IBM A1000-116 Advanced Practice Exam: Hard Questions 2025

An enterprise is migrating a mission-critical application to IBM Cloud. The app must run in multiple zones within a region for resilience, and it requires private connectivity to on-premises systems with predictable performance. They also need to avoid exposing any workload endpoints to the public internet. Which architecture best meets these requirements with the fewest moving parts?

A team uses IBM Cloud Object Storage (COS) for data lake ingestion. They must ensure that newly ingested objects are immutable for a fixed retention period to satisfy regulatory requirements, even if an administrator’s credentials are compromised. Which approach best enforces this requirement?

A company wants to standardize identity and access across dozens of IBM Cloud accounts used by separate business units. Requirements: centralized identity provider, consistent role assignment, minimal manual user provisioning, and the ability to quickly revoke access across all accounts. Which design best satisfies these requirements?

A microservices platform runs on IBM Cloud Kubernetes Service. One service experiences sporadic latency spikes only during scale-out events. Metrics show CPU saturation is not the trigger; spikes correlate with pod scheduling delays and image pulls. The cluster nodes are in private subnets with no public internet access. Which change most directly addresses the root cause while keeping the cluster private?

An architect must design a hybrid solution: a latency-sensitive API in IBM Cloud needs to query an on-prem database. The database cannot be exposed outside the data center. The solution must support failover to a secondary on-prem site, and the IBM Cloud side must remain operational even if one connectivity method fails. Which connectivity design best meets these constraints?

A bank is building a multi-region active-active web application on IBM Cloud. They need global traffic steering, fast failover, and protection against zone/regional outages. State is stored in managed databases that are region-bound. Which design best balances availability and data consistency without introducing single points of failure?

A healthcare workload on IBM Cloud must satisfy strict network segmentation: application tier can reach database tier, but not vice versa; management access must be limited to a jump host; and egress to the internet must be blocked except for OS patch repositories via controlled paths. Which combination of controls best implements this with defense in depth on IBM Cloud VPC?

A security team detects that an IBM Cloud API key associated with an automation pipeline may have been leaked. The pipeline deploys resources across multiple resource groups and also writes secrets to a secrets manager. The team needs immediate containment with minimal disruption to other workloads. What is the best first action?

An organization must demonstrate compliance evidence for cloud operations: who changed network rules, when production workloads were scaled, and whether encryption settings were modified. They want tamper-resistant logging and the ability to correlate events across services. Which approach best satisfies these requirements on IBM Cloud?

A production workload deployed via infrastructure-as-code intermittently fails during provisioning: some runs create the VPC and subnets, but fail when attaching security rules and provisioning compute. A rerun sometimes succeeds but occasionally leaves partially created resources that break idempotency. The team needs a reliable deployment process with safe rollbacks. What is the best improvement?