Free C1000-138 Practice Test Questions and Answers (2026) | Cert Empire Practice Questions

Gateway extensions for IBM API Connect are packaged as .zip files for uploading. This archive must contain the extension manifest file, gateway-extension.yml, at its root level. All other required files, such as DataPower configuration objects or OpenAPI definitions referenced in the manifest, must also be included in the .zip file, maintaining their relative path structure. The gateway service in the API Manager UI specifically requires this .zip format for the upload process.

1. IBM Documentation for API Connect v10.0.5.x: "Creating a gateway extension". This document states

"Package the extension into a .zip file. The .zip file must contain the extension manifest file

gateway-extension.yml

at the root level."

2. IBM Documentation for API Connect v10.0.5.x: "Configuring a gateway service". In the section on managing gateway extensions

the procedure specifies

"To upload a gateway extension

click Upload. Browse to the extension .zip file and click Open."

In IBM API Connect, rate limits are configured at two primary levels to govern API consumption. First, they are defined within a Plan, which is part of a Product. This allows for creating different service tiers (e.g., Basic, Premium) with distinct rate limits that application developers can subscribe to. Second, a default rate limit can be set at the Catalog level. This Catalog-level limit is automatically applied to any Plan within that Catalog that does not have its own specific rate limit defined, ensuring a baseline level of governance and protection for all published APIs.

1. IBM API Connect v10.0.x Documentation

"Editing a Product draft": This document details the configuration of Plans within a Product. In the "Plans" section

it states

"In the Rate limits section

you can add new rate limits for the plan... Each rate limit has a name

is specified as a value per time interval...". This confirms that rate limits are defined at the Plan level.

2. IBM API Connect v10.0.x Documentation

"Creating and configuring Catalogs": This source describes the settings available for a Catalog. Under the "Catalog settings" tab details

it specifies the "Default plan rate limit" option and explains

"Apply a default rate limit to all plans in this Catalog. The default rate limit is not enforced for a plan if that plan has its own rate limit." This confirms that a default rate limit can be defined at the Catalog level.

The API Gateway is the dedicated runtime component in the IBM API Connect architecture responsible for processing and controlling API traffic. It acts as a proxy, intercepting all incoming API requests. At this point, it enforces the policies that have been defined in the API Manager, such as security checks (e.g., OAuth, API key validation), rate limiting, and traffic logging. After successful policy enforcement, the Gateway routes the request to the appropriate backend service. It is the data plane component where policies are actively applied to live traffic.

1. IBM API Connect v10.x Documentation: In the "API Connect components" section

the role of the Gateway is explicitly defined: "The Gateway is the component that enforces runtime policies to secure and control API traffic. The Gateway proxies and processes the API requests and responses."

Source: IBM. (2023). API Connect components. IBM API Connect 10.0.x Documentation. Retrieved from the IBM Knowledge Center. (Section: "API Connect components" > "Gateway").

2. IBM Redbooks: This publication details the architecture

stating

"The API gateway is the policy enforcement point that secures and controls API traffic. It is the component that handles the API traffic at run time."

Source: IBM Redbooks. (2018). IBM API Connect 2018.x Essentials. (SG24-8353-00). Page 10

Section 1.3.1 "API Connect components".

3. IBM API Connect v10.x Documentation: The overview section further clarifies the separation of duties: "You use the API Manager user interface to manage APIs for your provider organizations... The API Gateway is responsible for routing the API traffic and for the enforcement of the API security policies."

Source: IBM. (2023). API Connect overview. IBM API Connect 10.0.x Documentation. Retrieved from the IBM Knowledge Center. (Section: "API Connect overview").

The Developer Portal in IBM API Connect serves as the interface for API consumers. A member of a "Consumer organization," often called an Application Developer, is the user who registers on the portal. Their primary task is to create a client application entity within the portal. This registered application is then used to subscribe to available API Products, which in turn grants the application the necessary credentials (e.g., Client ID and Secret) to invoke the APIs. The Provider organization creates and publishes the APIs, while the Consumer organization builds applications that use them.

1. IBM API Connect v10.x Knowledge Center

"API Connect overview": This document outlines the key user roles. It states

"Application developers use the APIs that are created by API developers. Application developers work for an organization that wants to gain access to your APIs... They register their applications

then subscribe to the APIs... in the Developer Portal." This clearly defines the consumer's role in creating applications.

Reference: IBM API Connect v10.x Knowledge Center > API Connect overview > API Connect user roles.

2. IBM API Connect v10.x Knowledge Center

"Using the Developer Portal": This section details the workflow for an application developer. The first steps involve signing into the Developer Portal and then creating an application. It specifies

"To use an API

you register the client application that will access the API."

