[2023] Pass your MCPA-Level-1 exam with this 100% Free MCPA-Level-1 Braindump
View All MCPA-Level-1 Actual Exam Questions, Answers and Explanations for Free
The MCPA-Level-1 exam covers a wide range of topics, including MuleSoft Anypoint Platform architecture, design patterns, security, performance optimization, and troubleshooting. It is a rigorous exam that tests the candidate’s knowledge and understanding of the MuleSoft Anypoint Platform, as well as their ability to design and implement effective integration solutions.
NEW QUESTION # 36
What is typically NOT a function of the APIs created within the framework called API-led connectivity?
- A. They provide an additional layer of resilience on top of the underlying backend system, thereby insulating clients from extended failure of these systems.
- B. They can compose data from various sources and combine them with orchestration logic to create higher level value.
- C. They reduce the dependency on the underlying backend systems by helping unlock data from backend systems In a reusable and consumable way.
- D. They allow for innovation at the user Interface level by consuming the underlying assets without being aware of how data Is being extracted from backend systems.
Answer: A
Explanation:
Correct answer: They provide an additional layer of resilience on top of the underlying backend system, thereby insulating clients from extended failure of these systems.
*****************************************
In API-led connectivity,
>> Experience APIs - allow for innovation at the user interface level by consuming the underlying assets without being aware of how data is being extracted from backend systems.
>> Process APIs - compose data from various sources and combine them with orchestration logic to create higher level value
>> System APIs - reduce the dependency on the underlying backend systems by helping unlock data from backend systems in a reusable and consumable way.
However, they NEVER promise that they provide an additional layer of resilience on top of the underlying backend system, thereby insulating clients from extended failure of these systems.
https://dzone.com/articles/api-led-connectivity-with-mule
NEW QUESTION # 37
What should be ensured before sharing an API through a public Anypoint Exchange portal?
- A. The users needing access to the API should be added to the appropriate role in Anypoint Platform
- B. The API should be functional with at least an initial implementation deployed and accessible for users to interact with
- C. The visibility level of the API instances of that API that need to be publicly accessible should be set to public visibility
- D. The API should be secured using one of the supported authentication/authorization mechanisms to ensure that data is not compromised
Answer: C
Explanation:
Explanation
https://docs.mulesoft.com/exchange/to-share-api-asset-to-portal
NEW QUESTION # 38
What is a typical result of using a fine-grained rather than a coarse-grained API deployment model to implement a given business process?
- A. A better response time for the end user as a result of the APIs being smaller in scope and complexity
- B. A higher number of discoverable API-related assets in the application network
- C. An overall tower usage of resources because each fine-grained API consumes less resources
- D. A decrease in the number of connections within the application network supporting the business process
Answer: C
NEW QUESTION # 39
What API policy would LEAST likely be applied to a Process API?
- A. JSON threat protection
- B. Rate limiting
- C. Custom circuit breaker
- D. Client ID enforcement
Answer: A
Explanation:
Correct answer: JSON threat protection
*****************************************
Fact: Technically, there are no restrictions on what policy can be applied in what layer. Any policy can be applied on any layer API. However, context should also be considered properly before blindly applying the policies on APIs.
That is why, this question asked for a policy that would LEAST likely be applied to a Process API.
From the given options:
>> All policies except "JSON threat protection" can be applied without hesitation to the APIs in Process tier.
>> JSON threat protection policy ideally fits for experience APIs to prevent suspicious JSON payload coming from external API clients. This covers more of a security aspect by trying to avoid possibly malicious and harmful JSON payloads from external clients calling experience APIs.
As external API clients are NEVER allowed to call Process APIs directly and also these kind of malicious and harmful JSON payloads are always stopped at experience API layer only using this policy, it is LEAST LIKELY that this same policy is again applied on Process Layer API.
NEW QUESTION # 40
The implementation of a Process API must change.
What is a valid approach that minimizes the impact of this change on API clients?
- A. Update the RAML definition of the current Process API and notify API client developers by sending them links to the updated RAML definition
- B. Implement required changes to the Process API implementation so that whenever possible, the Process API's RAML definition remains unchanged
- C. Implement the Process API changes in a new API implementation, and have the old API implementation return an HTTP status code 301 - Moved Permanently to inform API clients they should be calling the new API implementation
- D. Postpone changes until API consumers acknowledge they are ready to migrate to a new Process API or API version
Answer: C
NEW QUESTION # 41
A set of tests must be performed prior to deploying API implementations to a staging environment. Due to data security and access restrictions, untested APIs cannot be granted access to the backend systems, so instead mocked data must be used for these tests. The amount of available mocked data and its contents is sufficient to entirely test the API implementations with no active connections to the backend systems. What type of tests should be used to incorporate this mocked data?
