Free Practice Questions for the IBM Certified Administrator C1000-174 Exam (2026 Updated)

Performance advisors analyse runtime data and recommend tuning changes, and the product's advisors cover a defined set of resources. Two of the listed items are resources for which advice is available. The session cache size is covered because an undersized cache forces sessions to overflow to persistence or be discarded, while an oversized cache wastes heap, so the advisor compares the observed session counts with the configured limit and recommends an adjustment. Persisted session size and time are covered because the cost of writing sessions to a database or replicating them depends on how large they are and how long the writes take; the advisor flags excessive size or persistence time and suggests remedies such as reducing what is stored in the session. Options A and E are correct.

The remaining items, the number of live HTTP sessions, the connection pool WaitingThreadCount, and the connection pool PercentUsed, are PMI counters that an administrator can observe in the Tivoli Performance Viewer or through other monitoring, but they are not named as resources for which a performance advisor produces tuning advice. The advisor works by evaluating specific sets of counters against rules, and these particular counters are inputs to monitoring, not advisor subjects.

Performance advisors require the relevant PMI counters to be enabled, and the Tivoli Performance Viewer displays their advice.

A Java EE 6 application can describe its components through annotations in the code, through deployment descriptors, or through both. At installation time the product scans the application's classes, reads the annotations, and merges that information with whatever the deployment descriptors state, producing the metadata it uses at run time. That metadata is stored with the installed application, so a change to a descriptor, or to any element that changes how annotations are interpreted, is not picked up simply by changing a file in place or by restarting the application, because the stored result of the earlier scan remains in effect. To make the product repeat the scan and rebuild the metadata, the administrator reinstalls the application, which is option C.

Option A, updating files through the administrative console, is a way of delivering changed files, but it does not by itself guarantee a rescan of annotated classes. Option B, restarting, reloads the code but reuses the existing metadata. Option D, editing server.xml, targets the server configuration, and the file does not hold the application's deployment descriptor or its annotation metadata.

After reinstalling, administrators should confirm the intended components were discovered, for example by checking the module and servlet listings in the console, and should preserve bindings and mappings by supplying them again or using a saved binding file. In clustered environments the new version is synchronised to every node before the application starts.

Installation Manager's command-line tool offers separate commands for installing new packages, applying fixes, and updating what is already present. The updateAll command is the one that searches the configured repositories and updates every installed package that has an available newer version, so a single invocation brings an entire installation location up to the latest levels offered. Because it is driven by arguments, including a response file, it suits unattended maintenance across many machines. Option D is correct. In a response file, the equivalent is a command element that requests the update of all installed packages, and the repository locations are listed in the same file.

installPackages, option A, installs named packages and does not examine or update packages already installed. installFixes, option C, is an operation to install specific fixes into an installed package, and it needs the fix identifiers to be specified, so it does not search for and update all packages. updatePackages, option B, is not the command name for the all-package update; the product uses the term update on a named package instead.

When planning scheduled updates, administrators should ensure the repository, whether local, remote, or a mirrored internal one, contains the intended fix packs and that servers are stopped before the update runs, since Installation Manager cannot update files in use.

Authorisation determines what an authenticated identity is permitted to do, and WebSphere Application Server supports several technologies that decide this. The product's security documentation identifies them as the Java Message Service security model, which applies authorisation to messaging resources such as destinations, and the Java Authorization Contract for Containers, JACC. JACC defines how the application server hands authorisation decisions to a provider, so an external authorisation system such as Tivoli Access Manager can control access to Java EE resources. Options B and D are the two that fit.

The other items relate to authentication and identity federation, not authorisation. OAuth is a protocol for delegated authorisation to third-party clients, and OpenID Connect builds an identity layer on top of OAuth 2.0, so both appear in the product as token-based mechanisms that provide trust and identity rather than as the authorisation technologies in the product's list. The Security Assertion Markup Language, SAML, is an assertion format used for single sign-on and federated authentication.

The distinction matters in practice. Authentication, whether through LTPA, SPNEGO, OpenID Connect, or SAML, establishes who the caller is, while authorisation, through the Java EE role model and JACC or the JMS controls, establishes the resources that caller may reach. Administrators should configure and test each layer separately.

