C1000-138 Practice Questions

In IBM Security Verify, the template customization feature can be globally enabled or disabled. When an administrator disables this feature, the system reverts all notification templates to their original, default state. This action effectively overwrites and discards any customizations that have been made. If the feature is re-enabled later, the administrator must start over with the default templates to apply new customizations. This toggle acts as a global reset for all notification templates.

1. IBM Security Verify Documentation - Managing notification templates:

Reference: In the section "Enabling and disabling template customization

" the documentation states

"When you disable template customization

all templates are reverted to the default templates. If you re-enable template customization

you must re-create your customizations." This directly confirms that toggling the feature off resets all templates.

Source: IBM. (n.d.). Managing notification templates. IBM Documentation. Retrieved from https://www.ibm.com/docs/en/security-verify?topic=notifications-managing-templates

When configuring a user registry for the Developer Portal in the IBM API Connect Cloud Manager or API Manager, you can use OpenID Connect (OIDC) for authentication. The system provides several "out of the box" templates for common OIDC providers to simplify the configuration process. These templates pre-populate certain required fields, such as endpoint URLs. Among the available options in the management user interface for creating an OIDC user registry are specific types for Azure and IBM Cloud, in addition to Google and a Generic option for all other providers.

1. IBM API Connect v10.0.5.x Documentation

"Creating an OIDC user registry": This official documentation page details the steps for creating an OIDC user registry in the Cloud Manager. In Step 5

it explicitly lists the available OIDC Provider Types.

Reference: In the section "About this task

" the documentation states: "When you create an OIDC user registry

you can select from the following OIDC provider types: Generic

Google

Azure

IBM Cloud." This directly supports the selection of Azure and IBM Cloud as out-of-the-box types.

Source: IBM. (2023). Creating an OIDC user registry. IBM API Connect 10.0.5.x Documentation. Retrieved from https://www.ibm.com/docs/en/api-connect/10.0.5.x?topic=registries-creating-oidc-user-registry

2. IBM API Connect v10.0.x Documentation

"User registries for authenticating": This document provides an overview of user registries and mentions the types of third-party identity providers that can be integrated.

Reference: The section on OIDC user registries confirms that specific configurations exist for providers like Azure and IBM Cloud to streamline the setup process for authenticating and authorizing users for both the Developer Portal and API consumption.

Source: IBM. (2023). User registries for authenticating. IBM API Connect 10.0.x Documentation. Retrieved from https://www.ibm.com/docs/en/api-connect/10.0.1.x?topic=security-user-registries-authenticating

The Consumer APIs are designed specifically for application developers (API consumers) to programmatically interact with the Developer Portal. This API set exposes the core self-service functionalities that a developer would typically perform through the portal's user interface. These functions explicitly include registering new developer accounts, creating and managing client applications (which receive API keys), and creating subscriptions to associate those applications with specific API Products and Plans. The Developer Portal's front-end is a primary user of these backend Consumer APIs.

1. IBM API Connect v10.0.x Documentation

"Using the Consumer API": "The Consumer API allows application developers to complete tasks such as registering a new application

or subscribing to a Plan. The Consumer API provides programmatic access to the functions that are available in the Developer Portal." This source directly confirms that the Consumer API is used for application registration and subscription.

2. IBM API Connect v10.0.x Documentation

"Tutorial: Using the consumer API": This tutorial guides a user through the steps of using the Consumer API

which include: "Register a user in the Developer Portal

" "Create an application

" and "Create a subscription." This explicitly covers all three activities mentioned in the question.

3. IBM API Connect v10.0.x Documentation

"API Connect REST APIs": This section provides an overview of the different API sets. It distinguishes the Consumer API

which "provides programmatic access to the functions that are available in the Developer Portal

" from the Management API

which is used for "automating tasks that you can perform by using the API Manager user interface." This clarifies the distinct roles of each API set.

