The Ultimate MuleSoft MCPA-Level-1 Dumps PDF Review [Q41-Q63]

NO.41 Refer to the exhibit. An organization needs to enable access to their customer data from both a mobile app and a web application, which each need access to common fields as well as certain unique fields.
The data is available partially in a database and partially in a 3rd-party CRM system.
What APIs should be created to best fit these design requirements?

A) A Process API that contains the data required by both the web and mobile apps, allowing these applications to invoke it directly and access the data they need thereby providing the flexibility to add more fields in the future without needing API changes

B) One set of APIs (Experience API, Process API, and System API) for the web app, and another set for the mobile app

C) Separate Experience APIs for the mobile and web app, but a common Process API that invokes separate System APIs created for the database and CRM system

D) A common Experience API used by both the web and mobile apps, but separate Process APIs for the web and mobile apps that interact with the database and the CRM System

Option A

Option B

Option C

Option D

NO.42 Once an API Implementation is ready and the API is registered on API Manager, who should request the access to the API on Anypoint Exchange?

None

Both

API Client

API Consumer

NO.43 A new upstream API Is being designed to offer an SLA of 500 ms median and 800 ms maximum (99th percentile) response time. The corresponding API implementation needs to sequentially invoke 3 downstream APIs of very similar complexity.
The first of these downstream APIs offers the following SLA for its response time: median: 100 ms, 80th percentile: 500 ms, 95th percentile: 1000 ms.
If possible, how can a timeout be set in the upstream API for the invocation of the first downstream API to meet the new upstream API’s desired SLA?

Set a timeout of 50 ms; this times out more invocations of that API but gives additional room for retries

Set a timeout of 100 ms; that leaves 400 ms for the other two downstream APIs to complete

No timeout is possible to meet the upstream API’s desired SLA; a different SLA must be negotiated with the first downstream API or invoke an alternative API

Do not set a timeout; the Invocation of this API Is mandatory and so we must wait until it responds

NO.44 In an organization, the InfoSec team is investigating Anypoint Platform related data traffic.

From where does most of the data available to Anypoint Platform for monitoring and alerting originate?

From the Mule runtime or the API implementation, depending on the deployment model

From various components of Anypoint Platform, such as the Shared Load Balancer, VPC, and Mule runtimes

From the Mule runtime or the API Manager, depending on the type of data

From the Mule runtime irrespective of the deployment model

NO.45 What should be ensured before sharing an API through a public Anypoint Exchange portal?

The visibility level of the API instances of that API that need to be publicly accessible should be set to public visibility

The users needing access to the API should be added to the appropriate role in Anypoint Platform

The API should be functional with at least an initial implementation deployed and accessible for users to interact with

The API should be secured using one of the supported authentication/authorization mechanisms to ensure that data is not compromised

NO.46 Refer to the exhibit.

A developer is building a client application to invoke an API deployed to the STAGING environment that is governed by a client ID enforcement policy.
What is required to successfully invoke the API?

The client ID and secret for the Anypoint Platform account owning the API in the STAGING environment

The client ID and secret for the Anypoint Platform account’s STAGING environment

The client ID and secret obtained from Anypoint Exchange for the API instance in the STAGING environment

A valid OAuth token obtained from Anypoint Platform and its associated client ID and secret

NO.47 How are an API implementation, API client, and API consumer combined to invoke and process an API?

The API consumer creates an API implementation, which receives API invocations from an API such that they are processed for an API client

The API client creates an API consumer, which receives API invocations from an API such that they are processed for an API implementation

The ApI consumer creates an API client, which sends API invocations to an API such that they are processed by an API implementation

The ApI client creates an API consumer, which sends API invocations to an API such that they are processed by an API implementation

NO.48 What best describes the Fully Qualified Domain Names (FQDNs), also known as DNS entries, created when a Mule application is deployed to the CloudHub Shared Worker Cloud?

