C_CPI Integration Suite Development Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Set up a trust relationship between the Cloud Connector and the on-premise system's certificate authority (CA).

  Why it's wrong here

  While a trust relationship is important for secure communication, principal propagation specifically requires configuring the Cloud Connector to trust the SAP Cloud Integration tenant's certificate for user mapping. Setting up trust with the on-premise CA is part of the overall setup but is not the specific configuration for principal propagation. The key is to configure the Cloud Connector to accept the principal from the cloud and map it to an on-premise user.

• ✗

  Install a client certificate on the Cloud Connector that is trusted by the on-premise system.

  Why it's wrong here

  While a client certificate may be used for secure communication, principal propagation primarily relies on the Cloud Connector's ability to forward the user identity. The Cloud Connector uses its own certificate to establish a secure tunnel, but the user identity is propagated via a separate mechanism, often SAML. Installing a client certificate is not the specific configuration for enabling principal propagation; it is part of the general trust setup.

• ✗

  Configure the on-premise system to accept assertions from the Cloud Connector's certificate.

  Why it's wrong here

  The on-premise system must be configured to trust the Cloud Connector's certificate, but this is typically done as part of the overall trust setup. Principal propagation involves the Cloud Connector acting as a proxy and using the user's identity. The on-premise system must be configured to accept the propagated principal, but this is usually done via SAML or certificate-based authentication. The specific Cloud Connector configuration is the ACL and system mapping, not the on-premise system's assertion acceptance.

• ✓

  Configure an access control list (ACL) for the on-premise system with the 'Principal Propagation' option enabled.

  Why this is correct

  In the Cloud Connector, you must define an access control list (ACL) for the on-premise system. Within the ACL, you enable the 'Principal Propagation' option to allow user identity to be passed through. This is a mandatory step to establish the trust relationship and permit principal propagation for the specified resources. Without this, the Cloud Connector will not forward the user identity.

• ✓

  Enable 'Principal Propagation' in the Cloud Connector's system mapping for the on-premise system.

  Why this is correct

  In the Cloud Connector's system mapping, you must enable the 'Principal Propagation' checkbox. This tells the Cloud Connector to use the logged-in user's identity from SAP Cloud Integration and propagate it to the on-premise system. This setting is essential for principal propagation to work, as it activates the feature for that specific system mapping.