MCPA-Level-1: MuleSoft Certified Platform Architect - Level 1

An organization makes a strategic decision to move towards an IT operating model that emphasizes consumption of reusable IT assets using modern APIs (as defined by MuleSoft).

What best describes each modern API in relation to this new IT operating model?

Each modern API has its own software development lifecycle, which reduces the need for documentation and automation
Each modem API must be treated like a product and designed for a particular target audience (for instance, mobile app developers)
Each modern API must be easy to consume, so should avoid complex authentication mechanisms such as SAML or JWT D
Each modern API must be REST and HTTP based

Correct answer: B

Explanation:

Answer:s:1. Each modern API must be treated like a product and designed for a particular target audience (for instance mobile app developers) Bottom of FormTop of Form

Answer:s:1. Each modern API must be treated like a product and designed for a particular target audience (for instance mobile app developers)

Bottom of FormTop of Form

When designing an upstream API and its implementation, the development team has been advised to NOT set timeouts when invoking a downstream API, because that downstream API has no SLA that can be relied upon.

This is the only downstream API dependency of that upstream API.

Assume the downstream API runs uninterrupted without crashing. What is the impact of this advice?

An SLA for the upstream API CANNOT be provided
The invocation of the downstream API will run to completion without timing out
A default timeout of 500 ms will automatically be applied by the Mule runtime in which the upstream API implementation executes
A toad-dependent timeout of less than 1000 ms will be applied by the Mule runtime in which the downstream API implementation executes

Correct answer: A

Explanation:

An SLA for the upstream API CANNOT be provided. >> First thing first, the default HTTP response timeout for HTTP connector is 10000 ms (10 seconds). NOT 500 ms.>> Mule runtime does NOT apply any such 'load-dependent' timeouts. There is no such behavior currently in Mule.>> As there is default 10000 ms time out for HTTP connector, we CANNOT always guarantee that the invocation of the downstream API will run to completion without timing out due to its unreliable SLA times. If the response time crosses 10 seconds then the request may time out.The main impact due to this is that a proper SLA for the upstream API CANNOT be provided.

What best explains the use of auto-discovery in API implementations?

It makes API Manager aware of API implementations and hence enables it to enforce policies
It enables Anypoint Studio to discover API definitions configured in Anypoint Platform
It enables Anypoint Exchange to discover assets and makes them available for reuse
It enables Anypoint Analytics to gain insight into the usage of APIs

Correct answer: A

Explanation:

It makes API Manager aware of API implementations and henceenables it to enforce policies. >> API Autodiscovery is a mechanism that manages an API from API Manager by pairing the deployed application to an API created on the platform.>> API Management includes tracking, enforcing policies if you apply any, and reporting API analytics.>> Critical to the Autodiscovery process is identifying the API by providing the API name and version.https://docs.mulesoft.com/api-manager/2.x/api-auto-discovery-new-concepthttps://docs.mulesoft.com/api-manager/1.x/api-auto-discoveryhttps://docs.mulesoft.com/api-manager/2.x/api-auto-discovery-new-concept

It makes API Manager aware of API implementations and henceenables it to enforce policies. >> API Autodiscovery is a mechanism that manages an API from API Manager by pairing the deployed application to an API created on the platform.>> API Management includes tracking, enforcing policies if you apply any, and reporting API analytics.>> Critical to the Autodiscovery process is identifying the API by providing the API name and version.

https://docs.mulesoft.com/api-manager/2.x/api-auto-discovery-new-concepthttps://docs.mulesoft.com/api-manager/1.x/api-auto-discoveryhttps://docs.mulesoft.com/api-manager/2.x/api-auto-discovery-new-concept

What should be ensured before sharing an API through a public Anypoint Exchange portal?

The visibility level of the API instances of that API that need to be publicly accessible should be set to public visibility
The users needing access to the API should be added to the appropriate role in Anypoint Platform
The API should be functional with at least an initial implementation deployed and accessible for users to interact with
The API should be secured using one of the supported authentication/authorization mechanisms to ensure that data is not compromised

Correct answer: A

Explanation:

The visibility level of the API instances of that API that need to bepublicly accessible should be set to public visibility. https://docs.mulesoft.com/exchange/to-share-api-asset-to-portal

An organization has several APIs that accept JSON data over HTTP POST. The APIs are all publicly available and are associated with several mobile applications and web applications.

The organization does NOT want to use any authentication or compliance policies for these APIs, but at the same time, is worried that some bad actor could send payloads that could somehow compromise the applications or servers running the API implementations.

What out-of-the-box Anypoint Platform policy can address exposure to this threat?

Shut out bad actors by using HTTPS mutual authentication for all API invocations
Apply an IP blacklist policy to all APIs; the blacklist will Include all bad actors
Apply a Header injection and removal policy that detects the malicious data before it is used
Apply a JSON threat protection policy to all APIs to detect potential threat vectors

Correct answer: D

Explanation:

Apply a JSON threat protection policy to all APIs to detect potentialthreat vectors >> Usually, if the APIs are designed and developed for specific consumers (known consumers/customers) then we would IP Whitelist the same to ensure that traffic only comes from them.>> However, as this scenario states that the APIs are publicly available and being used by so many mobile and web applications, it is NOT possible to identify and blacklist all possible bad actors.>> So, JSON threat protection policy is the best chance to prevent any bad JSON payloads from such bad actors.

An API experiences a high rate of client requests (TPS) vwth small message paytoads. How can usage limits be imposed on the API based on the type of client application?