A fixed number of FQDNs are created, IRRESPECTIVE of the environment and VPC design

The FQDNs are determined by the application name chosen, IRRESPECTIVE of the region

The FQDNs are determined by the application name, but can be modified by an administrator after deployment

The FQDNs are determined by both the application name and the Anypoint Platform organization

NO.49 What is a best practice when building System APIs?

Document the API using an easily consumable asset like a RAML definition

Model all API resources and methods to closely mimic the operations of the backend system

Build an Enterprise Data Model (Canonical Data Model) for each backend system and apply it to System APIs

Expose to API clients all technical details of the API implementation’s interaction wifch the backend system

NO.50 The responses to some HTTP requests can be cached depending on the HTTP verb used in the request.
According to the HTTP specification, for what HTTP verbs is this safe to do?

PUT, POST, DELETE

GET, HEAD, POST

GET, PUT, OPTIONS

GET, OPTIONS, HEAD

NO.51 How can the application of a rate limiting API policy be accurately reflected in the RAML definition of an API?

By refining the resource definitions by adding a description of the rate limiting policy behavior

By refining the request definitions by adding a remaining Requests query parameter with description, type, and example

By refining the response definitions by adding the out-of-the-box Anypoint Platform rate-limit-enforcement securityScheme with description, type, and example

By refining the response definitions by adding the x-ratelimit-* response headers with description, type, and example

NO.52 The implementation of a Process API must change.
What is a valid approach that minimizes the impact of this change on API clients?

Update the RAML definition of the current Process API and notify API client developers by sending them links to the updated RAML definition.

Postpone changes until API consumers acknowledge they are ready to migrate to a new Process API or API version.

Implement required changes to the Process API implementation so that, whenever possible, the Process API’s RAML definition remains unchanged.

Implement the Process API changes in a new API implementation, and have the old API implementation return an HTTP status code 301 – Moved Permanentlyto inform API clients they should be calling the new API implementation.

NO.53 A system API is deployed to a primary environment as well as to a disaster recovery (DR) environment, with different DNS names in each environment. A process API is a client to the system API and is being rate limited by the system API, with different limits in each of the environments. The system API’s DR environment provides only 20% of the rate limiting offered by the primary environment. What is the best API fault-tolerant invocation strategy to reduce overall errors in the process API, given these conditions and constraints?

Invoke the system API deployed to the primary environment; add timeout and retry logic to the process API to avoid intermittent failures; if it still fails, invoke the system API deployed to the DR environment

Invoke the system API deployed to the primary environment; add retry logic to the process API to handle intermittent failures by invoking the system API deployed to the DR environment

In parallel, invoke the system API deployed to the primary environment and the system API deployed to the DR environment; add timeout and retry logic to the process API to avoid intermittent failures; add logic to the process API to combine the results

Invoke the system API deployed to the primary environment; add timeout and retry logic to the process API to avoid intermittent failures; if it still fails, invoke a copy of the process API deployed to the DR environment

Correct answer: Invoke the system API deployed to the primary environment; add timeout and retry logic to the process API to avoid intermittent failures; if it still fails, invoke the system API deployed to the DR environment
*****************************************
There is one important consideration to be noted in the question which is – System API in DR environment provides only 20% of the rate limiting offered by the primary environment. So, comparitively, very less calls will be allowed into the DR environment API opposed to its primary environment. With this in mind, lets analyse what is the right and best fault-tolerant invocation strategy.
1. Invoking both the system APIs in parallel is definitely NOT a feasible approach because of the 20% limitation we have on DR environment. Calling in parallel every time would easily and quickly exhaust the rate limits on DR environment and may not give chance to genuine intermittent error scenarios to let in during the time of need.
2. Another option given is suggesting to add timeout and retry logic to process API while invoking primary environment’s system API. This is good so far. However, when all retries failed, the option is suggesting to invoke the copy of process API on DR environment which is not right or recommended. Only system API is the one to be considered for fallback and not the whole process API. Process APIs usually have lot of heavy orchestration calling many other APIs which we do not want to repeat again by calling DR’s process API. So this option is NOT right.
3. One more option given is suggesting to add the retry (no timeout) logic to process API to directly retry on DR environment’s system API instead of retrying the primary environment system API first. This is not at all a proper fallback. A proper fallback should occur only after all retries are performed and exhausted on Primary environment first. But here, the option is suggesting to directly retry fallback API on first failure itself without trying main API. So, this option is NOT right too.
This leaves us one option which is right and best fit.
– Invoke the system API deployed to the primary environment
– Add Timeout and Retry logic on it in process API
– If it fails even after all retries, then invoke the system API deployed to the DR environment.

