All nodes within an OpenShift cluster (both control plane/master and compute/worker nodes) require the ability to pull images from a container registry. The kubelet service on each node is responsible for fetching the correct container images to run the pods scheduled on it. This includes pods for core OpenShift services on the control plane nodes and application workloads on the worker nodes.

Furthermore, cluster features like Source-to-Image (S2I) builds run in pods on worker nodes. These build pods compile source code, create a new container image, and then must push that image to the registry. Therefore, worker nodes must have the capability to push images. Option D is the most accurate as it encompasses the necessary pull and push capabilities for a fully functional cluster.

A. Only the master nodes ever require registry access.

This is incorrect. Worker nodes run application pods and must pull their corresponding images from the registry.

B. Only the bastion node should be able to reach the registry.

This is incorrect. A bastion node is typically used to populate a private registry in a restricted network, but the cluster nodes must pull images directly from that registry to function.

C. While the bastion node pushes to the private registry, only the worker nodes pull images.

This is incorrect. Control plane (master) nodes also run containerized components (e.g., etcd, API server) and must pull their respective images from the registry.

1. Red Hat OpenShift Container Platform 4.14 Documentation

"About the internal image registry": This document explains the role of the registry and its interaction with cluster nodes. It states

"The OpenShift Container Platform registry is a core component that stores and manages container images. [...] Each node in the cluster needs to be able to pull images from the registry to run containers." This supports the requirement for all nodes to have pull access.

Source: Red Hat OpenShift 4.14 Documentation

Architecture -> Key concepts -> Image registry -> About the internal image registry.

2. Red Hat OpenShift Container Platform 4.14 Documentation

"Build strategies": This section details how builds operate within OpenShift. For Source-to-Image (S2I) builds

it states

"S2I produces a new image that incorporates the application source and is ready to run. S2I pushes the resulting image to the specified container image registry." Since builds execute in pods scheduled on cluster nodes (typically workers)

this confirms the requirement for nodes to have push access.

Source: Red Hat OpenShift 4.14 Documentation

Builds -> Build strategies.

3. Red Hat OpenShift Container Platform 4.14 Documentation

"Installing in a restricted network": This guide clarifies the roles of different hosts. It describes how a bastion host is used to mirror images to a private registry

after which all cluster nodes are configured with an ImageContentSourcePolicy to pull images from that private registry during and after installation. This explicitly shows that all cluster nodes

not just the bastion

require access.

Source: Red Hat OpenShift 4.14 Documentation

Installing -> Installing in a restricted network -> Mirroring the OpenShift Container Platform image repository.

The automated deployment of IBM Cloud Pak for Data on Microsoft Azure utilizes a specific command-line utility (cpd-azure). The official upgrade procedure requires downloading the latest version of this utility and executing the cpd-azure upgrade command from a command-line interface. This CLI tool orchestrates the entire upgrade process, managing the underlying Red Hat OpenShift Container Platform and the Cloud Pak for Data services.

A. GitHub Repo: The GitHub repository contains the source code and automation scripts, but it is not the execution tool itself; a CLI is used to run these scripts.

B. PowerShell: While PowerShell is a command-line shell, the cpd-azure utility is the specific tool used, which is run from a CLI, not exclusively PowerShell.

C. Cloud Providers Marketplace: The Azure Marketplace is used for the initial provisioning and deployment of the environment, not for performing in-place software version upgrades.

1. IBM Cloud Pak for Data 4.8 Documentation

"Upgrading Cloud Pak for Data on Microsoft Azure". This section explicitly states: "You can upgrade your Cloud Pak for Data on Microsoft Azure environment by running the cpd-azure command-line utility." It then details the steps

which involve using the cpd-azure upgrade command.

2. IBM Cloud Pak for Data 4.8 Documentation

"Installing Cloud Pak for Data on Microsoft Azure". The installation guide introduces the cpd-azure command-line utility as the primary tool for managing the environment

reinforcing its role in the lifecycle

including upgrades. The document states

"The cpd-azure command-line utility uses Terraform and Ansible to provision and install Cloud Pak for Data on Microsoft Azure."

To enable IBM Cloud Pak for Data to validate and trust internal servers that use custom TLS certificates, the platform's truststore must be updated with the company's custom Certificate Authority (CA) certificate. The official and documented procedure for this is to create a Kubernetes ConfigMap. This ConfigMap, typically named connection-ca-certs, holds the public CA certificate(s). The platform's services are configured to mount this ConfigMap and add the certificate to their truststores, allowing them to establish secure, validated connections to the internal servers.

