C_ADBTP exam questions

1. Question 1 Maridadi AgriExports BTP Subaccount Go-Live Readiness

   Single answer

   Case study: Maridadi AgriExports BTP Subaccount Go-Live Readiness

   Maridadi AgriExports BTP Subaccount Go-Live ReadinessBusiness Context

   Maridadi AgriExports is a tea and coffee processor based in Nairobi, Kenya, that aggregates produce from hundreds of smallholder cooperatives across the highlands around Nakuru. The company is preparing to launch a grower-payment and traceability portal that lets cooperative officers confirm deliveries, view settlement amounts, and trace each lot from collection point to export container. A small platform administration team is standing up a new cloud subaccount to host the portal, with go-live scheduled in a matter of days and the first settlement run expected the following week.

   System Landscape

   The portal runs on the company's business technology platform, draws identities from the corporate directory, and connects to the existing settlement records. Entitlements for the services the portal needs were assigned to the new subaccount earlier in the week, and the build team reported that the application deploys cleanly. During a rehearsal, however, an engineer who tried to create one of the required service instances found that the plan was not offered as a selectable option in the subaccount, even though the entitlement showed as available. A neighbouring region did offer the plan and would shorten response times, but the company had committed to keeping grower-payment data within the country.

   Identity Context

   Cooperative officers sit in the corporate directory, while several hundred field-collection agents are maintained in a separate regional login domain used across the company's rural sites. Provisioning was configured to bring both populations onto the platform. After the run completed, the user accounts were present, yet a role assignment intended to grant the portal role to each agent's cooperative group reached nobody, and agents who opened the portal during testing saw an empty workspace. Separately, agents whose accounts live in the regional login domain were rejected at sign-in, while officers from the head-office domain signed in normally.

   Process Flow Context

   The settlement calendar is fixed by the cooperatives' own payout cycle, so the portal must be usable by both officers and agents on day one. The team has weighed several quick ways to get everyone in before the deadline, including pointing all users at the head-office sign-in path and assigning the portal role to affected agents one by one. Each shortcut would unblock the rehearsal, but the administrators know the same conditions would return for every new agent onboarded through the coming harvest season.

   Governance Context

   Maridadi AgriExports ships into markets that require certification of fair and traceable payments, and an internal review is planned to confirm that settlement actions were performed by authorized, identifiable users. When the team looked for several months of sign-in and change history to prepare, they found that the platform keeps activity records only for a limited period and that no routine export had been set up, so the earliest entries were already gone. A separate data-minimization policy limits how long personal sign-in data may be held, which the team must weigh against the certification need.

   Readiness Context

   With the rehearsal incomplete, the administrators must decide how to place the subaccount so the required services are actually consumable, how to make group membership and sign-in work for field agents without resorting to shared credentials, and how to preserve the evidence a certification review will expect. Every choice has to hold through the harvest season's onboarding and honor the commitment that grower-payment data stays within the country, and the fixed settlement deadline leaves little room to rework foundational decisions once the portal is live.

   Your assignment

   You are an administrator on the platform team standing up a new subaccount to host the grower-payment and traceability portal for Maridadi AgriExports ahead of a fixed settlement deadline. You work in the platform cockpit and supporting administration tooling, using the assigned entitlements, the corporate directory, the regional login domain, and the platform's identity, connectivity, and activity-logging capabilities. Complete the tasks below so the portal is consumable, usable by both officers and field agents, and evidenced for a certification review, while honoring the in-country data-residency commitment. Do not introduce shared credentials or unscoped access to meet the deadline

   1. CHALLENGE 1 — Aligning Subaccount Region With Required Service Availability

   • Determine why a required service plan is not selectable for instance creation even though the entitlement is assigned to the subaccount.

   • Place the subaccount in a region that offers the required plan and satisfies the in-country data-residency commitment.

   • Create the required service instance and bind the portal to it, treating a closer region's lower latency as secondary to the residency commitment.

   Checkpoints

   • The required plan is selectable and an instance is created in a region that offers it.

   • The chosen region keeps grower-payment data within the country.

   • The portal binds to the instance and reaches the service.

   2. CHALLENGE 2 — Carrying Grower Attributes Through Identity Provisioning

   • Diagnose why a group-based role assignment grants the portal role to no agents although the agent accounts exist on the platform.