NO.54 Refer to the exhibit.

What is the best way to decompose one end-to-end business process into a collaboration of Experience, Process, and System APIs?
A) Handle customizations for the end-user application at the Process API level rather than the Experience API level

B) Allow System APIs to return data that is NOT currently required by the identified Process or Experience APIs

C) Always use a tiered approach by creating exactly one API for each of the 3 layers (Experience, Process and System APIs)

D) Use a Process API to orchestrate calls to multiple System APIs, but NOT to other Process APIs

Option A

Option B

Option C

Option D

NO.55 A set of tests must be performed prior to deploying API implementations to a staging environment. Due to data security and access restrictions, untested APIs cannot be granted access to the backend systems, so instead mocked data must be used for these tests. The amount of available mocked data and its contents is sufficient to entirely test the API implementations with no active connections to the backend systems. What type of tests should be used to incorporate this mocked data?

Integration tests

Performance tests

Functional tests (Blackbox)

Unit tests (Whitebox)

NO.56 An Order API must be designed that contains significant amounts of integration logic and involves the invocation of the Product API.
The power relationship between Order API and Product API is one of “Customer/Supplier”, because the Product API is used heavily throughout the organization and is developed by a dedicated development team located in the office of the CTO.
What strategy should be used to deal with the API data model of the Product API within the Order API?

Convince the development team of the Product API to adopt the API data model of the Order API such that the integration logic of the Order API can work with one consistent internal data model

Work with the API data types of the Product API directly when implementing the integration logic of the Order API such that the Order API uses the same (unchanged) data types as the Product API

Implement an anti-corruption layer in the Order API that transforms the Product API data model into internal data types of the Order API

Start an organization-wide data modeling initiative that will result in an Enterprise Data Model that will then be used in both the Product API and the Order API

NO.57 What is a best practice when building System APIs?

Document the API using an easily consumable asset like a RAML definition

Model all API resources and methods to closely mimic the operations of the backend system

Build an Enterprise Data Model (Canonical Data Model) for each backend system and apply it to System APIs

Expose to API clients all technical details of the API implementation’s interaction with the backend system

NO.58 The responses to some HTTP requests can be cached depending on the HTTP verb used in the request.
According to the HTTP specification, for what HTTP verbs is this safe to do?

PUT, POST, DELETE

GET, HEAD, POST

GET, PUT, OPTIONS

GET, OPTIONS, HEAD

NO.59 A company requires Mule applications deployed to CloudHub to be isolated between non-production and production environments. This is so Mule applications deployed to non-production environments can only access backend systems running in their customer-hosted non-production environment, and so Mule applications deployed to production environments can only access backend systems running in their customer-hosted production environment. How does MuleSoft recommend modifying Mule applications, configuring environments, or changing infrastructure to support this type of per-environment isolation between Mule applications and backend systems?

Modify properties of Mule applications deployed to the production Anypoint Platform environments to prevent access from non-production Mule applications

Configure firewall rules in the infrastructure inside each customer-hosted environment so that only IP addresses from the corresponding Anypoint Platform environments are allowed to communicate with corresponding backend systems

Create non-production and production environments in different Anypoint Platform business groups

Create separate Anypoint VPCs for non-production and production environments, then configure connections to the backend systems in the corresponding customer-hosted environments

NO.60 What is a key requirement when using an external Identity Provider for Client Management in Anypoint Platform?

