C_CPI Integration Suite Development Practice Question
You are configuring an HTTPS sender adapter in SAP Cloud Integration. The integration flow must accept requests from an external partner, and you need to authenticate the partner using a client certificate. Which keystore artifact must you create and deploy to enable this authentication?
⚠ Common exam trap
Candidates often confuse keystores used for inbound client certificate validation with those used for outbound client authentication, leading to selecting your own private key instead of the partner's public certificate.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A Java keystore (JKS) containing the partner's public certificate, deployed as a Keystore artifact.
For an HTTPS sender adapter to authenticate a partner using a client certificate, the integration flow must trust the partner's certificate. This is achieved by deploying a Keystore artifact that contains the partner's public certificate. The sender adapter references this keystore to validate the client certificate during the TLS handshake. Using a keystore with your own private key is for outbound scenarios, and PGP or OAuth2 artifacts serve different security purposes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A Java keystore containing your own private key and certificate, deployed as a Keystore artifact.
Why it's wrong here
A keystore containing your own private key and certificate is used for outbound connections where the integration flow acts as a client and needs to present a certificate to a receiver, or for signing. For inbound client certificate authentication, the sender adapter needs to trust the partner's certificate, so it requires the partner's public certificate, not your private key.
- ✗
An OAuth2 client credentials artifact deployed as a Security Material artifact.
Why it's wrong here
OAuth2 client credentials are used for token-based authentication, not client certificate authentication. The HTTPS sender adapter supports client certificate authentication via keystores, not OAuth2. Deploying an OAuth2 client credentials artifact would not enable the partner to authenticate using a client certificate.
- ✗
A PGP key pair deployed as a PGP Keys artifact.
Why it's wrong here
PGP Keys artifacts are used for PGP-based encryption and signing, not for TLS client certificate authentication. The HTTPS sender adapter uses Java keystores for certificate validation during the TLS handshake. PGP keys are irrelevant to authenticating an HTTPS client via client certificate.
- ✓
A Java keystore (JKS) containing the partner's public certificate, deployed as a Keystore artifact.
Why this is correct
A Keystore artifact in SAP Cloud Integration stores public certificates used to validate incoming client certificates. You must import the partner's public certificate into a Keystore and deploy it. The HTTPS sender adapter then references this keystore to trust the partner's certificate during the TLS handshake, enabling client certificate authentication.
About these practice questions
Courseiva writes every C_CPI question from scratch — 218 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official SAP exam blueprint
This C_CPI practice question is part of Courseiva's free SAP certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the C_CPI exam.