A. A wildcard certificate is a server-side certificate for securing multiple subdomains, not a CA certificate used for validating other certificates.

B. The platform only needs the root and intermediate CA certificates to establish a chain of trust, not the specific certificate chains for every internal server.

C. While Secrets are used for sensitive data like private keys, the public part of a CA certificate is not secret and is distributed using a ConfigMap per IBM's documentation.

1. IBM Cloud Pak for Data 4.8 Documentation

"Importing a CA certificate on the Cloud Pak for Data platform." This official guide explicitly states: "To ensure that Cloud Pak for Data services can successfully connect to an internal service that uses a custom certificate

create a configmap called connection-ca-certs and add the CA certificate for the internal service to the configmap." It provides the exact oc create configmap command to perform this action.

2. IBM Cloud Pak for Data 4.8 Documentation

"Security and compliance." The section on managing certificates details the use of ConfigMaps for distributing public certificates and Secrets for private keys

reinforcing the correct use case for each Kubernetes object in the platform's security architecture.

This combination of features is fundamental to creating reusable and flexible DataStage jobs. Parameters, parameter sets, and environment variables allow developers to externalize configuration details (like file paths, database credentials, or processing logic switches) from the core job design. This enables a single job to be executed in different environments (development, testing, production) or with different inputs without modification. DataStage components, specifically shared containers, allow a sequence of stages and logic to be encapsulated into a single, reusable unit that can be embedded in multiple jobs, promoting modularity and ensuring consistency.

A. DataStage APIs are primarily for programmatic control, automation, and integration, not for making the internal job design reusable.

B. Connectors and stages are fundamental, pre-built building blocks, not features specifically designed by a user to create their own reusable logic patterns.

D. Dynamic Workload Management and ELT run mode are primarily features for performance optimization and resource management, not design reusability.

1. Parameters and Parameter Sets: The official IBM documentation states

"You can create parameter sets to store job parameters that you want to use in different jobs or in different instances of the same job." This directly supports their role in reusability and flexibility.

Source: IBM Cloud Pak for Data 4.8 Documentation

"Creating and using parameter sets".

2. Environment Variables: Environment variables are used to define configuration values outside of the job design

making jobs portable and flexible across different execution environments.

Source: IBM Cloud Pak for Data 4.8 Documentation

"Creating environment variables".

3. DataStage Components (Shared Containers): Shared containers are the primary mechanism for creating reusable logic components. The documentation notes

"You can use shared containers to make a reusable job component available to all the jobs in a project."

Source: IBM Cloud Pak for Data 4.8 Documentation

"Shared containers".

The predefined Data Engineer role in IBM Cloud Pak for Data is designed for users responsible for creating, managing, and populating data assets. According to the official IBM documentation, this role is explicitly granted a set of permissions to perform these tasks. Among the key permissions are the ability to Create projects, which provides an environment to build and run data integration jobs, and the ability to Manage data protection rules, which is essential for implementing data governance and ensuring data is handled according to organizational policies.

A. Monitor project workload: This permission is typically associated with administrative roles responsible for platform health and resource management, not the Data Engineer role's primary function.

D. Manage platform: This is a high-level administrative permission reserved for the Administrator role, granting comprehensive control over the Cloud Pak for Data platform.

E. Manage workflows: While data engineers build and use workflows (e.g., DataStage flows), "Manage workflows" is not a distinct platform-level permission assigned to this role; it's an activity performed within a project.

1. IBM Cloud Pak for Data 4.8 Documentation

"Predefined roles and permissions."

Section: Data Engineer

Content: This official documentation explicitly lists the permissions for the Data Engineer role. It states

"Users with the Data Engineer role can... Create projects... Manage data protection rules." This directly supports the selection of options B and C.

2. IBM Cloud Pak for Data 4.8 Documentation

"Managing users."

Section: User roles and permissions

Content: This section details the different levels of authorization within the platform. It distinguishes between platform-level permissions and permissions within a specific service or asset. The permissions to "Create projects" and "Manage data protection rules" are defined as platform-level permissions granted to the Data Engineer role

whereas "Manage platform" is reserved for the Administrator.