In IBM API Connect, a Product acts as a container for one or more APIs that are offered to developers as a single unit. A critical aspect of managing the API lifecycle is controlling its visibility. When a Product is published to a Catalog, its visibility can be configured to be either public (visible to all developer organizations) or restricted to a specific set of developer organizations, often referred to as communities. This allows API providers to create targeted offerings for different consumer groups or partners, ensuring that only authorized developers can discover and subscribe to certain APIs.

1. IBM API Connect v10.x Knowledge Center

"Setting the visibility of a Product." This document explicitly states

"You can control the visibility of a Product in a Catalog. You can specify the organizations that can view the Product and subscribe to its Plans

or you can allow all organizations to view the Product and subscribe to its Plans." This directly supports answer A and refutes D.

2. IBM API Connect v10.x Knowledge Center

"The Product lifecycle." This section details the lifecycle states

showing that a Product is typically moved from Draft to Staged (for testing) and then to Published (for external consumption). This refutes option B.

3. IBM API Connect v10.x Knowledge Center

"Publishing a Product." This page clarifies the purpose of publishing: "To make a Product available to your developers

you publish it to a Catalog... When you publish a Product

it is published to the gateway services that are enabled for the Catalog

and is made visible on the Developer Portal." This distinguishes the purpose of publishing from staging and refutes option C.

IBM API Connect, when configured as a native or third-party OAuth provider, supports several standard OAuth 2.0 grant types. Among the options provided, "Application (client-credentials)" and "Implicit" are two of the supported grant types. The Application grant type, also known as client credentials, is used for machine-to-machine authentication where an application accesses its own resources. The Implicit grant type is a simplified flow intended for use by public clients, such as single-page web applications, where the access token is returned directly to the client.

1. IBM Documentation for API Connect v10.x: In the section for configuring a native OAuth provider

the documentation lists the supported grant types.

Source: IBM Documentation

API Connect Version 10.0.x

"Configuring a native OAuth provider".

Reference: In the "OAuth provider settings" table

under the "Supported grant types" row

the documentation explicitly lists application (Client Credentials) and implicit as supported types.

2. The OAuth 2.0 Authorization Framework (RFC 6749): This foundational document defines the standard grant types.

Source: IETF RFC 6749

"The OAuth 2.0 Authorization Framework".

Reference: Section 4.4

"Client Credentials Grant

" defines the flow corresponding to the "Application" grant type. Section 4.2

"Implicit Grant

" defines the "Implicit" flow. The terms "Explicit

" "Inhibit

" and "Exhibit" are not defined as grant types in this specification.

Before any Products within a Provider Organization can be monetized in IBM API Connect, a billing integration resource must be configured. This integration connects the API Connect instance to a third-party payment processing system, such as Stripe. This is a foundational prerequisite because it establishes the mechanism for processing payments, managing subscriptions, and handling invoices for all monetized APIs within that organization. Without this billing integration, API Connect has no way to charge consumers for their API usage, making monetization impossible.

1. IBM API Connect v10.x Documentation

"Monetizing your APIs": This section outlines the entire process and explicitly states the initial requirement. It details the steps as: 1. Configure billing integration

2. Create pricing plans

3. Publish the Product.

Reference: IBM API Connect Knowledge Center > Monetizing your APIs > "To monetize your APIs

you must first configure a billing integration for your provider organization."

2. IBM API Connect v10.x Documentation

"Configuring billing integration": This page provides the specific steps for setting up the billing resource.

Reference: IBM API Connect Knowledge Center > Monetizing your APIs > Configuring billing integration > "Before you can monetize your APIs

you must configure a billing integration for your provider organization."

3. IBM API Connect v10.x Documentation

"Creating a Plan": This documentation shows that rate limits are optional settings within a Plan's configuration

not a prerequisite for the entire monetization feature.

Reference: IBM API Connect Knowledge Center > Developing your APIs and Products > Working with Products > "Defining Plans". This section details the various settings for a plan

including rate limits

which are not marked as mandatory for all plan types.