The IBM JVM provides several garbage collection policies, each of which suits a different workload. The subpool policy, now only available in the older platform releases of the JVM, divides the heap into sub-pools, which reduces contention between allocating threads because each thread allocates from its own area. That design improves allocation performance and scalability on multiprocessor systems, which is the stated purpose of this policy. Option A is correct.

The other policies are designed with other goals in mind. The optthruput policy, option B, was the default for many releases and focuses on maximum throughput by using a mark-and-sweep collection that pauses the application. The gencon policy, option C, is a generational concurrent collector that targets applications that create many short-lived objects, and it reduces pause time by splitting the heap into nursery and tenured areas. The optavgpause policy, option D, uses concurrent marking to reduce average pause time at some cost in throughput.

Selecting a policy depends on the application's allocation profile and on the platform. Administrators typically use verbose GC output to determine whether pause times or throughput are the limiting factor before changing policy. Because the policy is set with the -Xgcpolicy option, it can be changed and tested simply through the server's generic JVM arguments.

Configuration properties files let an administrator extract the configuration of selected objects with AdminTask.extractConfigProperties, edit or reuse the resulting file, and apply it elsewhere with applyConfigProperties. A properties file extracted in the default form includes data that is tied to the source cell, such as node names, server names, and unique identifiers, so applying it to a different cell can fail or misconfigure objects. To produce a file that can be reused across cells, the extraction must be run with the portable option, which removes or generalises the cell-specific values. The name of that option is PortablePropertiesFile, so option D is correct.

Options A, B, and C are plausible-sounding names but are not valid option names for this task. The wording "cross cell" in options A and B reflects the intended use but does not correspond to anything the command accepts, and "PortableFile" in option C omits the properties designation that identifies the file type.

When moving the EJB timer configuration or scheduler settings to other cells, an administrator should extract with the portable option, check the generated file for references that still point to resources that do not exist in the target, and then apply it with the matching apply task. A configuration review after applying confirms that scheduler definitions took effect.

PMI data is held inside each server process, and external programs read it through the server's administrative interfaces. The access method defined for PMI uses a client/server model on top of the Java Management Extensions API: a client connects to the server's administrative connector, either SOAP or RMI, and calls the Perf MBean to obtain the statistics, which is the architecture presented by option C. The Tivoli Performance Viewer in the administrative console does this itself, and so do custom monitoring clients written with the JMX API and the PMI client classes.

The other options describe access paths that are either secondary or not the required mechanism. An HTTP request and response is how PerfServlet delivers XML data, which is a supported alternative, but the question asks which mechanism must be used, and the underlying method is JMX. Wsadmin scripting, option B, is itself a JMX client, so it can retrieve PMI data, but it is a tool and not the architectural mechanism. A publish and subscribe model through predefined topics, option D, is not how PMI works, as clients poll the server for data and do not subscribe to events.

Because PMI is built on JMX, any monitoring product that can act as a JMX client with the appropriate security credentials can gather statistics, subject to the PMI settings in force on each server.

Applications deployed to an application server are started during server startup, and the product provides a setting to control the order. On the application's configuration page in the console, and as an attribute in wsadmin, there is a Startup order parameter, which accepts an integer. Applications with lower values start before those with higher values, so an administrator can start a shared service application before the applications that depend on it. Option D is correct.

Option A is wrong because the ordering is supported. Option C is wrong because the applications are not started in the order in which they were defined or installed; without ordering values, the sequence is not something that can be relied on. Option B concerns a different parameter, "Launch application before server completes startup", which determines whether the server waits for the application to start before it declares itself started and accepts requests. That is related to startup behaviour but does not set the order among applications.

Administrators typically combine the two settings: the startup order sets the sequence, and the launch-before-completion option makes sure a critical application is fully up before the server opens for traffic. The values should be checked after changes, since the product starts applications in parallel by default when ordering is not specified, and the server log records the start messages for confirmation.

WebSphere Application Server distinguishes several client types according to the runtime support they receive. A Java EE client is an application client component packaged as an application client module and run inside the application client container. The container supplies the client-side runtime and gives the client simplified access to system services, including security, transactions, JNDI naming, and, through configured resource references, data access. Declared resource and EJB references are resolved by the container, so the client does not have to code the lookup and configuration logic itself. That is the characteristic the question describes, and it identifies D.

