Skip to content

IBM Cloud Security Engineer (C1000-173) - Exam Strategy

Format reminder

  • 60 questions, 90 minutes
  • Pass mark: 70% (42 of 60)
  • Multiple choice + multiple select + scenario-based
  • Tests IBM Cloud security stack: IAM, network, key management, compliance, threat detection, with hooks into IBM Z / IBM Power for hybrid

Top traps

  1. IAM hierarchy: Account → Resource Groups → Resources. Access Groups bundle policies. Service IDs replace user IDs for workloads. Trusted Profiles for federated identities. Don't conflate.

  2. Key Protect vs Hyper Protect Crypto Services (HPCS):

  3. Key Protect: FIPS 140-2 L3, BYOK, suitable for most regulated

  4. HPCS: FIPS 140-2 L4, KYOK ("Keep Your Own Key" - operator can't access), highest assurance Pick by compliance requirement.

  5. VPC vs Classic Infrastructure: VPC is the modern offering; Classic is legacy IaaS. Modern security questions assume VPC unless specified.

  6. Transit Gateway: connects VPCs across regions and to Classic Infrastructure. Single attachment per VPC.

  7. Direct Link types: Connect (via SP, lower bandwidth), Dedicated (customer-owned circuit, higher bandwidth). Both private; encryption recommended.

  8. Security and Compliance Center (SCC): posture management + compliance profiles + evidence collection. Replaces older offerings.

  9. Activity Tracker vs Log Analysis:

  10. Activity Tracker: audit logs (who did what)

  11. Log Analysis (now Cloud Logs): platform + app logs Different services with different scopes.

  12. QRadar: IBM's SIEM/SOAR. The IBM-native SIEM answer.

  13. Hyper Protect family: Hyper Protect Crypto Services (keys), Hyper Protect Virtual Servers (confidential VMs on IBM Z), Hyper Protect DBaaS (encrypted MongoDB / PostgreSQL). All built on IBM Z Secure Execution.

  14. VPN vs Direct Link: VPN over internet (encrypted, lower SLA); Direct Link private (higher SLA, optional encryption). Pick by privacy + bandwidth needs.

High-yield topics easy to miss

  • IBM Cloud Service Endpoints (private connectivity to IBM Cloud services without internet)
  • Code Engine (managed serverless container platform on IBM Cloud)
  • IBM Cloud Container Registry security (vulnerability advisor, signed images)
  • IBM Cloud Code Risk Analyzer (SAST/SCA in CI/CD)
  • IBM Cloud Internet Services (CIS - Cloudflare-based DNS + WAF + DDoS)
  • IBM Verify (SaaS IDaaS) - separate from cloud IAM, federated for workforce
  • IBM zSystem-specific concepts: pervasive encryption, RACF integration

Time management

90 / 60 = 1.5 min/question. Time pressure is moderate. Pace: half done by 45 min.

When stuck

  1. Identify the layer - identity (IAM / Verify), network (VPC / Direct Link / CIS), data (Key Protect / HPCS), ops (SCC / Activity Tracker / QRadar).
  2. Default to IBM-native services - they're tested first.
  3. Match compliance level to product - HPCS for highest assurance; Key Protect for typical regulated; default for non-regulated.

Day-of logistics

90 min, 60 questions. Pearson VUE.

After

Pass: Cert valid 3 years (recertification recommended).

Fail: Most failures cluster on Compliance Operations (~25%) or IAM (~20%).

C1000-173 patterns

  • "Environment isolation for admins" = Access Groups + Resource Groups
  • "Customer-managed keys, FIPS 140-2 L4" = Hyper Protect Crypto Services (KYOK)
  • "Customer-managed keys, FIPS 140-2 L3" = Key Protect
  • "Private hybrid" = Direct Link
  • "Inter-VPC + multi-region" = Transit Gateway
  • "Continuous compliance" = Security and Compliance Center
  • "SIEM" = QRadar
  • "Audit logging" = Activity Tracker
  • "Confidential computing" = Hyper Protect Virtual Servers (IBM Z Secure Execution)
  • "Private service access" = IBM Cloud Service Endpoints
  • "Managed DDoS + WAF" = Cloud Internet Services (CIS)