Reference: IBM API Connect v10.x Knowledge Center > Developing and managing APIs and Products > Using the Developer Portal > Registering an application.

3. IBM API Connect v10.x Knowledge Center

"Managing consumer organizations": This page explains that Provider organizations manage the consumer organizations that will use their APIs. It states

"In the API Manager UI

you can create and manage the consumer organizations that will sign up to your Developer Portal to use your APIs." This reinforces the distinction between the provider and the consumer who creates the application.

Reference: IBM API Connect v10.x Knowledge Center > Administering your environment > Managing consumer organizations.

In any API Connect policy YAML—custom or global—the identifier line (policy:, global-policy:, assembly-flow:, and so on) carries a version string that must exactly match the version declared later in info.version. If the two values differ, the Gateway rejects the policy at load time. Therefore, when you create a global-policy YAML to alter default rate-limit behaviour, you must ensure that the version number at the start of the file is identical to the version inside the info section.

1. IBM API Connect 10.0.x Documentation

“Creating a global policy” – Note on matching version numbers (https://www.ibm.com/docs/api-connect/10.0.x

Section: Creating a global policy

para. 3).

2. IBM API Connect 10.0.x Gateway Extension Dev Guide

“YAML file structure for policies”

Table “Required fields”

note 2 — version in header must equal info.version.

3. IBM API Connect 10.0.x

Custom Policy Reference

“full-custom flag”

states it is only valid for custom (non-global) policies

not global policies.

In the IBM API Connect Developer Portal, there are two distinct methods for establishing a new Consumer organization. The first method is a direct administrative action where a user with appropriate permissions creates the organization, specifying both its title and assigning an existing user as the owner. The second method is an invitation-based workflow, where an administrator invites a new user via email. Upon accepting the invitation and completing the registration process, this new user is prompted to create their own organization and provide its title, thereby becoming its owner.

1. IBM API Connect v10.x Documentation

Administering consumer organizations: This page explicitly outlines the two methods. It states

"You can create a consumer organization in the following ways: You can create the consumer organization yourself

and assign an owner... You can invite a user to become an organization owner. The user then creates the consumer organization when they accept the invitation."

2. IBM API Connect v10.x Documentation

Creating a consumer organization: This section details the direct creation method

showing that the administrator must complete the "Organization title" and "Organization owner" fields. This directly supports option D.

3. IBM API Connect v10.x Documentation

Inviting a new consumer organization owner: This page describes the invitation process. It clarifies the user's role: "The user must complete the Organization field to specify the title of their new consumer organization." This directly supports option E.

Enabling Spaces in an IBM API Connect Catalog creates distinct partitions for managing the API lifecycle. This partitioning extends to all consumer-related entities and their management. Consequently, consumer organizations, the applications they register, the subscriptions those applications make to Products, the associated approval workflows, and the resulting analytics data are all scoped to and managed within a specific Space. This allows different teams to manage their own APIs and consumer communities independently within a single Catalog, providing a multi-tenant-like experience.

1. IBM API Connect v10.x Documentation

"Using Spaces in Catalogs": "When Spaces are enabled in a Catalog

API provider teams can manage their APIs and Products in a dedicated Space... allowing each team to manage its own API consumers... When an application developer signs in to the Developer Portal

they select which Space to work in. The application developer can register applications only in the Spaces that they have access to

and can subscribe only to the Products that are available in those Spaces." This confirms that consumers

applications

and subscriptions are space-specific.

2. IBM API Connect v10.x Documentation

"Viewing the analytics for a Space": "Analytics data is specific to a Catalog

and is partitioned by Space. You can view the analytics data for a specific Space." This confirms that analytics are also partitioned by Space.

3. IBM API Connect v10.x Documentation

"Managing consumer access to Spaces": "When Spaces are enabled

the Developer Portal is partitioned by Space. Application developers who are members of a consumer organization can be granted access to one or more Spaces." This directly links consumer management to the Space level.

When configuring a user registry for the Developer Portal in the IBM API Connect Cloud Manager or API Manager, you can use OpenID Connect (OIDC) for authentication. The system provides several "out of the box" templates for common OIDC providers to simplify the configuration process. These templates pre-populate certain required fields, such as endpoint URLs. Among the available options in the management user interface for creating an OIDC user registry are specific types for Azure and IBM Cloud, in addition to Google and a Generic option for all other providers.

1. IBM API Connect v10.0.5.x Documentation

"Creating an OIDC user registry": This official documentation page details the steps for creating an OIDC user registry in the Cloud Manager. In Step 5

it explicitly lists the available OIDC Provider Types.

