Updated Mar-2023 Premium MCPA-Level-1 Exam Engine pdf - Download Free Updated 97 Questions
Authentic MCPA-Level-1 Dumps With 100% Passing Rate Practice Tests Dumps
NEW QUESTION 22
What is a typical result of using a fine-grained rather than a coarse-grained API deployment model to implement a given business process?
- A. A better response time for the end user as a result of the APIs being smaller in scope and complexity
- B. An overall tower usage of resources because each fine-grained API consumes less resources
- C. A higher number of discoverable API-related assets in the application network
- D. A decrease in the number of connections within the application network supporting the business process
Answer: A
NEW QUESTION 23
The application network is recomposable: it is built for change because it "bends but does not break"
- A. FALSE
- B. TRUE
Answer: B
Explanation:
*****************************************
>> Application Network is a disposable architecture.
>> Which means, it can be altered without disturbing entire architecture and its components.
>> It bends as per requirements or design changes but does not break
NEW QUESTION 24
Refer to the exhibit.
An organization is running a Mule standalone runtime and has configured Active Directory as the Anypoint Platform external Identity Provider. The organization does not have budget for other system components.
What policy should be applied to all instances of APIs in the organization to most effectively restrict access to a specific group of internal users?
- A. Apply an IP whitelist policy; only the specific users' workstations will be in the whitelist.
- B. Apply a basic authentication - LDAP policy; the internal Active Directory will be configured as the LDAP source for authenticating users.
- C. Apply a client ID enforcement policy; the specific group of users will configure their client applications to use their specific client credentials.
- D. Apply an OAuth 2.0 access token enforcement policy; the internal Active Directory will be configured as the OAuth server.
Answer: B
NEW QUESTION 25
An Anypoint Platform organization has been configured with an external identity provider (IdP) for identity management and client management. What credentials or token must be provided to Anypoint CLI to execute commands against the Anypoint Platform APIs?
- A. An OAuth 2.0 token generated using the credentials provided by the IdP for identity management
- B. An OAuth 2.0 token generated using the credentials provided by the IdP for client management
- C. The credentials provided by the IdP for identity management
- D. The credentials provided by the IdP for client management
Answer: C
Explanation:
Correct answer: The credentials provided by the IdP for identity management
*****************************************
Reference:
>> There is no support for OAuth 2.0 tokens from client/identity providers to authenticate via Anypoint CLI. Only possible tokens are "bearer tokens" that too only generated using Anypoint Organization/Environment Client Id and Secret from https://anypoint.mulesoft.com/accounts/login. Not the client credentials of client provider. So, OAuth 2.0 is not possible. More over, the token is mainly for API Manager purposes and not associated with a user. You can NOT use it to call most APIs (for example Cloudhub and etc) as per this Mulesoft Knowledge article.
>> The other option allowed by Anypoint CLI is to use client credentials. It is possible to use client credentials of a client provider but requires setting up Connected Apps in client management but such details are not given in the scenario explained in the question.
>> So only option left is to use user credentials from identify provider
NEW QUESTION 26
What is true about where an API policy is defined in Anypoint Platform and how it is then applied to API instances?
- A. The API policy is defined in API Manager, and then applied to ALL API instances in the specified environment
- B. The API policy Is defined In Runtime Manager as part of the API deployment to a Mule runtime, and then ONLY applied to the specific API Instance
- C. The API policy Is defined in API Manager and then automatically applied to ALL API instances
- D. The API policy Is defined In API Manager for a specific API Instance, and then ONLY applied to the specific API instance
Answer: D
Explanation:
Correct answer: The API policy is defined in API Manager for a specific API instance, and then ONLY applied to the specific API instance.
*****************************************
>> Once our API specifications are ready and published to Exchange, we need to visit API Manager and register an API instance for each API.
>> API Manager is the place where management of API aspects takes place like addressing NFRs by enforcing policies on them.
>> We can create multiple instances for a same API and manage them differently for different purposes.
