Mulesoft MuleSoft Certified Architect MCIA-LEVEL-1-MAINTENANCE Questions & Answers

• Question 31:

  Refer to the exhibit.

  

  What is the type data format shown in the exhibit?

  A. JSON

  B. XML

  C. YAML

  D. CSV

  Correct Answer: A

• Question 32:

  How does timeout attribute help inform design decisions while using JMS connector listening for incoming messages in an extended architecture (XA) transaction?

  A. After the timeout is exceeded, stale JMS consumer threads are destroyed and new threads are created

  B. The timeout specifies the time allowed to pass between receiving JMS messages on the same JMS connection and then after the timeout new JMS connection is established

  C. The time allowed to pass between committing the transaction and the completion of the mule flow and then after the timeout flow processing triggers an error

  D. The timeout defines the time that is allowed to pass without the transaction ending explicitly and after the timeout expires, the transaction rolls back

  Correct Answer: D

• Question 33:

  An API implementation is being designed that must invoke an Order API which is known to repeatedly experience downtime. For this reason a fallback API is to be called when the Order API is unavailable. What approach to designing invocation of the fallback API provides the best resilience?

  A. Redirect client requests through an HTTP 303 temporary redirect status code to the fallback API whenever the Order API is unavailable

  B. Set an option in the HTTP Requester component that invokes the order API to instead invoke a fallback API whenever an HTTP 4XX or 5XX response status code is received from Order API

  C. Create a separate entry for the order API in API manager and then invoke this API as a fallback API if the primary Order API is unavailable

  D. Search Anypoint Exchange for a suitable existing fallback API and them implement invocations to their fallback API in addition to the Order API

  Correct Answer: A

  *

  Resilience testing is a type of software testing that observes how applications act under stress. It's meant to ensure the product's ability to perform in chaotic conditions without a loss of core functions or data; it ensures a quick recovery after unforeseen, uncontrollable events.

  *

  In case an API invocation fails -- even after a certain number of retries -- it might be adequate to invoke a different API as a fallback. A fallback API, by definition, will never be ideal for the purpose of the API client, otherwise it would be the primary API.

  *

  Here are some examples for fallback APIs:

  -An old, deprecated version of the same API.

  -

  An alternative endpoint of the same API and version (e.g. API in another CloudHub region).

  -

  An API doing more than required, and therefore not as performant as the primary API.

  -

  An API doing less than required and therefore forcing the API Client to offer a degraded service, which is still better than no service at all.

  *

  API clients implemented as Mule applications offer the `Until Successful Scope and Exception' strategies at their disposal, which together allow configuring fallback actions such as a fallback API invocation.

  *

  All HTTP response status codes within the 3xx category are considered redirection messages. These codes indicate to the user agent (i.e. your web browser) that an additional action is required in order to complete the request and access the desired resource

  

  Hence correct answer is Redirect client requests through an HTTP 303 temporary redirect status code to the fallback API whenever the Order API is unavailable

• Question 34:

  What is an advantage of using OAuth 2.0 client credentials and access tokens over only API keys for API authentication?

  A. If the access token is compromised, the client credentials do not to be reissued.

  B. If the access token is compromised, I can be exchanged for an API key.

  C. If the client ID is compromised, it can be exchanged for an API key

  D. If the client secret is compromised, the client credentials do not have to be reissued.

  Correct Answer: A

  The advantage of using OAuth 2.0 client credentials and access tokens over only API keys for API authentication is that if the access token is compromised, the client credentials do not have to be reissued. OAuth 2.0 is a secure protocol for authenticating clients and authorizing them to access protected resources. It works by having the client authenticate with the authorization server and receive an access token, which is then used to authenticate requests to the API. If the access token is compromised, it can be revoked and replaced without needing to reissue the client credentials. References: MuleSoft Certified Integration Architect - Level 1 Official Text Book and Resources: Chapter 7: Security Section 7.2: OAuth 2.0

• Question 35:

  Refer to the exhibit.

  

  A Mule application is deployed to a multi-node Mule runtime cluster. The Mule application uses the competing consumer pattern among its cluster replicas to receive JMS messages from a JMS queue. To process each received JMS message, the following steps are performed in a flow:

  Step l: The JMS Correlation ID header is read from the received JMS message.

  Step 2: The Mule application invokes an idempotent SOAP webservice over HTTPS, passing the JMS Correlation ID as one parameter in the SOAP request.

  Step 3: The response from the SOAP webservice also returns the same JMS Correlation ID.

  Step 4: The JMS Correlation ID received from the SOAP webservice is validated to be identical to the JMS Correlation ID received in Step 1.

  Step 5: The Mule application creates a response JMS message, setting the JMS Correlation ID message header to the validated JMS Correlation ID and publishes that message to a response JMS queue.

  Where should the Mule application store the JMS Correlation ID values received in Step 1 and Step 3 so that the validation in Step 4 can be performed, while also making the overall Mule application highly available, fault-tolerant, performant, and maintainable?