The remaining client types do not use a client container. A Java thin client is a standalone Java SE program that uses the thin client runtime libraries and must handle naming and security itself. An applet client runs inside a browser and relies on the browser's Java plug-in, with the limitations that environment imposes. The ActiveX to EnterpriseJavaBeans Bridge lets non-Java ActiveX clients, such as those written for Windows environments, reach enterprise beans; it is a bridging technology rather than a container-managed client type.

Choosing between these types is largely a decision about how much infrastructure the client should receive from the platform. The Java EE client gives the greatest degree of container-provided function.

IBM's offering for running WebSphere Application Server on IBM Cloud virtual server instances is delivered as a catalog tile that provisions virtual machines with the product installed. The tile automates the initial deployment, creating the instances and installing the software at the version it offers. After that point, the environment behaves as an ordinary installation on virtual servers that the customer owns and operates. The service is not a managed platform that patches itself, so operations such as applying fix packs, updating the operating system, and managing the cell remain the customer's duty. This corresponds to option D.

Option A is incorrect because fix packs are not applied automatically. Option B is incorrect because no support ticket is needed, and IBM support does not apply fixes on the customer's behalf. Option C is incorrect because the tile is used for provisioning and is not an update mechanism for an existing installation.

The administrator therefore patches the cell with the usual tools, using Installation Manager to apply the fix pack to the product installation on each virtual server, taking care to follow the supported order for the deployment manager and nodes, and backing up the configuration beforehand. The documentation for the offering describes the shared responsibility between the platform and the customer.

A service integration bus is made highly available by arranging for a messaging engine to be able to fail over. When a cluster is added as a bus member, the product creates a messaging engine for the cluster, and by default only one cluster member runs that engine at a time, while the other members stand ready to take over if the host server fails. The high availability manager monitors the active member, and on failure it activates the engine on another member of the cluster, restoring messaging service with the engine's persistent state held in the shared message store. Because one engine, with the ability to fail over among the four members, achieves that availability, option A is correct.

More engines are not required. Option C, one engine per member, describes a scalability configuration, in which a workload is partitioned across engines, and it adds complexity because of partitioned destinations; it is not a requirement for availability. Option D, two engines, is arbitrary and does not correspond to a rule in the product. Option B, two buses, would multiply management effort without providing failover in the way a clustered engine does.

An administrator choosing between availability and scalability should recognise that the default policy favours availability. If throughput is also a concern, additional engines can be introduced with workload sharing, along with the necessary configuration of the message stores.

Java 2 security gives WebSphere Application Server a policy-based mechanism for controlling which resources application code may access. Permissions are granted through policy files at several levels. Server-wide defaults live in files such as server.policy and the product's default policy, while permissions specific to one application are placed in a was.policy file packaged in the application's META-INF directory. The supported way to edit that file is the PolicyTool utility, which provides a graphical editor for policy files, including adding codebase entries and granting permissions such as file, socket, or runtime permissions. Option B is correct.

The alternatives are not valid. A file named was.policy.props does not exist as a policy file. The keytool utility manages keys, certificates, and keystores, so it addresses SSL and signing, and not permission grants. An app.policy file is a name used by other products and is not part of this runtime's policy structure.

Because an incorrectly granted permission weakens the sandbox, administrators should grant only the specific permissions an application demonstrably needs, and should rely on the product's tracing of AccessControlException messages to identify what was missing. Java 2 security must also be enabled for these files to have any effect, and an application restart is required for changes to apply.

Application migration reports in the administrative console classify each finding by severity, and the categories are shown with distinct icons on the enterprise application collection page. Severe issues identify APIs that are unavailable on the target runtime, or behavioural changes that can break the application. Warning issues identify behavioural changes that might break the application and that deserve evaluation. Recommendations are informational findings: they cover deprecated APIs or minor behavioural changes that do not affect most applications. Option C is therefore correct.

Option A, Fatal, is not a category used by the migration report, so it can be dismissed on terminology alone. Option B, Severe, is the opposite end of the scale and is reserved for items that must be resolved before the application can run correctly on the target. Option D, Warnings, applies to changes that could break an application depending on how it uses the affected behaviour; those findings call for review rather than being merely advisory.

In practice, a reviewer should work through Severe items first, assess each Warning against actual application usage, and treat Recommendations as optional clean-up that reduces future migration effort. Recommendations alone should not block a move to the target environment, which is why they are labelled informational rather than as a defect.

WebSphere Application Server 9.0.5 on distributed platforms uses the IBM SDK, Java Technology Edition, and the product is designed so that the Java SDK is serviced separately from the application server's own code. The SDK can be installed and updated as a package in its own right through Installation Manager, and the managesdk command lets administrators choose which installed SDK a profile uses. That separation means a new SDK service release can be applied without waiting for an application server fix pack, which supports option D, that the Java SDK version can be updated independently.

The other statements are less accurate for this release. Option A claims that both 32-bit and 64-bit SDKs are supported, but the product now runs on 64-bit platforms only, so a 32-bit SDK is not supported. Option B says the SDK is embedded with the product, whereas it is delivered as a separate package that Installation Manager installs alongside the server. Option C suggests that SDKs used with version 8.5.5 are supported, but each release supports the SDK levels that IBM certifies for it, and the earlier release's Java 6 and 7 levels are not.

After updating an SDK, administrators should use managesdk to verify and, where required, change the default or per-profile SDK, restart the servers, and check the Java level from the startup messages.

Security auditing records events that relate to authentication, authorisation, and administrative actions, so that an organisation can establish accountability and detect misuse. The audit function is part of the security subsystem and depends on it being active. Two prerequisites follow from that arrangement: the administrative security, which is global security, has to be turned on, and the security auditing subsystem itself has to be enabled. In the product's terminology these are the security subsystem and global security, and option B names them together.

Option A is incorrect because Java 2 security is a separate policy mechanism governing code access to resources and is not a prerequisite for auditing. Option C introduces auditable events, which are the event types that are selected for recording once auditing is functioning; selecting them is part of audit policy configuration and not a precondition for enabling it. Option D uses application security, which controls whether security applies to applications, and, although it commonly accompanies global security, it is not what auditing requires.

After enabling the subsystem, administrators configure the audit event types, the audit filters, and the audit service provider, including the binary log provider with signing and encryption where tamper resistance is needed. They also need an auditor role assigned to review and manage the audit records.

The requirement has three parts: the deployment manager must sit on system A, a single node must sit on system B, and that node must not contain a default server or the default applications. Each profile type answers a different need. A management profile with the deployment manager server type provides the administrative hub for the cell on system A. For system B, a custom profile creates a node with no servers and no applications, ready to be federated into the cell, which satisfies the final condition. After creation, the node is added with the addNode command, and servers are then defined through the deployment manager.

Option C proposes an application server profile on system B. That profile type creates server1 and installs the default applications, so it breaks the stated condition. A cell profile, referred to in options A and B, creates a deployment manager and one federated application server node together on a single machine; it cannot place the two parts on separate systems by specifying a target, and copying configuration folders between machines followed by syncNode is not a supported way of building a cell.

The recommended topology for a distributed cell is therefore a management profile on one machine and custom profiles on each machine that will host application servers, making D the correct answer.

Memory-to-memory session persistence uses the data replication service to copy session state between servers, so sessions survive the failure of one server without a database. The risk to avoid is concentrating the only copy of a session in a single place. Configuring more than one session replica means each session's data exists in at least two other locations, so a failover can still find the session even if a replica is lost at the same time. Option A states this principle and describes the configuration that minimises data loss.

The options mentioning GetDWLMTable are less suitable. GetDWLMTable is a plug-in setting that makes the plug-in retrieve dynamic workload management table data from the server, which concerns routing information in the Intelligent Management environment and does not govern how many copies of the session data are kept. Peer-to-peer replication, option B, copies sessions between all members of a replication domain, and it is a valid mode, but the question asks about minimising loss, which depends on the number of replicas. Server replication and client replication, options C and D, specify where the replicas are held, with different trade-offs, and the GetDWLMTable setting alone does not reduce the risk.

Administrators should size the replication domain to the number of replicas chosen, as additional copies increase network traffic and memory usage.

