IBM IBM Cloud Pak for Integration V2021.2 Administration C1000-130 Exam Dumps: Updated Questions & Answers (October 2025)

IBM API Connect, as part of IBM Cloud Pak for Integration (CP4I), supports various deployment topologies, including Active/Active and Active/Passive configurations across multiple data centers. Let's analyze the provided topology carefully:

Backup Strategy (Option A - Correct)

The API Manager and Developer Portal components are stateful and require regular backups.

Since the topology spans across two sites, these backups should be replicated to the second site to ensure disaster recovery (DR) and high availability (HA).

This aligns with IBM’s best practices for multi-data center deployment of API Connect.

Deployment Mode for API Manager & Portal (Option B - Incorrect)

The question suggests that API Manager and Portal are deployed across two sites.

If it were an Active/Passive deployment, only one site would be actively handling requests, while the second remains idle.

However, in IBM’s recommended architectures, API Manager and Portal are usually deployed in an Active/Active setup with proper failover mechanisms.

Cluster Type (Option C - Incorrect)

A distributed Kubernetes cluster across multiple sites would require an underlying multi-cluster federation or synchronization.

IBM API Connect is usually deployed on separate Kubernetes clusters per data center, rather than a single distributed cluster.

Therefore, this topology does not represent a distributed Kubernetes cluster across sites.

Failover Behavior (Option D - Incorrect)

Kubernetes cannot automatically detect failures in Data Center 1 and migrate services to Data Center 2 unless specifically configured with multi-cluster HA policies and disaster recovery.

Instead, IBM API Connect HA and DR mechanisms would handle failover via manual or automated orchestration, but not via Kubernetes native services.

Gateway and Analytics Deployment (Option E - Correct)

API Gateway and Analytics services are typically deployed in Active/Active mode for high availability and load balancing.

This means that traffic is dynamically routed to the available instance in both sites, ensuring uninterrupted API traffic even if one data center goes down.

Final Answer:✅ A. Regular backups of the API Manager and Portal have to be taken, and these backups should be replicated to the second site.✅ E. This represents an Active/Active deployment for Gateway and Analytics services.

IBM API Connect Deployment Topologies

IBM Documentation – API Connect Deployment Models

High Availability and Disaster Recovery in IBM API Connect

IBM API Connect HA & DR Guide

IBM Cloud Pak for Integration Architecture Guide

IBM Cloud Pak for Integration Docs

References:

The Operations Dashboard in IBM Cloud Pak for Integration (CP4I) v2021.2 is used for monitoring and managing integration components. When securing data at rest, the supported encryption method in CP4I includes Portworx, which provides enterprise-grade storage and encryption solutions.

Portworx is a Kubernetes-native storage solution that supports encryption of data at rest.

It enables persistent storage for OpenShift workloads, including Cloud Pak for Integration components.

Portworx provides AES-256 encryption, ensuring that data at rest remains secure.

It allows for role-based access control (RBAC) and Key Management System (KMS) integration for secure key handling.

Why Option B (Portworx) is Correct:

A. AES128 → Incorrect

While AES encryption is used for data protection, AES128 is not explicitly mentioned as the standard for Operations Dashboard storage encryption.

AES-256 is the preferred encryption method when using Portworx or IBM-provided storage solutions.

C. base64 → Incorrect

Base64 is an encoding scheme, not an encryption method.

It does not provide security for data at rest, as base64-encoded data can be easily decoded.

D. NFS → Incorrect

Network File System (NFS) does not inherently provide encryption for data at rest.

NFS can be used for storage, but additional encryption mechanisms are needed for securing data at rest.

Explanation of Incorrect Answers:

IBM Cloud Pak for Integration Security Best Practices

Portworx Data Encryption Documentation

IBM Cloud Pak for Integration Storage Considerations

Red Hat OpenShift and Portworx Integration

IBM Cloud Pak for Integration (CP4I) v2021.2 Administration References:

https://www.ibm.com/docs/en/cloud-paks/cp-integration/2020.3?topic=configuration-installation

In IBM API Connect, an Authentication URL user registry is a type of user registry that allows authentication by delegating user verification to an external identity provider. This is typically used when API Connect needs to integrate with custom authentication mechanisms, such as OAuth, OpenID Connect, or SAML-based identity providers.

When configured, API Connect does not store user credentials locally. Instead, it redirects authentication requests to the specified external authentication URL, and if the response is valid, the user is authenticated.

