C_CPI Integration Suite Development Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Add a Groovy Script step that reads the client secret from a local file and calls the token endpoint.

  Why it's wrong here

  Reading secrets from a local file is insecure and unsupported in the cloud runtime, where the file system is not a reliable secret store. This approach also bypasses the Security Material artifact and introduces custom code where a standard step exists, increasing maintenance and risk.

• ✓

  Add an OAuth2 Authorization step and reference the OAuth2 Client Credentials artifact to retrieve the access token.

  Why this is correct

  The OAuth2 Authorization step is the built-in mechanism to obtain an access token using a configured OAuth2 Client Credentials artifact from Security Material. It performs the token request, stores the token, and makes it available for the subsequent HTTP receiver call without exposing the secret in the flow.

• ✗

  Add a Content Modifier step and set the Authorization header to a hardcoded Bearer token.

  Why it's wrong here

  Hardcoding a Bearer token defeats the purpose of using OAuth 2.0 and will expire, causing failures. It also violates the requirement that the client secret not be stored in the integration flow configuration, and Content Modifier cannot perform the token exchange.

• ✗

  Add a Request Reply step with the OAuth2 adapter and select the Client Credentials grant type.

  Why it's wrong here

  The Request Reply step uses adapters such as HTTP, SOAP, or OData, not an OAuth2 adapter for token retrieval. While the HTTP adapter can use OAuth2 authentication, it does not itself fetch a standalone token to be reused; the dedicated OAuth2 Authorization step is required for that.