IBM Cloud Advocate (C1000-176): AI, DevOps, and Security¶

Table of Contents¶

1. Watson AI Services
2. Machine Learning and Data Science
3. DevOps Services
4. CI/CD Pipelines
5. Infrastructure as Code
6. Identity and Access Management (IAM)
7. Security Services
8. Compliance and Governance
9. Monitoring and Logging
10. Exam Tips

Watson AI Services¶

Watson AI Overview¶

IBM Watson provides pre-built AI models and services that developers can integrate into applications without requiring deep machine learning expertise.

Watson AI Categories: - Natural Language Processing (NLP) - Speech and Audio - Vision and Image Recognition - Data and Knowledge - Conversational AI

Watson Assistant¶

Build conversational interfaces and chatbots.

Key Features: - Natural language understanding - Dialog management - Multi-channel deployment (web, mobile, messaging) - Integration with voice assistants - Analytics and insights - Multiple language support - Entity recognition and intent classification

Concepts:

Intents: User goals or purposes
  Example: #greeting, #make_reservation, #check_balance

Entities: Specific information in user input
  Example: @date, @location, @product

Dialog: Conversation flow logic
  Example: If intent=#greeting, respond with "Hello!"

Actions: New skill-based approach
  Example: Check account balance, Book appointment

Working with Watson Assistant:

# Create Watson Assistant instance
ibmcloud resource service-instance-create my-assistant \
  conversation \
  plus \
  us-south

# Get service credentials
ibmcloud resource service-key-create my-assistant-key \
  --instance-name my-assistant \
  --role Manager

# Python SDK example
from ibm_watson import AssistantV2
from ibm_cloud_sdk_core.authenticators import IAMAuthenticator

authenticator = IAMAuthenticator('your-api-key')
assistant = AssistantV2(
    version='2023-06-15',
    authenticator=authenticator
)
assistant.set_service_url('your-service-url')

# Create session
session = assistant.create_session(
    assistant_id='your-assistant-id'
).get_result()

# Send message
response = assistant.message(
    assistant_id='your-assistant-id',
    session_id=session['session_id'],
    input={
        'message_type': 'text',
        'text': 'Hello'
    }
).get_result()

print(response['output']['generic'][0]['text'])

Use Cases: - Customer service chatbots - Virtual assistants - FAQ automation - Lead qualification - IT helpdesk - Appointment scheduling

Watson Discovery¶

AI-powered search and text analytics.

Key Features: - Document ingestion and parsing - Natural language queries - Entity extraction - Sentiment analysis - Relationship detection - Smart document understanding - Custom machine learning models

Document Processing:

Supported Formats:
- PDF, Word, PowerPoint
- HTML, JSON, XML
- Plain text

Processing Steps:
1. Document conversion
2. Enrichment (entities, concepts, sentiment)
3. Indexing
4. Query optimization

Working with Watson Discovery:

from ibm_watson import DiscoveryV2
from ibm_cloud_sdk_core.authenticators import IAMAuthenticator

authenticator = IAMAuthenticator('your-api-key')
discovery = DiscoveryV2(
    version='2023-03-31',
    authenticator=authenticator
)
discovery.set_service_url('your-service-url')

# Create project
project = discovery.create_project(
    name='My Project',
    type='document_retrieval'
).get_result()

# Add document
with open('document.pdf', 'rb') as f:
    discovery.add_document(
        project_id=project['project_id'],
        collection_id='collection-id',
        file=f,
        filename='document.pdf'
    )

# Query documents
response = discovery.query(
    project_id=project['project_id'],
    natural_language_query='What is IBM Cloud?'
).get_result()

for result in response['results']:
    print(result['document_passages'][0]['passage_text'])

Use Cases: - Enterprise search - Knowledge management - Customer support insights - Contract analysis - Research and discovery - Compliance monitoring

Watson Natural Language Understanding (NLU)¶

Analyze text to extract metadata and insights.