A Java EE application that exposes or consumes JAX-WS services can define its web service metadata in two ways, through annotations in the code and through the webservices.xml deployment descriptor. The descriptor is optional in this model, because annotations alone are sufficient, so it is not required, which rules out option A. The JAX-WS specification, together with the web services metadata specification it builds on, establishes a precedence rule: where both sources define the same item, the information given in the deployment descriptor overrides what the annotations specify. That is the position described in option B, and it lets an administrator or assembler adjust values such as port component names without changing the source code.

Option C is incorrect because wsdeploy is associated with the older JAX-RPC model and does not apply to JAX-WS applications in this release; JAX-WS annotated classes are discovered and prepared automatically when the application is installed. Option D is also incorrect because JAX-WS applications do not require additional product-specific bindings or deployment descriptors for ordinary deployment, since the runtime assembles the endpoint from the annotations.

When a service behaves differently from the annotations, the first check should therefore be whether a webservices.xml file in the module is overriding them. Policy sets and bindings can then be attached separately for qualities of service such as security and reliable messaging.

1. jre/lib and jre/lib/ext

2. java.ext.dirs

3. shared libraries

4. WEB-INF/classes and WEB-INF/lib

With the parent first class loader mode, a class loader asks its parent to load a class before it tries to load the class itself, so lookup proceeds from the broadest scope to the narrowest. The order for an application therefore runs as follows. First, the Java virtual machine's own class path is searched, which includes the jre/lib and jre/lib/ext directories. Second, the directories listed in the java.ext.dirs system property are consulted, which carries the WebSphere extensions and runtime classes. Third, the shared libraries associated with the application are searched. Fourth, and last, the application's own classes are loaded from WEB-INF/classes and WEB-INF/lib.

Placing the application's classes last means that any class available higher in the hierarchy takes precedence over a class of the same name that the application packages. That behaviour protects the integrity of the server runtime and provides consistent versions, but it also means an application that bundles a different version of a library supplied by the server will see the server's copy. Applications that must use their own versions should be set to parent last, in which case the application's classes are checked ahead of the parent's.

Class loader conflicts can be diagnosed with the class loader viewer in the administrative console, which displays the loaders and their search paths.

A class loader policy in WebSphere Application Server controls how many application class loaders are created for the applications on a server. The product recognises two values, Multiple and Single, so options A and C are correct. With the Multiple policy, each application receives its own class loader, which isolates applications from one another and allows each to carry its own versions of libraries without conflict. With the Single policy, one class loader is shared by all applications on that server, so classes are visible across applications. That reduces memory consumption in some cases but removes the isolation, and a library version required by one application becomes visible to all of them.

The remaining options are not defined by the product. Sequential, Compact, and Ordered do not describe a class loader policy. The term "ordered" might be confused with the class loading order setting, which is a separate attribute choosing between parent first and parent last delegation; it is not a policy value for application class loaders.

Administrators set the policy on the application server's configuration, and it works together with the class loading mode, which determines the search order. Most deployments retain Multiple because isolation prevents version collisions between applications that share a server.

When a profile is created with default settings and administrative security is turned on, the product has to have a user registry in place so that the administrative user can authenticate. It configures the file-based federated repository as the active registry. That repository stores the administrative user and group definitions in a file in the profile's configuration, and it is a federated repositories realm that contains a single file-based repository. Option D is correct. The administrator can later add LDAP or other repositories to the realm, or switch the active registry to a stand-alone LDAP registry or a custom registry, once the profile is running.

The other options name registry types that are possible choices after creation, but are not what the profile creation sets up. A stand-alone LDAP registry, option A, and a stand-alone custom registry, option B, are alternative configurations that an administrator selects deliberately. The term Federated Repository in option C names the realm technology in general and does not identify the repository that actually holds the identities at creation time.

The practical implication is that a freshly created profile with security enabled can be used at once, with the administrator ID and password supplied during creation. For production, organisations usually point the realm to a corporate LDAP directory, and they take care to keep the administrative identity defined in a repository that stays available.

A service integration bus is the messaging infrastructure of WebSphere Application Server's service integration technology. It supplies the transport, destinations, and persistence behind the default messaging provider: applications look up JMS connection factories and destinations that resolve to a bus, and the messaging engines running on bus members move the messages. Option C captures that relationship, a component used by the default messaging provider for transport.