   • Correct the provisioning transformation so the cooperative-group attribute is written to the target, and re-provision the affected agents.

   • Confirm group membership rather than substituting per-agent manual role assignment as a durable fix.

   Checkpoints

   • Affected agents carry the cooperative-group attribute after re-provisioning.

   • The cooperative group is populated and the group-based assignment grants the portal role.

   • New agents onboarded later inherit the same membership without manual intervention.

   3. CHALLENGE 3 — Routing Field Agents To The Correct Sign-In Path

   • Identify why field agents in the regional login domain are rejected at sign-in while head-office officers are not.

   • Correct the login-domain routing so the field agents reach the identity provider that holds their accounts.

   • Restore sign-in without introducing a shared generic login or broadening trust beyond what is required.

   Checkpoints

   • The field agents' login domain routes to the provider that stores their accounts.

   • An affected agent signs in with their own account and reaches the portal with the expected role.

   • Each agent remains individually identifiable at sign-in.

   4. CHALLENGE 4 — Preserving Platform Activity Evidence For Export Certification

   • Establish why several months of required sign-in and change history were unavailable when the review was being prepared.

   • Set up a recurring export of the required activity records to a governed archive before the platform's retention window elapses.

   • Scope retention to what the certification review requires for its defined period, weighing it against the data-minimization policy.

   Checkpoints

   • Required activity records are exported to a governed archive on a schedule.

   • Retained records cover the certification period without holding personal data longer or more broadly than the policy allows.

   • The archive is independent of the platform's bounded retention window.

   CHALLENGE 1 — Aligning Subaccount Region With Required Service Availability

   The new subaccount holds the entitlement for a required service plan, but when the team attempts to create a service instance the plan does not appear as a selectable option.

   What is the most likely reason, and the correct next step?

   • A

     The assigned quota is exhausted; raise the entitlement quota in the global account so the plan becomes selectable for this subaccount.

   • B

     The administrator lacks a runtime role; assign the runtime developer role so the plan becomes visible during instance creation.

   • C

     The subaccount sits in a region that does not offer this plan; recreate it in a supporting region, then create the instance there.

   • D

     The application subscription was removed; re-subscribe to the application so the plan reappears in the instance-creation list.

   Reveal answer

   Correct answer

   • C

     The subaccount sits in a region that does not offer this plan; recreate it in a supporting region, then create the instance there.

   Explanation

   An entitlement grants the right to use a plan, but a plan can be consumed only where the provider offers it in that region; if the region does not offer it, the plan never appears for instance creation regardless of quota. Recreating the subaccount in a supporting region that also honors the residency commitment is the correct path before binding the portal.

2. Question 2 Maridadi AgriExports BTP Subaccount Go-Live Readiness

   Single answer

   CHALLENGE 1 — Aligning Subaccount Region With Required Service Availability

   A neighbouring region offers the required plan and would lower response times, but the company has committed to keeping grower-payment data within the country.

   How should the subaccount region be chosen?

   • A

     Choose an in-country region that offers the plan and accept the added latency, since residency governs where data may be stored.

   • B

     Choose the closer neighbouring region for its lower latency, since residency is satisfied when users connect from inside the country.

   • C

     Choose the closer neighbouring region and encrypt the data, since encryption removes the residency constraint on where data is stored.

   • D

     Choose any region offering the plan and document the latency, since residency covers reporting data only, not transactional data.

   Reveal answer

   Correct answer

   • A

     Choose an in-country region that offers the plan and accept the added latency, since residency governs where data may be stored.

   Explanation

   Data residency governs where data is stored, not where users connect from; an in-country region that offers the plan satisfies the commitment, and the modest added latency is the acceptable trade-off. The performance gain of a closer region cannot override where grower-payment data is allowed to reside.

3. Question 3 Maridadi AgriExports BTP Subaccount Go-Live Readiness

   Single answer

   CHALLENGE 1 — Aligning Subaccount Region With Required Service Availability

   After recreating the subaccount in a region that offers the plan, which check best confirms the service is now usable by the portal?

   • A

     Confirm the entitlement shows as assigned to the subaccount, which proves the service instance is active and bound to the portal.

   • B

     Confirm an administrator can open the subaccount in the cockpit, which proves the plan is provisioned and usable in the region.