Features:

Text Analysis:
- Entities (people, places, organizations)
- Keywords
- Categories
- Concepts
- Emotion
- Sentiment
- Relations
- Semantic roles

Working with Watson NLU:

from ibm_watson import NaturalLanguageUnderstandingV1
from ibm_watson.natural_language_understanding_v1 import Features, EntitiesOptions, KeywordsOptions, SentimentOptions

authenticator = IAMAuthenticator('your-api-key')
nlu = NaturalLanguageUnderstandingV1(
    version='2022-04-07',
    authenticator=authenticator
)
nlu.set_service_url('your-service-url')

# Analyze text
response = nlu.analyze(
    text='IBM Cloud provides a full stack platform for building cloud-native applications.',
    features=Features(
        entities=EntitiesOptions(sentiment=True, limit=10),
        keywords=KeywordsOptions(sentiment=True, limit=10),
        sentiment=SentimentOptions()
    )
).get_result()

print(f"Sentiment: {response['sentiment']['document']['label']}")
print(f"Entities: {response['entities']}")
print(f"Keywords: {response['keywords']}")

Use Cases: - Social media monitoring - Voice of customer analysis - Content classification - Brand sentiment tracking - Competitive intelligence - Risk assessment

Watson Speech to Text¶

Convert audio to written text.

Key Features: - Real-time transcription - Batch processing - Multiple language support - Custom language models - Speaker diarization - Profanity filtering - Word alternatives and confidence

Supported Audio Formats: - WAV, MP3, FLAC, OGG - PCM, WebM

Working with Speech to Text:

from ibm_watson import SpeechToTextV1
from ibm_cloud_sdk_core.authenticators import IAMAuthenticator

authenticator = IAMAuthenticator('your-api-key')
stt = SpeechToTextV1(authenticator=authenticator)
stt.set_service_url('your-service-url')

# Transcribe audio file
with open('audio.mp3', 'rb') as audio_file:
    response = stt.recognize(
        audio=audio_file,
        content_type='audio/mp3',
        model='en-US_BroadbandModel',
        timestamps=True,
        word_confidence=True
    ).get_result()

for result in response['results']:
    print(result['alternatives'][0]['transcript'])

Use Cases: - Call center transcription - Meeting minutes - Video captioning - Voice assistants - Accessibility features - Content indexing

Watson Text to Speech¶

Convert written text to natural-sounding audio.

Key Features: - Multiple voices and languages - Neural and standard voices - SSML markup support - Pronunciation customization - Audio format options - Expressive synthesis

Working with Text to Speech:

from ibm_watson import TextToSpeechV1
from ibm_cloud_sdk_core.authenticators import IAMAuthenticator

authenticator = IAMAuthenticator('your-api-key')
tts = TextToSpeechV1(authenticator=authenticator)
tts.set_service_url('your-service-url')

# Generate speech
response = tts.synthesize(
    text='Hello! Welcome to IBM Cloud.',
    accept='audio/mp3',
    voice='en-US_AllisonV3Voice'
).get_result()

# Save audio file
with open('output.mp3', 'wb') as audio_file:
    audio_file.write(response.content)

Use Cases: - Voice assistants - Accessibility applications - E-learning platforms - IVR systems - Audiobook generation - Voice alerts and notifications

Watson Studio¶

Integrated environment for data science and machine learning.

Key Components:

Watson Studio Features:
1. Jupyter Notebooks
2. Data refinery (data preparation)
3. AutoAI (automated model building)
4. Model deployment
5. Collaboration tools
6. Git integration
7. Visual modeling (SPSS Modeler)

AutoAI Capabilities: - Automatic data preparation - Algorithm selection - Feature engineering - Hyperparameter optimization - Model evaluation - Pipeline generation

Use Cases: - Data science projects - Machine learning development - Model training and deployment - Team collaboration - Exploratory data analysis - Production ML pipelines

Watson Machine Learning¶

Deploy and manage machine learning models.