The Authentication URL user registry is specifically designed to reference an external custom identity provider.

This enables API Connect to integrate with external authentication systems like LDAP, Active Directory, OAuth, and OpenID Connect.

It is commonly used for single sign-on (SSO) and enterprise authentication strategies.

Why Answer D is Correct:

A. It authenticates Developer Portal sites. → Incorrect

The Developer Portal uses its own authentication mechanisms, such as LDAP, local user registries, and external identity providers, but the Authentication URL user registry does not authenticate Developer Portal users directly.

B. It authenticates users defined in a provider organization. → Incorrect

Users in a provider organization (such as API providers and administrators) are typically authenticated using Cloud Manager or an LDAP-based user registry, not via an Authentication URL user registry.

C. It authenticates Cloud Manager users. → Incorrect

Cloud Manager users are typically authenticated via LDAP or API Connect’s built-in user registry.

The Authentication URL user registry is not responsible for Cloud Manager authentication.

Explanation of Incorrect Answers:

IBM API Connect User Registry Types

IBM API Connect Authentication and User Management

IBM Cloud Pak for Integration Documentation

IBM Cloud Pak for Integration (CP4I) v2021.2 Administration References:

https://www.ibm.com/docs/SSMNED_v10/com.ibm.apic.cmc.doc/capic_cmc_registries_concepts.html

In IBM Cloud Pak for Integration (CP4I) v2021.2, only a Cluster Administrator has the necessary permissions to replace default keys and certificates. This is because modifying security components such as TLS certificates affects the entire cluster and requires elevated privileges.

Access to OpenShift and Cluster-Wide Resources:

The Cluster Administrator role has full administrative control over the OpenShift cluster where CP4I is deployed.

Replacing keys and certificates often involves interacting with OpenShift secrets and security configurations, which require cluster-wide access.

Management of Certificates and Encryption:

In CP4I, certificates are used for securing communication between integration components and external systems.

Updating or replacing certificates requires privileges to modify security configurations, which only a Cluster Administrator has.

Control Over Security Policies:

CP4I security settings, including certificates, are managed at the cluster level.

Cluster Administrators ensure compliance with security policies, including certificate renewal and management.

Why is "Cluster Administrator" the Correct Answer?

Why Not the Other Options?Option

Reason for Exclusion

A. Cluster Manager

This role is typically responsible for monitoring and managing cluster resources but does not have full administrative control over security settings.

B. Super-user

There is no predefined "Super-user" role in CP4I. If referring to an elevated user, it would still require a Cluster Administrator's permissions to replace certificates.

C. System User

System users often refer to service accounts or application-level users that lack the required cluster-wide security privileges.

Thus, the Cluster Administrator role is the only one with the required access to replace default keys and certificates in Cloud Pak for Integration.

IBM Cloud Pak for Integration Security Overview

Managing Certificates in Cloud Pak for Integration

OpenShift Cluster Administrator Role

IBM Cloud Pak for Integration - Replacing Default Certificates

IBM Cloud Pak for Integration (CP4I) v2021.2 Administration References:

In IBM Cloud Pak for Integration (CP4I) v2021.2, which runs on OpenShift Container Platform (OCP), administrators can configure log forwarding to an external log aggregator (e.g., Elasticsearch, Splunk, or Loki).

OCP uses Fluentd as the log collector, and when log forwarding fails due to the external logging aggregator becoming unavailable, the following happens:

Fluentd buffers the logs in memory (up to a defined limit).

If the buffer reaches its maximum size, OCP follows its default log management policy:

Older logs are rotated and deleted to make space for new logs.

This prevents excessive storage consumption on the OpenShift cluster.

This behavior ensures that the logging system does not stop functioning but rather manages storage efficiently by deleting older logs once the buffer is full.

Log rotation is a default behavior in OCP when storage limits are reached.

If logs cannot be forwarded and the buffer is full, OCP deletes old logs to continue operations.

This is a standard logging mechanism to prevent resource exhaustion.

Why Answer A is Correct?

B. OCP stores the logs in a temporary PVC. → Incorrect

OCP does not automatically store logs in a Persistent Volume Claim (PVC).

Logs are buffered in memory and not redirected to PVC storage unless explicitly configured.

C. OCP extends the buffer size and resumes log collection. → Incorrect

The buffer size is fixed and does not dynamically expand.

Instead of increasing the buffer, older logs are rotated out when the limit is reached.

