Pass the IBM Certified Administrator - Cloud Pak for Integration V2021.2 C1000-130 Questions and answers with ExamsMirror

In an air-gapped environment, the OpenShift cluster does not have direct internet access, which means that new software images, such as IBM API Connect, must be manually mirrored from an external source.

The correct approach for installing a new API Connect capability in an air-gapped OpenShift environment is to:

Use a laptop or a bastion host that does have internet access to pull required container images from IBM’s entitled software registry.

Leverage Container Application Software for Enterprises (CASE) files to download and transfer images to the private OpenShift registry.

Mirror images into the OpenShift cluster by using OpenShift’s built-in image mirror utilities (oc mirror).

This method ensures that all required container images are available locally within the air-gapped environment.

Why the Other Options Are Incorrect?Option

Explanation

Correct?

B. An OVA form-factor of the Cloud Pak for Integration is recommended for high-security deployments.

❌ Incorrect – IBM Cloud Pak for Integration does not provide an OVA (Open Virtual Appliance) format for API Connect deployments. It is containerized and runs on OpenShift.

❌

C. A pass-through route must be configured in the OpenShift Container Platform to connect to the online image registry.

❌ Incorrect – Air-gapped environments have no internet connectivity, so this approach would not work.

❌

D. Use secure FTP to mirror software images in the OpenShift Container Platform cluster nodes.

❌ Incorrect – OpenShift does not use FTP for image mirroring; it relies on oc mirror and image registries for air-gapped deployments.

❌

Final Answer:✅ A. Configure a laptop or bastion host to use Container Application Software for Enterprises files to mirror images.

IBM API Connect Air-Gapped Installation Guide

IBM Container Application Software for Enterprises (CASE) Documentation

Red Hat OpenShift - Mirroring Images for Disconnected Environments

IBM Cloud Pak for Integration (CP4I) v2021.2 Administration References:

In IBM API Connect, an Authentication URL user registry is a type of user registry that allows authentication by delegating user verification to an external identity provider. This is typically used when API Connect needs to integrate with custom authentication mechanisms, such as OAuth, OpenID Connect, or SAML-based identity providers.

When configured, API Connect does not store user credentials locally. Instead, it redirects authentication requests to the specified external authentication URL, and if the response is valid, the user is authenticated.

The Authentication URL user registry is specifically designed to reference an external custom identity provider.

This enables API Connect to integrate with external authentication systems like LDAP, Active Directory, OAuth, and OpenID Connect.

It is commonly used for single sign-on (SSO) and enterprise authentication strategies.

Why Answer D is Correct:

A. It authenticates Developer Portal sites. → Incorrect

The Developer Portal uses its own authentication mechanisms, such as LDAP, local user registries, and external identity providers, but the Authentication URL user registry does not authenticate Developer Portal users directly.

B. It authenticates users defined in a provider organization. → Incorrect

Users in a provider organization (such as API providers and administrators) are typically authenticated using Cloud Manager or an LDAP-based user registry, not via an Authentication URL user registry.

C. It authenticates Cloud Manager users. → Incorrect

Cloud Manager users are typically authenticated via LDAP or API Connect’s built-in user registry.

The Authentication URL user registry is not responsible for Cloud Manager authentication.

Explanation of Incorrect Answers:

IBM API Connect User Registry Types

IBM API Connect Authentication and User Management

IBM Cloud Pak for Integration Documentation

IBM Cloud Pak for Integration (CP4I) v2021.2 Administration References:

https://www.ibm.com/docs/SSMNED_v10/com.ibm.apic.cmc.doc/capic_cmc_registries_concepts.html

In IBM Cloud Pak for Integration (CP4I) v2021.2, when deploying API Connect on OpenShift or within the Cloud Pak for Integration framework, there are different deployment methods:

Single Top-Level Custom Resource (CR) – This method deploys all API Connect subsystems as a single unit, meaning they are managed together. Removing individual subsystems is not supported when using this deployment method. If you need to remove a subsystem, you must delete the entire API Connect instance.