Key Features: - Model deployment (REST API) - Batch scoring - Online scoring - Model monitoring - A/B testing - Model governance - AutoAI integration

Deploying a Model:

from ibm_watson_machine_learning import APIClient

# Initialize client
wml_credentials = {
    "url": "https://us-south.ml.cloud.ibm.com",
    "apikey": "your-api-key"
}
client = APIClient(wml_credentials)

# Deploy model
deployment = client.deployments.create(
    model_uid='model-id',
    meta_props={
        client.deployments.ConfigurationMetaNames.NAME: "My Deployment",
        client.deployments.ConfigurationMetaNames.ONLINE: {}
    }
)

# Score data
scoring_payload = {
    "input_data": [{
        "fields": ["age", "income", "education"],
        "values": [[35, 50000, "Bachelor"]]
    }]
}

predictions = client.deployments.score(
    deployment_uid='deployment-id',
    meta_props=scoring_payload
)

Machine Learning and Data Science¶

Watson Knowledge Catalog¶

Data governance and catalog for enterprise data.

Key Features: - Data discovery - Metadata management - Data quality assessment - Data lineage - Policy enforcement - Access control - Data profiling

Use Cases: - Data governance - Compliance management - Data quality monitoring - Metadata management - Enterprise data catalog

IBM Cognos Analytics¶

Business intelligence and analytics platform.

Features: - Interactive dashboards - Report generation - Data visualization - AI-assisted insights - Natural language queries - Mobile access

DevOps Services¶

IBM Cloud Continuous Delivery¶

Integrated DevOps service for building, testing, and deploying applications.

Key Components:

Toolchain: Integrated set of tools
  ├── Source Control (Git, GitHub, GitLab)
  ├── Delivery Pipeline
  ├── IDE (Eclipse Orion Web IDE)
  ├── Issue Tracking (JIRA, GitHub Issues)
  ├── Messaging (Slack, PagerDuty)
  └── Security Scanning (Vulnerability Advisor)

Creating a Toolchain:

# Create toolchain via CLI
ibmcloud dev toolchain-create \
  --name my-toolchain \
  --template simple-toolchain \
  --region us-south

# List toolchains
ibmcloud dev toolchains

# View toolchain details
ibmcloud dev toolchain-get my-toolchain

Delivery Pipeline Stages:

# Example pipeline configuration
stages:
  - name: BUILD
    jobs:
      - name: Build
        type: builder
        script: |
          #!/bin/bash
          npm install
          npm run build

  - name: TEST
    jobs:
      - name: Unit Tests
        type: tester
        script: |
          #!/bin/bash
          npm test

  - name: DEPLOY
    jobs:
      - name: Deploy to Kubernetes
        type: deployer
        script: |
          #!/bin/bash
          kubectl apply -f deployment.yaml

Use Cases: - Application CI/CD - Automated testing - Multi-stage deployments - Integration with IBM Cloud services - DevSecOps workflows

IBM Cloud Shell¶

Browser-based shell environment with pre-installed tools.

Pre-installed Tools: - IBM Cloud CLI and plugins - kubectl (Kubernetes CLI) - oc (OpenShift CLI) - terraform - helm - git - jq, yq - Node.js, Python - Docker CLI

Features: - 500 MB persistent storage - Session timeout: 1 hour idle, 4 hours maximum - File upload/download - Multiple terminal sessions - Cloud Shell Editor (VSCode-like)

Use Cases: - Quick CLI access without local installation - Cloud resource management - Script development and testing - Learning and experimentation - Remote administration

CI/CD Pipelines¶

Pipeline Best Practices¶

1. Version Control Everything:

Source Code → Git
Infrastructure → Terraform
Configuration → YAML/JSON
Documentation → Markdown

2. Automated Testing:

Unit Tests → Code level
Integration Tests → Component interaction
System Tests → End-to-end
Security Tests → Vulnerability scanning
Performance Tests → Load testing

3. Deployment Strategies:

Blue-Green Deployment:
  - Two identical environments
  - Switch traffic between them
  - Zero downtime
  - Easy rollback

Canary Deployment:
  - Gradual rollout to subset of users
  - Monitor metrics
  - Progressive increase
  - Risk mitigation

Rolling Update:
  - Update instances incrementally
  - Maintain availability
  - Gradual migration
  - Built-in Kubernetes support

Tekton Pipelines¶

Cloud-native CI/CD framework (integrated in OpenShift).

