Adobe AD0-E124 - Adobe Experience Manager DevOps Engineer Expert

If a Cloud Manager build requires dependencies from a private, password-protected corporate artifact repository, the DevOps engineer must provide Cloud Manager with a custom Maven settings file to handle the authentication. This is done by placing a file at .cloudmanager/maven/settings.xml in the root of the AEM Git repository. Because hardcoding Basic Authentication credentials in Git is a massive security risk, the credentials inside the settings.xml should reference environment variables. The DevOps engineer then uses the Adobe I/O CLI (aio cloudmanager:set-pipeline-variables) to inject the actual username and password as secure pipeline secrets.

Jackrabbit FileVault packages (AEM Content Packages) use a filter.xml file to define the workspace paths being imported and the behavior of the import. The mode attribute on a filter determines how existing nodes are handled.

replace (default): Overwrites existing nodes completely.

merge: Only adds nodes that do not already exist. It explicitly preserves existing content and ignores the updated properties in the incoming package.

If existing pages are not updating upon package deployment, it is because the filter mode is incorrectly set to merge.

In AEM as a Cloud Service, Sling Content Distribution is responsible for moving content and packages between tiers. If the sling-distribution-importer system user lacks the necessary Access Control Lists (ACLs) to write to specific paths, it will throw an AccessDeniedException during package installation. Because AEMaaCS environments are ephemeral and access to traditional local consoles (like User Admin or CRXDE) is restricted or wiped out during updates, all system user creation and ACL configurations must be declared as code. The DevOps engineer must configure these permissions using OSGi factory configurations containing OSGi Repoinit scripts.

In AEM as a Cloud Service, the Preview tier is designed to act as an internal staging ground to verify content exactly as it will look on Publish, but restricted from the general public. By default, the Preview Service is completely blocked from external access via a default IP Allow List. To grant access to specific internal authors or stakeholders, the DevOps engineer must first remove/unbind this default blocking rule, and then create and bind a custom IP Allow List via Cloud Manager that explicitly whitelists the corporate IP addresses or VPN IP ranges of those specific authors.

AEM as a Cloud Service enforces strict architectural rules analyzed by the aemanalyser-maven-plugin. This analyzer scans the compiled project to ensure it is compliant with cloud standards. If a custom OSGi bundle relies on external Java packages but fails to explicitly declare them in the Import-Package section of its manifest (often managed by the bnd-maven-plugin), the analyzer feature model validation will fail. This failure frequently manifests as a downstream assembly error where the analyzer's output archive is empty because it crashed during bundle inspection. Resolving the missing Import-Package headers fixes the analyzer model creation.

Role-Based Access Control (RBAC) in Adobe Cloud Manager is strictly managed via the Adobe Admin Console. The "Developer" role grants read-only access to environments and pipelines, allowing the user to view execution steps, download logs, and access the Developer Console to push Git commits. However, the Developer role cannot initiate, override, or cancel pipeline executions. To trigger a build (making the Build button visible and active), the user must be assigned the "Deployment Manager" role within the Admin Console.

When troubleshooting routing or Virtual Host configurations on a Dispatcher (which is typically an Apache or Nginx web proxy), the proxy relies on the Host HTTP header to determine which farm or server block should process the request. Using cURL, you can bypass DNS layers and test the origin server directly by specifying the target IP or default hostname (e.g., origin-mysite.adobeqms.com) while explicitly passing the desired Virtual Host name via the Host header (-H "Host: mysite.com"). This forces the Dispatcher to process the request as if it were traffic coming for mysite.com.

Adobe Support has strict Service Level Agreement (SLA) definitions for priority levels.

P1 (Critical): The production application is completely down and unavailable to end-users (e.g., Publish tier is crashed).

P2 (Serious): A core, business-critical function is down for all users, causing severe revenue or operational impact.

P3 (Interruption to normal operations): The application is functional, but specific users are experiencing degraded performance or feature loss (like a broken authoring workflow).

Even though the business has a deadline (a product launch within 24 hours), the fact that the live production site is still up and only two authors are currently reporting an inability to activate pages categorizes this strictly as a P3 issue according to standard Adobe support guidelines.

Unclosed JCR sessions are a classic cause of memory leaks in AEM applications. When custom backend code opens a JCR Session or ResourceResolver but fails to close it within a finally block, the garbage collector cannot reclaim that memory. Over time, these open sessions accumulate in the heap memory, causing the system to slow down and eventually leading to unpredictable OutOfMemory (OOM) crashes. Restarting the instance clears the heap, temporarily mitigating the issue until the unclosed sessions build up again. This issue is agnostic of visitor peaks or runmodes (author/publish).