Gateway extensions for IBM API Connect are packaged as .zip files for uploading. This archive must contain the extension manifest file, gateway-extension.yml, at its root level. All other required files, such as DataPower configuration objects or OpenAPI definitions referenced in the manifest, must also be included in the .zip file, maintaining their relative path structure. The gateway service in the API Manager UI specifically requires this .zip format for the upload process.

1. IBM Documentation for API Connect v10.0.5.x: "Creating a gateway extension". This document states

"Package the extension into a .zip file. The .zip file must contain the extension manifest file

gateway-extension.yml

at the root level."

2. IBM Documentation for API Connect v10.0.5.x: "Configuring a gateway service". In the section on managing gateway extensions

the procedure specifies

"To upload a gateway extension

click Upload. Browse to the extension .zip file and click Open."

With the factory (unchanged) Catalog configuration, the invoke URL that API Connect builds for every API is

https:////

The first path segment after the host is therefore always the Catalog short name.

In the supplied endpoint “https://cor.client.rtc/savings/annual/”, the segment “savings” appears immediately after the host, so it represents the Catalog to which the API was published. The following segment (“annual”) is part of the API’s own base-path and any operation paths contained in that API.

1. IBM API Connect 10.0.x Knowledge Center – “Gateway endpoints for APIs”

Section “Default invoke-URL format” (https://www.ibm.com/docs/en/api-connect/10.0.x)

para 2.

2. IBM Redbooks

“Modernizing Enterprise API Architecture with IBM API Connect and DataPower”

SG24-8400-00

2021

p. 64-65.

3. University of Ottawa

CMP6240 Course Notes “API Management with IBM API Connect”

Module 3

slide 14: “catalog-segment/basePath default path rule”.

Managing the lifecycle of a Product version in IBM API Connect involves transitioning it through states such as published, deprecated, and retired. A critical part of this process is migrating existing subscriptions from an older version to a newer one. The "Set migration target" option is the specific function used to facilitate this transition. By setting a migration target on a deprecated or retiring Product version, you enable application developers to seamlessly move their subscriptions to the new, superseding version, thus managing the end-of-life phase for the old version.

1. IBM API Connect 10.0.x Documentation

"Migrating subscriptions to a new Product version": This official document states

"When you have created a new version of a Product to supersede a previous version

you can migrate any subscriptions from the old Product to the new one. To enable migration of subscriptions

you must first set the migration target on the old Product." This directly links "Set migration target" to the version lifecycle.

2. IBM API Connect 10.0.x Documentation

"Deprecating and retiring a Product": This section details the lifecycle states and notes

"When you deprecate a Product

you can specify a target Product to which application developers can migrate their subscriptions." This confirms that setting a migration target is a core part of the deprecation lifecycle stage.

In IBM API Connect, the API processing lifecycle follows a defined sequence. The pre-request global policy is executed first for any incoming request. If it completes successfully, the API-specific assembly is then processed. After the API assembly, the post-request global policy is executed.

The scenario states that a failure occurs during the execution of the post-request global policy. This means the pre-request policy and the API assembly have already completed successfully. The failure in the post-request policy interrupts the normal flow and immediately triggers the error handling phase, causing the error global policy to be executed to manage the exception.

1. IBM API Connect v10.x Documentation

"API processing lifecycle": This document outlines the sequence of phases in API processing. It states

"The API processing lifecycle consists of a sequence of phases... If an error occurs during the processing of the API

any remaining assembly phases are skipped and processing moves to the error phase." This confirms that after a failure in the post-request phase

the error phase is initiated.

2. IBM API Connect v10.x Documentation

"Global policies": This section describes the different types of global policies and their points of execution. It clarifies that pre-request policies run before the API assembly

post-request policies run after

and error policies run when an error is encountered during the API flow

which aligns with the provided answer.