   • C

     Confirm the global account still shows remaining quota for the plan, which proves the instance was created in the subaccount.

   • D

     Create the service instance and confirm the portal binds to it and reaches the service, which proves it is consumable here.

   Reveal answer

   Correct answer

   • D

     Create the service instance and confirm the portal binds to it and reaches the service, which proves it is consumable here.

   Explanation

   Usability is proven only by consumption: creating the instance and confirming the portal binds to and reaches it demonstrates the plan is genuinely available and working in the region. This validates the full chain from region to instance to application.

4. Getting the hang of it? 550 more C_ADBTP questions are waiting, each with its answer. Unlock them all

5. Question 4 Maridadi AgriExports BTP Subaccount Go-Live Readiness

   Single answer

   CHALLENGE 2 — Carrying Grower Attributes Through Identity Provisioning

   Field-collection agents were provisioned from the directory, yet a role assignment that grants the portal role to their cooperative group reaches no one, and agents see an empty workspace.

   What is the most likely root cause?

   • A

     The portal role collection was deleted after provisioning, so the cooperative group has no authorization left to grant its members.

   • B

     The provisioning transformation did not write the cooperative-group attribute, so the group is empty although the users exist.

   • C

     The agents authenticated against the wrong provider, so their group membership was never evaluated when they signed in.

   • D

     The subaccount trust was removed, so provisioned agents cannot be matched to their cooperative group during sign-in.

   Reveal answer

   Correct answer

   • B

     The provisioning transformation did not write the cooperative-group attribute, so the group is empty although the users exist.

   Explanation

   The users provisioned successfully, but the transformation that maps source attributes to the target omitted the cooperative-group attribute; with no member carrying the group, the group-based assignment matches nobody and the portal stays empty. Correcting the transformation and re-provisioning restores membership and the role grant.

6. Question 5 Maridadi AgriExports BTP Subaccount Go-Live Readiness

   Single answer

   CHALLENGE 2 — Carrying Grower Attributes Through Identity Provisioning

   To unblock go-live, an engineer proposes assigning the portal role to each affected agent individually.

   Why is correcting the provisioning transformation the better action?

   • A

     Manual assignment is slower to carry out, so correcting the transformation mainly saves administrator effort during the go-live window.

   • B

     Manual assignment grants broader access than the group does, so correcting the transformation avoids over-granting access to the agents.

   • C

     Manual assignment hides the defect and fails for each new agent, while correcting the transformation restores group membership going forward.

   • D

     Manual assignment cannot grant the portal role at all, so correcting the transformation is the only way to make the role assignable.

   Reveal answer

   Correct answer

   • C

     Manual assignment hides the defect and fails for each new agent, while correcting the transformation restores group membership going forward.

   Explanation

   Assigning roles per agent treats the symptom while leaving the broken attribute mapping in place, so every newly provisioned agent fails the same way and assignments drift from the governed group model. Correcting the transformation repairs membership for current agents and for everyone onboarded through the harvest season.

7. Question 6 Maridadi AgriExports BTP Subaccount Go-Live Readiness

   Single answer

   CHALLENGE 3 — Routing Field Agents To The Correct Sign-In Path

   Head-office officers sign in normally, but field agents whose accounts live in the regional login domain are rejected at sign-in. The authentication configuration applies a rule based on login domain.

   What is the most likely cause?

   • A

     A conditional rule routes the agents' domain to a provider that does not hold their accounts, so sign-in fails.

   • B

     The agents lack the portal role collection, so the platform rejects them before their password is ever checked at sign-in.

   • C

     The agents' service instance runs in another region, so their sign-in requests cannot reach the authentication step.

   • D

     The agents' entitlement was not assigned, so the platform denies them when they reach the authentication step.

   Reveal answer

   Correct answer

   • A

     A conditional rule routes the agents' domain to a provider that does not hold their accounts, so sign-in fails.

   Explanation

   A domain-based rule sends each user to a configured identity provider; if the field agents' domain points to a provider that does not store their accounts, they cannot authenticate even though they are valid users. Correcting the rule to route them to the provider that holds their accounts restores sign-in.

8. Question 7 Maridadi AgriExports BTP Subaccount Go-Live Readiness

   Single answer

   CHALLENGE 3 — Routing Field Agents To The Correct Sign-In Path

   With go-live hours away, the team considers pointing every user at the head-office sign-in path using one shared generic login to get everyone in quickly.

