New Mule-Arch-201 Dumps For Preparing Salesforce MuleSoft Certified Salesforce Exam Well
Updated Mule-Arch-201 Dumps Questions Are Available [2026] For Passing Salesforce Exam
NEW QUESTION # 84
Question 10: Skipped
An API implementation returns three X-RateLimit-* HTTP response headers to a requesting API client. What type of information do these response headers indicate to the API client?
- A. The HTTP response size
- B. A correlation ID that should be sent in the next request
- C. The error codes that result from throttling
- D. The remaining capacity allowed by the API implementation
Answer: D
Explanation:
Correct Answe r: The remaining capacity allowed by the API implementation.
*****************************************
>> Reference: https://docs.mulesoft.com/api-manager/2.x/rate-limiting-and-throttling-sla-based-policies#response-headers
NEW QUESTION # 85
An IT Security Compliance Auditor is assessing which nonfunctional requirements (NFRs) are already being implemented to meet security measures.
* The Web API has Rate-Limiting SLA
* Basic Authentication - LDAP
* JSON Threat Protection
* TP Allowlist policies applied
Which two NFRs-are enforced?
- A. Performance expectations are to be allowed up to 1,000 requests per second
- B. The API is protected against XML invocation attacks
- C. The API invocations are coming from a known subnet range
- D. Sensitive data is masked to prevent compromising critical information
- E. Username/password supported to validate login credentials
Answer: C,E
Explanation:
Understanding Nonfunctional Requirements (NFRs):
The NFRs in this context are related to security measures implemented for the Web API, such as rate limiting, LDAP-based authentication, JSON threat protection, and IP allowlist policies.
Evaluating the Options:
Option A (Correct Answer): The IP allowlist policy restricts access to known subnets, ensuring that API invocations come from a defined range of IPs.
Option B (Correct Answer): Basic Authentication with LDAP enforces a username/password validation, satisfying an NFR for identity verification.
Option C: Masking sensitive data is not part of the listed NFRs, as none of the mentioned policies address data masking.
Option D: XML threat protection is not mentioned, so this option is incorrect.
Option E: While rate-limiting implies performance control, it does not directly enforce a specific performance expectation.
Conclusion:
Options A and B are correct as they directly address the implemented security measures related to IP range restrictions and username/password authentication.
Refer to MuleSoft's documentation on API security policies for details on LDAP, rate limiting, and allowlist policies.
NEW QUESTION # 86
When must an API implementation be deployed to an Anypoint VPC?
- A. When the API implementation must be accessible within a subnet of a restricted customer-hosted network that does not allow public access
- B. When the API Implementation must invoke publicly exposed services that are deployed outside of CloudHub in a customer- managed AWS instance
- C. When the API implementation must be deployed to a production AWS VPC using the Mule Maven plugin
- D. When the API Implementation must write to a persistent Object Store
Answer: B
NEW QUESTION # 87
What is most likely NOT a characteristic of an integration test for a REST API implementation?
- A. The test needs all source and/or target systems configured and accessible
- B. The test prepares a known request payload and validates the response payload
- C. The test runs immediately after the Mule application has been compiled and packaged
- D. The test is triggered by an external HTTP request
Answer: C
Explanation:
Correct Answe r: The test runs immediately after the Mule application has been compiled and packaged
*****************************************
>> Integration tests are the last layer of tests we need to add to be fully covered.
>> These tests actually run against Mule running with your full configuration in place and are tested from external source as they work in PROD.
>> These tests exercise the application as a whole with actual transports enabled. So, external systems are affected when these tests run.
So, these tests do NOT run immediately after the Mule application has been compiled and packaged.
FYI... Unit Tests are the one that run immediately after the Mule application has been compiled and packaged.
NEW QUESTION # 88
Refer to the exhibit. An organization needs to enable access to their customer data from both a mobile app and a web application, which each need access to common fields as well as certain unique fields.
The data is available partially in a database and partially in a 3rd-party CRM system.