Core Resources:

# Task: Reusable unit of work
apiVersion: tekton.dev/v1beta1
kind: Task
metadata:
  name: build-image
spec:
  params:
    - name: image
      type: string
  steps:
    - name: build
      image: gcr.io/kaniko-project/executor:latest
      args:
        - --dockerfile=Dockerfile
        - --destination=$(params.image)

---
# Pipeline: Sequence of tasks
apiVersion: tekton.dev/v1beta1
kind: Pipeline
metadata:
  name: build-and-deploy
spec:
  params:
    - name: image-name
  tasks:
    - name: build
      taskRef:
        name: build-image
      params:
        - name: image
          value: $(params.image-name)
    - name: deploy
      taskRef:
        name: deploy-to-cluster
      runAfter:
        - build

---
# PipelineRun: Execution of a pipeline
apiVersion: tekton.dev/v1beta1
kind: PipelineRun
metadata:
  name: build-and-deploy-run
spec:
  pipelineRef:
    name: build-and-deploy
  params:
    - name: image-name
      value: myapp:v1

Infrastructure as Code¶

IBM Cloud Schematics¶

Terraform as a Service for IBM Cloud.

Key Features: - Managed Terraform execution - State management - Version control integration - Workspace management - Cost estimation - Drift detection - Terraform v1.0+ support

Working with Schematics:

# Create workspace
ibmcloud schematics workspace new \
  --name my-workspace \
  --location us-south \
  --terraform-version 1.5 \
  --github-url https://github.com/user/terraform-config

# Generate plan
ibmcloud schematics plan --id <workspace-id>

# Apply configuration
ibmcloud schematics apply --id <workspace-id>

# View workspace
ibmcloud schematics workspace get --id <workspace-id>

# Destroy resources
ibmcloud schematics destroy --id <workspace-id>

# Delete workspace
ibmcloud schematics workspace delete --id <workspace-id>

Example Terraform Configuration:

# main.tf
terraform {
  required_providers {
    ibm = {
      source = "IBM-Cloud/ibm"
      version = "~> 1.58"
    }
  }
}

provider "ibm" {
  region = var.region
}

# Create VPC
resource "ibm_is_vpc" "main" {
  name = "${var.prefix}-vpc"
  resource_group = var.resource_group_id
}

# Create subnet
resource "ibm_is_subnet" "main" {
  name            = "${var.prefix}-subnet"
  vpc             = ibm_is_vpc.main.id
  zone            = var.zone
  ipv4_cidr_block = "10.240.0.0/24"
  resource_group  = var.resource_group_id
}

# Create security group
resource "ibm_is_security_group" "main" {
  name = "${var.prefix}-sg"
  vpc  = ibm_is_vpc.main.id
  resource_group = var.resource_group_id
}

# Security group rule
resource "ibm_is_security_group_rule" "allow_https" {
  group     = ibm_is_security_group.main.id
  direction = "inbound"
  remote    = "0.0.0.0/0"
  tcp {
    port_min = 443
    port_max = 443
  }
}

# Create Kubernetes cluster
resource "ibm_container_vpc_cluster" "main" {
  name              = "${var.prefix}-cluster"
  vpc_id            = ibm_is_vpc.main.id
  flavor            = "bx2.4x16"
  worker_count      = 3
  resource_group_id = var.resource_group_id
  zones {
    subnet_id = ibm_is_subnet.main.id
    name      = var.zone
  }
}

# Create PostgreSQL database
resource "ibm_database" "postgres" {
  name              = "${var.prefix}-postgres"
  plan              = "standard"
  location          = var.region
  service           = "databases-for-postgresql"
  resource_group_id = var.resource_group_id

  members_memory_allocation_mb = 4096
  members_disk_allocation_mb   = 20480
}

# variables.tf
variable "prefix" {
  description = "Resource name prefix"
  type        = string
}

variable "region" {
  description = "IBM Cloud region"
  type        = string
  default     = "us-south"
}

variable "zone" {
  description = "Availability zone"
  type        = string
  default     = "us-south-1"
}

variable "resource_group_id" {
  description = "Resource group ID"
  type        = string
}