Reference: In the section "About this task

" the documentation states: "When you create an OIDC user registry

you can select from the following OIDC provider types: Generic

Google

Azure

IBM Cloud." This directly supports the selection of Azure and IBM Cloud as out-of-the-box types.

Source: IBM. (2023). Creating an OIDC user registry. IBM API Connect 10.0.5.x Documentation. Retrieved from https://www.ibm.com/docs/en/api-connect/10.0.5.x?topic=registries-creating-oidc-user-registry

2. IBM API Connect v10.0.x Documentation

"User registries for authenticating": This document provides an overview of user registries and mentions the types of third-party identity providers that can be integrated.

Reference: The section on OIDC user registries confirms that specific configurations exist for providers like Azure and IBM Cloud to streamline the setup process for authenticating and authorizing users for both the Developer Portal and API consumption.

Source: IBM. (2023). User registries for authenticating. IBM API Connect 10.0.x Documentation. Retrieved from https://www.ibm.com/docs/en/api-connect/10.0.1.x?topic=security-user-registries-authenticating

The Consumer APIs are designed specifically for application developers (API consumers) to programmatically interact with the Developer Portal. This API set exposes the core self-service functionalities that a developer would typically perform through the portal's user interface. These functions explicitly include registering new developer accounts, creating and managing client applications (which receive API keys), and creating subscriptions to associate those applications with specific API Products and Plans. The Developer Portal's front-end is a primary user of these backend Consumer APIs.

1. IBM API Connect v10.0.x Documentation

"Using the Consumer API": "The Consumer API allows application developers to complete tasks such as registering a new application

or subscribing to a Plan. The Consumer API provides programmatic access to the functions that are available in the Developer Portal." This source directly confirms that the Consumer API is used for application registration and subscription.

2. IBM API Connect v10.0.x Documentation

"Tutorial: Using the consumer API": This tutorial guides a user through the steps of using the Consumer API

which include: "Register a user in the Developer Portal

" "Create an application

" and "Create a subscription." This explicitly covers all three activities mentioned in the question.

3. IBM API Connect v10.0.x Documentation

"API Connect REST APIs": This section provides an overview of the different API sets. It distinguishes the Consumer API

which "provides programmatic access to the functions that are available in the Developer Portal

" from the Management API

which is used for "automating tasks that you can perform by using the API Manager user interface." This clarifies the distinct roles of each API set.

The IBM API Connect Developer Portal allows administrators to configure which file types can be uploaded. By default, the list of permitted file extensions for images includes several common formats. Among the options provided, both JPG (Joint Photographic Experts Group) and GIF (Graphics Interchange Format) are included in this default configuration, making them supported formats for use in portal content, theming, and branding.

1. IBM Documentation for API Connect v10.0.x: Configuring the file settings for the Developer Portal. This document specifies the default permitted file extensions. In the section describing the "Permitted file extensions" field

the default list is provided as: jpg jpeg gif png txt doc xls pdf ppt pps odt ods odp. This explicitly includes jpg and gif.

Source: IBM Documentation

API Connect Version 10.0.x

Administering the Developer Portal > Configuring the file settings for the Developer Portal.

The json-to-xml policy in the IBM DataPower API Gateway operates on an in-memory representation of JSON data, not on a raw JSON string or stream. The official IBM documentation explicitly states that the input for this policy must be parsed JSON. If the preceding policy in the assembly (such as an invoke policy) does not provide a parsed JSON object in the specified context variable (by default, message.body), a parse policy must be used beforehand to convert the raw JSON payload into the required parsed format. This ensures the json-to-xml policy can correctly traverse the JSON structure to perform the conversion to XML (specifically, JSONx).

1. IBM Documentation for API Connect Version 10.0.x: In the documentation for the json-to-xml assembly policy

the "Description" section states: "The input to the policy is read from the variable that is specified in the input-variable field

or from message.body if an input variable is not specified. The input must be parsed JSON."

Source: IBM. (2023). API Connect Version 10.0.x Documentation. Section: "API-defining and processing policies" -> "json-to-xml". (Direct link varies

but this path is consistent in the IBM Knowledge Center/Documentation).

In a multi-node Kubernetes cluster, IBM API Connect's management subsystem handles stateful operations, including OAuth token management. To ensure high availability (HA) and data consistency for these operations, the underlying distributed database (e.g., PostgreSQL) relies on a consensus algorithm. The core principle of these algorithms is quorum, which is the minimum number of server nodes that must be active and agree on an operation for it to be committed. This prevents data inconsistencies ("split-brain") and ensures that critical OAuth operations are reliably processed even if some nodes fail. The requirement for a minimum of three management nodes in an HA API Connect deployment directly reflects this principle.

