C1000-130 Exam Dumps - IBM Cloud Pak for Integration V2021.2 Administration

In IBM Cloud Pak for Integration (CP4I) v2021.2, the Platform Navigator is the central UI for managing integration capabilities, including user and access control. To add users and user groups, the required permission level is Administrator.

User Management Capabilities:

The Administrator role in Platform Navigator has full access to user and group management functions, including:

Adding new users

Assigning roles

Managing access policies

RBAC (Role-Based Access Control) Enforcement:

CP4I enforces RBAC to restrict actions based on roles.

Only Administrators can modify user access, ensuring security compliance.

Access Control via OpenShift and IAM Integration:

User management in CP4I integrates with IBM Cloud IAM or OpenShift User Management.

The Administrator role ensures correct permissions for authentication and authorization.

Why is "Administrator" the Correct Answer?

Why Not the Other Options?Option

Reason for Exclusion

A. root

"root" is a Linux system user and not a role in Platform Navigator. CP4I does not grant UI-based root access.

B. Super-user

No predefined "Super-user" role exists in CP4I. If referring to an elevated user, it still does not match the Administrator role in Platform Navigator.

D. User

Regular "User" roles have view-only or limited permissions and cannot manage users or groups.

Thus, the Administrator role is the correct choice for adding users and user groups in Platform Navigator.

IBM Cloud Pak for Integration - Platform Navigator Overview

Managing Users in Platform Navigator

Role-Based Access Control in CP4I

OpenShift User Management and Authentication

IBM Cloud Pak for Integration (CP4I) v2021.2 Administration References:

Before installing Automation Assets in IBM Cloud Pak for Integration (CP4I) v2021.2, specific storage types must be provisioned to support asset data and metadata storage. These storage types are required to ensure proper functioning and persistence of Automation Assets in an OpenShift-based deployment.

Asset Data Storage (File RWX Volume)

This storage is used to store asset files, which need to be accessible by multiple pods simultaneously.

It requires a shared file storage with ReadWriteMany (RWX) access mode, ensuring multiple replicas can access the data.

Example: NFS (Network File System) or OpenShift persistent storage supporting RWX.

Asset Metadata Storage (Block RWO Volume)

This storage is used for managing metadata related to automation assets.

It requires a block storage with ReadWriteOnce (RWO) access mode, which ensures exclusive access by a single node at a time for consistency.

Example: IBM Cloud Block Storage, OpenShift Container Storage (OCS) with RWO mode.

C. Asset ephemeral storage - a Block RWX volume (Incorrect)

There is no requirement for ephemeral storage in Automation Assets. Persistent storage is necessary for both asset data and metadata.

D. Automation data storage - a Block RWO volume (Incorrect)

Automation Assets specifically require file-based RWX storage for asset data, not block-based storage.

E. Automation metadata storage - a File RWX volume (Incorrect)

The metadata storage requires block-based RWO storage, not file-based RWX storage.

IBM Cloud Pak for Integration Documentation: Automation Assets Storage Requirements

IBM OpenShift Storage Documentation: Persistent Storage Configuration

IBM Cloud Block Storage: Storage Requirements for CP4I

Explanation of Incorrect Options:IBM Cloud Pak for Integration (CP4I) v2021.2 Administration References:

The monitoring component of IBM Cloud Pak for Integration (CP4I) v2021.2 is built on Prometheus and Grafana. These tools are widely used for monitoring and visualization in Kubernetes-based environments like OpenShift.

Prometheus – A time-series database designed for monitoring and alerting. It collects metrics from different services and components running within CP4I, enabling real-time observability.

Grafana – A visualization tool that integrates with Prometheus to create dashboards for monitoring system performance, resource utilization, and application health.

A. Jaeger → Incorrect. Jaeger is used for distributed tracing, not core monitoring.

D. Logstash → Incorrect. Logstash is used for log processing and forwarding, primarily in ELK stacks.

E. Kibana → Incorrect. Kibana is a visualization tool but is not the primary monitoring tool in CP4I; Grafana is used instead.

IBM Cloud Pak for Integration Monitoring Documentation

Prometheus Official Documentation

Grafana Official Documentation

Explanation of Other Options:IBM Cloud Pak for Integration (CP4I) v2021.2 Administration References:

In IBM Cloud Pak for Integration (CP4I) v2021.2, when deploying API Connect on OpenShift or within the Cloud Pak for Integration framework, there are different deployment methods:

Single Top-Level Custom Resource (CR) – This method deploys all API Connect subsystems as a single unit, meaning they are managed together. Removing individual subsystems is not supported when using this deployment method. If you need to remove a subsystem, you must delete the entire API Connect instance.

Multiple Independent Custom Resources (CRs) – This method allows more granular control, enabling the deletion of individual subsystems without affecting the entire deployment.

Since the question specifically asks about API Connect deployed using a single top-level CR, it is not possible to delete individual subsystems. The entire deployment must be deleted and reconfigured if changes are required.

IBM Cloud Pak for Integration (CP4I) v2021.2 Administration References:

IBM API Connect v10 Documentation: IBM Docs - API Connect on OpenShift

IBM Cloud Pak for Integration Knowledge Center: IBM CP4I Documentation

API Connect Deployment Guide: Managing API Connect Subsystems

In IBM Cloud Pak for Integration (CP4I) v2021.2, which runs on Red Hat OpenShift, administrators often need to retrieve logs from pods to diagnose issues or monitor application behavior. The correct OpenShift CLI (oc) command to retrieve logs from a specific pod is:

sh

CopyEdit

oc logs

This command fetches the logs of a running container within the specified pod. If a pod has multiple containers, the -c flag is used to specify the container name:

sh

CopyEdit

oc logs -c

A. oc get logs → Incorrect. The oc get command is used to list resources (such as pods, deployments, etc.), but it does not retrieve logs.