# outputs.tf
output "vpc_id" {
  value = ibm_is_vpc.main.id
}

output "cluster_id" {
  value = ibm_container_vpc_cluster.main.id
}

output "database_connection" {
  value = ibm_database.postgres.connectionstrings[0].composed
  sensitive = true
}

Use Cases: - Infrastructure provisioning - Environment replication - Disaster recovery setup - Multi-region deployment - Configuration management - Compliance as code

Identity and Access Management (IAM)¶

IAM Overview¶

IBM Cloud IAM provides unified access control for IBM Cloud resources.

Key Concepts:

Subjects: Who can access?
  - Users (IBMid)
  - Service IDs (application identities)
  - Trusted profiles

Resources: What can be accessed?
  - Resource groups
  - Individual resources
  - Account management services

Actions: What can be done?
  - Viewer (read-only)
  - Operator (manage operations)
  - Editor (create/modify/delete)
  - Administrator (full control)
  - Custom roles

IAM Users and Service IDs¶

User Management:

# Invite user to account
ibmcloud account user-invite user@example.com

# List users
ibmcloud account users

# Remove user
ibmcloud account user-remove user@example.com

Service IDs:

# Create service ID
ibmcloud iam service-id-create my-service-id \
  -d "Service ID for application"

# List service IDs
ibmcloud iam service-ids

# Create API key for service ID
ibmcloud iam service-api-key-create my-key my-service-id \
  --description "API key for CI/CD" \
  --file service-key.json

# Delete service ID
ibmcloud iam service-id-delete my-service-id

Access Groups¶

Organize users and service IDs for easier policy management.

Creating Access Groups:

# Create access group
ibmcloud iam access-group-create developers \
  -d "Developer access group"

# Add users to group
ibmcloud iam access-group-user-add developers user@example.com

# Add service ID to group
ibmcloud iam access-group-service-id-add developers my-service-id

# List access groups
ibmcloud iam access-groups

# Assign policy to group
ibmcloud iam access-group-policy-create developers \
  --roles Editor \
  --resource-group-name production

IAM Policies¶

Define who has what access to which resources.

Policy Components:

{
  "type": "access",
  "subjects": [
    {
      "attributes": [
        {
          "name": "access_group_id",
          "value": "AccessGroupId-abc123"
        }
      ]
    }
  ],
  "roles": [
    {
      "role_id": "crn:v1:bluemix:public:iam::::role:Editor"
    }
  ],
  "resources": [
    {
      "attributes": [
        {
          "name": "accountId",
          "value": "account-id"
        },
        {
          "name": "resourceGroupId",
          "value": "resource-group-id"
        }
      ]
    }
  ]
}

Creating Policies:

# Resource-level policy
ibmcloud iam user-policy-create user@example.com \
  --roles Editor \
  --service-name kubernetes \
  --resource-group-name production

# Account management policy
ibmcloud iam user-policy-create user@example.com \
  --roles Administrator \
  --account-management

# Service-specific policy
ibmcloud iam user-policy-create user@example.com \
  --roles Writer \
  --service-name cloud-object-storage \
  --service-instance instance-id

# List policies
ibmcloud iam user-policies user@example.com

IAM Roles¶

Platform Roles: - Viewer: Read-only access - Operator: Perform operational actions (start/stop) - Editor: Create, modify, delete resources - Administrator: Full access including managing access

Service Roles: - Reader: Read service data - Writer: Modify service data - Manager: Full service access

Custom Roles: - Define specific actions - Service-dependent - Granular control

Trusted Profiles¶

Establish trust with compute resources and federated users.

# Create trusted profile for compute resources
ibmcloud iam trusted-profile-create my-profile \
  --description "Profile for Kubernetes pods"

# Add compute resource rule
ibmcloud iam trusted-profile-rule-create my-profile \
  --type "cr_type:IKS_SA" \
  --conditions "namespace:default,name:my-service-account"

Security Services¶

IBM Cloud Key Protect¶

Managed encryption key service.

