Free C1000-138 sample questions

Correct answer: The `redirect_uri` included in the token request does not exactly match the `redirect_uri` used in the initial authorization request.

According to the OAuth 2.0 specification (RFC 6749), if the `redirect_uri` parameter was included in the initial authorization request, it MUST also be included in the token request, and the values must be identical. A mismatch is a common cause for an `invalid_grant` error, as it prevents authorization code injection attacks. While other issues can cause this error, the `redirect_uri` mismatch is a frequent and subtle problem in this specific flow.

Correct answer: Add `format: password` to the property definition.

In the YAML definition file for a user-defined policy, when defining a property in the `properties` section, you can add `format: password` to a property of `type: string`. This instructs the API Connect UI to render the input field as a password field (obfuscating the value with asterisks or dots) and to handle the value as a secret.

Correct answer: Define a property in the API's OpenAPI definition (e.g., `backend_url`). Set a different value for this property in each environment's Catalog settings. Reference this property in the Invoke policy.

This is the standard best practice for managing environment-specific configurations. By defining a property in the API definition, you create a variable. This property can then be assigned a specific value at the Catalog level. When the API is published to the 'Development' Catalog, it uses the 'Development' value. When published to 'Production', it uses the 'Production' value. The Invoke policy in the assembly then references this property (e.g., `$(backend_url)`), allowing a single API definition to be promoted across environments without modification.

Correct answer: False

The statement is false. The 'Deprecated' state serves as a notice to consumers that the Product will be retired in the future. Existing subscriptions remain active, and API calls will continue to succeed. However, no new applications can subscribe to the Plans within the deprecated Product. This provides a grace period for consumers to migrate to a new version before the Product is eventually 'Retired', at which point calls would fail.

Correct answer: Edit the GraphQL schema within the API definition in API Connect and apply the `@hide` directive to the desired types or fields.

API Connect provides the `@hide` directive as a specific feature for GraphQL API proxies. By adding this directive to fields or types in the schema within the API definition, API Connect will automatically remove them from the schema exposed to consumers. This prevents those fields from being included in introspection queries and invalidates any incoming requests that attempt to query them, effectively hiding them without backend changes.

Correct answers: A Keystore containing the private key and public certificate for the API Gateway.; A Truststore containing the CA certificates used to validate client certificates.

Correct answer: `apic validate`

The `apic validate` command is specifically designed for local validation of project files. When run from the project directory, it checks the syntax and structure of the `product.yaml` and any referenced `api.yaml` files, reporting errors or warnings without requiring a connection to an API Connect server. This is a crucial step in a local development workflow before attempting to publish.

Correct answer: Navigate to the partner's application subscription and override the rate limit defined in the Plan with a custom, higher limit for that specific subscription.

API Connect allows for plan overrides at the individual subscription level. This is the most efficient and targeted way to grant a specific application a different rate limit than the one defined in the general Plan. It avoids the overhead of creating new Products or Plans and doesn't require the consumer to make any changes on their end.

Correct answer: The Switch policy

The Switch policy is ideal for this scenario. It evaluates a value (in this case, `request.headers.x-transaction-type`) and executes a different sequence of policies for each matching `case`. It also includes an `otherwise` block for default actions. While an `If` policy could work, `Switch` is cleaner and more scalable if more transaction types are added later.

Correct answer: Export the current theme, modify the SASS/CSS files locally, package the new theme, and upload it through the portal's administrative interface or CLI.

The Developer Portal uses a theming engine. The correct procedure is to download or export the existing theme, make modifications to its constituent files (like SASS variables, CSS, and templates) locally, package the modified theme into a `.tgz` file, and then upload it back to the portal. This ensures changes are properly applied and are not lost during portal upgrades.