failures. The most critical diagnostic information comes from the Standard OpenShift Container Platform logs because:

CP4I runs on OpenShift, and its components are deployed as Kubernetes pods, meaning logs from OpenShift provide essential insights into infrastructure-level and application-level issues.

The OpenShift logs include:

Pod logs (oc logs ), which contain information about application behavior.

Event logs (oc get events), which provide details about errors, scheduling issues, or failed deployments.

Node and system logs, which help diagnose resource exhaustion, networking issues, or storage failures.

B. Platform Navigator event logs → Incorrect

While Platform Navigator manages CP4I services, its event logs focus mainly on UI-related issues and do not provide deep troubleshooting data needed for IBM Support.

C. Cloud Pak For Integration activity logs → Incorrect

CP4I activity logs include component-specific logs but do not cover the underlying OpenShift platform or container-level issues, which are crucial for troubleshooting.

D. Integration tracing activity reports → Incorrect

Integration tracing focuses on tracking API and message flows but is not sufficient for diagnosing broader CP4I system failures or deployment issues.

Explanation of Incorrect Answers:

IBM Cloud Pak for Integration Troubleshooting Guide

OpenShift Log Collection for Support

IBM MustGather for Cloud Pak for Integration

Red Hat OpenShift Logging and Monitoring

IBM Cloud Pak for Integration (CP4I) v2021.2 Administration References:

In IBM Cloud Pak for Integration (CP4I) v2021.2, licensing is based on Virtual Processor Cores (VPCs), and it includes entitlement for OpenShift usage. However, OpenShift master nodes (control plane nodes) do not consume license entitlement, because:

OpenShift licensing only applies to worker nodes.

The master nodes (control plane nodes) manage cluster operations and scheduling, but they do not run user workloads.

IBM’s Cloud Pak licensing model considers only the worker nodes for licensing purposes.

Master nodes are essential infrastructure and are excluded from entitlement calculations.

IBM and Red Hat do not charge for OpenShift master nodes in Cloud Pak deployments.

A. CP4I licenses include entitlement for the entire OpenShift cluster that they run on, and the administrator can count against the master nodes. → ❌ Incorrect

CP4I licenses do cover OpenShift, but only for worker nodes where workloads are deployed.

Master nodes are excluded from licensing calculations.

C. The administrator will need to purchase additional OpenShift licenses to cover the master nodes. → ❌ Incorrect

No additional OpenShift licenses are required for master nodes.

OpenShift licensing only applies to worker nodes that run applications.

D. CP4I licenses include entitlement for 3 cores of OpenShift per core of CP4I. → ❌ Incorrect

The standard IBM Cloud Pak licensing model provides 1 VPC of OpenShift for 1 VPC of CP4I, not a 3:1 ratio.

Additionally, this applies only to worker nodes, not master nodes.

Explanation of Incorrect Answers:

IBM Cloud Pak Licensing Guide

IBM Cloud Pak for Integration Licensing Details

Red Hat OpenShift Licensing Guide

IBM Cloud Pak for Integration (CP4I) v2021.2 Administration References:

In Red Hat OpenShift, installing OpenShift GitOps (based on ArgoCD) requires elevated cluster-wide permissions because the installation process:

Deploys Custom Resource Definitions (CRDs).

Creates Operators and associated resources.

Modifies cluster-scoped components like role-based access control (RBAC) policies.

Only a user with cluster-admin privileges can perform these actions, making cluster-admin the correct role for installing OpenShift GitOps.

Command to Install OpenShift GitOps:oc apply -f openshift-gitops-subscription.yaml

This operation requires cluster-wide permissions, which only the cluster-admin role provides.

Why the Other Options Are Incorrect?Option

Explanation

Correct?

A. cluster-operator

❌ Incorrect – No such default role exists in OpenShift. Operators are managed within namespaces but cannot install GitOps at the cluster level.

❌

C. admin

❌ Incorrect – The admin role provides namespace-level permissions, but GitOps requires cluster-wide access to install Operators and CRDs.

❌

D. operator

❌ Incorrect – This is not a valid OpenShift role. Operators are software components managed by OpenShift, but an operator role does not exist for installation purposes.

❌

Final Answer:✅ B. cluster-admin

Red Hat OpenShift GitOps Installation Guide

Red Hat OpenShift RBAC Roles and Permissions

IBM Cloud Pak for Integration - OpenShift GitOps Best Practices

IBM Cloud Pak for Integration (CP4I) v2021.2 Administration References: