IBM C1000-130 Exam Questions

Single Sign-On (SSO) is an authentication mechanism that allows users to log in once and gain access to multiple applications without re-entering credentials. In IBM Cloud Pak for Integration (CP4I), Enterprise LDAP and OpenShift authentication both support SSO.

Enterprise LDAP (B) -- Supports SSO

Lightweight Directory Access Protocol (LDAP) is commonly used in enterprises for centralized authentication.

CP4I can integrate with Enterprise LDAP, allowing users to authenticate once and access multiple cloud services without needing separate logins.

OpenShift Authentication (E) -- Supports SSO

OpenShift provides OAuth-based authentication, enabling SSO across multiple OpenShift-integrated services.

CP4I uses OpenShift's built-in identity provider to allow seamless user authentication across different Cloud Pak components.

Analysis of the Incorrect Options:

A . 2FA (Incorrect):

Two-Factor Authentication (2FA) enhances security by requiring an additional verification step but does not inherently support SSO.

C . Plain Text over HTTPS (Incorrect):

Plain text authentication is insecure and does not support SSO.

D . Enterprise SSH (Incorrect):

SSH authentication is used for remote access to servers but is not related to SSO.

IBM Cloud Pak for Integration (CP4I) v2021.2 Administration Reference:

IBM Cloud Pak for Integration Authentication & SSO Guide

Red Hat OpenShift Authentication and Identity Providers

IBM Cloud Pak - Integrating with Enterprise LDAP

In IBM Cloud Pak for Integration (CP4I) v2021.2, the Platform Navigator is the central UI for managing integration capabilities, including user and access control. To add users and user groups, the required permission level is Administrator.

Why is 'Administrator' the Correct Answer?

User Management Capabilities:

The Administrator role in Platform Navigator has full access to user and group management functions, including:

Adding new users

Assigning roles

Managing access policies

RBAC (Role-Based Access Control) Enforcement:

CP4I enforces RBAC to restrict actions based on roles.

Only Administrators can modify user access, ensuring security compliance.

Access Control via OpenShift and IAM Integration:

User management in CP4I integrates with IBM Cloud IAM or OpenShift User Management.

The Administrator role ensures correct permissions for authentication and authorization.

Why Not the Other Options?

Option

Reason for Exclusion

A . root

'root' is a Linux system user and not a role in Platform Navigator. CP4I does not grant UI-based root access.

B . Super-user

No predefined 'Super-user' role exists in CP4I. If referring to an elevated user, it still does not match the Administrator role in Platform Navigator.

D . User

Regular 'User' roles have view-only or limited permissions and cannot manage users or groups.

Thus, the Administrator role is the correct choice for adding users and user groups in Platform Navigator.

IBM Cloud Pak for Integration (CP4I) v2021.2 Administration Reference:

IBM Cloud Pak for Integration - Platform Navigator Overview

Managing Users in Platform Navigator

Role-Based Access Control in CP4I

OpenShift User Management and Authentication

In an air-gapped environment, the OpenShift cluster does not have direct internet access, which means that new software images, such as IBM API Connect, must be manually mirrored from an external source.

The correct approach for installing a new API Connect capability in an air-gapped OpenShift environment is to:

Use a laptop or a bastion host that does have internet access to pull required container images from IBM's entitled software registry.

Leverage Container Application Software for Enterprises (CASE) files to download and transfer images to the private OpenShift registry.

Mirror images into the OpenShift cluster by using OpenShift's built-in image mirror utilities (oc mirror).

This method ensures that all required container images are available locally within the air-gapped environment.

Why the Other Options Are Incorrect?

Option

Explanation

Correct?

B . An OVA form-factor of the Cloud Pak for Integration is recommended for high-security deployments.

Incorrect -- IBM Cloud Pak for Integration does not provide an OVA (Open Virtual Appliance) format for API Connect deployments. It is containerized and runs on OpenShift.

C . A pass-through route must be configured in the OpenShift Container Platform to connect to the online image registry.

Incorrect -- Air-gapped environments have no internet connectivity, so this approach would not work.

D . Use secure FTP to mirror software images in the OpenShift Container Platform cluster nodes.