Key Features: - FIPS 140-2 Level 3 HSM - Envelope encryption - Key lifecycle management - Audit logging - Bring Your Own Key (BYOK) - Key rotation

Working with Key Protect:

# Create Key Protect instance
ibmcloud resource service-instance-create my-kp \
  kms tiered-pricing us-south

# Create root key
ibmcloud kp create my-root-key \
  --instance-id <instance-id>

# List keys
ibmcloud kp list --instance-id <instance-id>

# Wrap (encrypt) data encryption key
ibmcloud kp wrap <key-id> \
  --instance-id <instance-id> \
  --plaintext <base64-encoded-dek>

# Unwrap (decrypt) data encryption key
ibmcloud kp unwrap <key-id> \
  --instance-id <instance-id> \
  --ciphertext <encrypted-dek>

# Rotate key
ibmcloud kp rotate <key-id> \
  --instance-id <instance-id>

Integration with Services:

# Enable encryption for COS bucket
ibmcloud cos bucket-kp-add \
  --bucket my-bucket \
  --key-protect-instance <kp-instance-id> \
  --key-id <root-key-id>

# Enable encryption for Kubernetes cluster
ibmcloud ks cluster master update \
  --cluster my-cluster \
  --kms-instance <kp-instance-id> \
  --crk <root-key-id>

Use Cases: - Data encryption at rest - Compliance requirements - Secrets management - Key rotation automation - Multi-cloud encryption

IBM Cloud Secrets Manager¶

Centralized secrets management service.

Key Features: - Secret storage and versioning - Dynamic secrets generation - Automatic rotation - Access control - Audit logging - Integration with IAM

Secret Types:

Arbitrary Secrets:
- API keys
- Passwords
- Configuration data

IAM Credentials:
- Dynamic IAM API keys
- Time-bound access

Certificates:
- SSL/TLS certificates
- Let's Encrypt integration
- Auto-renewal

Key-Value Secrets:
- Configuration parameters
- Feature flags

Working with Secrets Manager:

# Create Secrets Manager instance
ibmcloud resource service-instance-create my-sm \
  secrets-manager trial us-south

# Create arbitrary secret
ibmcloud secrets-manager secret-create \
  --secret-type arbitrary \
  --name "api-key" \
  --payload "secret-value"

# Get secret
ibmcloud secrets-manager secret-get \
  --secret-type arbitrary \
  --id <secret-id>

# Rotate secret
ibmcloud secrets-manager secret-rotate \
  --secret-type arbitrary \
  --id <secret-id>

Use Cases: - API key management - Database credentials - Certificate management - Application secrets - DevOps automation

IBM Cloud Certificate Manager¶

Manage SSL/TLS certificates.

Key Features: - Certificate lifecycle management - Let's Encrypt integration - Custom certificate upload - Renewal notifications - Integration with CDN and load balancers

Use Cases: - Website SSL certificates - Application TLS - API security - Load balancer certificates

Security and Compliance Center¶

Unified security and compliance monitoring.

Key Features: - Posture management - Configuration monitoring - Compliance assessments - Risk scoring - Remediation guidance - Custom profiles

Compliance Frameworks: - CIS Benchmarks - PCI DSS - HIPAA - SOC 2 - GDPR - NIST

Use Cases: - Compliance monitoring - Security posture assessment - Risk management - Audit preparation - Continuous compliance

Compliance and Governance¶

IBM Cloud Compliance¶

IBM Cloud maintains extensive compliance certifications:

Global Standards: - ISO/IEC 27001, 27017, 27018 - SOC 1, SOC 2 Type 2, SOC 3 - CSA STAR

Industry-Specific: - PCI DSS (Payment Card Industry) - HIPAA (Healthcare) - FedRAMP (US Government) - FISMA (Federal Information Security) - GDPR (European Data Protection) - ITAR (International Traffic in Arms)

Regional: - EU Model Clauses - APEC Privacy Framework - EU-US Privacy Shield (historical)

Financial Services Cloud¶

Dedicated environment for regulated financial services.

