Free C1000-138 sample questions

Correct answer: Apply a Redact policy in the API assembly's response flow, configured to remove the sensitive fields. This will ensure they are stripped before the global post-request logging policy is triggered.

The Redact policy is specifically designed for removing or masking sensitive data from a message payload. By placing it in the API's assembly flow, it will process the message before control is passed to any global policies. Since the logging is a post-request (meaning response flow) global policy, redacting the data in the API's response flow is the correct and most efficient solution. GatewayScript could achieve this but is more complex to implement and maintain. A Map policy is for transformation, not redaction. The Redact policy cannot be applied to the Activity Log policy directly.

Correct answer: Create a separate Catalog for each LOB within a single Provider Organization. Use Syndication to share the published 'Customer Profile' Products from a central 'master' Catalog to each LOB's Catalog.

This scenario is the primary use case for Syndication. Creating separate Catalogs provides the required isolation for each LOB, including a distinct developer portal and consumer base. Syndication allows a Product published in one Catalog (the central master) to be shared and made available in other Catalogs (the LOBs). This avoids duplicating the API definitions and allows for centralized management of the core APIs while enabling decentralized consumption. Spaces provide isolation but share a single developer portal, which does not meet the requirement.

Correct answer: The `redirect_uri` included in the token request does not exactly match the `redirect_uri` used in the initial authorization request.

According to the OAuth 2.0 specification (RFC 6749), if the `redirect_uri` parameter was included in the initial authorization request, it MUST also be included in the token request, and the values must be identical. A mismatch is a common cause for an `invalid_grant` error, as it prevents authorization code injection attacks. While other issues can cause this error, the `redirect_uri` mismatch is a frequent and subtle problem in this specific flow.

Correct answer: Add `format: password` to the property definition.

In the YAML definition file for a user-defined policy, when defining a property in the `properties` section, you can add `format: password` to a property of `type: string`. This instructs the API Connect UI to render the input field as a password field (obfuscating the value with asterisks or dots) and to handle the value as a secret.

Correct answer: Define a property in the API's OpenAPI definition (e.g., `backend_url`). Set a different value for this property in each environment's Catalog settings. Reference this property in the Invoke policy.

This is the standard best practice for managing environment-specific configurations. By defining a property in the API definition, you create a variable. This property can then be assigned a specific value at the Catalog level. When the API is published to the 'Development' Catalog, it uses the 'Development' value. When published to 'Production', it uses the 'Production' value. The Invoke policy in the assembly then references this property (e.g., `$(backend_url)`), allowing a single API definition to be promoted across environments without modification.

Correct answer: False

The statement is false. The 'Deprecated' state serves as a notice to consumers that the Product will be retired in the future. Existing subscriptions remain active, and API calls will continue to succeed. However, no new applications can subscribe to the Plans within the deprecated Product. This provides a grace period for consumers to migrate to a new version before the Product is eventually 'Retired', at which point calls would fail.

Correct answer: Edit the GraphQL schema within the API definition in API Connect and apply the `@hide` directive to the desired types or fields.

API Connect provides the `@hide` directive as a specific feature for GraphQL API proxies. By adding this directive to fields or types in the schema within the API definition, API Connect will automatically remove them from the schema exposed to consumers. This prevents those fields from being included in introspection queries and invalidates any incoming requests that attempt to query them, effectively hiding them without backend changes.

Correct answers: A Keystore containing the private key and public certificate for the API Gateway.; A Truststore containing the CA certificates used to validate client certificates.

Correct answer: `apic validate`

The `apic validate` command is specifically designed for local validation of project files. When run from the project directory, it checks the syntax and structure of the `product.yaml` and any referenced `api.yaml` files, reporting errors or warnings without requiring a connection to an API Connect server. This is a crucial step in a local development workflow before attempting to publish.

Correct answer: Navigate to the partner's application subscription and override the rate limit defined in the Plan with a custom, higher limit for that specific subscription.

API Connect allows for plan overrides at the individual subscription level. This is the most efficient and targeted way to grant a specific application a different rate limit than the one defined in the general Plan. It avoids the overhead of creating new Products or Plans and doesn't require the consumer to make any changes on their end.