Pass the IBM IBM Certified Administrator C1000-174 Questions and answers with CertsForce

Lightweight memory leak detection is a component of the Performance and Diagnostic Advisor framework. It examines Java heap behaviour, watching how heap occupancy trends after garbage collection, and issues a warning when the pattern is consistent with a leak. Because it runs inside the advisor framework in the server process, it does not need an external agent or monitoring product, and the overhead is small enough for routine use.

That design explains why the other options are wrong. Option A overstates the scope: the facility is concerned with the Java heap only and does not detect native memory leaks, which require operating-system tools or native-memory tracing. Option C misdescribes its purpose: it provides early notification that heap growth looks abnormal, not analysis of which objects or code paths are responsible. Option D is incorrect for the reason already given: no additional agent is required or used.

Once the advisor raises a notification, the next step is evidence collection. Typical follow-up includes enabling verbose garbage collection, taking a series of heap dumps, and examining them with a heap analysis tool to identify retained object paths. The lightweight detector narrows the question of whether to investigate; it does not answer where the leak originates, and an administrator should treat its output accordingly.

Installation Manager's command-line tool offers separate commands for installing new packages, applying fixes, and updating what is already present. The updateAll command is the one that searches the configured repositories and updates every installed package that has an available newer version, so a single invocation brings an entire installation location up to the latest levels offered. Because it is driven by arguments, including a response file, it suits unattended maintenance across many machines. Option D is correct. In a response file, the equivalent is a command element that requests the update of all installed packages, and the repository locations are listed in the same file.

installPackages, option A, installs named packages and does not examine or update packages already installed. installFixes, option C, is an operation to install specific fixes into an installed package, and it needs the fix identifiers to be specified, so it does not search for and update all packages. updatePackages, option B, is not the command name for the all-package update; the product uses the term update on a named package instead.

When planning scheduled updates, administrators should ensure the repository, whether local, remote, or a mirrored internal one, contains the intended fix packs and that servers are stopped before the update runs, since Installation Manager cannot update files in use.

A node in WebSphere Application Server is a logical grouping of server processes that share a configuration and a host system. A cell can contain two kinds. Managed nodes have a node agent and are federated into the cell, so the deployment manager can administer them and synchronise their configuration. Unmanaged nodes have no node agent; they are used to represent resources that the cell must know about but cannot fully administer, such as a web server. A cell can therefore hold both managed and unmanaged nodes, which is option D.

The other statements are incorrect. Node agents do not need manual creation after federation, option A, since the addNode command creates and starts the node agent as part of federating the node. Application servers do not have to be on managed nodes, option B, because a stand-alone application server is a valid configuration, though it lacks central administration. Option C, that nodes can span a single or multiple virtual machines, conflicts with the definition of a node as associated with one host; a physical or virtual machine may host several nodes, but a single node does not extend across machines.

When planning topology, administrators generally place one node per machine for each profile, and add an unmanaged node when a web server must be included in the cell so that the plug-in configuration can be generated and propagated.

SPNEGO, the Simple and Protected GSS-API Negotiation mechanism, lets a browser or Java client authenticate to WebSphere Application Server using Kerberos credentials obtained at desktop login. For the HTTP protocol, the product supports a defined set of trust relationships between the Kerberos realms or Active Directory domains in which the client and the server's service principal reside. The two that appear in the list are the Kerberos realm trust and the domain trust within the same forest, so options D and E are correct. In a realm trust, a client in one Kerberos realm obtains a service ticket for a server registered in a trusted realm. In a same-forest domain trust, users in a child domain authenticate to services registered elsewhere in the forest because the trust is transitive and implicit.

Options B and C describe cross-forest and forest external trusts, which carry restrictions and are not included among the supported scenarios, and option A, an Azure realm trust, is not a SPNEGO trust type recognised by the product.

Administrators configuring SPNEGO must also create the service principal name for the host, generate a Kerberos keytab and configuration file, and set up the SPNEGO trust association interceptor or the SPNEGO web authentication settings in the security configuration. Clock synchronisation between the client, the KDC, and the server is essential because Kerberos tickets are time-sensitive.

A service integration bus has members, which are the servers or clusters that host the bus's messaging engines and thus supply its messaging resources. When an administrator creates a bus or adds a member in the administrative console, which is the Integrated Solutions Console, the choices of member type are an application server, a cluster, a WebSphere MQ server, or a web service gateway. Among the options provided, an application server or a cluster is what can be selected, so option C is correct. Adding a cluster allows the engine to fail over or be scaled across members.

The other pairs name process types that cannot host a messaging engine. The deployment manager and node agent are management processes, and they do not run applications or messaging engines, so they are not valid members. The on demand router and virtual enterprise server are Intelligent Management components, where the router handles request routing and the term virtual enterprise server does not denote a bus member type. The administrative agent is the management process for unfederated nodes, and IBM Integration Bus is a separate integration product, so neither can be added as members.

After selecting the member, the console prompts for the message store type, either a file store or a data store, which determines where the messaging engine persists messages. The choice should reflect the availability and performance needs of the messaging workload.