>> One instance can have a set of API policies applied and another instance of same API can have different set of policies applied for some other purpose.
>> These APIs and their instances are defined PER environment basis. So, one need to manage them seperately in each environment.
>> We can ensure that same configuration of API instances (SLAs, Policies etc..) gets promoted when promoting to higher environments using platform feature. But this is optional only. Still one can change them per environment basis if they have to.
>> Runtime Manager is the place to manage API Implementations and their Mule Runtimes but NOT APIs itself. Though API policies gets executed in Mule Runtimes, We CANNOT enforce API policies in Runtime Manager. We would need to do that via API Manager only for a cherry picked instance in an environment.
So, based on these facts, right statement in the given choices is - "The API policy is defined in API Manager for a specific API instance, and then ONLY applied to the specific API instance".
NEW QUESTION 27
Refer to the exhibit.
A developer is building a client application to invoke an API deployed to the STAGING environment that is governed by a client ID enforcement policy.
What is required to successfully invoke the API?
- A. The client ID and secret for the Anypoint Platform account owning the API in the STAGING environment
- B. The client ID and secret obtained from Anypoint Exchange for the API instance in the STAGING environment
- C. The client ID and secret for the Anypoint Platform account's STAGING environment
- D. A valid OAuth token obtained from Anypoint Platform and its associated client ID and secret
Answer: D
Explanation:
Explanation
https://docs.mulesoft.com/api-manager/2.x/policy-mule3-client-id-based-policies
NEW QUESTION 28
An organization uses various cloud-based SaaS systems and multiple on-premises systems. The on-premises systems are an important part of the organization's application network and can only be accessed from within the organization's intranet.
What is the best way to configure and use Anypoint Platform to support integrations with both the cloud-based SaaS systems and on-premises systems?
A) Use CloudHub-deployed Mule runtimes in an Anypoint VPC managed by Anypoint Platform Private Cloud Edition control plane
B) Use CloudHub-deployed Mule runtimes in the shared worker cloud managed by the MuleSoft-hosted Anypoint Platform control plane
C) Use an on-premises installation of Mule runtimes that are completely isolated with NO external network access, managed by the Anypoint Platform Private Cloud Edition control plane
D) Use a combination of Cloud Hub-deployed and manually provisioned on-premises Mule runtimes managed by the MuleSoft-hosted Anypoint Platform control plane
- A. Option B
- B. Option C
- C. Option A
- D. Option D
Answer: A
NEW QUESTION 29
An API implementation is deployed to CloudHub.
What conditions can be alerted on using the default Anypoint Platform functionality, where the alert conditions depend on the end-to-end request processing of the API implementation?
- A. When the response time of API invocations exceeds a threshold
- B. When a particular API client invokes the API too often within a given time period
- C. When the API is invoked by an unrecognized API client
- D. When the API receives a very high number of API invocations
Answer: B
NEW QUESTION 30
What CANNOT be effectively enforced using an API policy in Anypoint Platform?
- A. Logging HTTP requests and responses
- B. Backend system overloading
- C. Maintaining tamper-proof credentials between APIs
- D. Guarding against Denial of Service attacks
Answer: D
NEW QUESTION 31
What Mule application deployment scenario requires using Anypoint Platform Private Cloud Edition or Anypoint Platform for Pivotal Cloud Foundry?
- A. When it is required that ALL APIs are private and NOT exposed to the public cloud
- B. When regulatory requirements mandate on-premises processing of EVERY data item, including meta-data
- C. When ALL backend systems in the application network are deployed in the organization's intranet
- D. When it Is required to make ALL applications highly available across multiple data centers
Answer: C
NEW QUESTION 32
Refer to the exhibit.
what is true when using customer-hosted Mule runtimes with the MuleSoft-hosted Anypoint Platform control plane (hybrid deployment)?
- A. Anypoint Runtime Manager initiates a network connection to a Mule runtime in order to deploy Mule applications
- B. Anypoint Runtime Manager automatically ensures HA in the control plane by creating a new Mule runtime instance in case of a node failure
- C. API implementations can run successfully in customer-hosted Mule runtimes, even when they are unable to communicate with the control plane
- D. The MuleSoft-hosted Shared Load Balancer can be used to load balance API invocations to the Mule runtimes
Answer: C
Explanation:
Correct answer: API implementations can run successfully in customer-hosted Mule runtimes, even when they are unable to communicate with the control plane.
*****************************************
>> We CANNOT use Shared Load balancer to load balance APIs on customer hosted runtimes
>> For Hybrid deployment models, the on-premises are first connected to Runtime Manager using Runtime Manager agent. So, the connection is initiated first from On-premises to Runtime Manager. Then all control can be done from Runtime Manager.
>> Anypoint Runtime Manager CANNOT ensure automatic HA. Clusters/Server Groups etc should be configured before hand.
Only TRUE statement in the given choices is, API implementations can run successfully in customer-hosted Mule runtimes, even when they are unable to communicate with the control plane. There are several references below to justify this statement.
References:
https://docs.mulesoft.com/runtime-manager/deployment-strategies#hybrid-deployments
https://help.mulesoft.com/s/article/On-Premise-Runtimes-Disconnected-From-US-Control-Plane-June-18th-2018
https://help.mulesoft.com/s/article/Runtime-Manager-cannot-manage-On-Prem-Applications-and-Servers-from-US-Control-Plane-June-25th-2019
https://help.mulesoft.com/s/article/On-premise-Runtimes-Appear-Disconnected-in-Runtime-Manager-May-29th-2018
NEW QUESTION 33
What API policy would be LEAST LIKELY used when designing an Experience API that is intended to work with a consumer mobile phone or tablet application?
- A. IPwhitellst
- B. JSON threat protection
- C. OAuth 2.0 access token enforcement
- D. Client ID enforcement
Answer: C
NEW QUESTION 34
What do the API invocation metrics provided by Anypoint Platform provide?
- A. ROI metrics from APIs that can be directly shared with business users
- B. Measurements of the effectiveness of the application network based on the level of reuse
- C. Data on past API invocations to help identify anomalies and usage patterns across various APIs
- D. Proactive identification of likely future policy violations that exceed a given threat threshold
Answer: B
NEW QUESTION 35
Say, there is a legacy CRM system called CRM-Z which is offering below functions:
1. Customer creation
2. Amend details of an existing customer
3. Retrieve details of a customer
4. Suspend a customer
- A. Implement different system APIs named createCustomer, amendCustomer, retrieveCustomer and suspendCustomer as they are modular and has seperation of concerns
- B. Implement different system APIs named createCustomerInCRMZ, amendCustomerInCRMZ, retrieveCustomerFromCRMZ and suspendCustomerInCRMZ as they are modular and has seperation of concerns
- C. Implement a system API named customerManagement which has all the functionalities wrapped in it as various operations/resources
Answer: A
Explanation:
Correct answer: Implement different system APIs named createCustomer, amendCustomer, retrieveCustomer and suspendCustomer as they are modular and has seperation of concerns
*****************************************
>> It is quite normal to have a single API and different Verb + Resource combinations. However, this fits well for an Experience API or a Process API but not a best architecture style for System APIs. So, option with just one customerManagement API is not the best choice here.
>> The option with APIs in createCustomerInCRMZ format is next close choice w.r.t modularization and less maintenance but the naming of APIs is directly coupled with the legacy system. A better foreseen approach would be to name your APIs by abstracting the backend system names as it allows seamless replacement/migration of any backend system anytime. So, this is not the correct choice too.
>> createCustomer, amendCustomer, retrieveCustomer and suspendCustomer is the right approach and is the best fit compared to other options as they are both modular and same time got the names decoupled from backend system and it has covered all requirements a System API needs.
NEW QUESTION 36
The implementation of a Process API must change.
What is a valid approach that minimizes the impact of this change on API clients?
