When must an API implementation be deployed to an Anypoint VPC?

1. A. When the API Implementation must invoke publicly exposed services that are deployed outside of CloudHub in a customer- managed AWS instance
2. B. When the API implementation must be accessible within a subnet of a restricted customer-hosted network that does not allow public access
3. C. When the API implementation must be deployed to a production AWS VPC using the Mule Maven plugin
4. D. When the API Implementation must write to a persistent Object Store

Correct Answer: A

What Mule application can have API policies applied by
Anypoint Platform to the endpoint exposed by that Mule application?
A) A Mule application that accepts requests over HTTP/1.x

B) A Mule application that accepts JSON requests over TCP but is NOT required to provide a response

C) A Mute application that accepts JSON requests over WebSocket

D) A Mule application that accepts gRPC requests over HTTP/2

1. A. Option A
2. B. Option B
3. C. Option C
4. D. Option D

Correct Answer: A

Correct Answer
Option A
*****************************************
>> Anypoint API Manager and API policies are applicable to all types of HTTP/1.x APIs.
>> They are not applicable to WebSocket APIs, HTTP/2 APIs and gRPC APIs

An API implementation is updated. When must the RAML definition of the API also be updated?

1. A. When the API implementation changes the structure of the request or response messages
2. B. When the API implementation changes from interacting with a legacy backend system deployedon-premises to a modern, cloud-based (SaaS) system
3. C. When the API implementation is migrated from an older to a newer version of the Mule runtime
4. D. When the API implementation is optimized to improve its average response time

Correct Answer: A
Correct Answer
When the API implementation changes the structure of the request or response messages
*****************************************
>> RAML definition usually needs to be touched only when there are changes in the request/response schemas or in any traits on API.
>> It need not be modified for any internal changes in API implementation like performance tuning, backend system migrations etc..

Which of the following sequence is correct?

1. A. API Client implementes logic to call an API >> API Consumer requests access to API >> API Implementation routes the request to >> API
2. B. API Consumer requests access to API >> API Client implementes logic to call an API >> API routes the request to >> API Implementation
3. C. API Consumer implementes logic to call an API >> API Client requests access to API >> API Implementation routes the request to >> API
4. D. API Client implementes logic to call an API >> API Consumer requests access to API >> API routes the request to >> API Implementation

Correct Answer: B
Correct Answer
API Consumer requests access to API >> API Client implementes logic to call an API >> API routes the request to >> API Implementation
*****************************************
>> API consumer does not implement any logic to invoke APIs. It is just a role. So, the option stating "API Consumer implementes logic to call an API" is INVALID.
>> API Implementation does not route any requests. It is a final piece of logic where functionality of target systems is exposed. So, the requests should be routed to the API implementation by some other entity. So, the options stating "API Implementation routes the request to >> API" is INVALID
>> The statements in one of the options are correct but sequence is wrong. The sequence is given as "API Client implementes logic to call an API >> API Consumer requests access to API >> API routes the request to
>> API Implementation". Here, the statements in the options are VALID but sequence is WRONG.
>> Right option and sequence is the one where API consumer first requests access to API on Anypoint Exchange and obtains client credentials. API client then writes logic to call an API by using the access client credentials requested by API consumer and the requests will be routed to API implementation via the API which is managed by API Manager.

What is a key requirement when using an external Identity Provider for Client Management in Anypoint Platform?

1. A. Single sign-on is required to sign in to Anypoint Platform
2. B. The application network must include System APIs that interact with the Identity Provider
3. C. To invoke OAuth 2.0-protected APIs managed by Anypoint Platform, API clients must submit access tokens issued by that same Identity Provider
4. D. APIs managed by Anypoint Platform must be protected by SAML 2.0 policies

Correct Answer: C
https://www.folkstalk.com/2019/11/mulesoft-integration-and-platform.html
Correct Answer
To invoke OAuth 2.0-protected APIs managed by Anypoint Platform, API clients must submit access tokens issued by that same Identity Provider
*****************************************
>> It is NOT necessary that single sign-on is required to sign in to Anypoint Platform because we are using an external Identity Provider for Client Management
>> It is NOT necessary that all APIs managed by Anypoint Platform must be protected by SAML 2.0 policies because we are using an external Identity Provider for Client Management
>> Not TRUE that the application network must include System APIs that interact with the Identity Provider because we are using an external Identity Provider for Client Management
Only TRUE statement in the given options is - "To invoke OAuth 2.0-protected APIs managed by Anypoint Platform, API clients must submit access tokens issued by that same Identity Provider"
References:
https://docs.mulesoft.com/api-manager/2.x/external-oauth-2.0-token-validation-policy https://blogs.mulesoft.com/dev/api-dev/api-security-ways-to-authenticate-and-authorize/