Features: - Isolated compute and network - Enhanced security controls - Compliance automation - Audit support - Dedicated support team

Certifications: - PCI DSS Level 1 - SOC 2 Type 2 - ISO 27001 - Regional banking regulations

Data Residency and Sovereignty¶

Control Options: - Regional Services: Data stays in selected region - Multi-Zone Regions: Data within region boundaries - Private Endpoints: Traffic stays on IBM network - Customer-Managed Keys: Full key control - IBM Cloud Satellite: Deploy anywhere

Monitoring and Logging¶

IBM Cloud Monitoring¶

Prometheus-based monitoring service.

Key Features: - Metrics collection and storage - Custom dashboards - Alerting and notifications - API access - Integration with platform services - PromQL query language

Working with Monitoring:

# Create monitoring instance
ibmcloud resource service-instance-create my-monitoring \
  sysdig-monitor graduated-tier us-south

# Configure platform metrics
ibmcloud ob monitoring config create \
  --instance my-monitoring

# Access Monitoring UI
ibmcloud ob monitoring dashboard open --instance my-monitoring

Common Metrics: - CPU utilization - Memory usage - Disk I/O - Network traffic - Application response time - Error rates

Use Cases: - Infrastructure monitoring - Application performance monitoring - Capacity planning - Anomaly detection - SLA tracking

IBM Cloud Logging¶

Log management and analysis service.

Key Features: - Centralized log aggregation - Real-time log streaming - Log search and filtering - Custom views and alerts - Archiving to Object Storage - Compliance and audit trails

Working with Logging:

# Create logging instance
ibmcloud resource service-instance-create my-logging \
  logdna 7-day us-south

# Configure platform logs
ibmcloud ob logging config create \
  --instance my-logging

# Access Logging UI
ibmcloud ob logging dashboard open --instance my-logging

# Export logs via API
curl -X POST https://api.us-south.logging.cloud.ibm.com/v1/export \
  -H "Authorization: Bearer <token>" \
  -d '{"from": 1234567890, "to": 1234567900}'

Log Sources: - Platform logs (IBM Cloud services) - Application logs - Kubernetes logs - Syslog - Custom log shipping

Use Cases: - Troubleshooting - Security analysis - Compliance auditing - Performance analysis - Incident investigation

IBM Cloud Activity Tracker¶

Track actions and changes to IBM Cloud resources.

Key Features: - User activity tracking - API call logging - Resource change tracking - Compliance auditing - Real-time streaming - Long-term archival

Event Types:

Management Events:
- Resource creation
- Configuration changes
- Access policy updates
- User actions

Data Events:
- Object storage access
- Database queries
- Key usage

Working with Activity Tracker:

# Create Activity Tracker instance
ibmcloud resource service-instance-create my-at \
  logdnaat 7-day us-south

# Configure Activity Tracker
ibmcloud ob at config create \
  --instance my-at

# View events
ibmcloud ob at events --instance my-at

Use Cases: - Security auditing - Compliance monitoring - Incident investigation - Change tracking - User activity analysis

Exam Tips¶

Key Concepts to Master¶

Watson AI: - Understand use cases for each Watson service - Know the difference between NLU, Discovery, and Assistant - Familiar with speech services capabilities - Watson Studio and ML deployment workflow

DevOps: - Continuous Delivery toolchains - Pipeline stages and automation - Infrastructure as Code with Terraform - Schematics workspace management

IAM: - Users vs Service IDs vs Trusted Profiles - Access Groups for policy management - Platform vs Service roles - Policy creation and management

Security: - Key Protect for encryption key management - Secrets Manager for secrets storage - Certificate Manager for SSL/TLS - Difference between BYOK and KYOK

Compliance: - Major compliance certifications - Security and Compliance Center features - Financial Services Cloud - Data residency options

Monitoring: - Monitoring vs Logging vs Activity Tracker - When to use each service - Platform metrics and logs - Audit trail requirements