- A. Implement required changes to the Process API implementation so that whenever possible, the Process API's RAML definition remains unchanged
- B. Update the RAML definition of the current Process API and notify API client developers by sending them links to the updated RAML definition
- C. Postpone changes until API consumers acknowledge they are ready to migrate to a new Process API or API version
- D. Implement the Process API changes in a new API implementation, and have the old API implementation return an HTTP status code 301 - Moved Permanently to inform API clients they should be calling the new API implementation
Answer: A
Explanation:
Correct answer: Implement required changes to the Process API implementation so that, whenever possible, the Process API's RAML definition remains unchanged.
*****************************************
Key requirement in the question is:
>> Approach that minimizes the impact of this change on API clients
Based on above:
>> Updating the RAML definition would possibly impact the API clients if the changes require any thing mandatory from client side. So, one should try to avoid doing that until really necessary.
>> Implementing the changes as a completely different API and then redirectly the clients with 3xx status code is really upsetting design and heavily impacts the API clients.
>> Organisations and IT cannot simply postpone the changes required until all API consumers acknowledge they are ready to migrate to a new Process API or API version. This is unrealistic and not possible.
The best way to handle the changes always is to implement required changes to the API implementations so that, whenever possible, the API's RAML definition remains unchanged.
NEW QUESTION 37
A System API is designed to retrieve data from a backend system that has scalability challenges. What API policy can best safeguard the backend system?
- A. Auth 2 token enforcement
- B. IPwhitelist
- C. SLA-based rate limiting
- D. Client ID enforcement
Answer: C
Explanation:
Explanation
https://dzone.com/articles/how-to-secure-apis
NEW QUESTION 38
What correctly characterizes unit tests of Mule applications?
- A. They must be run in a unit testing environment with dedicated Mule runtimes for the environment
- B. They are typically written using MUnit to run in an embedded Mule runtime that does not require external connectivity
- C. They must be triggered by an external client tool or event source
- D. They test the validity of input and output of source and target systems
Answer: B
Explanation:
Correct answer: They are typically written using MUnit to run in an embedded Mule runtime that does not require external connectivity.
*****************************************
Below TWO are characteristics of Integration Tests but NOT unit tests:
>> They test the validity of input and output of source and target systems.
>> They must be triggered by an external client tool or event source.
It is NOT TRUE that Unit Tests must be run in a unit testing environment with dedicated Mule runtimes for the environment.
MuleSoft offers MUnit for writing Unit Tests and they run in an embedded Mule Runtime without needing any separate/ dedicated Runtimes to execute them. They also do NOT need any external connectivity as MUnit supports mocking via stubs.
https://dzone.com/articles/munit-framework
NEW QUESTION 39
A code-centric API documentation environment should allow API consumers to investigate and execute API client source code that demonstrates invoking one or more APIs as part of representative scenarios.
What is the most effective way to provide this type of code-centric API documentation environment using Anypoint Platform?
- A. Enable mocking services for each of the relevant APIs and expose them via their Anypoint Exchange entry
- B. Ensure the APIs are well documented through their Anypoint Exchange entries and API Consoles and share these pages with all API consumers
- C. Create API Notebooks and include them in the relevant Anypoint Exchange entries
- D. Make relevant APIs discoverable via an Anypoint Exchange entry
Answer: B
NEW QUESTION 40
What Mule application can have API policies applied by Anypoint Platform to the endpoint exposed by that Mule application?
A) A Mule application that accepts requests over HTTP/1.x
B) A Mule application that accepts JSON requests over TCP but is NOT required to provide a response
C) A Mute application that accepts JSON requests over WebSocket
D) A Mule application that accepts gRPC requests over HTTP/2
- A. Option B
- B. Option D
- C. Option C
- D. Option A
Answer: B
NEW QUESTION 41
An organization has implemented a Customer Address API to retrieve customer address information. This API has been deployed to multiple environments and has been configured to enforce client IDs everywhere.