Data Protection Rules are a core component of the data governance framework within IBM Cloud Pak for Data. They are created and managed within the IBM Knowledge Catalog. These rules are then enforced by various data access services. IBM Data Virtualization is a key service that enforces these rules in real-time on virtualized assets, masking or filtering data based on user permissions. The Data Privacy service provides advanced masking capabilities, such as format-preserving redaction and obfuscation, which are essential for protecting personally identifiable information (PII) as described in the scenario. This combination of services represents the definition (IKC), advanced capability (Data Privacy), and enforcement (Data Virtualization) aspects of data protection.

A. Watson Discovery and Watson Assistant are primarily AI/NLP services and are not direct enforcers of data governance rules in the same way as data integration or virtualization tools.

B. While Data Refinery, Watson Pipelines, and Watson Studio tools do enforce these rules, this option omits the foundational service (IBM Knowledge Catalog) where rules are created and managed.

D. While DataStage, SPSS Modeler, and Python Notebooks are also enforcers of the rules, this option omits the core governance (IKC) and advanced privacy services essential to the process.

1. IBM Cloud Pak for Data Documentation - Data protection rules: "You create data protection rules in IBM Knowledge Catalog to identify the data to control and to specify the method of control... Data protection rules are enforced for a user when that user accesses an asset in a governed catalog... Examples of tools that enforce rules are Data Refinery

DataStage

SPSS Modeler

notebooks

and Data Virtualization." (Section: Data protection rules).

2. IBM Cloud Pak for Data Documentation - Masking data with Data Privacy: "The Data Privacy service provides advanced data masking to protect sensitive data... You can use advanced masking through data protection rules to mask data in projects and catalogs." (Section: Masking data with Data Privacy).

3. IBM Cloud Pak for Data Documentation - Governing virtual data: "When you virtualize data with Data Virtualization

you can add the virtual data assets to a governed catalog. Then you can use the data protection features of IBM Knowledge Catalog to protect your data." (Section: Governing virtual data).

The upgrade to IBM Cloud Pak for Data v4.7 required an export and import of governance data because the underlying metadata repository for Watson Knowledge Catalog (WKC), known as XMETA, underwent significant changes. This repository, which is based on a Db2 database, had its schema and structure altered in a way that was incompatible with a direct, in-place upgrade from previous versions. To accommodate these changes and ensure data integrity, the existing governance artifacts had to be extracted from the old repository structure and then imported into the newly structured repository post-upgrade.

A. Containers are ephemeral, but stateful applications like WKC use persistent volumes for data persistence. This is not the reason for the specific export/import requirement.

C. While the product evolves, the direct technical driver for this specific data migration task was the change in the data store, not the removal of components.

D. Catalog data is already managed on persistent storage (Persistent Volumes) in Cloud Pak for Data. The procedure was a migration, not an initial move to persistence.

1. IBM Cloud Pak for Data 4.7.0 Documentation

"Upgrading Watson Knowledge Catalog": The documentation for upgrading from version 4.6 to 4.7 explicitly states

"The upgrade process for Watson Knowledge Catalog includes backing up the Watson Knowledge Catalog data and restoring it to a new metadata repository." This confirms the creation of a new

altered repository

necessitating the export/import process. (Reference: IBM Documentation

Cloud Pak for Data 4.7

Upgrading > Upgrading from Version 4.6 > Upgrading services > Watson Knowledge Catalog

"Before you begin" section).

2. IBM Cloud Pak for Data 4.7.0 Documentation

"Exporting data from Watson Knowledge Catalog": This section details the wkc-import-export utility used for the migration. The documentation notes its use for "backing up and restoring or migrating Watson Knowledge Catalog assets between clusters of the same version or for the upgrade process." The need for such a utility during an upgrade points to underlying structural changes that prevent a simple automated data upgrade. (Reference: IBM Documentation

Cloud Pak for Data 4.7

Administering > Backing up and restoring > Exporting data from Watson Knowledge Catalog).

When installing Cloud Pak for Data from a cloud provider's marketplace, such as the Red Hat Marketplace, the automated process typically deploys the required operators and the Cloud Pak for Data control plane. However, this initial installation is considered "partial" because it does not automatically install the specific data and AI services (e.g., Watson Studio, Db2, DataStage). The architect must perform a subsequent manual step to install each desired service by creating and applying a custom resource (CR) for it. This two-phase approach is a known characteristic of this deployment method.