1. Official Vendor Documentation: IBM API Connect v10.0.x Knowledge Center

"Management subsystem requirements". The documentation specifies

"For a production installation

a 3-node cluster is recommended for high availability." This three-node minimum is a standard architecture for establishing a quorum-based consensus system for the underlying data store that manages OAuth and other configuration data.

Source: IBM. (2023). Management subsystem requirements. IBM API Connect 10.0.x Documentation. Retrieved from www.ibm.com/docs/en/api-connect/10.0.x?topic=kubernetes-management-subsystem-requirements.

2. University Courseware/Academic Publication: The concept of quorum is fundamental to consensus algorithms like Raft

which are used in modern distributed systems. A leader can only append a new entry to the log once a majority of servers (a quorum) have responded

ensuring consistency.

Source: Ongaro

D.

& Ousterhout

J. (2014). In Search of an Understandable Consensus Algorithm. Proceedings of the 2014 USENIX Annual Technical Conference (USENIX ATC '14). Stanford University. (Section 3.2

"Leader election

" and Section 3.3

"Log replication

" describe the necessity of a majority/quorum for operations).

3. Official Vendor Documentation (Kubernetes): The official Kubernetes documentation on running stateful applications explains the challenges of managing distributed data stores. These systems

which would manage OAuth state

inherently rely on consensus and quorum to maintain a consistent state across replicas.

Source: Kubernetes Authors. (2023). Running Stateful Applications. Kubernetes Documentation. Retrieved from kubernetes.io/docs/tutorials/stateful-application/running-stateful-application/. (This document discusses the principles of stateful sets and persistent storage

which are prerequisites for building HA data services that use quorum).

In IBM API Connect, the @hide directive is the designated method for modifying a GraphQL schema to prevent specific fields or types from being exposed to the client. Applying this directive to a field in the schema definition ensures that it is omitted from the schema served by the API gateway. Consequently, the field will not appear in introspection queries and will be rejected by the validator if a client attempts to include it in a query, effectively hiding it.

1. IBM. (2023). Creating a GraphQL API proxy. IBM Documentation. Retrieved from https://www.ibm.com/docs/en/api-connect/10.0.5.x?topic=apis-creating-graphql-proxy-api. In the section "Editing a GraphQL schema

" the documentation states: "You can use the @hide directive to remove types or fields from the schema."

2. IBM. (2023). GraphQL policies. IBM Documentation. Retrieved from https://www.ibm.com/docs/en/api-connect/10.0.5.x?topic=reference-graphql-policies. This page details the Redaction policy

explaining its function is to "Redact specified fields in the GraphQL response object

" which confirms it acts on the response data

not the schema definition for introspection.

Disabling the administrator login on the Developer Portal login page is a user interface configuration that removes the visible link for administrative access. This is often done to present a cleaner interface for API consumers. However, the underlying administrative login functionality is not removed. Administrators can still access the login page by navigating directly to a specific URL. The correct URL for this purpose is https:///user/login?registryurl=/admin, which bypasses the standard login page and presents the administrator-specific login prompt.

1. IBM API Connect v10.x Documentation

"Logging in as an administrator". This official documentation explicitly states: "If the administrator login link has been disabled on the Developer Portal login page

you can still log in as an administrator by navigating to the administrator login page... The URL for the administrator login page is https:///user/login?registryurl=/admin". (URL: https://www.ibm.com/docs/en/api-connect/10.0.5.x?topic=portal-logging-in-as-administrator)

The correct sequence follows the standard API lifecycle management process in IBM API Connect. First, an API must be created or defined. This API is then bundled into a Product, which acts as a container for one or more APIs intended for a specific use case. To make the Product available for consumption, it must be published to a Catalog. A consumer then registers an Application in the Developer Portal, which generates client credentials. Finally, this Application is subscribed to a plan within the published Product to gain access to the API.

1. IBM API Connect v10.x Documentation

"Tutorial: Importing and publishing your first API": This official tutorial outlines the initial steps of the provider workflow. It explicitly guides the user to first import an API definition

then add the API to a new Product

and finally publish that Product to a catalog. This confirms the first three steps in the sequence.

2. IBM API Connect v10.x Documentation

"Tutorial: Registering an application and subscribing to an API": This tutorial details the consumer workflow

which follows the provider actions. It instructs the user to first create an Application in the Developer Portal and then subscribe that application to the previously published Product to consume the API. This confirms the final two steps.

3. IBM API Connect v10.x Documentation

"Products": This section clarifies the relationship between APIs and Products

stating

"A Product is a group of APIs that is packaged together... You use Products to control which APIs are available to application developers." This supports the logic that an API must exist before it can be packaged into a Product.