C_CPE_2409 Practice Questions

C – Define role templates in xs-security.json

xs-security.json is the core XSUAA configuration file. It defines:

Role templates

Scopes

Attributes

Authorization semantics

To secure the app, developers must definerole templates, which determine which scopes a role grants.

B – Use role names in application descriptors (web.xml in Java apps)

For Java web apps running via Tomcat/Servlet containers,web.xmldefines application-level roles and maps them to XSUAA role templates.

Thus, restricting access involves linking:

web.xml roles → XSUAA role templates → scopes → permissions

Why A and D Are Incorrect:

A:In xs-app.json, scopes define access rules forHTML5 apps via approuter, not Java applications.

D:Scopes belong to xs-security.json, but setting them alone does not restrict application access unless roles and mappings are defined. The question focuses onstepsto restrict access, and B + C describe the necessary actions.

Side-by-side extensions run on SAP BTP, which is:

A – Distributed

BTP is a distributed cloud platform across:

Multiple data centers

Multiple hyperscalers

Multiple regions

Workloads run across distributed nodes and services.

B – Autonomous

Extensions operateindependentlyfrom SAP S/4HANA Cloud core.

They are:

Independently deployable

Independently versioned

Not impacted by S/4HANA upgrades

Running in isolated environments

Why C and D Are Incorrect:

C – Centralized:

Side-by-side extensibility isnotcentralized; it is explicitly distributed.

D – Heterogenic:

Extensions can run in heterogenous landscapes, but this is not the defining characteristic recognized in SAP extensibility models.

In SAP CI/CD service, low-code project pipelines (e.g., SAP Build Apps or SAP Build Work Zone content) can release artifacts by:

Deploying to Cloud Foundry (B):The pipeline packages and deploys artifacts to the Cloud Foundry runtime.

Deploying to Cloud Transport Management Service (C):Used for landscape-aware transport of application modules.

Incorrect options:

A:Private server deployment is not supported by SAP CI/CD predefined pipelines.

D:FTP uploads are not part of SAP CI/CD Release stage capabilities.

TheSAP Cloud SDKis designed to simplify and standardize buildingside-by-side extensions(primarily in Java and JavaScript/TypeScript) for SAP S/4HANA and other SAP solutions.

Typical use cases described in the SDK documentation and training are:

Advanced features such as resilience and caching (B):The SDK providesresilience libraries(circuit breakers, retries, timeouts) andcaching mechanismsaround outbound calls to SAP S/4HAN

A.  

This allows backend developers to implement robustness and performance patterns without building them from scratch.

Add new features to an existing Java application (C):There are project templates and libraries forJava (Spring Boot). You can integrate the SDK into an existing Java application to call SAP S/4HANA APIs using the VDM and benefit from resilience, logging, and multitenancy support.

Why the other options are incorrect:

A – Allow key users to create fields:This relates toin-app extensibility (key-user extensibility)within SAP S/4HANA (for example, Custom Fields and Logic), not SAP Cloud SDK.

D – Build extensions using .NET:Officially supported runtimes for SAP Cloud SDK areJavaandJavaScript/TypeScript, not .NET.

SAP BTP Cloud Foundry runtime is amanaged PaaS platform.

B – Managed security and automatic updates

The platform handles:

Operating system patching

Buildpack updates

Security vulnerability patches

Scaling and monitoring infrastructure

Developers do not manage OS, VM, clusters, or security baselines.

C – High availability with load balancing

Cloud Foundry natively provides:

Multiple application instances

Route-based load balancing

Health checks

Automatic restart of unhealthy instances

This ensureshigh availabilityfor deployed apps.

Why the Others Are Incorrect:

A:Scaling isautomatic, not manual. Developers can set autoscaling rules.

D:Service mesh is not part of Cloud Foundry; it belongs to Kubernetes-based runtimes (e.g., Kyma).