Sample Questions¶

Q1: Which Watson service should you use to build a customer service chatbot? - A) Watson Discovery - B) Watson Assistant ✓ - C) Watson NLU - D) Watson Studio

Q2: What is the purpose of IBM Cloud Schematics? - A) Create CI/CD pipelines - B) Manage infrastructure as code using Terraform ✓ - C) Monitor application performance - D) Manage user access

Q3: Which IAM identity type should be used for application authentication? - A) User account - B) Service ID ✓ - C) Access Group - D) Trusted Profile

Q4: What is the primary difference between Key Protect and Secrets Manager? - A) No difference - B) Key Protect manages encryption keys, Secrets Manager manages secrets like passwords ✓ - C) Secrets Manager is for databases only - D) Key Protect is deprecated

Q5: Which service tracks user actions and API calls for compliance auditing? - A) IBM Cloud Monitoring - B) IBM Cloud Logging - C) IBM Cloud Activity Tracker ✓ - D) Security and Compliance Center

Hands-On Practice¶

# Practice scenario: Secure application deployment

# 1. Create IAM service ID
ibmcloud iam service-id-create app-service-id

# 2. Create API key
ibmcloud iam service-api-key-create app-key app-service-id \
  --file app-key.json

# 3. Create Key Protect instance and root key
ibmcloud resource service-instance-create my-kp kms tiered-pricing us-south
ibmcloud kp create my-root-key

# 4. Create Secrets Manager instance
ibmcloud resource service-instance-create my-sm secrets-manager trial us-south

# 5. Store secret in Secrets Manager
ibmcloud secrets-manager secret-create \
  --secret-type arbitrary \
  --name "db-password" \
  --payload "secure-password"

# 6. Create monitoring instance
ibmcloud resource service-instance-create my-monitoring \
  sysdig-monitor graduated-tier us-south

# 7. Create logging instance
ibmcloud resource service-instance-create my-logging \
  logdna 7-day us-south

# 8. Configure Activity Tracker
ibmcloud resource service-instance-create my-at \
  logdnaat 7-day us-south

Final Checklist¶

• Understand Watson AI service capabilities and use cases
• Know when to use each Watson service
• Familiar with Watson Studio and ML deployment
• Understand CI/CD pipeline concepts
• Know how to use Schematics for IaC
• Understand IAM users, service IDs, and access groups
• Know how to create and manage IAM policies
• Understand platform vs service roles
• Familiar with Key Protect and encryption concepts
• Know Secrets Manager capabilities
• Understand compliance certifications
• Know Security and Compliance Center features
• Understand monitoring, logging, and Activity Tracker differences
• Practiced basic Watson API calls
• Created IAM policies via CLI
• Deployed infrastructure with Terraform

Watson AI Decision Tree¶

Need natural language processing?
├─ Building a chatbot? → Watson Assistant
├─ Analyzing text sentiment/entities? → Watson NLU
├─ Searching documents? → Watson Discovery
└─ Converting speech?
   ├─ Audio to text? → Speech to Text
   └─ Text to audio? → Text to Speech

Need machine learning?
├─ Automated model building? → AutoAI (Watson Studio)
├─ Custom model development? → Watson Studio
└─ Model deployment? → Watson Machine Learning

Security Service Selection¶

Encryption Keys → Key Protect
Passwords/API Keys → Secrets Manager
SSL/TLS Certificates → Certificate Manager
User Access Control → IAM
Compliance Monitoring → Security and Compliance Center
Audit Trail → Activity Tracker

Conclusion¶

The AI, DevOps, and Security components of IBM Cloud provide essential capabilities for building secure, intelligent, and automated applications. Watson AI services enable you to add AI capabilities without deep ML expertise, while DevOps tools streamline development workflows. IAM and security services ensure proper access control and data protection, and compliance features help meet regulatory requirements.

Focus on understanding when to use each service and how they integrate together. Practice with the free tier offerings and familiarize yourself with the IBM Cloud Console and CLI. Good luck with your exam!