IBM Installation Manager keeps a registry of every package it has installed, and its command-line tool, imcl, can read that registry. Running imcl listInstalledPackages, optionally with -verbose, lists the packages and their versions in the installation location. An administrator who performed a silent installation with a response file, as a non-root user, can use that listing to confirm that the expected product and fix packs are present. Option D is correct. The command must be run by the same user and against the same Installation Manager data location that were used for the installation, because non-root installs record their data in the user's own registry.

The alternatives do not fit. Opening installed.xml by hand, option A, is not the recommended method, and the file path given is not a documented verification mechanism. The Installation Verification Tool, option B, is associated with checking a profile's server startup, not the package installation, and it is run from a profile. The administrative console, option C, has no File menu with a View Installed Packages item; it is also unavailable until a profile has been created and a server is running.

Additionally, the versionInfo command, run from the product's bin directory, reports the product and fix pack level, and is a useful complement for confirming the installed version.

Application security roles in an enterprise application are mapped to users, groups, or special subjects, and the special subjects are a convenient way to grant a role to broad categories of caller without naming individuals. The product supplies two principal special subjects: All Authenticated, in the application's realm or in the trusted realms, and Everyone. When the application uses external identity providers, such as when authentication is carried out by a third-party provider through a trust association or by a token from another realm, the callers belong to a realm other than the application's own. The special subject that covers any authenticated user in the trusted realms is "All authenticated in the trusted realm", which is option A.

The application-realm variant, option B, includes only users authenticated in the application's own realm, which would exclude callers who arrive from the external provider. Everyone, option D, grants the role to any caller including unauthenticated ones, which is a much weaker control than the question implies. None, option C, is not a mapping that would grant access.

When mapping roles in the administrative console during installation, or later through the Security role to user/group mapping page, administrators should prefer the narrowest subject that serves the purpose, and test with a user from the external provider to confirm the expected access.

A java.net.ConnectException reporting a timeout during a remote EJB call needs careful reading, because the ORB has several timeout properties and each one governs a different stage. A client-side property that gives a busy server more time to complete the client request is com.ibm.CORBA.RequestTimeout. It defines the number of seconds the client ORB waits for a response to a request before it gives up, so increasing it allows slow server-side processing to finish before the client reports a failure. Option D is the property intended for this circumstance.

The other properties do not match the situation. com.ibm.CORBA.ConnectTimeout, option B, controls the time allowed to establish the socket connection to the server, which is before any request is processed. com.ibm.ws.orb.SSLHandshakeTimeout, option A, limits the time for the SSL handshake and concerns only secured connections. com.ibm.CORBA.MaxOpenConnections, option C, sets the size of the connection table, so it governs how many connections are cached, not how long requests are given.

Raising the request timeout hides the symptom rather than correcting the cause. Because the server is slow under heavy client traffic, administrators should also consider tuning the ORB thread pool, adding cluster members, or reducing the work performed per call, with the timeout adjusted as a temporary measure.

A federated repository realm combines several user registries, such as LDAP directories and a file-based repository, into one virtual realm that WebSphere Application Server uses for authentication and authorisation. Each repository contributes a portion of the overall name space, and the realm must give every user and group a unique distinguished name. To avoid collisions and to make the combined tree coherent, each repository is mapped to a base entry within the realm, and the realm defines which entity types, such as PersonAccount and Group, are supported and where new entries of each type are created. In the console, this is done by configuring the supported entity types and specifying a base entry for the default parent. Option B is correct.

The other items are part of repository setup but do not accomplish this particular requirement. Group attribute definitions, option A, tell the repository how group membership is read. The property-to-LDAP-attribute mapping, option C, translates logical property names to directory attributes for one repository. A baseDN, option D, is defined within each repository configuration to identify the subtree used, which is a precondition for the realm's base entries but is not what allows more than one repository below the realm.

When adding repositories, administrators must also verify that the base entries are unique and do not overlap in the realm's name space, because overlapping entries cause ambiguous lookups.

An enterprise application is packaged as an enterprise archive, or EAR, which contains modules of several types. The module types the product recognises are web modules, packaged as WAR files, enterprise bean modules, packaged as JAR files, application client modules, also JAR files, and resource adapter modules, packaged as RAR files. Of the four extensions offered, only JAR corresponds to a module type that can be installed, since it is used for EJB modules and client modules. Option D is correct.

The other extensions do not correspond to enterprise modules. SAR, option A, is a name used by some other application servers for service archives, and it is not an enterprise module type in this product. CAR, option C, is not an enterprise module type either; the term client archive does appear in some other contexts, but the product's application client module uses the JAR extension. BAR, option B, is likewise not a module type in this product.

When an application is installed, the console or wsadmin reads the modules from the EAR and presents each one for mapping to servers and for binding of references. A standalone WAR or JAR may also be installed, in which case the product wraps it in an enterprise application, so the same module types apply. Understanding the module types helps in planning the mapping of modules to targets.