- A. Functional tests (Blackbox)
- B. Performance tests
- C. Integration tests
- D. Unit tests (Whitebox)
Answer: D
Explanation:
Correct answer: Unit tests (Whitebox)
*****************************************
Reference:
As per general IT testing practice and MuleSoft recommended practice, Integration and Performance tests should be done on full end to end setup for right evaluation. Which means all end systems should be connected while doing the tests. So, these options are OUT and we are left with Unit Tests and Functional Tests.
As per attached reference documentation from MuleSoft:
Unit Tests - are limited to the code that can be realistically exercised without the need to run it inside Mule itself. So good candidates are Small pieces of modular code, Sub Flows, Custom transformers, Custom components, Custom expression evaluators etc.
Functional Tests - are those that most extensively exercise your application configuration. In these tests, you have the freedom and tools for simulating happy and unhappy paths. You also have the possibility to create stubs for target services and make them success or fail to easily simulate happy and unhappy paths respectively.
As the scenario in the question demands for API implementation to be tested before deployment to Staging and also clearly indicates that there is enough/ sufficient amount of mock data to test the various components of API implementations with no active connections to the backend systems, Unit Tests are the one to be used to incorporate this mocked data.
NEW QUESTION # 42
Refer to the exhibit.
A RAML definition has been proposed for a new Promotions Process API, and has been published to Anypoint Exchange.
The Marketing Department, who will be an important consumer of the Promotions API, has important requirements and expectations that must be met.
What is the most effective way to use Anypoint Platform features to involve the Marketing Department in this early API design phase?
A) Ask the Marketing Department to interact with a mocking implementation of the API using the automatically generated API Console
B) Organize a design workshop with the DBAs of the Marketing Department in which the database schema of the Marketing IT systems is translated into RAML
C) Use Anypoint Studio to Implement the API as a Mule application, then deploy that API implementation to CloudHub and ask the Marketing Department to interact with it
D) Export an integration test suite from API designer and have the Marketing Department execute the tests In that suite to ensure they pass
- A. Option A
- B. Option B
- C. Option C
- D. Option D
Answer: A
NEW QUESTION # 43
The implementation of a Process API must change.
What is a valid approach that minimizes the impact of this change on API clients?
- A. Update the RAML definition of the current Process API and notify API client developers by sending them links to the updated RAML definition
- B. Implement the Process API changes in a new API implementation, and have the old API implementation return an HTTP status code 301 - Moved Permanently to inform API clients they should be calling the new API implementation
- C. Implement required changes to the Process API implementation so that whenever possible, the Process API's RAML definition remains unchanged
- D. Postpone changes until API consumers acknowledge they are ready to migrate to a new Process API or API version
Answer: C
Explanation:
Correct answer: Implement required changes to the Process API implementation so that, whenever possible, the Process API's RAML definition remains unchanged.
*****************************************
Key requirement in the question is:
>> Approach that minimizes the impact of this change on API clients
Based on above:
>> Updating the RAML definition would possibly impact the API clients if the changes require any thing mandatory from client side. So, one should try to avoid doing that until really necessary.
>> Implementing the changes as a completely different API and then redirectly the clients with 3xx status code is really upsetting design and heavily impacts the API clients.
>> Organisations and IT cannot simply postpone the changes required until all API consumers acknowledge they are ready to migrate to a new Process API or API version. This is unrealistic and not possible.
The best way to handle the changes always is to implement required changes to the API implementations so that, whenever possible, the API's RAML definition remains unchanged.
NEW QUESTION # 44
An organization has several APIs that accept JSON data over HTTP POST. The APIs are all publicly available and are associated with several mobile applications and web applications.
The organization does NOT want to use any authentication or compliance policies for these APIs, but at the same time, is worried that some bad actor could send payloads that could somehow compromise the applications or servers running the API implementations.
What out-of-the-box Anypoint Platform policy can address exposure to this threat?
- A. Apply a Header injection and removal policy that detects the malicious data before it is used
- B. Apply an IP blacklist policy to all APIs; the blacklist will Include all bad actors
- C. Shut out bad actors by using HTTPS mutual authentication for all API invocations
- D. Apply a JSON threat protection policy to all APIs to detect potential threat vectors
Answer: B
NEW QUESTION # 45
Due to a limitation in the backend system, a system API can only handle up to 500 requests per second. What is the best type of API policy to apply to the system API to avoid overloading the backend system?
- A. Rate limiting
- B. Rate limiting - SLA based
- C. HTTP caching
- D. Spike control
Answer: D
Explanation:
Correct answer: Spike control
*****************************************
>> First things first, HTTP Caching policy is for purposes different than avoiding the backend system from overloading. So this is OUT.
>> Rate Limiting and Throttling/ Spike Control policies are designed to limit API access, but have different intentions.
