Question 1

Refer to the exhibit. https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/MuleSoft_MCPA-Level-1/page_10_img_2.jpg A developer is building a client application to invoke an API deployed to the STAGING environment that is governed by a client ID enforcement policy. What is required to successfully invoke the API?

Accepted Answer

C

Explanation: Correct Answer: The client ID and secret obtained from Anypoint Exchange for the API instance in the STAGING environment ***************************************** >> We CANNOT use the client ID and secret of Anypoint Platform account or any individual environments for accessing the APIs >> As the type of policy that is enforced on the API in question is "Client ID Enforcment Policy", OAuth token based access won't work. Right way to access the API is to use the client ID and secret obtained from Anypoint Exchange for the API instance in a particular environment we want to work on.

Question 2

What is true about the technology architecture of Anypoint VPCs?

Accepted Answer

B

Explanation: Correct Answer: Traffic between Mule applications deployed to an Anypoint VPC and on-premises systems can stay within a private network ***************************************** >> The private IP address range of an Anypoint VPC is NOT automatically chosen by CloudHub. It is chosen by us at the time of creating VPC using thr CIDR blocks. CIDR Block: The size of the Anypoint VPC in Classless Inter-Domain Routing (CIDR) notation. For example, if you set it to 10.111.0.0/24, the Anypoint VPC is granted 256 IP addresses from 10.111.0.0 to 10.111.0.255. Ideally, the CIDR Blocks you choose for the Anypoint VPC come from a private IP space, and should not overlap with any other Anypoint VPC’s CIDR Blocks, or any CIDR Blocks in use in your corporate network. https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/MuleSoft_MCPA-Level-1/page_6_img_1.jpg that each CloudHub environment requires a separate Anypoint VPC. Once an Anypoint VPC is created, we can choose a same VPC by multiple environments. However, it is generally a best and recommended practice to always have seperate Anypoint VPCs for Non-Prod and Prod environments. >> We use Anypoint VPN to link the underlying AWS VPC to an on-premises (non AWS) private network. NOT VPC Peering. Reference: https://docs.mulesoft.com/runtime-manager/vpn-about Only true statement in the given choices is that the traffic between Mule applications deployed to an Anypoint VPC and on-premises systems can stay within a private network. https://docs.mulesoft.com/runtime-manager/vpc-connectivity-methods-concept

Question 3

A new upstream API Is being designed to offer an SLA of 500 ms median and 800 ms maximum (99th
percentile) response time. The corresponding API implementation needs to sequentially invoke 3
downstream APIs of very similar complexity.
The first of these downstream APIs offers the following SLA for its response time: median: 100 ms,
80th percentile: 500 ms, 95th percentile: 1000 ms.
If possible, how can a timeout be set in the upstream API for the invocation of the first downstream
API to meet the new upstream API's desired SLA?

Accepted Answer

B

Explanation: Correct Answer: Set a timeout of 100ms; that leaves 400ms for other two downstream APIs to complete ***************************************** Key details to take from the given scenario: >> Upstream API's designed SLA is 500ms (median). Lets ignore maximum SLA response times. >> This API calls 3 downstream APIs sequentially and all these are of similar complexity. >> The first downstream API is offering median SLA of 100ms, 80th percentile: 500ms; 95th percentile: 1000ms. Based on the above details: >> We can rule out the option which is suggesting to set 50ms timeout. Because, if the median SLA itself being offered is 100ms then most of the calls are going to timeout and time gets wasted in retried them and eventually gets exhausted with all retries. Even if some retries gets successful, the remaining time wont leave enough room for 2nd and 3rd downstream APIs to respond within time. >> The option suggesting to NOT set a timeout as the invocation of this API is mandatory and so we must wait until it responds is silly. As not setting time out would go against the good implementation pattern and moreover if the first API is not responding within its offered median SLA 100ms then most probably it would either respond in 500ms (80th percentile) or 1000ms (95th percentile). In BOTH cases, getting a successful response from 1st downstream API does NO GOOD because already by this time the Upstream API SLA of 500 ms is breached. There is no time left to call 2nd and 3rd downstream APIs. >> It is NOT true that no timeout is possible to meet the upstream APIs desired SLA. As 1st downstream API is offering its median SLA of 100ms, it means MOST of the time we would get the responses within that time. So, setting a timeout of 100ms would be ideal for MOST calls as it leaves enough room of 400ms for remaining 2 downstream API calls.

Question 4

An organization makes a strategic decision to move towards an IT operating model that emphasizes
consumption of reusable IT assets using modern APIs (as defined by MuleSoft).
What best describes each modern API in relation to this new IT operating model?

Accepted Answer

B

Explanation: Correct Answers: 1. Each modern API must be treated like a product and designed for a particular target audience (for instance mobile app developers) ***************************************** https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/MuleSoft_MCPA-Level-1/page_38_img_1.jpg

Question 5

What is true about automating interactions with Anypoint Platform using tools such as Anypoint Platform REST APIs, Anypoint CU, or the Mule Maven plugin?

Accepted Answer

C

Explanation: Correct Answer: By default, the Anypoint CLI and Mule Maven plugin are NOT included in the Mule runtime, so are NOT available to be used by deployed Mule applications ***************************************** >> We CANNOT apply API policies to the Anypoint Platform APIs like we can do on our custom written API instances. So, option suggesting this is FALSE. >> Anypoint Platform APIs can be used for automating interactions with both CloudHub and customer-hosted Mule runtimes. Not JUST the CloudHub. So, option opposing this is FALSE. >> Mule Maven plugin is NOT mandatory for deployment to customer-hosted Mule runtimes. It just helps your CI/CD to have smoother automation. But not a compulsory requirement to deploy. So, option opposing this is FALSE. >> We DO NOT have any such special roles and permissions on the platform to separately control access for some users to have Anypoint CLI and others to have Anypoint Platform APIs. With proper general roles/permissions (API Owner, Cloudhub Admin etc..), one can use any of the options (Anypoint CLI or Platform APIs). So, option suggesting this is FALSE. Only TRUE statement given in the choices is that - Anypoint CLI and Mule Maven plugin are NOT included in the Mule runtime, so are NOT available to be used by deployed Mule applications. Maven is part of Studio or you can use other Maven installation for development. CLI is convenience only. It is one of many ways how to install app to the runtime. These are definitely NOT part of anything except your process of deployment or automation.

Question 6

An organization is deploying their new implementation of the OrderStatus System API to multiple
workers in CloudHub. This API fronts the organization's on-premises Order Management System,
which is accessed by the API implementation over an IPsec tunnel.
What type of error typically does NOT result in a service outage of the OrderStatus System API?

Accepted Answer

A

Explanation: Correct Answer: A CloudHub worker fails with an out-of-memory exception. ***************************************** >> An AWS Region itself going down will definitely result in an outage as it does not matter how many workers are assigned to the Mule App as all of those in that region will go down. This is a complete downtime and outage. >> Extended outage of API manager during initial deployment of API implementation will of course cause issues in proper application startup itself as the API Autodiscovery might fail or API policy templates and polices may not be downloaded to embed at the time of applicaiton startup etc... there are many reasons that could cause issues. >> A network outage onpremises would of course cause the Order Management System not accessible and it does not matter how many workers are assigned to the app they all will fail and cause outage for sure. The only option that does NOT result in a service outage is if a cloudhub worker fails with an out-of- memory exception. Even if a worker fails and goes down, there are still other workers to handle the requests and keep the API UP and Running. So, this is the right answer.

Question 7

How can the application of a rate limiting API policy be accurately reflected in the RAML definition of an API?

Accepted Answer

D

Explanation: Correct Answer: By refining the response definitions by adding the x-ratelimit-* response headers with description, type, and example ***************************************** https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/MuleSoft_MCPA-Level-1/page_33_img_1.jpg https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/MuleSoft_MCPA-Level-1/page_33_img_2.jpg

Question 8

The implementation of a Process API must change. What is a valid approach that minimizes the impact of this change on API clients?

Accepted Answer

C

Explanation: Correct Answer: Implement required changes to the Process API implementation so that, whenever possible, the Process API’s RAML definition remains unchanged. ***************************************** Key requirement in the question is: >> Approach that minimizes the impact of this change on API clients Based on above: >> Updating the RAML definition would possibly impact the API clients if the changes require any thing mandatory from client side. So, one should try to avoid doing that until really necessary. >> Implementing the changes as a completely different API and then redirectly the clients with 3xx status code is really upsetting design and heavily impacts the API clients. >> Organisations and IT cannot simply postpone the changes required until all API consumers acknowledge they are ready to migrate to a new Process API or API version. This is unrealistic and not possible. The best way to handle the changes always is to implement required changes to the API implementations so that, whenever possible, the API’s RAML definition remains unchanged.

Question 9

An organization has implemented a Customer Address API to retrieve customer address information.
This API has been deployed to multiple environments and has been configured to enforce client IDs
everywhere.
A developer is writing a client application to allow a user to update their address. The developer has
found the Customer Address API in Anypoint Exchange and wants to use it in their client application.
What step of gaining access to the API can be performed automatically by Anypoint Platform?

Accepted Answer

A

Explanation: Correct Answer: Approve the client application request for the chosen SLA tier ***************************************** >> Only approving the client application request for the chosen SLA tier can be automated >> Rest of the provided options are not valid Reference: https://docs.mulesoft.com/api-manager/2.x/defining-sla-tiers#defining-a-tier

Question 10

In an organization, the InfoSec team is investigating Anypoint Platform related data traffic. From where does most of the data available to Anypoint Platform for monitoring and alerting originate?

Accepted Answer

D

Explanation: Correct Answer: From the Mule runtime irrespective of the deployment model ***************************************** >> Monitoring and Alerting metrics are always originated from Mule Runtimes irrespective of the deployment model. >> It may seems that some metrics (Runtime Manager) are originated from Mule Runtime and some are (API Invocations/ API Analytics) from API Manager. However, this is realistically NOT TRUE. The reason is, API manager is just a management tool for API instances but all policies upon applying on APIs eventually gets executed on Mule Runtimes only (Either Embedded or API Proxy). >> Similarly all API Implementations also run on Mule Runtimes. So, most of the day required for monitoring and alerts are originated fron Mule Runtimes only irrespective of whether the deployment model is MuleSoft-hosted or Customer-hosted or Hybrid.

Question 11

Refer to the exhibit. An organization is running a Mule standalone runtime and has configured Active
Directory as the Anypoint Platform external Identity Provider. The organization does not have budget
for other system components.
MCPA-Level-1 practice exam questions

What policy should be applied to all instances of APIs in the organization to most effecuvelyKestrict
access to a specific group of internal users?

Accepted Answer

A

Explanation: Correct Answer: Apply a basic authentication - LDAP policy; the internal Active Directory will be configured as the LDAP source for authenticating users. ***************************************** >> IP Whitelisting does NOT fit for this purpose. Moreover, the users workstations may not necessarily have static IPs in the network. >> OAuth 2.0 enforcement requires a client provider which isn't in the organizations system components. >> It is not an effective approach to let every user create separate client credentials and configure those for their usage. The effective way it to apply a basic authentication - LDAP policy and the internal Active Directory will be configured as the LDAP source for authenticating users. Reference: https://docs.mulesoft.com/api-manager/2.x/basic-authentication-ldap-concept

Question 12

What is a typical result of using a fine-grained rather than a coarse-grained API deployment model to implement a given business process?

Accepted Answer

B

Explanation: Correct Answer: A higher number of discoverable API-related assets in the application network. ***************************************** >> We do NOT get faster response times in fine-grained approach when compared to coarse-grained approach. >> In fact, we get faster response times from a network having coarse-grained APIs compared to a network having fine-grained APIs model. The reasons are below. Fine-grained approach: 1. will have more APIs compared to coarse-grained 2. So, more orchestration needs to be done to achieve a functionality in business process. 3. Which means, lots of API calls to be made. So, more connections will needs to be established. So, obviously more hops, more network i/o, more number of integration points compared to coarse- grained approach where fewer APIs with bulk functionality embedded in them. 4. That is why, because of all these extra hops and added latencies, fine-grained approach will have bit more response times compared to coarse-grained. 5. Not only added latencies and connections, there will be more resources used up in fine-grained approach due to more number of APIs. That's why, fine-grained APIs are good in a way to expose more number of resuable assets in your network and make them discoverable. However, needs more maintenance, taking care of integration points, connections, resources with a little compromise w.r.t network hops and response times.

Question 13

What Mule application deployment scenario requires using Anypoint Platform Private Cloud Edition or Anypoint Platform for Pivotal Cloud Foundry?

Accepted Answer

C

Explanation: Correct Answer: When regulatory requirements mandate on-premises processing of EVERY data item, including meta-data. ***************************************** We need NOT require to use Anypoint Platform PCE or PCF for the below. So these options are OUT. >> We can make ALL applications highly available across multiple data centers using CloudHub too. >> We can use Anypoint VPN and tunneling from CloudHub to connect to ALL backend systems in the application network that are deployed in the organization's intranet. >> We can use Anypoint VPC and Firewall Rules to make ALL APIs private and NOT exposed to the public cloud. Only valid reason in the given options that requires to use Anypoint Platform PCE/ PCF is - When regulatory requirements mandate on-premises processing of EVERY data item, including meta-data.

Question 14

An API implementation is deployed on a single worker on CloudHub and invoked by external API
clients (outside of CloudHub). How can an alert be set up that is guaranteed to trigger AS SOON AS
that API implementation stops responding to API invocations?

Accepted Answer

B

Explanation: Correct Answer: Configure a “Worker not responding” alert in Anypoint Runtime Manager. ***************************************** >> All the options eventually helps to generate the alert required when the application stops responding. >> However, handling exceptions within calling API and then raising alert from API client is inappropriate and silly. There could be many API clients invoking the API implementation and it is not ideal to have this setup consistently in all of them. Not a realistic way to do. >> Implementing a health check/ heartbeat with in the API and calling from outside to detmine the health sounds OK but needs extra setup for it and same time there are very good chances of generating false alarms when there are any intermittent network issues between external tool calling the health check API on API implementation. The API implementation itself may not have any issues but due to some other factors some false alarms may go out. >> Creating an alert in API Manager when the API receives no requests within a specified time period would actually generate realistic alerts but even here some false alarms may go out when there are genuinely no requests from API clients. The best and right way to achieve this requirement is to setup an alert on Runtime Manager with a condition "Worker not responding". This would generate an alert AS SOON AS the workers become unresponsive. https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/MuleSoft_MCPA-Level-1/page_7_img_1.jpg

Question 15

What API policy would LEAST likely be applied to a Process API?

Accepted Answer

D

Explanation: Correct Answer: JSON threat protection ***************************************** Fact: Technically, there are no restrictions on what policy can be applied in what layer. Any policy can be applied on any layer API. However, context should also be considered properly before blindly applying the policies on APIs. That is why, this question asked for a policy that would LEAST likely be applied to a Process API. From the given options: >> All policies except "JSON threat protection" can be applied without hesitation to the APIs in Process tier. >> JSON threat protection policy ideally fits for experience APIs to prevent suspicious JSON payload coming from external API clients. This covers more of a security aspect by trying to avoid possibly malicious and harmful JSON payloads from external clients calling experience APIs. As external API clients are NEVER allowed to call Process APIs directly and also these kind of malicious and harmful JSON payloads are always stopped at experience API layer only using this policy, it is LEAST LIKELY that this same policy is again applied on Process Layer API. Reference: https://docs.mulesoft.com/api-manager/2.x/policy-mule3-provided-policies

Free MCPA-Level-1 Actual Exam Questions