Multiple Independent Custom Resources (CRs) – This method allows more granular control, enabling the deletion of individual subsystems without affecting the entire deployment.

Since the question specifically asks about API Connect deployed using a single top-level CR, it is not possible to delete individual subsystems. The entire deployment must be deleted and reconfigured if changes are required.

IBM Cloud Pak for Integration (CP4I) v2021.2 Administration References:

IBM API Connect v10 Documentation: IBM Docs - API Connect on OpenShift

IBM Cloud Pak for Integration Knowledge Center: IBM CP4I Documentation

API Connect Deployment Guide: Managing API Connect Subsystems

In Red Hat OpenShift, when a CI/CD pipeline (such as an OpenShift Pipeline based on Tekton) needs to pull an image from a remote image repository (e.g., Quay, Docker Hub, or a private registry), it must authenticate securely. The required OpenShift component for securely storing and providing credentials is a Secret.

A Secret stores authentication credentials, such as username/password, OAuth tokens, or registry credentials.

OpenShift supports the kubernetes.io/dockerconfigjson Secret type, which is used for storing Docker or container registry credentials.

The Secret can be referenced in ServiceAccounts to allow Pods and CI/CD pipelines to pull images securely.

Example of creating a Secret for a remote image repository:

Why is "Secret" the Correct Answer?oc create secret docker-registry my-registry-secret \

--docker-server= \

--docker-username= \

--docker-password= \

--docker-email=

The Secret can then be linked to a ServiceAccount for use in the CI/CD pipeline:

oc secrets link default my-registry-secret --for=pull

Why the Other Options Are Incorrect?Option

Explanation

Correct?

A. ConfigMap

❌ Incorrect – A ConfigMap stores non-sensitive configuration data (e.g., environment variables, properties files) but not credentials.

❌

B. TLS Certificate

❌ Incorrect – A TLS certificate is used for secure communication (e.g., HTTPS encryption), but it does not handle authentication for pulling images.

❌

D. API Key

❌ Incorrect – While an API key might be used for authentication, OpenShift does not directly use API keys for image pulling; it relies on Secrets instead.

❌

Final Answer:✅ C. Secret

Red Hat OpenShift Documentation - Pulling Images with Secrets

IBM Cloud Pak for Integration - Configuring Secure Image Pulling

Kubernetes Documentation - Image Pull Secrets

IBM Cloud Pak for Integration (CP4I) v2021.2 Administration References:

In IBM Cloud Pak for Integration (CP4I) v2021.2, which runs on Red Hat OpenShift, logging is managed through the OpenShift Logging Operator. This operator is responsible for collecting, storing, and forwarding logs within the cluster.

The OpenShift Logging Operator monitors a specific Custom Resource (CR) named ClusterLogging, which defines the logging stack configuration.

The ClusterLogging CR is used to configure and manage the cluster-wide logging stack, including components like:

Fluentd (Log collection and forwarding)

Elasticsearch (Log storage and indexing)

Kibana (Log visualization)

Administrators define log collection, storage, and forwarding settings using this CR.

How the ClusterLogging Custom Resource Works:Example of a ClusterLogging CR Definition:apiVersion: logging.openshift.io/v1

kind: ClusterLogging

metadata:

name: instance

namespace: openshift-logging

spec:

managementState: Managed

logStore:

type: elasticsearch

retentionPolicy:

application:

maxAge: 7d

collection:

type: fluentd

This configuration sets up an Elasticsearch-based log store with Fluentd as the log collector.

The OpenShift Logging Operator monitors the ClusterLogging CR to manage logging settings.

It defines how logs are collected, stored, and forwarded across the cluster.

IBM Cloud Pak for Integration uses this CR when integrating OpenShift’s logging system.

Why Answer A (ClusterLogging) is Correct?

B. DefaultLogging → Incorrect

There is no such resource named DefaultLogging in OpenShift.

The correct resource is ClusterLogging.

C. ElasticsearchLog → Incorrect

Elasticsearch is the default log store, but it is managed within ClusterLogging, not as a separate CR.