Single sign-on is required to sign in to Anypoint Platform

The application network must include System APIs that interact with the Identity Provider

To invoke OAuth 2.0-protected APIs managed by Anypoint Platform, API clients must submit access tokens issued by that same Identity Provider

APIs managed by Anypoint Platform must be protected by SAML 2.0 policies

NO.61 When designing an upstream API and its implementation, the development team has been advised to NOT set timeouts when invoking a downstream API, because that downstream API has no SLA that can be relied upon.
This is the only downstream API dependency of that upstream API.

Assume the downstream API runs uninterrupted without crashing. What is the impact of this advice?

An SLA for the upstream API CANNOT be provided

The invocation of the downstream API will run to completion without timing out

A default timeout of 500 ms will automatically be applied by the Mule runtime in which the upstream API implementation executes

A toad-dependent timeout of less than 1000 ms will be applied by the Mule runtime in which the downstream API implementation executes

NO.62 When could the API data model of a System API reasonably mimic the data model exposed by the corresponding backend system, with minimal improvements over the backend system’s data model?

When there is an existing Enterprise Data Model widely used across the organization

When the System API can be assigned to a bounded context with a corresponding data model

When a pragmatic approach with only limited isolation from the backend system is deemed appropriate

When the corresponding backend system is expected to be replaced in the near future

Correct answer: When a pragmatic approach with only limited isolation from the backend system is deemed appropriate.
*****************************************
General guidance w.r.t choosing Data Models:
>> If an Enterprise Data Model is in use then the API data model of System APIs should make use of data types from that Enterprise Data Model and the corresponding API implementation should translate between these data types from the Enterprise Data Model and the native data model of the backend system.
>> If no Enterprise Data Model is in use then each System API should be assigned to a Bounded Context, the API data model of System APIs should make use of data types from the corresponding Bounded Context Data Model and the corresponding API implementation should translate between these data types from the Bounded Context Data Model and the native data model of the backend system. In this scenario, the data types in the Bounded Context Data Model are defined purely in terms of their business characteristics and are typically not related to the native data model of the backend system. In other words, the translation effort may be significant.
>> If no Enterprise Data Model is in use, and the definition of a clean Bounded Context Data Model is considered too much effort, then the API data model of System APIs should make use of data types that approximately mirror those from the backend system, same semantics and naming as backend system, lightly sanitized, expose all fields needed for the given System API’s functionality, but not significantly more and making good use of REST conventions.
The latter approach, i.e., exposing in System APIs an API data model that basically mirrors that of the backend system, does not provide satisfactory isolation from backend systems through the System API tier on its own. In particular, it will typically not be possible to “swap out” a backend system without significantly changing all System APIs in front of that backend system and therefore the API implementations of all Process APIs that depend on those System APIs! This is so because it is not desirable to prolong the life of a previous backend system’s data model in the form of the API data model of System APIs that now front a new backend system. The API data models of System APIs following this approach must therefore change when the backend system is replaced.
On the other hand:
>> It is a very pragmatic approach that adds comparatively little overhead over accessing the backend system directly
>> Isolates API clients from intricacies of the backend system outside the data model (protocol, authentication, connection pooling, network address, …)
>> Allows the usual API policies to be applied to System APIs
>> Makes the API data model for interacting with the backend system explicit and visible, by exposing it in the RAML definitions of the System APIs
>> Further isolation from the backend system data model does occur in the API implementations of the Process API tier

NO.63 An organization is implementing a Quote of the Day API that caches today’s quote.
What scenario can use the GoudHub Object Store via the Object Store connector to persist the cache’s state?

When there are three CloudHub deployments of the API implementation to three separate CloudHub regions that must share the cache state

When there are two CloudHub deployments of the API implementation by two Anypoint Platform business groups to the same CloudHub region that must share the cache state

When there is one deployment of the API implementation to CloudHub and anottV deployment to a customer-hosted Mule runtime that must share the cache state

When there is one CloudHub deployment of the API implementation to three CloudHub workers that must share the cache state