Use an SLA-based rate limiting policy and assign a client application to a matching SLA tier based on its type
Use a spike control policy that limits the number of requests for each client application type
Use a cross-origin resource sharing (CORS) policy to limit resource sharing between client applications, configured by the client application type
Use a rate limiting policy and a client ID enforcement policy, each configured by the client application type

Correct answer: A

Explanation:

Use an SLA-based rate limiting policy and assign a clientapplication to a matching SLA tier based on its type. >> SLA tiers will come into play whenever any limits to be imposed on APIs based on client type

A code-centric API documentation environment should allow API consumers to investigate and execute API client source code that demonstrates invoking one or more APIs as part of representative scenarios.

What is the most effective way to provide this type of code-centric API documentation environment using Anypoint Platform?

Enable mocking services for each of the relevant APIs and expose them via their Anypoint Exchange entry
Ensure the APIs are well documented through their Anypoint Exchange entries and API Consoles and share these pages with all API consumers
Create API Notebooks and include them in the relevant Anypoint Exchange entries
Make relevant APIs discoverable via an Anypoint Exchange entry

Correct answer: C

Explanation:

Create API Notebooks and Include them in the relevant Anypoint exchangeentries >>API Notebooks are the one on Anypoint Platform that enable us to provide code-centric API documentationBottom of FormTop of Form

Refer to the exhibit. An organization is running a Mule standalone runtime and has configured Active Directory as the Anypoint Platform external Identity Provider. The organization does not have budget for other system components.

What policy should be applied to all instances of APIs in the organization to most effecuvelyKestrict access to a specific group of internal users?

Apply a basic authentication - LDAP policy; the internal Active Directory will be configured as the LDAP source for authenticating users
Apply a client ID enforcement policy; the specific group of users will configure their client applications to use their specific client credentials
Apply an IP whitelist policy; only the specific users' workstations will be in the whitelist
Apply an OAuth 2.0 access token enforcement policy; the internal Active Directory will be configured as the OAuth server

Correct answer: A

Explanation:

Apply a basic authentication - LDAP policy; the internal ActiveDirectory will be configured as the LDAP source for authenticating users. >> IP Whitelisting does NOT fit for this purpose. Moreover, the users workstations may not necessarily have static IPs in the network.>> OAuth 2.0 enforcement requires a client provider which isn't in the organizations system components.>> It is not an effective approach to let every user create separate client credentials and configure those for their usage.The effective way it to apply a basic authentication - LDAP policy and the internal Active Directory will be configured as the LDAP source for authenticating users.

What is a best practice when building System APIs?

Document the API using an easily consumable asset like a RAML definition
Model all API resources and methods to closely mimic the operations of the backend system
Build an Enterprise Data Model (Canonical Data Model) for each backend system and apply it to System APIs
Expose to API clients all technical details of the API implementation's interaction wifch the backend system

Correct answer: B

Explanation:

Model all API resources and methods to closely mimic theoperations of the backend system. >> There are NO fixed and straight best practices while opting data models for APIs. They are completly contextual and depends on number of factors. Based upon those factors, an enterprise can choose if they have to go with Enterprise Canonical Data Model or Bounded Context Model etc.>> One should NEVER expose the technical details of API implementation to their API clients. Only the API interface/ RAML is exposed to API clients.>> It is true that the RAML definitions of APIs should be as detailed as possible and should reflect most of the documentation.However, just that is NOT enough to call your API as best documented API. There should be even more documentation on Anypoint Exchange with API Notebooks etc. to make and create a developer friendly API and repository..>> The best practice always when creating System APIs is to create their API interfaces by modeling their resources and methods to closely reflect the operations and functionalities of that backend system.

Model all API resources and methods to closely mimic theoperations of the backend system. >> There are NO fixed and straight best practices while opting data models for APIs. They are completly contextual and depends on number of factors. Based upon those factors, an enterprise can choose if they have to go with Enterprise Canonical Data Model or Bounded Context Model etc.>> One should NEVER expose the technical details of API implementation to their API clients. Only the API interface/ RAML is exposed to API clients.>> It is true that the RAML definitions of APIs should be as detailed as possible and should reflect most of the documentation.

However, just that is NOT enough to call your API as best documented API. There should be even more documentation on Anypoint Exchange with API Notebooks etc. to make and create a developer friendly API and repository..>> The best practice always when creating System APIs is to create their API interfaces by modeling their resources and methods to closely reflect the operations and functionalities of that backend system.

Refer to the exhibit.

A RAML definition has been proposed for a new Promotions Process API, and has been published to Anypoint Exchange.

The Marketing Department, who will be an important consumer of the Promotions API, has important requirements and expectations that must be met.

What is the most effective way to use Anypoint Platform features to involve the Marketing Department in this early API design phase?

Ask the Marketing Department to interact with a mocking implementation of the API using the automatically generated API Console
Organize a design workshop with the DBAs of the Marketing Department in which the database schema of the Marketing IT systems is translated into RAML
Use Anypoint Studio to Implement the API as a Mule application, then deploy that API implementation to CloudHub and ask the Marketing Department to interact with it
Export an integration test suite from API designer and have the Marketing Department execute the tests In that suite to ensure they pass

Correct answer: A

Explanation:

Ask the Marketing Department to interact with a mocking implementationof the API using the automatically generated API Console. As per MuleSoft's IT Operating Model:>>API consumers need NOT wait until the fullAPI implementation is ready.>>NO technical test-suites needs to be shared with end users to interact with APIs.>>Anypoint Platform offers a mocking capability on all the published API specifications to Anypoint Exchange which also will be rich in documentation covering all details of API functionalities and working nature.>>No needs of arranging days of workshops with end users for feedback.API consumers can use Anypoint Exchange features on the platform and interact with the API using its mocking feature. The feedback can be shared quickly on the same to incorporate any changes.