D. LoggingResource → Incorrect

This is not an actual OpenShift CR related to logging.

Explanation of Incorrect Answers:

OpenShift Logging Overview

Configuring OpenShift Cluster Logging

IBM Cloud Pak for Integration - Logging and Monitoring

IBM Cloud Pak for Integration (CP4I) v2021.2 Administration References:

In IBM Cloud Pak for Integration (CP4I) v2021.2, profiles define the resource allocation and configuration settings for deployed services. When creating a second medium-size profile, the system will allocate the resources according to the medium-size specifications, without affecting the first profile.

IBM Cloud Pak for Integration supports multiple profiles, each with its own resource allocation.

When a second medium-size profile is created, it is independently assigned the medium-size configuration without modifying the existing profiles.

This allows multiple services to run with similar resource constraints but remain separately managed.

Why Option B is Correct:

A. The first profile will be replaced by the second profile. → ❌ Incorrect

Creating a new profile does not replace an existing profile; each profile is independent.

C. The first profile will be re-configured with a medium size. → ❌ Incorrect

The first profile remains unchanged. A second profile does not modify or reconfigure an existing one.

D. The second profile will be configured with a large size. → ❌ Incorrect

The second profile will retain the specified medium size and will not be automatically upgraded to a large size.

Explanation of Incorrect Answers:

IBM Cloud Pak for Integration Sizing and Profiles

Managing Profiles in IBM Cloud Pak for Integration

OpenShift Resource Allocation for CP4I

IBM Cloud Pak for Integration (CP4I) v2021.2 Administration References:

In an IBM Cloud Pak for Integration (CP4I) v2021.2 deployment, certain components require ReadWriteMany (RWX) storage to allow multiple pods to read and write data concurrently.

CouchDB is used as the Asset Repository in CP4I to store configuration and metadata for IBM Automation Assets.

It requires persistent storage that can be accessed by multiple instances simultaneously.

RWX storage is necessary because multiple pods may need concurrent access to the same database storage in a distributed deployment.

Common RWX storage options in OpenShift include NFS, Portworx, or CephFS.

Why Option B (CouchDB for Asset Repository) is Correct:

A. MQ multi-instance → Incorrect

IBM MQ multi-instance queue managers require ReadWriteOnce (RWO) storage because only one active instance at a time can write to the storage.

MQ HA deployments typically use Replicated Data Queue Manager (RDQM) or Persistent Volumes with RWO access mode.

C. API Connect → Incorrect

API Connect stores most of its configurations in databases like MongoDB but does not specifically require RWX storage for its primary operation.

It uses RWO or ReadOnlyMany (ROX) storage for its internal components.

D. Event Streams → Incorrect

Event Streams (based on Apache Kafka) uses RWO storage for high-performance message persistence.

Each Kafka broker typically writes to its own dedicated storage, meaning RWX is not required.

Explanation of Incorrect Answers:

IBM Cloud Pak for Integration Storage Requirements

CouchDB Asset Repository in CP4I

IBM MQ Multi-Instance Setup

OpenShift RWX Storage Options

IBM Cloud Pak for Integration (CP4I) v2021.2 Administration References:

In IBM Cloud Pak for Integration (CP4I) v2021.2, which runs on Red Hat OpenShift, the Ingress Controller is responsible for managing external access to services running within the cluster. The Ingress Controller certificate ensures secure communication between clients and the OpenShift cluster.

A. The administrator can specify a custom certificate at a later time. ✅

OpenShift allows administrators to replace the default self-signed certificate with a custom TLS certificate at any time.

This is typically done using a Secret in the appropriate namespace and updating the IngressController resource.

Example command to update the Ingress Controller certificate:

Explanation of Correct Answers:oc create secret tls my-custom-cert --cert=custom.crt --key=custom.key -n openshift-ingress

oc patch ingresscontroller default -n openshift-ingress-operator --type=merge -p '{"spec":{"defaultCertificate":{"name":"my-custom-cert"}}}'

This ensures secure access with a trusted certificate instead of the default self-signed certificate.

