C_CPE_2409 SAP Certified Associate - Backend Developer - SAP Cloud Application Programming Model Free Practice Exam Questions (2025 Updated)

The Destination Service stores:

Endpoints

Authentication information

Configuration for external APIs or systems

This service is used by CAP applications to call external OData, REST, SOAP, or custom APIs.

Incorrect options:

A – Connectivity Service: Provides on-premise connectivity via Cloud Connector; does not store the metadata itself.

C – Core Data Service: CDS is a modeling language, not a BTP service.

In SAP CI/CD service, low-code project pipelines (e.g., SAP Build Apps or SAP Build Work Zone content) can release artifacts by:

Deploying to Cloud Foundry (B):The pipeline packages and deploys artifacts to the Cloud Foundry runtime.

Deploying to Cloud Transport Management Service (C):Used for landscape-aware transport of application modules.

Incorrect options:

A:Private server deployment is not supported by SAP CI/CD predefined pipelines.

D:FTP uploads are not part of SAP CI/CD Release stage capabilities.

The Kyma project (used in SAP BTP, Kyma runtime) is an extension framework that provides modular building blocks to extend applications using Kubernetes-native components. The official Kyma module list includes:

Serverless (A): Provides functions-as-a-service capabilities, enabling lightweight event-driven workloads.

Telemetry (C): Offers logging, metrics, and tracing capabilities enhancing observability.

API Gateway (E): Enables secure and managed exposure of APIs, including authentication and routing.

Incorrect options:

B – Data Warehouse: Not a Kyma module.

D – Storage: Storage is a Kubernetes concept, not a Kyma module.

SAP guarantees thatpublic APIs, CDS views, business events, and OData servicesexposed as “whitelisted” or “released” remainstable and backward compatibleacross quarterly upgrades.

Therefore:

Extensions built on these APIs continue functioning regardless of SAP internal changes.

SAP ensures upgrade compatibility through semantic versioning and API lifecycle policies.

Side-by-side and in-app extensibility both rely on stable released interfaces.

Thusoption C is the fundamental reasonwhy extensions remain unaffected.

Why the Others Are Incorrect:

A:The VDM may evolve, but stability is guaranteed only forreleased interfaces, not the whole VDM.

B:Running on BTP alone does not guarantee stability—stability comes from SAP’s API contract guarantee.

D:There is no mechanism that “freezes” APIs; SAP maintains them as stable by contract.

Namespaces in CDS:

Group related entities and types (B):Namespaces help organize models into logical domains.

Manage version or ownership separation (C):Different namespaces allow parallel evolution of models or clearer ownership boundaries.

Incorrect options:

A:Namespaces have no impact on performance.

D:No styling semantics exist in CDS namespaces.

C – Define role templates in xs-security.json

xs-security.json is the core XSUAA configuration file. It defines:

Role templates

Scopes

Attributes

Authorization semantics

To secure the app, developers must definerole templates, which determine which scopes a role grants.

B – Use role names in application descriptors (web.xml in Java apps)

For Java web apps running via Tomcat/Servlet containers,web.xmldefines application-level roles and maps them to XSUAA role templates.

Thus, restricting access involves linking:

web.xml roles → XSUAA role templates → scopes → permissions

Why A and D Are Incorrect:

A:In xs-app.json, scopes define access rules forHTML5 apps via approuter, not Java applications.

D:Scopes belong to xs-security.json, but setting them alone does not restrict application access unless roles and mappings are defined. The question focuses onstepsto restrict access, and B + C describe the necessary actions.

The SAP S/4HANA Virtual Data Model (VDM) provides:

Documented relationships between business entities (A):

The VDM contains associations, cardinalities, and links between entities, exposing the business domain structure.

Business semantics (D):

VDM entities are semantically rich views exposing fields, labels, and business meaning rather than technical database fields.

Incorrect options:

B: The VDM abstracts the database; it does not expose underlying tables.

C: The VDM does not provide UIs; it provides API-level views.

When connecting from a CAP application to thesandboxof SAP API Business Hub (now SAP Business Accelerator Hub) for APIs such as theBusiness PartnerOData service, the learning content and examples describe that:

The sandbox environment is protected by anAPI keythat must be sent in a specific HTTP header (for example, APIKey or similar) with each request.

Tutorials for CAP/Cloud SDK and S/4HANA integration in a training context show configuration steps where developers obtain anAPI keyfrom the hub and configure it in a destination or in custom code for outbound calls.

This matches optionC – API key.

Why the other options are incorrect:

A – Client certificate:Client certificates are common for productive mutual TLS connections, not for the public sandbox.

B – Service principal:“Service principal” is an Azure-specific concept and not how the sandbox on SAP API Business Hub is accessed.