D. The Fluentd daemon is forced to stop. → Incorrect

Fluentd does not stop when the external log aggregator is down.

It continues collecting logs, buffering them until the limit is reached, and then follows log rotation policies.

Explanation of Incorrect Answers:

IBM Cloud Pak for Integration Logging and Monitoring

OpenShift Logging Overview

Fluentd Log Forwarding in OpenShift

OpenShift Log Rotation and Retention Policy

IBM Cloud Pak for Integration (CP4I) v2021.2 Administration References:

In IBM Cloud Pak for Integration (CP4I) v2021.2, when integrating LDAP (Lightweight Directory Access Protocol) for authentication, an account lockout policy can be configured to enhance security.

The account lockout policy is designed to prevent brute-force attacks by temporarily or permanently restricting user access after multiple failed login attempts.

If a user enters incorrect credentials multiple times, the account is locked based on the configured policy.

The lockout can be temporary (auto-unlock after a period) or permanent (admin intervention required).

This prevents attackers from guessing passwords through repeated login attempts.

The policy's main function is to restrict access after repeated failed attempts, ensuring security.

It helps mitigate brute-force attacks and unauthorized access.

LDAP enforces the lockout rules based on the organization's security settings.

How the Account Lockout Policy Works:Why Answer D is Correct?

A. It warns the administrator if multiple login attempts fail. → Incorrect

While administrators may receive alerts, the primary function of the lockout policy is to restrict access, not just warn the admin.

B. It prompts the user to change the password. → Incorrect

An account lockout prevents login rather than prompting a password change.

Password change prompts usually happen for expired passwords, not failed logins.

C. It deletes the user account. → Incorrect

Lockout disables access but does not delete the user account.

Explanation of Incorrect Answers:

IBM Cloud Pak for Integration Security & LDAP Configuration

IBM Cloud Pak Foundational Services - Authentication & User Management

IBM Cloud Pak for Integration - Managing User Access

IBM LDAP Account Lockout Policy Guide

IBM Cloud Pak for Integration (CP4I) v2021.2 Administration References:

When deploying IBM Cloud Pak for Integration (CP4I) v2021.2 on AWS, an administrator has multiple options for managing the OpenShift layer. However, if the goal is to avoid managing OpenShift manually, the best approach is to deploy CP4I onto AWS ROSA (Red Hat OpenShift Service on AWS).

Managed OpenShift: ROSA is a fully managed OpenShift service, meaning AWS and Red Hat handle the deployment, updates, patching, and infrastructure maintenance of OpenShift.

Simplified Deployment: Administrators can directly deploy CP4I on ROSA without worrying about installing and maintaining OpenShift on AWS manually.

IBM Support: IBM Cloud Pak solutions, including CP4I, are certified to run on ROSA, ensuring compatibility and optimized performance.

Integration with AWS Services: ROSA allows seamless integration with AWS-native services like S3, RDS, and IAM for authentication and storage.

Why is AWS ROSA the Best Choice?

B. Installer-provisioned Infrastructure on EC2 – This requires manual setup of OpenShift on AWS EC2 instances, increasing operational overhead.

C. CP4I Quick Start on AWS – IBM provides a Quick Start guide for deploying CP4I, but it assumes you are managing OpenShift yourself. This does not eliminate OpenShift management.

D. Terraform scripts from IBM’s GitHub – These scripts help automate provisioning but still require the administrator to manage OpenShift themselves.

Why Not the Other Options?Thus, for a fully managed OpenShift solution on AWS, AWS ROSA is the best option.

IBM Cloud Pak for Integration Documentation

IBM Cloud Pak for Integration on AWS ROSA

Deploying Cloud Pak for Integration on AWS

Red Hat OpenShift Service on AWS (ROSA) Overview

IBM Cloud Pak for Integration (CP4I) v2021.2 Administration References:

In IBM App Connect, which is part of IBM Cloud Pak for Integration (CP4I), callable flows enable integration between different environments, including on-premises systems and cloud-based integration solutions deployed in an OpenShift cluster.

To facilitate this connectivity, two critical resources are used:

The Connectivity Agent acts as a bridge between cloud-hosted App Connect instances and on-premises integration servers.

It enables secure bidirectional communication by allowing callable flows to connect between cloud-based and on-premise integration servers.

This is essential for hybrid cloud integrations, where some components remain on-premises for security or compliance reasons.