A developer is writing a client application to allow a user to update their address. The developer has found the Customer Address API in Anypoint Exchange and wants to use it in their client application.
What step of gaining access to the API can be performed automatically by Anypoint Platform?
- A. Create a new application in Anypoint Exchange for requesting access to the API
- B. Request access to the appropriate API Instances deployed to multiple environments using the client application's credentials
- C. Approve the client application request for the chosen SLA tier
- D. Modify the client application to call the API using the client application's credentials
Answer: C
Explanation:
Correct answer: Approve the client application request for the chosen SLA tier
*****************************************
>> Only approving the client application request for the chosen SLA tier can be automated
>> Rest of the provided options are not valid
NEW QUESTION 42
What API policy would LEAST likely be applied to a Process API?
- A. JSON threat protection
- B. Custom circuit breaker
- C. Rate limiting
- D. Client ID enforcement
Answer: A
Explanation:
Correct answer: JSON threat protection
*****************************************
Fact: Technically, there are no restrictions on what policy can be applied in what layer. Any policy can be applied on any layer API. However, context should also be considered properly before blindly applying the policies on APIs.
That is why, this question asked for a policy that would LEAST likely be applied to a Process API.
From the given options:
>> All policies except "JSON threat protection" can be applied without hesitation to the APIs in Process tier.
>> JSON threat protection policy ideally fits for experience APIs to prevent suspicious JSON payload coming from external API clients. This covers more of a security aspect by trying to avoid possibly malicious and harmful JSON payloads from external clients calling experience APIs.
As external API clients are NEVER allowed to call Process APIs directly and also these kind of malicious and harmful JSON payloads are always stopped at experience API layer only using this policy, it is LEAST LIKELY that this same policy is again applied on Process Layer API.
NEW QUESTION 43
The responses to some HTTP requests can be cached depending on the HTTP verb used in the request. According to the HTTP specification, for what HTTP verbs is this safe to do?
- A. GET, PUT, OPTIONS
- B. GET, HEAD, POST
- C. GET, OPTIONS, HEAD
- D. PUT, POST, DELETE
Answer: C
Explanation:
Correct answer: GET, OPTIONS, HEAD
http://restcookbook.com/HTTP%20Methods/idempotency/
NEW QUESTION 44
What Anypoint Platform Capabilities listed below fall under APIs and API Invocations/Consumers category? Select TWO.
- A. API Design and Development
- B. API Runtime Execution and Hosting
- C. API Operations and Management
- D. API Consumer Engagement
Answer: A
Explanation:
Correct Answers: API Design and Development and API Runtime Execution and Hosting
*****************************************
>> API Design and Development - Anypoint Studio, Anypoint Design Center, Anypoint Connectors
>> API Runtime Execution and Hosting - Mule Runtimes, CloudHub, Runtime Services
>> API Operations and Management - Anypoint API Manager, Anypoint Exchange
Correct Answers: API Operations and Management and API Consumer Engagement
*****************************************
>> API Design and Development - Anypoint Studio, Anypoint Design Center, Anypoint Connectors
>> API Runtime Execution and Hosting - Mule Runtimes, CloudHub, Runtime Services
>> API Operations and Management - Anypoint API Manager, Anypoint Exchange
>> API Consumer Management - API Contracts, Public Portals, Anypoint Exchange, API Notebooks
NEW QUESTION 45
When using CloudHub with the Shared Load Balancer, what is managed EXCLUSIVELY by the API implementation (the Mule application) and NOT by Anypoint Platform?
- A. The logging configuration that enables log entries to be visible in Runtime Manager
- B. The SSL certificates used by the API implementation to expose HTTPS endpoints
- C. The assignment of each HTTP request to a particular CloudHub worker
- D. The number of DNS entries allocated to the API implementation
Answer: D
NEW QUESTION 46
......
Verified Pass MCPA-Level-1 Exam in First Attempt Guaranteed: https://www.exam4tests.com/MCPA-Level-1-valid-braindumps.html