Mulesoft MuleSoft Certified Developer MCD-LEVEL-2 Questions & Answers

• Question 1:

  A Mule application uses API autodiscovery to access and enforce policies for a RESTful implementation.

  A. Northing because flowRef is an optional attribute which can be passed runtime

  B. The name of the flow that has APlkit Console to receive all incoming RESTful operation requests.

  C. Anyof the APIkit generate implement flows

  D. The name of the flow that has HTTP listener to receive all incoming RESTful operation requests

  Correct Answer: D

  To use API autodiscovery to access and enforce policies for a RESTful implementation, flowRef must be set to the name of the flow that has HTTP listener to receive all incoming RESTful operation requests. This way, API autodiscovery can identify the API implementation and associate it with the corresponding API specification and policies in API Manager. The flow that has HTTP listener is usually the main flow that contains the APIKit Router. References:https:// docs.mulesoft.com/api-manager/2.x/api-auto-discovery-new-concept#flowref

• Question 2:

  A healthcare portal needs to validate the token that it sends to a Mule API. The developer plans to implement a custom policy using the HTTP Policy Transform Extension to match the token received in the header from the heathcare portal.

  Which files does the developer need to create in order to package the custom policy?

  A. Deployable ZIP file, YAML configuration file

  B. JSON properties file, YAML configuration file

  C. JSON properties file, XML template file

  D. XML template file, YAML configuration file

  Correct Answer: D

  To package a custom policy using the HTTP Policy Transform Extension, the developer needs to create an XML template file and a YAML configuration file. The XML template file defines the policy logic using Mule components and placeholders for user-defined properties. The YAML configuration file defines the metadata of the policy, such as its name, description, category, parameters, and dependencies. References:https://docs.mulesoft.com/api-manager/2.x/httppolicy-transform#packaging-the-policy

• Question 3:

  A company with MuleSoft Titanium develops a Salesforce System API using MuleSoft out- of-the-box Salesforce Connector and deploys the API to CloudHub.

  Which steps provide the average number of requests and average response time of the Salesforce Connector?

  A. Access Anypoint Monitoring's built-in dashboard. Select a resource. Locate the information under the Connectors tab.

  B. Access Anypoint Monitoring's built-in dashboard Seclect a resource. Create a custom dashboard to retrieve the information.

  C. Access Anypoint Monitoring built-in dashboard. Select a resource. Locate the information under Log Manager

  D. Change the API Implementation to capture the information in the log. Retrieve the information from the log file.

  Correct Answer: A

  To get the average number of requests and average response time of the Salesforce Connector, the developer should access Anypoint Monitoring's built-in dashboard, select a resource (such as an application or an API), and locate the information under the Connectors tab. The Connectors tab shows metrics for each connector used by the resource, such as average requests per minute, average response time, and failures. References:https://docs.mulesoft.com/monitoring/ built-in-dashboard-reference

• Question 4:

  Refer to the exhibit.

  

  What is the result if `'Insecure'' selected as part of the HTTP Listener configuration?

  A. The HTTP Listener will trust any certificate presented by the HTTP client

  B. The HTTP Lister will accept any unauthenticated request

  C. The HTTP listener will only accept HTTP requests

  D. Mutual TLS authentication will be enabled between this HTTP Listener and an HTTP client

  Correct Answer: C

  Based on the exhibit below, if `Insecure' is selected as part of the HTTP Listener configuration, the HTTP listener will only accept HTTP requests. This means that no TLS context will be configured for this listener and no encryption or authentication will be applied to incoming requests. The protocol attribute of this listener will be set to HTTP instead of HTTPS. References:https://docs.mulesoft.com/http-connector/1.6/http-listener-ref#insecure

• Question 5:

  Refer to the exhibit.

  

  The flow name is `'implementation'' with code for the MUnit test case.

  When the MUnit test case is executed, what is the expected result?

  A. The test case fails with an assertion error

  B. The test throws an error and does not start

  C. The test case fails with an unexpected error type

  D. The test case passes

  Correct Answer: A

  Based on the code snippet and MUnit test case below, when the MUnit test case is executed, the expected result is that the test case fails with an assertion error. This is because the assert-equals processor compares two values for equality, and fails if they are not equal. In this case, the expected value is `Hello World', but the actual value returned by the implementation flow is `Hello Mule'. Therefore, the assertion fails and an error is thrown. References:https:// docs.mulesoft.com/munit/2.3/assert-equals-processor

• Question 6:

  A mule application exposes and API for creating payments. An Operations team wants to ensure that the Payment API is up and running at all times in production.

  Which approach should be used to test that the payment API is working in production?

