C_CPI Integration Suite Development Practice Question
An integration developer is configuring secure communication between SAP Integration Suite and an on-premise Enterprise Resource Planning system using the Cloud Connector. Which TWO configuration steps are mandatory in the SAP Cloud Connector administration console to expose an RFC-enabled function module securely? (Choose two)
⚠ Common exam trap
Candidates often assume that only the host and port registration is required, forgetting that the Cloud Connector requires explicit, granular resource permissions for specific RFC function modules to authorize the actual execution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the Cloud To On-Premise access control by defining the internal host, port, and backend system type.
Establishing secure connectivity via the Cloud Connector requires both defining internal system mappings and explicitly granting resource access permissions. These prerequisite configurations ensure that only authorized integration flows can communicate with specific backend services through the secure cloud tunnel, satisfying strict enterprise security and compliance mandates.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure the Cloud To On-Premise access control by defining the internal host, port, and backend system type.
Why this is correct
Defining access control entries in the Cloud To On-Premise section is mandatory to map virtual hosts used in integration flows to actual internal backend addresses. Without this explicit mapping, the Cloud Connector tunnel rejects any inbound requests originating from the SAP Integration Suite tenant.
- ✗
Upload a custom enterprise CA-signed certificate directly into the SAP Integration Suite Keystore management screen.
Why it's wrong here
Keystore management within SAP Integration Suite handles tenant-level certificates and is independent of Cloud Connector access control rules. While certificates secure the HTTPS transport layer, they do not replace the requirement for defining internal resource accessibility permissions inside the connector.
- ✓
Grant resource permissions for specific RFC function modules or function groups under the configured backend system entry.
Why this is correct
Exposing RFC destinations requires granular resource permissions specifying which function modules or groups can be invoked over the tunnel. Restricting access prevents unauthorized remote code execution and ensures adherence to the principle of least privilege across hybrid landscapes.
- ✗
Deploy a custom Java servlet inside the Cloud Connector runtime container to translate OData payloads into RFC structures.
Why it's wrong here
The Cloud Connector runtime is a standardized, pre-built component provided by SAP and does not support deploying custom Java servlets. Payload transformation between OData and RFC structures must be handled entirely within the SAP Integration Suite integration flow using standard adapter capabilities.
- ✗
Enable mutual TLS authentication on the SAP Integration Suite Cloud Integration tenant runtime node properties file.
Why it's wrong here
Mutual TLS between the cloud tenant and Cloud Connector is enabled automatically during initial setup using the cloud connector certificate exchange. Manual runtime property edits are neither required nor supported for establishing the foundational tunnel authentication layer.
About these practice questions
One of 218 original C_CPI practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official SAP exam blueprint
This C_CPI practice question is part of Courseiva's free SAP certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the C_CPI exam.