C_CPI Integration Suite Development Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create an OAuth2 Client Credentials security material and reference it in the sender adapter's authentication settings.

  Why it's wrong here

  OAuth2 Client Credentials is a token-based authentication mechanism used for outbound calls or token issuance, not for client certificate authentication on an HTTPS sender. Configuring it here would not validate the partner's client certificate. The scenario explicitly requires client certificate authentication, so OAuth2 material is irrelevant and would not enable the intended handshake.

• ✗

  Enable CSRF protection on the sender adapter so that the partner's certificate is checked on every request.

  Why it's wrong here

  CSRF protection prevents cross-site request forgery in browser-based scenarios by requiring a token; it does not validate client certificates. Enabling it would not establish trust for the partner's certificate and could interfere with the partner's calls. Certificate validation happens during the TLS handshake, not through CSRF settings, so this action is not applicable.

• ✓

  Add the partner's root or intermediate CA certificate to the SAP Cloud Integration Keystore under the appropriate certificate alias so the incoming client certificate can be validated.

  Why this is correct

  For client certificate authentication, SAP Cloud Integration must validate the partner's certificate against a trusted CA. Adding the partner's root or intermediate CA certificate to the Keystore allows the runtime to build and verify the chain presented during the TLS handshake. Without this trust anchor, the sender adapter rejects the connection even if the client certificate itself is valid.

• ✗

  Configure the HTTPS sender adapter to use Role-Based Access Control and assign the partner's certificate to a user with the required permissions.

  Why it's wrong here

  Client certificate authentication does not map a certificate to a user via RBAC in the sender adapter configuration. RBAC applies to user-based access, not to certificate-based authentication. The partner authenticates at the TLS layer, and authorization is handled separately, so this action does not establish trust for the incoming certificate.

• ✓

  Download the SAP Cloud Integration tenant's server certificate and provide it to the partner so the partner can trust the server during the TLS handshake.

  Why this is correct

  In mutual TLS, the client must also trust the server. Providing the tenant's server certificate or its issuing CA to the partner allows the partner's client to validate the server certificate during the handshake. Without this, the partner's client may reject the connection even if the server trusts the client certificate, so it is a required step for successful mutual authentication.