  A. Both Correlation ID values should be stored in a persistent object store

  B. Both Correlation ID values should be stored In a non-persistent object store

  C. The Correlation ID value in Step 1 should be stored in a persistent object store The Correlation ID value in step 3 should be stored as a Mule event variable/attribute

  D. Both Correlation ID values should be stored as Mule event variable/attribute

  Correct Answer: C

  *

  If we store Correlation id value in step 1 as Mule event variables/attributes, the values will be cleared after server restart and we want system to be fault tolerant.

  *

  The Correlation ID value in Step 1 should be stored in a persistent object store.

  *

  We don't need to store Correlation ID value in Step 3 to persistent object store. We can store it but as we also need to make application performant. We can avoid this step of accessing persistent object store.

  *

  Accessing persistent object stores slow down the performance as persistent object stores are by default stored in shared file systems.

  *

  As the SOAP service is idempotent in nature. In case of any failures , using this Correlation ID saved in first step we can make call to SOAP service and validate the Correlation ID.

  Top of Form

  Additional Information:

  *

  Competing Consumers are multiple consumers that are all created to receive messages from a single Point-to-Point Channel. When the channel delivers a message, any of the consumers could potentially receive it. The messaging

  system's implementation determines which consumer actually receives the message, but in effect the consumers compete with each other to be the receiver. Once a consumer receives a message, it can delegate to the rest of its application

  to help process the message.

  *

  In case you are unaware about term idempotent re is more info:

  Idempotent operations means their result will always same no matter how many times these operations are invoked.

  

  

• Question 36:

  A Mule application uses APIkit for SOAP to implement a SOAP web service. The Mule application has been deployed to a CloudHub worker in a testing environment.

  The integration testing team wants to use a SOAP client to perform Integration testing. To carry out the integration tests, the integration team must obtain the interface definition for the SOAP web service.

  What is the most idiomatic (used for its intended purpose) way for the integration testing team to obtain the interface definition for the deployed SOAP web service in order to perform integration testing with the SOAP client?

  A. Retrieve the OpenAPI Specification file(s) from API Manager

  B. Retrieve the WSDL file(s) from the deployed Mule application

  C. Retrieve the RAML file(s) from the deployed Mule application

  D. Retrieve the XML file(s) from Runtime Manager

  Correct Answer: D

  Reference: https://docs.spring.io/spring-framework/docs/4.2.x/spring-framework-reference/html/integration-testing.html

• Question 37:

  What Is a recommended practice when designing an integration Mule 4 application that reads a large XML payload as a stream?

  A. The payload should be dealt with as a repeatable XML stream, which must only be traversed (iterated-over) once and CANNOT be accessed randomly from DataWeave expressions and scripts

  B. The payload should be dealt with as an XML stream, without converting it to a single Java object (POJO)

  C. The payload size should NOT exceed the maximum available heap memory of the Mute runtime on which the Mule application executes

  D. The payload must be cached using a Cache scope If It Is to be sent to multiple backend systems

  Correct Answer: C

  If the size of the stream exceeds the maximum, a STREAM_MAXIMUM_SIZE_EXCEEDED error is raised.

• Question 38:

  A trading company handles millions of requests a day. Due to nature of its business, it requires excellent performance and reliability within its application.

  For this purpose, company uses a number of event-based API's hosted on various mule clusters that communicate across a shared message queue sitting within its network.

  Which method should be used to meet the company's requirement for its system?

  A. XA transactions and XA connected components

  B. JMS transactions

  C. JMS manual acknowledgements with a reliability pattern

  D. VM queues with reliability pattern

  Correct Answer: C

• Question 39:

  A DevOps team has adequate observability of individual system behavior and performance, but it struggles to track the entire lifecycle of each request across different microservices.

  Which additional observability approach should this team consider adopting?

  A. Analytics

  B. Metrics

  C. Tracing

  D. Data mining

  Correct Answer: B

• Question 40:

  An API has been unit tested and is ready for integration testing. The API is governed by a Client ID Enforcement policy in all environments.

  What must the testing team do before they can start integration testing the API in the Staging environment?

  A. They must access the API portal and create an API notebook using the Client ID and Client Secret supplied by the API portal in the Staging environment

  B. They must request access to the API instance in the Staging environment and obtain a Client ID and Client Secret to be used for testing the API

  C. They must be assigned as an API version owner of the API in the Staging environment

  D. They must request access to the Staging environment and obtain the Client ID and Client Secret for that environment to be used for testing the API

  Correct Answer: B

  *

  It's mentioned that the API is governed by a Client ID Enforcement policy in all environments.

  *

  Client ID Enforcement policy allows only authorized applications to access the deployed API implementation.

  *

  Each authorized application is configured with credentials: client_id and client_secret.

  *

  At runtime, authorized applications provide the credentials with each request to the API implementation. MuleSoft Reference: https://docs.mulesoft.com/api-manager/2.x/policy-mule3-client-id- based-policies