In CAP Node.js projects, the .env file is used to store environment variables that influence application behavior at runtime, such as credentials, service endpoints, or configuration flags. It is automatically loaded by CAP during application startup.

CAP guidelines recommend using .env for environment-specific configuration that should not be hard-coded or committed directly into source files.

Incorrect options:

A: Version control settings are handled by Git configuration files.

B: UI settings belong to UI frameworks, not .env.

Pods in Kubernetes:

Are the smallest deployable unit (A).

Encapsulate one or more containers (C) that share network and storage namespaces.

Incorrect options:

B: Persistent storage is handled via volumes and claims, not pods.

D: Pods can wrap one or multiple containers; not limited to one.

C – Define role templates in xs-security.json

xs-security.json is the core XSUAA configuration file. It defines:

Role templates

Scopes

Attributes

Authorization semantics

To secure the app, developers must definerole templates, which determine which scopes a role grants.

B – Use role names in application descriptors (web.xml in Java apps)

For Java web apps running via Tomcat/Servlet containers,web.xmldefines application-level roles and maps them to XSUAA role templates.

Thus, restricting access involves linking:

web.xml roles → XSUAA role templates → scopes → permissions

Why A and D Are Incorrect:

A:In xs-app.json, scopes define access rules forHTML5 apps via approuter, not Java applications.

D:Scopes belong to xs-security.json, but setting them alone does not restrict application access unless roles and mappings are defined. The question focuses onstepsto restrict access, and B + C describe the necessary actions.

When connecting from a CAP application to thesandboxof SAP API Business Hub (now SAP Business Accelerator Hub) for APIs such as theBusiness PartnerOData service, the learning content and examples describe that:

The sandbox environment is protected by anAPI keythat must be sent in a specific HTTP header (for example, APIKey or similar) with each request.

Tutorials for CAP/Cloud SDK and S/4HANA integration in a training context show configuration steps where developers obtain anAPI keyfrom the hub and configure it in a destination or in custom code for outbound calls.

This matches optionC – API key.

Why the other options are incorrect:

A – Client certificate:Client certificates are common for productive mutual TLS connections, not for the public sandbox.

B – Service principal:“Service principal” is an Azure-specific concept and not how the sandbox on SAP API Business Hub is accessed.

D – OAuth token:Many productive APIs use OAuth 2.0, but thesandboxin the official exercises is specifically accessed using an API key.

In SAP’s CI/CD service:

You may manually trigger a pipeline without committing changes by selecting “Trigger a Build” in the CI/CD job interface.

This initiates the entire pipeline based on the latest version in the configured repository.

Incorrect options:

A: Sync & Share is not related to triggering builds.

B: Local build tasks do not invoke the CI/CD pipeline.

C: Deploy does not execute the CI/CD pipeline.

Comprehensive and Detailed Explanation

The SAP Cloud SDK enhances open-source frameworks for enterprise-grade side-by-side extensions.

B – Multi-tenant persistence

The SDK provides:

Multi-tenant database segregation

Tenant-specific configuration

Automatic resolution of tenant context

Support for SaaS extension scenarios

This feature is essential for SaaS applications built on SAP BTP.

C – Feature toggling

The SDK includes libraries that allow:

Dynamic enabling/disabling of features

Gradual rollout

Canary testing

Tenant-based feature control

This helps enterprise customers deploy new features safely.

Why the Others Are Incorrect:

A – Tightly coupled integration:

SAP strongly promotesloosely coupledarchitectures.

D – Code samples:

The SDK provides samples, but that's not an “enterprise adaptation feature.”