   Why is correcting the routing rule the better choice?

   • A

     The shared login is slower to hand out to agents, so fixing the routing rule mainly speeds up the go-live timeline for the team.

   • B

     The shared login consumes extra entitlements, so fixing the routing rule keeps the subaccount within its assigned quota at go-live.

   • C

     The shared login requires a new region, so fixing the routing rule avoids having to recreate the subaccount before go-live day.

   • D

     The shared login removes per-person identity and accountability, while fixing the routing rule lets each agent sign in as themselves.

   Reveal answer

   Correct answer

   • D

     The shared login removes per-person identity and accountability, while fixing the routing rule lets each agent sign in as themselves.

   Explanation

   A shared generic login collapses individual identity, so settlement actions cannot be attributed to a person and the agents' own provider is bypassed. Repairing the routing rule lets each agent authenticate with their own account, preserving the per-person accountability the certification review depends on.

9. Question 8 Maridadi AgriExports BTP Subaccount Go-Live Readiness

   Single answer

   CHALLENGE 3 — Routing Field Agents To The Correct Sign-In Path

   After updating the routing rule, which check best confirms the field agents can now use the portal as intended?

   • A

     Confirm office users can still sign in, which proves the agents' domain now routes to the correct identity provider as intended.

   • B

     Have an affected agent sign in with their own account and reach the portal with the expected role, proving routing and access.

   • C

     Confirm the routing rule now lists the agents' login domain, which proves they can authenticate and use the portal as intended.

   • D

     Confirm the agents appear in the regional login domain, which proves their corrected sign-in now succeeds against the provider.

   Reveal answer

   Correct answer

   • B

     Have an affected agent sign in with their own account and reach the portal with the expected role, proving routing and access.

   Explanation

   Only an end-to-end sign-in by an affected agent confirms the corrected rule routes them to the right provider and that they land in the portal with the expected role. This validates authentication and downstream access together rather than in isolation.

10. Question 9 Maridadi AgriExports BTP Subaccount Go-Live Readiness

    Single answer

    CHALLENGE 4 — Preserving Platform Activity Evidence For Export Certification

    The certification review needs several months of sign-in and change history, but the platform keeps activity records only for a limited period and no export was scheduled, so older entries are already gone.

    Going forward, how should the team reconcile the certification need with a data-minimization policy that limits how long personal sign-in data is held?

    • A

      Keep all audit records on the platform indefinitely, since the certification need outweighs the data-minimization policy in every case.

    • B

      Stop collecting sign-in audit data entirely, since the data-minimization policy outweighs the certification need and removes the burden.

    • C

      Export the required audit records on a schedule to a governed archive, keeping only what certification needs for its defined period.

    • D

      Rely on the platform's default retention window, since records it removes are by definition not needed for the certification review.

    Reveal answer

    Correct answer

    • C

      Export the required audit records on a schedule to a governed archive, keeping only what certification needs for its defined period.

    Explanation

    The two governance obligations are reconciled by exporting only the records certification requires into a governed archive for the defined retention period, satisfying the audit need without holding personal data longer or more broadly than the minimization policy allows. This scopes retention rather than maximizing it.

11. Question 10 Maridadi AgriExports BTP Subaccount Go-Live Readiness

    Single answer

    CHALLENGE 4 — Preserving Platform Activity Evidence For Export Certification

    The team wants to ensure required activity evidence is never lost again before a future certification review.

    Which action most directly prevents recurrence?

    • A

      Schedule automated, recurring export of the required audit records to durable storage before the retention window elapses.

    • B

      Ask each administrator to download the audit log by hand whenever they remember, so recent activity is usually captured in time.

    • C

      Increase the number of administrators holding audit access, so more people can retrieve the records if a review is announced.

    • D

      Wait until a certification review is scheduled, then request the full activity history from the platform for the required months.

    Reveal answer

    Correct answer

    • A

      Schedule automated, recurring export of the required audit records to durable storage before the retention window elapses.

    Explanation

    A recurring, automated export to durable storage captures records before the bounded retention window removes them, so the evidence exists independently of when a review is announced. This directly addresses why the earlier history was lost.

12. Question 11 Locked Unlock to see this question
13. Question 12 Locked Unlock to see this question

Back to the C_ADBTP exam page