Each alternative misplaces the bus. Option A is wrong because internal communication between administrative services is handled by the administrative connectors and the high availability manager, not by a bus. Option B is wrong because mediations are services that can be attached to bus destinations to process messages in flight; they are not deployed onto an embedded IBM MQ JMS provider, and the embedded provider concept does not apply to the bus in that way. Option D is wrong because the bus is not a separate product. IBM MQ is the separate product, and it can be connected to a bus through an MQ link or used directly through the IBM MQ messaging provider, but the bus itself is part of the application server.

When planning a bus, administrators add application servers or clusters as bus members, and each member hosts or can host messaging engines, which determines availability and scalability.

The node agent is represented in the cell by managed beans, and the AdminControl object of wsadmin operates on those running MBeans. A node agent MBean exposes operations including stopNode and restart, so the administrator first obtains the MBean identifier, for instance with AdminControl.queryNames for type NodeAgent and the node name, and then calls AdminControl.invoke(nodeAgentMBean, 'restart'). The node agent then restarts itself, and the deployment manager's view of the node returns to normal when the process is up. Option B describes that call.

AdminConfig, option A, works with configuration documents in the repository, and it has no method that sets server status. AdminTask offers administrative commands such as startServer and stopServer, but the command shown in option C, restartServer with the serverName parameter, is not a node agent restart operation; the node agent has its own stop and start procedures. AdminApp, option D, deals with installation and updates of applications, so updateInteractive has no relationship to server restarts, and 'restartApp' is not a valid argument.

An important practical point is that a node agent that is stopped cannot be restarted through the deployment manager, because the process that carries the MBean is not running. In that situation the node's startNode command has to be run locally on the node.

An application migration report is organised into sections, each with a different level of detail and a different audience. The Technology Evaluation Summary section sits at the top, and it answers a strategic question: given the technologies the application uses, which IBM runtime platforms suit it best. The analysis examines the application's use of specifications and APIs, and then indicates the fit with the platforms the report evaluates, such as traditional WebSphere Application Server, Liberty, and options for containers, so that a decision-maker can see where the application could run with the least rework. Option D is correct.

The other descriptions belong to different parts of the report. A list of the features needed in the Liberty server.xml file, option A, is the kind of information given in the Liberty-related recommendations, where features are mapped to the technologies used. A high-level view of the content and structure of the application, option B, is given by the application inventory or summary of its modules. A detailed analysis with file names and line numbers for infractions, option C, is the content of the detailed results, which identify the individual rule violations that a developer must fix.

Reading the report in order from summary to detail is the efficient approach: use the technology evaluation to choose a target, then the detailed section to estimate and plan the changes.

The on demand router is a component of Intelligent Management that sits in front of the application servers and routes incoming traffic to them. It is a Java-based proxy that receives HTTP requests and SIP messages and forwards them to the back-end application servers, selecting a target according to workload information, routing rules, and service policies. It also takes part in dynamic operations such as queueing and prioritising requests and routing around unhealthy servers. Option D describes it accurately.

The other statements are not correct. Option A says the router cannot be run in a virtualised environment, but it runs as an ordinary server process on a node and can be virtualised in the same way as other servers. Option B says that it requires a dedicated node, whereas it can share a node with other servers, although a dedicated node is a common practice for performance and isolation. Option C says it should be run in the DMZ, but the security guidance for the product places it inside the internal network behind the web server in the DMZ, in the same way as the application servers. The product also supports configurations in which the router replaces the web server plug-in for request distribution.

Administrators typically deploy at least two routers for availability, and use the dynamic workload management data to keep routing decisions consistent between them.

The high availability manager is a service that runs in every server process of the cell and provides a framework for making components highly available. It maintains information about which servers are in each core group and which of them hosts a component. A key use is the failover of services that must run in only one place at a time. The best-known example is the messaging engine of the service integration bus: when the server running the engine fails, the high availability manager activates the engine on another member of the cluster, so messaging resumes. Option D is correct. The manager also supports transaction log recovery, memory-to-memory replication, and the singleton services for the on demand router.

The other statements are false. Option A is false because the manager is enabled by default on the servers. Option B is false because the setting can be administered in the console, in the server's high availability manager service page, where it can be enabled or disabled for each process. Option C is false because the deployment manager is itself a member of the cell's core group, and therefore does have the service, with the node agents and application servers.

