C_CPI Integration Suite Development Practice Question
An integration developer is configuring a SOAP sender adapter in SAP Cloud Integration. The external partner's SOAP client sends a WS-Security UsernameToken header. The developer must validate the incoming credentials against a credential stored in the tenant's Security Material. Which adapter configuration achieves this without writing custom scripts?
⚠ Common exam trap
The trap here is assuming any inbound SOAP credential is validated by the generic Authorization setting rather than the dedicated WS-Security Username Token mode bound to a Security Material artifact.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set the SOAP sender adapter's Authorization to 'WS-Security Username Token' and select the deployed User Credentials artifact.
The SOAP sender adapter offers a WS-Security Username Token authorization mode that validates inbound UsernameToken credentials against a User Credentials artifact in Security Material. Selecting that artifact keeps validation at the adapter layer, requiring no Groovy or XSLT script, and ensures only partners presenting the stored credentials can invoke the flow.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set the SOAP sender adapter's Authorization to 'User Role' and map the incoming token to an OAuth client.
Why it's wrong here
The 'User Role' authorization on a SOAP sender adapter checks the authenticated user against a role assigned in the tenant, not against a WS-Security UsernameToken credential stored in Security Material. It also does not consume the UsernameToken header from the SOAP envelope, so the partner's credentials would not be validated as intended.
- ✓
Set the SOAP sender adapter's Authorization to 'WS-Security Username Token' and select the deployed User Credentials artifact.
Why this is correct
The SOAP sender adapter exposes a WS-Security Username Token authorization mode that validates the incoming UsernameToken against a User Credentials artifact stored in Security Material. Selecting the deployed artifact binds the flow to the stored username and password, so validation happens at the adapter without a script step.
- ✗
Enable 'Principal Propagation' on the SOAP sender adapter and trust the partner's IdP certificate.
Why it's wrong here
Principal Propagation is used to forward an already-authenticated principal to a receiver system; it does not validate inbound WS-Security UsernameToken headers. Trusting an IdP certificate supports SAML-based authentication, not username/password token validation, so the partner's UsernameToken would remain unverified.
- ✗
Configure the SOAP sender adapter with 'Client Certificate' authorization and import the partner's public key into the Keystore.
Why it's wrong here
Client Certificate authorization validates a TLS client certificate presented during the handshake, not a WS-Security UsernameToken inside the SOAP payload. Importing a public key into the Keystore supports certificate validation, but it does not authenticate the username and password the partner is sending in the message header.
About these practice questions
This C_CPI question is part of Courseiva's 218-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official SAP exam blueprint
This C_CPI practice question is part of Courseiva's free SAP certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the C_CPI exam.