D – OAuth token:Many productive APIs use OAuth 2.0, but thesandboxin the official exercises is specifically accessed using an API key.

In OData, theservice metadata document(typically accessed via the $metadata endpoint) is theformal description of the OData service. It is defined using the Conceptual Schema Definition Language (CSDL / EDMX).

The metadata document:

Describesentity types, complex types, and their properties(types).

Definesentity sets and singletons(sets).

Includes ODatafunctions and actions, together with parameters and return types.

Describes therelationships and navigation propertiesamong entities.

This matches optionD:“To describe the types, sets, functions, and actions.”

OptionB(“list the available entity sets, functions, and singletons”) is incomplete, since the document also defines types and relationships.

Why the others are incorrect:

A – API’s security requirements:Security is handled elsewhere (OAuth/XSUAA, configuration, API gateways), not in the OData metadata document.

C – Human-readable description:While a developer can read the XML, the primary intent is amachine-readableformal model for tools and clients.

SAP BTP Cloud Foundry runtime is amanaged PaaS platform.

B – Managed security and automatic updates

The platform handles:

Operating system patching

Buildpack updates

Security vulnerability patches

Scaling and monitoring infrastructure

Developers do not manage OS, VM, clusters, or security baselines.

C – High availability with load balancing

Cloud Foundry natively provides:

Multiple application instances

Route-based load balancing

Health checks

Automatic restart of unhealthy instances

This ensureshigh availabilityfor deployed apps.

Why the Others Are Incorrect:

A:Scaling isautomatic, not manual. Developers can set autoscaling rules.

D:Service mesh is not part of Cloud Foundry; it belongs to Kubernetes-based runtimes (e.g., Kyma).

A Kubernetes Deployment provides:

Declarative updates to pods

Rolling updates and rollbacks

Zero-downtime deployments when configured with suitable strategies

Incorrect options:

A: Databases are external or stateful sets, not deployments.

B: Network policies are configured via dedicated objects.

C: Deployments manage ReplicaSets, not pods "directly."

CAP development guidelines recommendSQLiteas the default database for local development because:

It requires no installation.

It supports CDS features needed for rapid prototyping.

It enables quick testing without deploying to SAP HANA.

For productive deployments, SAP HANA or SAP HANA Cloud is used, but SQLite remains the recommended local option.

Incorrect choices:

A – NoSQL:CAP does not support NoSQL databases as primary stores.

C – PostgreSQL:Supported via adapters, butnotthe recommended development default.

D – HANA Cloud:Used for production, not recommended for local development.

Comprehensive and Detailed Explanation

SAP CI/CD jobsalways operate on Git repositories.

Therefore, before creating a job:

The projectmust be committed and pushedto a remote Git repository such as GitHub, GitLab, or SAP’s Git service.

CI/CD pipelines use the repository to clone code, build, test, and deploy.

Without a Git repository, the CI/CD pipeline cannot function.

Incorrect options:

B:Deployment is theoutput, not a prerequisite.

C:Previewing is irrelevant to CI/CD setup.

OData protocol specifies:

PATCH is used for partial updates, where only changed fields are provided.

PUT performs complete replacement of an entity.

POST is used for create operations or invoking actions.

Thus, partial updates in OData use the PATCH method.

kubectl is thecommand-line interface for Kubernetes. According to the Kubernetes documentation:

kubectl communicates with theKubernetes API server.

It is used tocreate, update, delete, and inspectKubernetes resources such as Pods, Deployments, Services, ConfigMaps, and so on.

It is the primary tool administrators and developers use tomanage resources in a Kubernetes cluster.

This corresponds exactly to optionB – To interact with the Kubernetes API to manage cluster resources.

Why the others are incorrect:

A – Configure storage systems:You can manage storage-related Kubernetes objectsviakubectl, but that is only one aspect of managing resources; it is not the core definition.

C – Set up cloud environments:Cloud environments (accounts, projects, VPCs) are managed by cloud-provider-specific tools, not by kubectl.

D – Create virtual networks:Kubernetes networking is handled by CNI plugins and cluster configuration; kubectl does not directly create underlying virtual networks.

CAP supports integration with external services using multiple API definition formats.

D – EDMX for OData V2 and V4

CAP can import OData services using:

EDMX files (OData V2/V4)

Metadata downloaded from SAP Business Accelerator Hub

cds import

This generates CDS definitions for entities, actions, and functions.

B – OpenAPI (Swagger)

For REST services, CAP supports:

Importing OpenAPI specifications

Generating CDS service proxies

Creating typed service clients

OpenAPI is the standard way to describe REST endpoints in CAP.

Why the Others Are Incorrect:

A – GraphQL schema

CAP does not directly import GraphQL schemas.

C – WSDL

WSDL (SOAP) is not directly consumed by CAP modeling tools.