C. oc describe → Incorrect. This command provides detailed information about a pod, including events and status, but not logs.

D. oc retrieve logs → Incorrect. There is no such command in OpenShift CLI.

IBM Cloud Pak for Integration Logging and Monitoring

Red Hat OpenShift CLI (oc) Reference

IBM Cloud Pak for Integration Troubleshooting

Explanation of Other Options:IBM Cloud Pak for Integration (CP4I) v2021.2 Administration References:

In IBM Cloud Pak for Integration (CP4I) v2021.2, when integrating LDAP (Lightweight Directory Access Protocol) for authentication, an account lockout policy can be configured to enhance security.

The account lockout policy is designed to prevent brute-force attacks by temporarily or permanently restricting user access after multiple failed login attempts.

If a user enters incorrect credentials multiple times, the account is locked based on the configured policy.

The lockout can be temporary (auto-unlock after a period) or permanent (admin intervention required).

This prevents attackers from guessing passwords through repeated login attempts.

The policy's main function is to restrict access after repeated failed attempts, ensuring security.

It helps mitigate brute-force attacks and unauthorized access.

LDAP enforces the lockout rules based on the organization's security settings.

How the Account Lockout Policy Works:Why Answer D is Correct?

A. It warns the administrator if multiple login attempts fail. → Incorrect

While administrators may receive alerts, the primary function of the lockout policy is to restrict access, not just warn the admin.

B. It prompts the user to change the password. → Incorrect

An account lockout prevents login rather than prompting a password change.

Password change prompts usually happen for expired passwords, not failed logins.

C. It deletes the user account. → Incorrect

Lockout disables access but does not delete the user account.

Explanation of Incorrect Answers:

IBM Cloud Pak for Integration Security & LDAP Configuration

IBM Cloud Pak Foundational Services - Authentication & User Management

IBM Cloud Pak for Integration - Managing User Access

IBM LDAP Account Lockout Policy Guide

IBM Cloud Pak for Integration (CP4I) v2021.2 Administration References:

In IBM Cloud Pak for Integration (CP4I) v2021.2, licensing is based on Virtual Processor Cores (VPCs), and it includes entitlement for OpenShift usage. However, OpenShift master nodes (control plane nodes) do not consume license entitlement, because:

OpenShift licensing only applies to worker nodes.

The master nodes (control plane nodes) manage cluster operations and scheduling, but they do not run user workloads.

IBM’s Cloud Pak licensing model considers only the worker nodes for licensing purposes.

Master nodes are essential infrastructure and are excluded from entitlement calculations.

IBM and Red Hat do not charge for OpenShift master nodes in Cloud Pak deployments.

A. CP4I licenses include entitlement for the entire OpenShift cluster that they run on, and the administrator can count against the master nodes. → ❌ Incorrect

CP4I licenses do cover OpenShift, but only for worker nodes where workloads are deployed.

Master nodes are excluded from licensing calculations.

C. The administrator will need to purchase additional OpenShift licenses to cover the master nodes. → ❌ Incorrect

No additional OpenShift licenses are required for master nodes.

OpenShift licensing only applies to worker nodes that run applications.

D. CP4I licenses include entitlement for 3 cores of OpenShift per core of CP4I. → ❌ Incorrect

The standard IBM Cloud Pak licensing model provides 1 VPC of OpenShift for 1 VPC of CP4I, not a 3:1 ratio.

Additionally, this applies only to worker nodes, not master nodes.

Explanation of Incorrect Answers:

IBM Cloud Pak Licensing Guide

IBM Cloud Pak for Integration Licensing Details

Red Hat OpenShift Licensing Guide

IBM Cloud Pak for Integration (CP4I) v2021.2 Administration References:

IBM Cloud Pak for Integration (CP4I) relies on IBM Common Services for authentication, licensing, and other foundational functionalities. The License Service API is a key component that enables the monitoring and reporting of software license usage across the cluster.

Authentication to the License Service APITo authenticate to the IBM License Service APIs, a token is required, which is stored in the ibm-licensing-token secret within the ibm-common-services namespace (where IBM Common Services are installed).

When Cloud Pak for Integration (installed in the cp4i namespace) needs to interact with the License Service API, it retrieves the authentication token from this secret in the ibm-common-services namespace.

The ibm-licensing-token secret is automatically created in the ibm-common-services namespace when the IBM License Service is deployed.

This token is required for authentication when querying licensing information via the License Service API.

Since IBM Common Services are installed in ibm-common-services, and the licensing service is part of these foundational services, authentication tokens are stored in this namespace rather than the cp4i namespace.

Why is Option D Correct?

Analysis of Other Options:Option

Correct/Incorrect

Reason

A. A token available in ibm-licensing-token secret in the cp4i namespace.

❌ Incorrect

The licensing token is stored in the ibm-common-services namespace, not in cp4i.

B. A password available in platform-auth-idp-credentials in the ibm-common-services namespace.

❌ Incorrect

This secret is related to authentication for the IBM Identity Provider (OIDC) and is not used for licensing authentication.

C. A password available in ibm-entitlement-key in the cp4i namespace.

❌ Incorrect

The ibm-entitlement-key is used for accessing IBM Container Registry to pull images, not for licensing authentication.

D. A token available in ibm-licensing-token secret in the ibm-common-services namespace.

✅ Correct

This is the correct secret that contains the required token for authentication to the License Service API.

IBM Documentation: IBM License Service Authentication and Tokens

IBM Knowledge Center: Managing License Service in OpenShift

IBM Redbooks: IBM Cloud Pak for Integration Deployment Guide

IBM Cloud Pak for Integration (CP4I) v2021.2 Administration References: