Question 1

What are 4 important Platform Capabilities offered by Anypoint Platform?

Accepted Answer

C

Explanation: Anypoint Platform provides a comprehensive, unified solution for managing the full API lifecycle. The four capabilities listed in option C represent the core, high-level stages of this lifecycle. 1. API Design and Development: Creating reusable APIs and integrations using tools like Design Center and Anypoint Studio. 2. API Runtime Execution and Hosting: Deploying, running, and scaling APIs and integrations on various targets like CloudHub, Runtime Fabric, or customer-hosted servers. 3. API Operations and Management: Securing, governing, and monitoring APIs in production using API Manager and Anypoint Monitoring. 4. API Consumer Engagement: Enabling discovery, learning, and collaboration through a central catalog like Anypoint Exchange, fostering reuse and consumption.

Question 2

What is true about where an API policy is defined in Anypoint Platform and how it is then applied to API instances?

Accepted Answer

B

Explanation: API policies are defined and applied within Anypoint API Manager to govern specific API instances. An API instance represents a managed version of an API, often tied to a specific environment. This per-instance application allows architects to enforce different rules (e.g., stricter rate limiting in production versus development) for different deployments of the same API. The policy is configured in API Manager, and the corresponding Mule runtime, linked via API Autodiscovery to that specific API instance, downloads and enforces it. Policies are not defined in Runtime Manager, nor are they automatically applied to all instances across an organization or environment.

Question 3

Version 3.0.1 of a REST API implementation represents time values in PST time using ISO 8601
hh:mm:ss format. The API implementation needs to be changed to instead represent time values in
CEST time using ISO 8601 hh:mm:ss format. When following the semver.org semantic versioning
specification, what version should be assigned to the updated API implementation?

Accepted Answer

B

Explanation: Changing the timezone of a data field (from PST to CEST) in an API response is a backward-incompatible or "breaking" change. Any client application built to consume version 3.0.1 would have logic assuming the PST timezone. When the API starts sending CEST times, this client logic will fail or produce incorrect results. The Semantic Versioning 2.0.0 specification, which the question requires following, explicitly states that the MAJOR version must be incremented for any backward-incompatible changes. Incrementing the MAJOR version from 3 to 4 and resetting the MINOR and PATCH versions to 0 results in the new version 4.0.0.

Question 4

When must an API implementation be deployed to an Anypoint VPC?

Accepted Answer

B

Explanation: An Anypoint Virtual Private Cloud (VPC) is required when a Mule application deployed to CloudHub needs to integrate with resources in a private network that is not accessible over the public internet. The primary function of an Anypoint VPC is to create a logically isolated, private network space for your CloudHub workers. This private space can then be securely connected to a customer's on-premise data center or another private cloud network using methods like an IPsec VPN tunnel, AWS Direct Connect, or VPC peering. This allows the Mule application to be accessed from within the customer's restricted network as if it were part of that network.

Question 5

An eCommerce company is adding a new Product Details feature to their website, A customer will
launch the product catalog page, a new Product Details link will
appear by product where they can click to retrieve the product detail description. Product detail data
is updated with product update releases, once or twice a year, Presently
the database response time has been very slow due to high volume.
What action retrieves the product details with the lowest response time, fault tolerant, and
consistent data?

Accepted Answer

C

Explanation: The primary requirements are low response time, fault tolerance, and data consistency for infrequently updated data from a slow database. Using a shared Anypoint Object Store (OSv2) is the optimal solution. The product details can be loaded from the database into the Object Store once. Subsequent API requests can then retrieve this data directly from the high-performance Object Store, bypassing the slow database entirely. In a multi-worker environment like CloudHub, the Object Store is shared across all workers, ensuring data consistency and fault tolerance, as the cache is external to the individual Mule runtimes.

Question 6

An organization requires several APIs to be secured with OAuth 2.0, and PingFederate has been
identified as the identity provider for API client authorization, The
PingFederate Client Provider is configured in access management, and the PingFederate OAuth 2.0
Token Enforcement policy is configured for the API instances required by the
organization. The API instances reside in two business groups (Group A and Group B) within the
Master Organization (Master Org).
What should be done to allow API consumers to access the API instances?

Accepted Answer

C

Explanation: When using an external identity provider (IdP) like PingFederate as a client provider in Anypoint Platform, the management of client applications (creation, credentials) is handled by the IdP. However, the process of granting a specific client application access to a specific API is managed within Anypoint Platform through contracts. The standard self-service workflow requires the API consumer to first create their client application in PingFederate. They then navigate to Anypoint Exchange, find the desired API, and request access for their client application. This request is routed to the API administrator, who approves it in API Manager, creating a contract that links the external client application to the API instance.

Question 7

True or False. We should always make sure that the APIs being designed and developed are self- servable even if it needs more man-day effort and resources.

Accepted Answer

True

Explanation: The statement is true because the principle of self-servability is a cornerstone of MuleSoft's API-led connectivity approach and the creation of a successful application network. While making an API self-servable requires a greater upfront investment in design, documentation (e.g., using RAML or OAS), and publication to a discovery portal like Anypoint Exchange, this initial effort is critical for achieving long-term organizational agility and scalability. An API that is not self-servable cannot be easily discovered, understood, or consumed by other developers without direct intervention from the original development team. This creates a dependency, turning the API-providing team into a bottleneck and negating the core benefits of reusability. The upfront investment in self-service capabilities directly enables the decentralized consumption and reuse of assets, which reduces future development costs, accelerates project delivery, and fosters innovation across the organization. Therefore, from a platform architect's strategic perspective, this investment is essential.

Question 8

An API implementation is updated. When must the RAML definition of the API also be updated?

Accepted Answer

A

Explanation: The RAML definition is the API's contract, specifying its interface for consumers. This contract includes resource paths, methods, and the precise structure of request and response messages (e.g., headers, query parameters, and body schemas). When the implementation changes the structure of these messages, it alters the contract. To ensure consumers are aware of the new contract and to prevent breaking their applications, the RAML definition must be updated. Changes internal to the implementation, such as the backend system, runtime version, or performance optimizations, do not affect the external contract and thus do not require a RAML update.

Question 9

An operations team is analyzing the effort needed to set up monitoring of their application network.
They are looking at which API invocation metrics can be used to identify and predict trouble without
having to write custom scripts or install additional analytics software or tools.
Which type of metrics can satisfy this goal of directly identifying and predicting failures?

Accepted Answer

A

Explanation: API policy violations are direct, out-of-the-box indicators of operational problems. Metrics such as spikes in rate-limiting, security threat protection, or client ID enforcement failures signal misbehaving clients, potential security attacks, or impending backend service overloads. An operations team can use the built-in dashboards and alerting features of Anypoint Platform to monitor these violations in real-time. This allows them to proactively identify and predict system failures without needing custom scripts or external tools, directly satisfying the requirements.

Question 10

What best explains the use of auto-discovery in API implementations?

Accepted Answer

A

Explanation: Auto-discovery is the mechanism that links a deployed Mule application (the API implementation) to an API instance managed in API Manager. By configuring the Mule application with a specific api-id, the application, upon starting, registers itself with API Manager. This registration makes the API Manager "aware" of the running implementation, which is the essential prerequisite for applying and enforcing governance policies (such as rate limiting, security, or custom policies) on the API traffic. This connection is the primary function of auto-discovery.

Question 11

An organization is implementing a Quote of the Day API that caches today's quote. What scenario can use the GoudHub Object Store via the Object Store connector to persist the cache's state?

Accepted Answer

D

Explanation: The CloudHub Object Store (OSv2) is designed to provide a distributed, shared, and persistent key-value store for a single Mule application deployed to CloudHub. When an application is scaled horizontally across multiple workers, all workers for that specific application instance share the same underlying Object Store. This ensures that if one worker caches the "Quote of the Day," all other workers handling subsequent requests for the same API can access that same cached value, providing a consistent state across the deployment.

Question 12

An established communications company is beginning its API-led connectivity journey, The company
has been using a successful Enterprise Data Model for many years. The company has identified a self-
service account management app as the first effort for API-led, and it has identified the following
APIs.
Experience layer: Mobile Account Management EAPI, Browser Account Management EAPI
Process layer: Customer Lookup PAPI, Service Lookup PAPI, Account Lookup PAPI
System layer: Customer SAPI, Account SAPI, Product SAPI, Service SAPI
According to MuleSoft's API-led connectivity approach, which API would not be served by the
Enterprise Data Model?

Accepted Answer

C

Explanation: Experience APIs are designed to serve a specific client application or channel, such as a mobile app. Their primary purpose is to provide data in a format that is optimized and simplified for that specific consumer. This often requires reconfiguring, aggregating, or transforming data from underlying Process and System APIs. Therefore, the data model of the Mobile Account Management EAPI is dictated by the needs of the mobile app, not directly by the canonical Enterprise Data Model (EDM). The EAPI consumes data that originates from the EDM via lower-level APIs but presents it in a purpose-built, non-canonical format.

Question 13

Refer to the exhibit. An organization is running a Mule standalone runtime and has configured Active
Directory as the Anypoint Platform external Identity Provider. The organization does not have budget
for other system components.
What policy should be applied to all instances of APIs in the organization to most effecuvelyKestrict
access to a specific group of internal users?

Accepted Answer

A

Explanation: The most effective and direct method to restrict API access to a specific group of internal users, given the existing infrastructure (Mule standalone runtime, Active Directory) and constraints (no budget for new components), is the Basic Authentication - LDAP policy. Active Directory is an LDAP-compliant directory service. This policy can be configured to connect directly to the existing Active Directory to authenticate users based on their credentials and, crucially, to verify their membership in a specific group. This approach leverages existing systems without requiring additional software or infrastructure, thereby adhering to the budget constraint while providing robust, user-group-based access control.

Question 14

A large lending company has developed an API to unlock data from a database server and web
server. The API has been deployed to Anypoint Virtual Private Cloud
(VPC) on CloudHub 1.0.
The database server and web server are in the customer's secure network and are not accessible
through the public internet. The database server is in the customer's AWS
VPC, whereas the web server is in the customer's on-premises corporate data center.
How can access be enabled for the API to connect with the database server and the web server?

Accepted Answer

A

Explanation: The scenario requires connecting an API in an Anypoint Virtual Private Cloud (VPC) to two separate private networks. The correct approach uses the specific networking technologies designed for each connection type. 1. Anypoint VPC to Customer's AWS VPC: VPC Peering is the standard, native AWS mechanism to create a private, direct network connection between two VPCs. This allows resources in the Anypoint VPC to communicate with the database server in the customer's AWS VPC as if they were on the same network. 2. Anypoint VPC to On-Premises Data Center: An IPsec VPN tunnel is a secure method to extend the Anypoint VPC and connect it to a remote, on-premises corporate network over the internet. This enables the API to securely access the web server in the corporate data center.

Question 15

Refer to the exhibit. https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/Salesforce_MuleSoft-Platform-Architect-I/page_45_img_1.jpg An organization uses one specific CloudHub (AWS) region for all CloudHub deployments. How are CloudHub workers assigned to availability zones (AZs) when the organization's Mule applications are deployed to CloudHub in that region?

Accepted Answer

Explanation: An independent analysis of the question has been performed, disregarding the provided answer. Correct Answer: C Correct Answer: C Explanation: CloudHub is architected for high availability by leveraging multiple Availability Zones (AZs) within each supported AWS region. When a Mule application is deployed with two or more workers, the CloudHub platform automatically distributes these workers across different AZs. This ensures that the application can withstand the failure of a single AZ, as workers in the remaining, operational AZs will continue to process requests. This distribution is a core, automated feature of the platform's fault-tolerant design. Why Incorrect Options are Wrong: A. Workers belonging to a given environment are assigned to the same AZ within that region This is incorrect. Assigning an entire environment to a single AZ would create a massive single point of failure, which contradicts the principles of high availability. B. AZs are selected as part of the Mule application's deployment configuration This is incorrect. AZ placement is managed automatically by the CloudHub platform to ensure optimal distribution for high availability and is not a user-configurable setting. D. An AZ is randomly selected for a Mule application, and all the Mule application's CloudHub workers are assigned to that one AZ This is incorrect for multi-worker deployments. This behavior only applies to single-worker, non-HA applications. The platform's HA strategy explicitly distributes multiple workers across different AZs. References: 1. MuleSoft Documentation, "CloudHub Architecture": Reference: "If you deploy your application to multiple workers, CloudHub automatically distributes the workers for your application across two or more availability zones to support high availability (HA)." Source: MuleSoft Docs, Runtime Manager > CloudHub > CloudHub Architecture. 2. MuleSoft Documentation, "High Availability": Reference: "When you deploy an application to two or more workers, the application can withstand the loss of a single availability zone. CloudHub automatically distributes multiple workers for a single application across two or more availability zones." Source: MuleSoft Docs, Runtime Manager > Deploy and Manage Applications on CloudHub > High Availability.

Free Salesforce MuleSoft-Platform-Architect-1 Actual Exam Questions