Administrators should be cautious about disabling the manager on a server, since any component that relies on it would lose its failover capability, and core group sizes must be managed to limit the traffic that it generates.

Application security roles in an enterprise application are mapped to users, groups, or special subjects, and the special subjects are a convenient way to grant a role to broad categories of caller without naming individuals. The product supplies two principal special subjects: All Authenticated, in the application's realm or in the trusted realms, and Everyone. When the application uses external identity providers, such as when authentication is carried out by a third-party provider through a trust association or by a token from another realm, the callers belong to a realm other than the application's own. The special subject that covers any authenticated user in the trusted realms is "All authenticated in the trusted realm", which is option A.

The application-realm variant, option B, includes only users authenticated in the application's own realm, which would exclude callers who arrive from the external provider. Everyone, option D, grants the role to any caller including unauthenticated ones, which is a much weaker control than the question implies. None, option C, is not a mapping that would grant access.

When mapping roles in the administrative console during installation, or later through the Security role to user/group mapping page, administrators should prefer the narrowest subject that serves the purpose, and test with a user from the external provider to confirm the expected access.

Modernisation is justified by business and operational outcomes, and two of the listed reasons are legitimate. Speeding in-market delivery is a central motive: moving an application to a cloud environment, and often packaging it in containers, lets teams use automated build and release pipelines, provision environments on demand, and deliver changes more often. Reducing complexity and costs is the second: consolidating infrastructure, using pay-as-you-go capacity, and retiring ageing platforms lower the burden of operating the estate. Options B and D are correct.

The remaining statements describe side effects or goals that are not reasons in themselves. Making source code simpler, option A, may occur if an application is refactored, but a move to the cloud does not simplify code, and rewriting for that purpose is an expensive end in itself. Making the application faster, option C, is not a dependable result, because performance depends on design, and an application that is moved without change usually performs much as before. A better user experience, option E, relates to the application's interface and functionality, which modernisation of the platform does not by itself change.

Transformation Advisor helps to prioritise by estimating the effort per application, so the organisation can begin with the candidates that have the best ratio of benefit to work.

First failure data capture (FFDC) writes exception summaries and incident files to the profile's ffdc directory. Retention of those files is controlled by the ExceptionFileMaximumAge property, which sets how long an FFDC file may remain before it becomes eligible for purging. The product reads FFDC settings from three separate property files, and each file is consulted at a different point in the server lifecycle. ffdcRun.properties applies while the server is running, ffdcStart.properties applies during startup processing, and ffdcStop.properties applies during shutdown. For the purge policy to behave identically in all three phases, ExceptionFileMaximumAge has to carry the same value in every one of them, which is the position stated in option C.

Options A, B, and D each leave out at least one of the files. Updating only ffdcRun.properties, for example, would change the retention age for a running server but leave startup and shutdown purges operating on the previous value, so files could be removed on an inconsistent schedule or accumulate longer than intended. Option A also refers to "ffdcStart properties" without the .properties extension and names a single file, so it fails on both counts.

The practical rule for administrators is to treat the three files as one logical configuration and edit them together whenever FFDC retention is tuned.

Class-loading faults in WebSphere Application Server surface as standard Java throwables, and two from the list are genuine. ClassCastException occurs when code casts an object to a type of which it is not an instance. In class-loader terms, it is a classic symptom of the same class name being loaded by two different class loaders: the two Class objects are distinct to the JVM, so an object created from one fails a cast to the other. This commonly appears when a library exists in both an application and a shared library, or when parent-first and parent-last settings produce duplicate copies.

UnsatisfiedLinkError is thrown when the JVM cannot link a native method, typically because the native library cannot be found or, importantly in application servers, because a native library has already been loaded by a different class loader. A JVM allows a given native library to be bound to only one class loader, so redeployment or multiple loaders in the same server can trigger the error.

The remaining choices, NoClassFoundLibraryException, GeneralClassError, and DuplicatedClassException, are not exceptions in the Java platform or WebSphere runtime. Administrators looking for real class-loading evidence should also watch for ClassNotFoundException and NoClassDefFoundError, which were not offered here. The correct selections are therefore D and E.