C. By default, OpenShift uses an internal self-signed certificate. ✅

If no custom certificate is provided, OpenShift automatically generates and assigns a self-signed certificate for the Ingress Controller.

This certificate is not trusted by browsers or external clients and typically causes SSL/TLS warnings unless replaced.

B. The Ingress Controller does not support the use of a custom certificate. ❌ Incorrect

OpenShift fully supports custom certificates for the Ingress Controller, allowing secure TLS communication.

D. By default, OpenShift does not use any certificate if one is not applied during the initial setup. ❌ Incorrect

OpenShift always generates a default self-signed certificate if no custom certificate is provided.

E. Certificate assignment is only applicable during initial setup. ❌ Incorrect

Custom certificates can be assigned at any time, not just during initial setup.

Explanation of Incorrect Answers:

OpenShift Ingress Controller TLS Configuration

IBM Cloud Pak for Integration Security Configuration

Managing OpenShift Cluster Certificates

IBM Cloud Pak for Integration (CP4I) v2021.2 Administration References:

In IBM Cloud Pak for Integration (CP4I) v2021.2, which runs on OpenShift, administrators often need to check the current cluster version and available updates before performing an upgrade.

The correct command to display the current OpenShift cluster version and check for available updates is:

oc adm upgrade

This command provides information about:

The current OpenShift cluster version.

Whether a newer version is available for upgrade.

The channel and upgrade path.

A. update – Incorrect

There is no oc update or update command in OpenShift CLI for checking cluster versions.

C. adm update – Incorrect

oc adm update is not a valid command in OpenShift. The correct subcommand is adm upgrade.

D. upgrade – Incorrect

oc upgrade is not a valid OpenShift CLI command. The correct syntax requires adm upgrade.

Why the other options are incorrect:

Example Output of oc adm upgrade:$ oc adm upgrade

Cluster version is 4.10.16

Updates available:

Version 4.11.0

Version 4.11.1

OpenShift Cluster Upgrade Documentation

IBM Cloud Pak for Integration OpenShift Upgrade Guide

Red Hat OpenShift CLI Reference

IBM Cloud Pak for Integration (CP4I) v2021.2 Administration References:

Security Assertion Markup Language (SAML) is an XML-based standard used for exchanging identity, authentication, and authorization information between an Identity Provider (IdP) and a Service Provider (SP).

SAML is widely used for Single Sign-On (SSO) authentication in enterprise environments, allowing users to authenticate once with an identity provider and gain access to multiple applications without needing to log in again.

User Requests Access → The user tries to access a service (Service Provider).

Redirect to Identity Provider (IdP) → If not authenticated, the user is redirected to an IdP (e.g., Okta, Active Directory Federation Services).

User Authenticates with IdP → The IdP verifies user credentials.

SAML Assertion is Sent → The IdP generates a SAML assertion (XML-based token) containing authentication and authorization details.

Service Provider Grants Access → The service provider validates the SAML assertion and grants access.

How SAML Works:SAML is commonly used in IBM Cloud Pak for Integration (CP4I) v2021.2 to integrate with enterprise authentication systems for secure access control.

B. IAM SSO authentication → ❌ Incorrect

IAM (Identity and Access Management) supports SAML for SSO, but "IAM SSO authentication" is not a specific XML-based authentication standard.

C. IAM via XML → ❌ Incorrect

There is no authentication method called "IAM via XML." IBM IAM systems may use XML configurations, but IAM itself is not an XML-based authentication protocol.

D. Enterprise XML → ❌ Incorrect

"Enterprise XML" is not a standard authentication mechanism. While XML is used in many enterprise systems, it is not a dedicated authentication protocol like SAML.

Explanation of Incorrect Answers:

IBM Cloud Pak for Integration - SAML Authentication

Security Assertion Markup Language (SAML) Overview

IBM Identity and Access Management (IAM) Authentication

IBM Cloud Pak for Integration (CP4I) v2021.2 Administration References: