Question 1

Which action will reload all the default notifications and overwrite any customizations of notification templates?

Accepted Answer

B

Explanation: In IBM Security Verify, the template customization feature can be globally enabled or disabled. When an administrator disables this feature, the system reverts all notification templates to their original, default state. This action effectively overwrites and discards any customizations that have been made. If the feature is re-enabled later, the administrator must start over with the default templates to apply new customizations. This toggle acts as a global reset for all notification templates.

Question 2

The security team will allow OIDC to be used for Portal access. Which two OIDC provider types are available out of the box?

Accepted Answer

A, E

Explanation: When configuring a user registry for the Developer Portal in the IBM API Connect Cloud Manager or API Manager, you can use OpenID Connect (OIDC) for authentication. The system provides several "out of the box" templates for common OIDC providers to simplify the configuration process. These templates pre-populate certain required fields, such as endpoint URLs. Among the available options in the management user interface for creating an OIDC user registry are specific types for Azure and IBM Cloud, in addition to Google and a Generic option for all other providers.

Question 3

Which set of APIs should be used to register users in the Developer Portal, create applications, and subscribe to APIs?

Accepted Answer

B

Explanation: The Consumer APIs are designed specifically for application developers (API consumers) to programmatically interact with the Developer Portal. This API set exposes the core self-service functionalities that a developer would typically perform through the portal's user interface. These functions explicitly include registering new developer accounts, creating and managing client applications (which receive API keys), and creating subscriptions to associate those applications with specific API Products and Plans. The Developer Portal's front-end is a primary user of these backend Consumer APIs.

Question 4

Which of the following is true for Products?

Accepted Answer

A

Explanation: In IBM API Connect, a Product acts as a container for one or more APIs that are offered to developers as a single unit. A critical aspect of managing the API lifecycle is controlling its visibility. When a Product is published to a Catalog, its visibility can be configured to be either public (visible to all developer organizations) or restricted to a specific set of developer organizations, often referred to as communities. This allows API providers to create targeted offerings for different consumer groups or partners, ensuring that only authorized developers can discover and subscribe to certain APIs.

Question 5

Which two grant types are supported for native and third-party OAuth providers?

Accepted Answer

B, E

Explanation: IBM API Connect, when configured as a native or third-party OAuth provider, supports several standard OAuth 2.0 grant types. Among the options provided, "Application (client-credentials)" and "Implicit" are two of the supported grant types. The Application grant type, also known as client credentials, is used for machine-to-machine authentication where an application accesses its own resources. The Implicit grant type is a simplified flow intended for use by public clients, such as single-page web applications, where the access token is returned directly to the client.

Question 6

Which statement describes a requirement for monetizing a Product?

Accepted Answer

B

Explanation: Before any Products within a Provider Organization can be monetized in IBM API Connect, a billing integration resource must be configured. This integration connects the API Connect instance to a third-party payment processing system, such as Stripe. This is a foundational prerequisite because it establishes the mechanism for processing payments, managing subscriptions, and handling invoices for all monetized APIs within that organization. Without this billing integration, API Connect has no way to charge consumers for their API usage, making monetization impossible.

Question 7

How are Gateway extensions packaged to upload to the Gateways?

Accepted Answer

C

Explanation: Gateway extensions for IBM API Connect are packaged as .zip files for uploading. This archive must contain the extension manifest file, gateway-extension.yml, at its root level. All other required files, such as DataPower configuration objects or OpenAPI definitions referenced in the manifest, must also be included in the .zip file, maintaining their relative path structure. The gateway service in the API Manager UI specifically requires this .zip format for the upload process.

Question 8

Given the API Endpoint, "https://cor.client.rtc/savings/annual/", which statement is correct with default Catalog settings?

Accepted Answer

C

Explanation: With the factory (unchanged) Catalog configuration, the invoke URL that API Connect builds for every API is https:// / / The first path segment after the host is therefore always the Catalog short name. In the supplied endpoint “https://cor.client.rtc/savings/annual/”, the segment “savings” appears immediately after the host, so it represents the Catalog to which the API was published. The following segment (“annual”) is part of the API’s own base-path and any operation paths contained in that API.

Question 9

Which options would be selected to manage the lifecycle of a version of a Product?