  A. Create a health check endpoint that listens on a separate port and uses a separate HTTP Listener configuration from the API

  B. Configure the application to send health data to an external system

  C. Create a health check endpoint that reuses the same port number and HTTP Listener configuration as the API itself

  D. Monitor the Payment API directly sending real customer payment data

  Correct Answer: A

  To test that the payment API is working in production, the developer should create a health check endpoint that listens on a separate port and uses a separate HTTP Listener configuration from the API. This way, the developer can isolate the health check endpoint from the API traffic and avoid affecting the performance or availability of the API. The health check endpoint should return a simple response that indicates the status of the API, such as OK or ERROR. References:https://docs.mulesoft.com/api-functional-monitoring/afm-create-monitor#create-a-monitor

• Question 7:

  A heathcare customer wants to use hospital system data, which includes code that was developed using legacy tools and methods. The customer has created reusable Java libraries in order to read the data from the system.

  What is the most effective way to develop an API retrieve the data from the hospital system?

  A. Refer to JAR files in the code

  B. Include the libraries writes deploying the code into the runtime

  C. Create the Java code in your project and invoice the data from the code

  D. Install libraries in a local repository and refer to it in the pm.xml file

  Correct Answer: D

  To develop an API that retrieves data from a hospital system using reusable Java libraries, the developer should install libraries in a local repository and refer to it in the pom.xml file. This way, the developer can use Maven to manage dependencies and invoke Java code from Muleapplications using Java Module operations. References: https://docs.mulesoft.com/mule-runtime/4.3/java-module-reference#add-the-java-module-to-your-projecthttps://docs.mulesoft.com/mule-runtime/4.3/java-module-reference#invoke-java-code

• Question 8:

  An API has been developed and deployed to CloudHub Among the policies applied to this API is an allowlist of IP addresses. A developer wants to run a test in Anypoint Studio and does not want any policies applied because their workstation is not included in the allowlist.

  What must the developer do in order to run this test locally without the policies applied?

  A. Create a properties file specifically for local development and set the API instance ID to a value that is not used in API Manager

  B. Pass in the runtime parameter `'-Danpow.platform.gatekeeper=disabled''

  C. Deactivate the API in API Manager so the Autodiscovery element will not find the application when it runs in Studio

  D. Run the test as-s, with no changes because the Studio runtime will not attempt to connect to API Manager

  Correct Answer: A

  To run a test locally without the policies applied, the developer should create a properties file specifically for local development and set the API instance ID to a value that is not used in API Manager. This way, the developer can use different configuration properties for different environments and avoid triggering API autodiscovery when running tests locally. API autodiscovery is a mechanism that associates an API implementation with its corresponding API specification and policies in API Manager based on its API instance ID. By setting this ID to a value that does not exist in API Manager, the developer can prevent API autodiscovery from finding and applying any policies to the local test.

  References: https://docs.mulesoft.com/api-manager/2.x/api-auto-discovery-new-concept#configuring-api-autodiscovery https://docs.mulesoft.com/mule-runtime/4.3/configuring-properties

• Question 9:

  The flow is invoicing a target API. The API's protocol is HTTPS. The TLS configuration in the HTTP Request Configuration global element is set to None. A web client submits a request to http:localhost:8081/vehicles. If the certificate of the target API is signed by a certificate authority (CA), what is true about the HTTP Request operation when the flow executes?

  A. The HTTP Request operation will succeed if the CA'S certificate is present in the JRE's default keystore

  B. The HTTP Request operation will succeed if the CA's certificate is present in the JRE's default truststore.

  C. The HTTP Request operation will always succeed regardless of the CA

  D. The HTTP Request operation will always fail regardless of the CA

  Correct Answer: B

  The HTTP Request operation will use the default truststore of the JRE to validate the certificate of the target API. If the CA's certificate is present in the truststore, the operation will succeed. Otherwise, it will fail with a handshake exception. References:https://docs.mulesoft.com/mule-runtime/4.3/tls-configuration#tls-default

• Question 10:

  Which statement is true about using mutual TLS to secure an application?

  A. Mutual TLS requires a hardware security module to be used

  B. Mutual TLS authenticates the identity of the server before the identity of the client

  C. Mutual TLS ensures only authorized end users are allowed to access an endpoint

  D. Mutual TLS increases the encryption strength versus server-side TLS alone

  Correct Answer: B

  Mutual TLS (mTLS) is an extension of TLS that requires both parties (client and server) to present their certificates to each other during the handshake process. This way, both parties can verify each other's identity and establish a secure connection. The authentication of the server happens before the authentication of the client, as the server sends its certificate first and then requests the client's certificate. References:https://docs.mulesoft.com/mule-runtime/4.3/tls-configuration#mutual-authentication