C1000-138 IBM API Connect V10.0.3 Solution Implementation Practice Questions

A 'clock skew' error means there is a time difference between the system that issued the token (the IdP) and the system validating it (API Connect Gateway). This can cause validation of the nbf (not before) and exp (expiration time) claims to fail even if the token is technically valid. The JWT validation policy has an 'Allowed clock skew' setting to define a tolerance in seconds to account for these minor time discrepancies. The best practice is to set a small, reasonable value, not to accept expired tokens.

The activity-log policy is the designated policy for capturing transaction data and sending it to the analytics service. It can be configured to capture headers, the entire message body (payload), or just specific parts of the transaction for later analysis and auditing in the API Connect analytics dashboards.

The default approval requirements for a Developer Portal are managed at the Catalog level. Within the Catalog's settings, the 'Self-service onboarding' section contains checkboxes to enable or disable automatic approval for new user registrations and new application subscriptions. Unchecking these boxes enforces a manual approval workflow.

When generating a REST API from a WSDL, API Connect's main task is to act as a transformation bridge. The automatically generated assembly contains Map policies (or other transformation logic) that convert the incoming RESTful request (typically JSON) into the SOAP XML envelope expected by the backend. It then invokes the SOAP service and performs the reverse transformation on the response, converting the SOAP XML back into JSON for the client.

The 'Publish' action is the explicit step taken by an API Product Manager or other authorized role to make an API Product available for discovery and subscription in the Developer Portal. This action moves the Product from the 'Staged' state, where it might be undergoing final testing in a Catalog, to the 'Published' state, making it live for consumers.

The Redact policy is specifically designed for removing or masking sensitive data from a message payload. By placing it in the API's assembly flow, it will process the message before control is passed to any global policies. Since the logging is a post-request (meaning response flow) global policy, redacting the data in the API's response flow is the correct and most efficient solution. GatewayScript could achieve this but is more complex to implement and maintain. A Map policy is for transformation, not redaction. The Redact policy cannot be applied to the Activity Log policy directly.

This scenario is the primary use case for Syndication. Creating separate Catalogs provides the required isolation for each LOB, including a distinct developer portal and consumer base. Syndication allows a Product published in one Catalog (the central master) to be shared and made available in other Catalogs (the LOBs). This avoids duplicating the API definitions and allows for centralized management of the core APIs while enabling decentralized consumption. Spaces provide isolation but share a single developer portal, which does not meet the requirement.

According to the OAuth 2.0 specification (RFC 6749), if the redirect_uri parameter was included in the initial authorization request, it MUST also be included in the token request, and the values must be identical. A mismatch is a common cause for an invalid_grant error, as it prevents authorization code injection attacks. While other issues can cause this error, the redirect_uri mismatch is a frequent and subtle problem in this specific flow.

In the YAML definition file for a user-defined policy, when defining a property in the properties section, you can add format: password to a property of type: string. This instructs the API Connect UI to render the input field as a password field (obfuscating the value with asterisks or dots) and to handle the value as a secret.

This is the standard best practice for managing environment-specific configurations. By defining a property in the API definition, you create a variable. This property can then be assigned a specific value at the Catalog level. When the API is published to the 'Development' Catalog, it uses the 'Development' value. When published to 'Production', it uses the 'Production' value. The Invoke policy in the assembly then references this property (e.g., $(backend_url)), allowing a single API definition to be promoted across environments without modification.