Accepted Answer

B

Explanation: Managing the lifecycle of a Product version in IBM API Connect involves transitioning it through states such as published, deprecated, and retired. A critical part of this process is migrating existing subscriptions from an older version to a newer one. The "Set migration target" option is the specific function used to facilitate this transition. By setting a migration target on a deprecated or retiring Product version, you enable application developers to seamlessly move their subscriptions to the new, superseding version, thus managing the end-of-life phase for the old version.

Question 10

DRAG DROP
Select all that apply
Given an API that executes on an API Gateway service with pre-request, post-request, and error
global policies, what is the order that the different assemblies will be executed if the process fails
while executing the post-request?
C1000-138 practice exam questions

Accepted Answer

STEP 1: PRE-REQUEST GLOBAL POLICY
STEP 2: API ASSEMBLY
STEP 3: POST-REQUEST GLOBAL POLICY
STEP 4: ERROR GLOBAL POLICY

Explanation: In IBM API Connect, the API processing lifecycle follows a defined sequence. The pre-request global policy is executed first for any incoming request. If it completes successfully, the API-specific assembly is then processed. After the API assembly, the post-request global policy is executed. The scenario states that a failure occurs during the execution of the post-request global policy. This means the pre-request policy and the API assembly have already completed successfully. The failure in the post-request policy interrupts the normal flow and immediately triggers the error handling phase, causing the error global policy to be executed to manage the exception.

Question 11

A User registry was created in the Cloud Manager. In order for the registry to be used on the Developer Portal, what must be completed?

Accepted Answer

A

Explanation: In IBM API Connect, a Developer Portal is always associated with a specific Catalog. User Registries are defined globally in the Cloud Manager but must be explicitly enabled for each Catalog where they will be used for developer authentication. This configuration is done within the Catalog's settings, specifically in the "Developer Onboarding" section. This step links the User Registry to the Catalog, thereby making it available for developers to use when signing up or logging into that Catalog's associated Developer Portal.

Question 12

What can be done to make sure all errors are caught within an assembly?

Accepted Answer

B

Explanation: In an IBM API Connect assembly, the most robust method to ensure all errors are handled is to implement a default catch block. A catch block can be configured to handle specific error names (cases). However, by configuring a catch block without specifying any particular cases, it functions as a "catch-all" or default error handler. This ensures that any error occurring during the assembly execution that is not caught by a more specific catch block will be processed by this default catch, preventing unhandled exceptions and providing a consistent error management strategy.

Question 13

Which API Event Record field indicates N/A when a client ID is not used or is invalid on the API?

Accepted Answer

C

Explanation: In IBM API Connect, an API call is associated with a specific Product through the application's subscription, which is identified by the clientid. When an API call is made without a clientid or with an invalid one, the system cannot determine which Product the application is subscribed to. Consequently, the productname field in the API event record, which is used for analytics and monitoring, cannot be populated with the correct Product name and is therefore set to "N/A" to indicate this unresolved association.

Question 14

The GraphQL developer incorporated a field that should not be available for introspection or validation by the client. How would the API developer obfuscate the field so clients will not view them?

Accepted Answer

B

Explanation: In IBM API Connect, the @hide directive is the designated method for modifying a GraphQL schema to prevent specific fields or types from being exposed to the client. Applying this directive to a field in the schema definition ensures that it is omitted from the schema served by the API gateway. Consequently, the field will not appear in introspection queries and will be rejected by the validator if a client attempts to include it in a query, effectively hiding it.

Question 15

How can an application developer create a better app using APIs?

Accepted Answer

A
CORRECT ANSWER: A. BY USING MULTIPLE APIS TO CREATE COMPOSITE APPS TO GET EXTRA VALUE.

Explanation: The primary advantage of using APIs is the ability to compose new applications by integrating functionalities and data from various independent services. This approach, often called creating "mashups" or composite applications, allows developers to build feature-rich solutions more rapidly than building everything from scratch. By combining multiple APIs, a developer can create a new, synergistic value proposition that exceeds the capabilities of any single, constituent service. This is a fundamental principle of the API economy, enabling innovation and accelerating development.

Free IBM C1000-138 Actual Exam Questions