>> Rate limiting protects an API by applying a hard limit on its access.
>> Throttling/ Spike Control shapes API access by smoothing spikes in traffic.
That is why, Spike Control is the right option.
NEW QUESTION # 46
A new upstream API Is being designed to offer an SLA of 500 ms median and 800 ms maximum (99th percentile) response time. The corresponding API implementation needs to sequentially invoke 3 downstream APIs of very similar complexity.
The first of these downstream APIs offers the following SLA for its response time: median: 100 ms, 80th percentile: 500 ms, 95th percentile: 1000 ms.
If possible, how can a timeout be set in the upstream API for the invocation of the first downstream API to meet the new upstream API's desired SLA?
- A. Set a timeout of 50 ms; this times out more invocations of that API but gives additional room for retries
- B. No timeout is possible to meet the upstream API's desired SLA; a different SLA must be negotiated with the first downstream API or invoke an alternative API
- C. Set a timeout of 100 ms; that leaves 400 ms for the other two downstream APIs to complete
- D. Do not set a timeout; the Invocation of this API Is mandatory and so we must wait until it responds
Answer: C
Explanation:
Correct answer: Set a timeout of 100ms; that leaves 400ms for other two downstream APIs to complete
*****************************************
Key details to take from the given scenario:
>> Upstream API's designed SLA is 500ms (median). Lets ignore maximum SLA response times.
>> This API calls 3 downstream APIs sequentially and all these are of similar complexity.
>> The first downstream API is offering median SLA of 100ms, 80th percentile: 500ms; 95th percentile: 1000ms.
Based on the above details:
>> We can rule out the option which is suggesting to set 50ms timeout. Because, if the median SLA itself being offered is 100ms then most of the calls are going to timeout and time gets wasted in retried them and eventually gets exhausted with all retries. Even if some retries gets successful, the remaining time wont leave enough room for 2nd and 3rd downstream APIs to respond within time.
>> The option suggesting to NOT set a timeout as the invocation of this API is mandatory and so we must wait until it responds is silly. As not setting time out would go against the good implementation pattern and moreover if the first API is not responding within its offered median SLA 100ms then most probably it would either respond in 500ms (80th percentile) or 1000ms (95th percentile). In BOTH cases, getting a successful response from 1st downstream API does NO GOOD because already by this time the Upstream API SLA of 500 ms is breached. There is no time left to call 2nd and 3rd downstream APIs.
>> It is NOT true that no timeout is possible to meet the upstream APIs desired SLA.
As 1st downstream API is offering its median SLA of 100ms, it means MOST of the time we would get the responses within that time. So, setting a timeout of 100ms would be ideal for MOST calls as it leaves enough room of 400ms for remaining 2 downstream API calls.
NEW QUESTION # 47
A company wants to move its Mule API implementations into production as quickly as possible. To protect access to all Mule application data and metadata, the company requires that all Mule applications be deployed to the company's customer-hosted infrastructure within the corporate firewall. What combination of runtime plane and control plane options meets these project lifecycle goals?
- A. iPaaS provisioned customer-hosted runtime plane and MuleSoft-hosted control plane
- B. Manually provisioned customer-hosted runtime plane and customer-hosted control plane
- C. MuleSoft-hosted runtime plane and customer-hosted control plane
- D. Manually provisioned customer-hosted runtime plane and MuleSoft-hosted control plane
Answer: B
Explanation:
Correct answer: Manually provisioned customer-hosted runtime plane and customer-hosted control plane
*****************************************
There are two key factors that are to be taken into consideration from the scenario given in the question.
>> Company requires both data and metadata to be resided within the corporate firewall
>> Company would like to go with customer-hosted infrastructure.
Any deployment model that is to deal with the cloud directly or indirectly (Mulesoft-hosted or Customer's own cloud like Azure, AWS) will have to share atleast the metadata.
Application data can be controlled inside firewall by having Mule Runtimes on customer hosted runtime plane. But if we go with Mulsoft-hosted/ Cloud-based control plane, the control plane required atleast some minimum level of metadata to be sent outside the corporate firewall.
As the customer requirement is pretty clear about the data and metadata both to be within the corporate firewall, even though customer wants to move to production as quickly as possible, unfortunately due to the nature of their security requirements, they have no other option but to go with manually provisioned customer-hosted runtime plane and customer-hosted control plane.
NEW QUESTION # 48
How are an API implementation, API client, and API consumer combined to invoke and process an API?
- A. The API client creates an API consumer, which receives API invocations from an API such that they are processed for an API implementation
- B. The ApI consumer creates an API client, which sends API invocations to an API such that they are processed by an API implementation
- C. The ApI client creates an API consumer, which sends API invocations to an API such that they are processed by an API implementation
- D. The API consumer creates an API implementation, which receives API invocations from an API such that they are processed for an API client
Answer: B
NEW QUESTION # 49
A System API is designed to retrieve data from a backend system that has scalability challenges. What API policy can best safeguard the backend system?