Incorrect -- OpenShift does not use FTP for image mirroring; it relies on oc mirror and image registries for air-gapped deployments.

Final Answer:

A. Configure a laptop or bastion host to use Container Application Software for Enterprises files to mirror images.

IBM Cloud Pak for Integration (CP4I) v2021.2 Administration Reference:

IBM API Connect Air-Gapped Installation Guide

IBM Container Application Software for Enterprises (CASE) Documentation

Red Hat OpenShift - Mirroring Images for Disconnected Environments

IBM Cloud Pak for Integration (CP4I) relies on IBM Common Services for authentication, licensing, and other foundational functionalities. The License Service API is a key component that enables the monitoring and reporting of software license usage across the cluster.

Authentication to the License Service API

To authenticate to the IBM License Service APIs, a token is required, which is stored in the ibm-licensing-token secret within the ibm-common-services namespace (where IBM Common Services are installed).

When Cloud Pak for Integration (installed in the cp4i namespace) needs to interact with the License Service API, it retrieves the authentication token from this secret in the ibm-common-services namespace.

Why is Option D Correct?

The ibm-licensing-token secret is automatically created in the ibm-common-services namespace when the IBM License Service is deployed.

This token is required for authentication when querying licensing information via the License Service API.

Since IBM Common Services are installed in ibm-common-services, and the licensing service is part of these foundational services, authentication tokens are stored in this namespace rather than the cp4i namespace.

Analysis of Other Options:

Option

Correct/Incorrect

Reason

A . A token available in ibm-licensing-token secret in the cp4i namespace.

Incorrect

The licensing token is stored in the ibm-common-services namespace, not in cp4i.

B . A password available in platform-auth-idp-credentials in the ibm-common-services namespace.

Incorrect

This secret is related to authentication for the IBM Identity Provider (OIDC) and is not used for licensing authentication.

C . A password available in ibm-entitlement-key in the cp4i namespace.

Incorrect

The ibm-entitlement-key is used for accessing IBM Container Registry to pull images, not for licensing authentication.

D . A token available in ibm-licensing-token secret in the ibm-common-services namespace.

Correct

This is the correct secret that contains the required token for authentication to the License Service API.

IBM Cloud Pak for Integration (CP4I) v2021.2 Administration Reference:

IBM Documentation: IBM License Service Authentication and Tokens

IBM Knowledge Center: Managing License Service in OpenShift

IBM Redbooks: IBM Cloud Pak for Integration Deployment Guide

The Operations Dashboard in IBM Cloud Pak for Integration (CP4I) v2021.2 is used for monitoring and managing integration components. When securing data at rest, the supported encryption method in CP4I includes Portworx, which provides enterprise-grade storage and encryption solutions.

Why Option B (Portworx) is Correct:

Portworx is a Kubernetes-native storage solution that supports encryption of data at rest.

It enables persistent storage for OpenShift workloads, including Cloud Pak for Integration components.

Portworx provides AES-256 encryption, ensuring that data at rest remains secure.

It allows for role-based access control (RBAC) and Key Management System (KMS) integration for secure key handling.

Explanation of Incorrect Answers:

A . AES128 Incorrect

While AES encryption is used for data protection, AES128 is not explicitly mentioned as the standard for Operations Dashboard storage encryption.

AES-256 is the preferred encryption method when using Portworx or IBM-provided storage solutions.

C . base64 Incorrect

Base64 is an encoding scheme, not an encryption method.

It does not provide security for data at rest, as base64-encoded data can be easily decoded.

D . NFS Incorrect

Network File System (NFS) does not inherently provide encryption for data at rest.

NFS can be used for storage, but additional encryption mechanisms are needed for securing data at rest.

IBM Cloud Pak for Integration (CP4I) v2021.2 Administration Reference:

IBM Cloud Pak for Integration Security Best Practices

Portworx Data Encryption Documentation

IBM Cloud Pak for Integration Storage Considerations

Red Hat OpenShift and Portworx Integration

https://www.ibm.com/docs/en/cloud-paks/cp-integration/2020.3?topic=configuration-installation