A. Cloud Pak for Data is explicitly designed to be deployed on existing OpenShift Container Platform clusters; this is a standard and supported installation pattern.

B. The installation of individual services is automated via their respective operators; however, the initiation of this process requires manual creation of custom resources after the platform is installed.

C. Cloud Pak for Data operators are designed to be co-located with and depend on the IBM Cloud Pak foundational services operators within the same cluster.

1. IBM Cloud Pak for Data 4.8 Documentation

"Installing Cloud Pak for Data from the Red Hat Marketplace." This official guide outlines the installation as a multi-step process. It states

"After you install the operators

you create a ZenService custom resource to install the Cloud Pak for Data control plane." It then specifies a separate

subsequent step: "After you install the control plane

you can install the services that you want to use." This confirms the initial installation is partial and requires further manual action for services.

2. IBM Cloud Pak for Data 4.8 Documentation

"Creating custom resources for Cloud Pak for Data services." This document details the manual procedure required after the control plane is running. It specifies

"To install a service

you must create a custom resource... on the Red Hat OpenShift Container Platform cluster." This reinforces that service installation is a distinct

manual step following the initial platform deployment.

IBM Data Virtualization accesses files in shared directories (network file systems) by using a remote connector. This connector is a Java-based application that is installed and run on a server within the remote data source's network. It acts as a secure gateway, allowing the Data Virtualization service, which runs on the Cloud Pak for Data cluster, to connect to and query data from file systems that are not directly accessible, such as those behind a firewall. This architecture enables the virtualization of data without moving it.

A. Adding a connection in the UI is part of the workflow, but it's a user action that relies on the pre-installed remote connector to function.

B. The service does not automatically scan networks for security and performance reasons; connections must be explicitly configured by an administrator.

C. The remote connector is a general-purpose agent and is not limited to the FTP protocol; it supports various types of remote data sources.

1. IBM Cloud Pak for Data 4.6 Documentation

"Adding data from files in Data Virtualization": This document states

"To virtualize data from files in a network file system

you must first install and configure a remote connector." This directly confirms that the remote connector is the required mechanism.

2. IBM Cloud Pak for Data 4.6 Documentation

"Installing the remote connector": This section describes the remote connector's purpose: "The Data Virtualization remote connector is a Java-based application that you can deploy on Windows or Linux®. The remote connector connects to data sources that are on-premises or in other clouds." This explains the role and nature of the connector used for accessing remote sources like shared directories.

IBM Match 360 is a master data management (MDM) service within IBM Cloud Pak for Data. Its primary function is to consolidate data from disparate sources to create a single, trusted 360-degree view of master data entities (e.g., customers, products). A key outcome of this process is the ability for data stewards and analysts to use the Master Data Explorer interface. This interface provides tools to search, view, and analyze the consolidated master data, including statistics about the data entities and graphical representations of their relationships, which allows users to explore and understand the master data.

A. This describes a conversational AI or natural language interface, which is the core function of IBM Watson Assistant, not IBM Match 360.

B. This describes data virtualization, where data is accessed from multiple sources without being moved. This capability is provided by the Watson Query service in Cloud Pak for Data.

C. This describes a business intelligence (BI) and analytics platform for creating AI-driven dashboards. This is the primary function of IBM Cognos Analytics.

1. IBM Cloud Pak for Data 4.8 Documentation

"IBM Match 360". This document outlines the core capabilities of Match 360. The section on "Exploring master data" states: "The master data explorer enables data engineers and data stewards to search

view

and analyze your master data... View a graph of the relationships between records." This directly supports the correct answer (D) by describing the analysis and exploration features.

2. IBM Cloud Pak for Data 4.8 Documentation

"Watson Query". The overview states: "With the Watson Query service on Cloud Pak for Data

you can have a single point of access to all your data sources... without having to move or replicate data." This confirms that option (B) describes Watson Query

not Match 360.

3. IBM Cloud Pak for Data 4.8 Documentation

"Watson Assistant". The service description states: "Build conversational interfaces into any application

device

or channel." This confirms that option (A) describes Watson Assistant.

4. IBM Cloud Pak for Data 4.8 Documentation

"Cognos Analytics". The overview describes the service as a "business intelligence solution that empowers users with AI-infused self-service capabilities" to "create compelling dashboards and reports." This confirms that option (C) describes Cognos Analytics.