- A. SLA-based rate limiting
- B. Client ID enforcement
- C. IPwhitelist
- D. Auth 2 token enforcement
Answer: C
Explanation:
Explanation
https://dzone.com/articles/how-to-secure-apis
NEW QUESTION # 50
An organization makes a strategic decision to move towards an IT operating model that emphasizes consumption of reusable IT assets using modern APIs (as defined by MuleSoft).
What best describes each modern API in relation to this new IT operating model?
- A. Each modern API must be easy to consume, so should avoid complex authentication mechanisms such as SAML or JWT D
- B. Each modem API must be treated like a product and designed for a particular target audience (for instance, mobile app developers)
- C. Each modern API has its own software development lifecycle, which reduces the need for documentation and automation
- D. Each modern API must be REST and HTTP based
Answer: D
NEW QUESTION # 51
What is the main change to the IT operating model that MuleSoft recommends to organizations to improve innovation and clock speed?
- A. Drive consumption as much as production of assets; this enables developers to discover and reuse assets from other projects and encourages standardization
- B. Implement SOA for reusable APIs to focus on production over consumption; this standardizes on XML and WSDL formats to speed up decision making
- C. Create a lean and agile organization that makes many small decisions everyday; this speeds up decision making and enables each line of business to take ownership of its projects
- D. Expose assets using a Master Data Management (MDM) system; this standardizes projects and enables developers to quickly discover and reuse assets from other projects
Answer: A
Explanation:
Correct answer: Drive consumption as much as production of assets; this enables developers to discover and reuse assets from other projects and encourages standardization
*****************************************
>> The main motto of the new IT Operating Model that MuleSoft recommends and made popular is to change the way that they are delivered from a production model to a production + consumption model, which is done through an API strategy called API-led connectivity.
>> The assets built should also be discoverable and self-serveable for reusablity across LOBs and organization.
>> MuleSoft's IT operating model does not talk about SDLC model (Agile/ Lean etc) or MDM at all. So, options suggesting these are not valid.
References:
https://blogs.mulesoft.com/biz/connectivity/what-is-a-center-for-enablement-c4e/
https://www.mulesoft.com/resources/api/secret-to-managing-it-projects
NEW QUESTION # 52
A new upstream API Is being designed to offer an SLA of 500 ms median and 800 ms maximum (99th percentile) response time. The corresponding API implementation needs to sequentially invoke 3 downstream APIs of very similar complexity.
The first of these downstream APIs offers the following SLA for its response time: median: 100 ms, 80th percentile: 500 ms, 95th percentile: 1000 ms.
If possible, how can a timeout be set in the upstream API for the invocation of the first downstream API to meet the new upstream API's desired SLA?
- A. Set a timeout of 50 ms; this times out more invocations of that API but gives additional room for retries
- B. No timeout is possible to meet the upstream API's desired SLA; a different SLA must be negotiated with the first downstream API or invoke an alternative API
- C. Set a timeout of 100 ms; that leaves 400 ms for the other two downstream APIs to complete
- D. Do not set a timeout; the Invocation of this API Is mandatory and so we must wait until it responds
Answer: C
NEW QUESTION # 53
When could the API data model of a System API reasonably mimic the data model exposed by the corresponding backend system, with minimal improvements over the backend system's data model?
- A. When the System API can be assigned to a bounded context with a corresponding data model
- B. When the corresponding backend system is expected to be replaced in the near future
- C. When a pragmatic approach with only limited isolation from the backend system is deemed appropriate
- D. When there is an existing Enterprise Data Model widely used across the organization
Answer: C
NEW QUESTION # 54
A code-centric API documentation environment should allow API consumers to investigate and execute API client source code that demonstrates invoking one or more APIs as part of representative scenarios.
What is the most effective way to provide this type of code-centric API documentation environment using Anypoint Platform?
- A. Make relevant APIs discoverable via an Anypoint Exchange entry
- B. Create API Notebooks and include them in the relevant Anypoint Exchange entries
- C. Enable mocking services for each of the relevant APIs and expose them via their Anypoint Exchange entry
- D. Ensure the APIs are well documented through their Anypoint Exchange entries and API Consoles and share these pages with all API consumers
Answer: B
Explanation:
Correct answer: Create API Notebooks and Include them in the relevant Anypoint exchange entries
*****************************************
>> API Notebooks are the one on Anypoint Platform that enable us to provide code-centric API documentation Reference:
NEW QUESTION # 55
......
MCPA-Level-1 dumps Free Test Engine Verified By It Certified Experts: https://torrentvce.certkingdompdf.com/MCPA-Level-1-latest-certkingdom-dumps.html