The Routing Agent directs incoming callable flow requests to the appropriate App Connect integration server based on configured routing rules.

It ensures low-latency and efficient message routing between cloud and on-premise systems, making it a key component for hybrid integrations.

1. Connectivity Agent (✅ Correct Answer)2. Routing Agent (✅ Correct Answer)

Why the Other Options Are Incorrect?Option

Explanation

Correct?

A. Sync server

❌ Incorrect – There is no "Sync Server" component in IBM App Connect. Synchronization happens through callable flows, but not via a "Sync Server".

❌

C. Kafka sync

❌ Incorrect – Kafka is used for event-driven messaging, but it is not required for callable flows between cloud and on-premises environments.

❌

D. Switch server

❌ Incorrect – No such component called "Switch Server" exists in App Connect.

❌

Final Answer:✅ B. Connectivity agent✅ E. Routing agent

IBM App Connect - Callable Flows Documentation

IBM Cloud Pak for Integration - Hybrid Connectivity with Connectivity Agents

IBM App Connect Enterprise - On-Premise and Cloud Integration

IBM Cloud Pak for Integration (CP4I) v2021.2 Administration References:

Before installing Automation Assets in IBM Cloud Pak for Integration (CP4I) v2021.2, specific storage types must be provisioned to support asset data and metadata storage. These storage types are required to ensure proper functioning and persistence of Automation Assets in an OpenShift-based deployment.

Asset Data Storage (File RWX Volume)

This storage is used to store asset files, which need to be accessible by multiple pods simultaneously.

It requires a shared file storage with ReadWriteMany (RWX) access mode, ensuring multiple replicas can access the data.

Example: NFS (Network File System) or OpenShift persistent storage supporting RWX.

Asset Metadata Storage (Block RWO Volume)

This storage is used for managing metadata related to automation assets.

It requires a block storage with ReadWriteOnce (RWO) access mode, which ensures exclusive access by a single node at a time for consistency.

Example: IBM Cloud Block Storage, OpenShift Container Storage (OCS) with RWO mode.

C. Asset ephemeral storage - a Block RWX volume (Incorrect)

There is no requirement for ephemeral storage in Automation Assets. Persistent storage is necessary for both asset data and metadata.

D. Automation data storage - a Block RWO volume (Incorrect)

Automation Assets specifically require file-based RWX storage for asset data, not block-based storage.

E. Automation metadata storage - a File RWX volume (Incorrect)

The metadata storage requires block-based RWO storage, not file-based RWX storage.

IBM Cloud Pak for Integration Documentation: Automation Assets Storage Requirements

IBM OpenShift Storage Documentation: Persistent Storage Configuration

IBM Cloud Block Storage: Storage Requirements for CP4I

Explanation of Incorrect Options:IBM Cloud Pak for Integration (CP4I) v2021.2 Administration References:

In IBM Cloud Pak for Integration (CP4I), IBM MQ Native High Availability (NativeHA) is a feature that enables automated failover and redundancy by maintaining multiple replicas of an MQ queue manager.

When using NativeHA, licensing in CP4I is calculated based on the total number of VPCs (Virtual Processor Cores) consumed by all MQ instances, including both active and standby replicas.

IBM MQ NativeHA uses a multi-replica setup, meaning there are multiple queue manager instances running simultaneously for redundancy.

Licensing in CP4I is based on the total CPU consumption of all running MQ replicas, not just the active instance.

Therefore, the administrator must ensure that all HA replicas are accounted for in their license entitlement.

Why Option B is Correct:

A. No licenses, because only RDQM is supported on CP4I. (Incorrect)

IBM MQ NativeHA is fully supported on CP4I alongside RDQM (Replicated Data Queue Manager). NativeHA is actually preferred over RDQM in containerized OpenShift environments.

C. A different license from the standard CP4I license must be purchased from IBM to use the NativeHA feature. (Incorrect)

No separate license is required for NativeHA – it is covered under the CP4I licensing model.

D. The administrator can use their pool of CP4I licenses. (Incorrect)

Partially correct but incomplete – while the administrator can use their CP4I licenses, they must ensure that all HA replicas are included in the license calculation, not just the active instance.

Analysis of the Incorrect Options:

IBM MQ Native High Availability Licensing

IBM Cloud Pak for Integration Licensing Guide

IBM MQ on CP4I - Capacity Planning and Licensing

IBM Cloud Pak for Integration (CP4I) v2021.2 Administration References: