Free Google Apigee-API-Engineer Actual Exam Questions

It’s B—automated smoke tests catch missing configs right after deployment fast.

B imo, smoke tests can catch these missing config issues right after deployment before users notice anything wrong. It’s a quick way to spot problems early, even if the configs are in source control or not.

Makes sense to avoid relying on health checks, so C.

This one’s tricky but I’d go with C here. Using two service callouts lets you explicitly control the order of calls and handle failures more granularly without relying on LoadBalancer health checks that the question doesn’t mention. It feels more straightforward for guaranteed failover. D sounds nice but without info on health checks it could just end up retrying blindly. B is clean but depends on FaultRules which might not be as flexible if you want to add logic later. So, I’d say C makes the failover explicit and manageable.

D imo, B is out since OAuthV2 policies generally don’t deal with storing external tokens—that’s more of a separate system function. Between A, C, and D, I pick C and D easily because credential checks and setting different expirations are standard. A also fits because customizing tokens with extra attributes feels like a common extension point. So A, C, and D seem like the solid picks regardless of which OAuthV2 variant you consider.

Not B, because OAuthV2 policies typically don't handle external token storage directly. A and D are common for token customization and expiration control, while C fits with validating credentials during password grants.

Maybe C. It’s all about letting apps access your info without sharing your password, so the app never actually sees your credentials. That’s the key security benefit here.

Not B, because OAuth’s point isn’t to let random people access your data, but to authorize an app securely. C fits best since it keeps your password hidden from the app while still giving access.

E - SmartDocs is the only one that actually hosts your docs and supports versioning, unlike Apigee-127 which is more for generating static docs. The others just don’t focus on documentation.

Maybe E, since SmartDocs is specifically built for managing API documentation and supports version control, unlike Apigee-127 which mainly focuses on doc generation without hosting or versioning.

B could also fit since smoke tests verify basic functionality before full runs.

It’s C since integration tests really mimic how users interact across components.

Makes sense, SAML tokens have expiration (A) and are signed for verification (C).

A/C? Limited token lifetime is definitely covered since SAML assertions have expiration timestamps. Self-verifiable content also fits because SAML tokens are signed XML documents you can validate without contacting the issuer again. D is out since XML isn’t compact, and E doesn’t work because SAML doesn’t have a built-in refresh mechanism. B is more about how keys are managed outside the token itself, so that’s not really part of SAML’s core features. So yeah, A and C feel like the best match here.

A/D? If conditions are definitely matching but the wrong endpoint is called, maybe the RouteRule targets a generic TargetServer that doesn’t handle this case right. So adding a new TargetServer (D) for your special condition makes sense. On the other hand, if multiple RouteRules overlap and the wrong one gets picked first, making them more specific (A) can help avoid conflicts before jumping to new servers. Both seem valid steps depending on whether the problem is condition specificity or the actual TargetServer setup.

D imo, if the RouteRule is matching but still sending you to the wrong endpoint, maybe the TargetServer it references isn’t set up right for that condition. Adding a new TargetServer specifically for your edge case could clear up the confusion without changing how you order or write your rules. Sometimes the problem isn’t the routing logic but the actual server config behind it.

A seems off since response millis isn’t a common property name.

This one feels like C is the best fit since it lists properties with the typical naming pattern for timeouts in config files—connect.timeout.millis and io.timeoutmillis sound like precise property names. D feels too generic, like descriptions rather than exact property keys. So I’d go with C here.

C, because route rules can dynamically adjust backends without redefining endpoints.

Actually, D makes more sense here because TargetServer lets you define backend targets separately from the endpoint configuration and then reference them, which simplifies managing multiple environments. You can create different TargetServers for dev, test, prod, etc., and just switch references. That way, your endpoint config stays clean, and you avoid duplicating settings. It’s especially handy if the backends share similar URLs but differ by environment names or domains. So, while B is about the overall endpoint, D handles backend targets specifically for each environment in a modular way.

Option A for sure, since refresh tokens are about renewing access tokens.

A/D? Refresh tokens are for getting new access tokens and can be reused until revoked. B is clearly wrong since not all tokens come with refresh tokens, and C is unrelated.

It’s D for sure, and A since it gives access to the cache but doesn’t do analytics or conversions.

D, A only provides access to cache but doesn’t handle analytics or conversions.

Option D, because the Content-Type header must correctly specify application/json for JSONPath to work.

Makes sense that Content-Type needs to be right since it defines the payload format. Going with D here because without it, JSONPath won’t parse properly even if Accept is fine. D

C. Conditional flows are definitely supported because Edge Microgateway proxies need flexibility in routing. The other options mention must-haves that don’t seem like strict requirements.

It’s C for me as well. The key thing is that Edge Microgateway-aware proxies handle conditional flows, which is a core feature. Looking at A and D, neither Node.js targets nor HTTPTargetConnection are hard requirements—they can work with other backends or target types. As for B, quota and OAuth2 policies are useful but definitely not mandatory for every proxy. So C stands out as the only statement that’s always true.

It’s B because query parameters are meant for filtering and don’t change the resource itself. A feels more like an RPC call, not RESTful. Also, POST in D is unnecessary since this is just a GET operation.

It’s B for me too. Using query parameters to specify date ranges fits REST principles since you’re just filtering the orders resource, not creating or updating anything. A puts filters awkwardly in the path, which is more like RPC and less flexible if you want to add other filters later. C adds unnecessary customer context which the question doesn’t ask for. D uses POST, which isn’t right here because GET is meant for retrieving data, and you don’t need a request body just to filter. So B’s clean, straightforward, and makes sense.