What APIs should be created to best fit these design requirements?
A) A Process API that contains the data required by both the web and mobile apps, allowing these applications to invoke it directly and access the data they need thereby providing the flexibility to add more fields in the future without needing API changes B) One set of APIs (Experience API, Process API, and System API) for the web app, and another set for the mobile app C) Separate Experience APIs for the mobile and web app, but a common Process API that invokes separate System APIs created for the database and CRM system
D) A common Experience API used by both the web and mobile apps, but separate Process APIs for the web and mobile apps that interact with the database and the CRM System
- A. Option D
- B. Option A
- C. Option B
- D. Option C
Answer: D
Explanation:
Correct Answe r: Separate Experience APIs for the mobile and web app, but a common Process API that invokes separate System APIs created for the database and CRM system
*****************************************
As per MuleSoft's API-led connectivity:
>> Experience APIs should be built as per each consumer needs and their experience.
>> Process APIs should contain all the orchestration logic to achieve the business functionality.
>> System APIs should be built for each backend system to unlock their data.
NEW QUESTION # 89
Refer to the exhibit. An organization is running a Mule standalone runtime and has configured Active Directory as the Anypoint Platform external Identity Provider. The organization does not have budget for other system components.
What policy should be applied to all instances of APIs in the organization to most effecuvelyKestrict access to a specific group of internal users?
- A. Apply an IP whitelist policy; only the specific users' workstations will be in the whitelist
- B. Apply a basic authentication - LDAP policy; the internal Active Directory will be configured as the LDAP source for authenticating users
- C. Apply an OAuth 2.0 access token enforcement policy; the internal Active Directory will be configured as the OAuth server
- D. Apply a client ID enforcement policy; the specific group of users will configure their client applications to use their specific client credentials
Answer: B
Explanation:
Correct Answe r: Apply a basic authentication - LDAP policy; the internal Active Directory will be configured as the LDAP source for authenticating users.
*****************************************
>> IP Whitelisting does NOT fit for this purpose. Moreover, the users workstations may not necessarily have static IPs in the network.
>> OAuth 2.0 enforcement requires a client provider which isn't in the organizations system components.
>> It is not an effective approach to let every user create separate client credentials and configure those for their usage.
The effective way it to apply a basic authentication - LDAP policy and the internal Active Directory will be configured as the LDAP source for authenticating users.
NEW QUESTION # 90
Which of the following sequence is correct?
- A. API Consumer requests access to API >> API Client implementes logic to call an API >> API routes the request to >> API Implementation
- B. API Client implementes logic to call an API >> API Consumer requests access to API >> API Implementation routes the request to >> API
- C. API Consumer implementes logic to call an API >> API Client requests access to API >> API Implementation routes the request to >> API
- D. API Client implementes logic to call an API >> API Consumer requests access to API >> API routes the request to >> API Implementation
Answer: A
Explanation:
Correct Answe r: API Consumer requests access to API >> API Client implementes logic to call an API >> API routes the request to >> API Implementation
*****************************************
>> API consumer does not implement any logic to invoke APIs. It is just a role. So, the option stating "API Consumer implementes logic to call an API" is INVALID.
>> API Implementation does not route any requests. It is a final piece of logic where functionality of target systems is exposed. So, the requests should be routed to the API implementation by some other entity. So, the options stating "API Implementation routes the request to >> API" is INVALID
>> The statements in one of the options are correct but sequence is wrong. The sequence is given as "API Client implementes logic to call an API >> API Consumer requests access to API >> API routes the request to >> API Implementation". Here, the statements in the options are VALID but sequence is WRONG.
>> Right option and sequence is the one where API consumer first requests access to API on Anypoint Exchange and obtains client credentials. API client then writes logic to call an API by using the access client credentials requested by API consumer and the requests will be routed to API implementation via the API which is managed by API Manager.
NEW QUESTION # 91
What correctly characterizes unit tests of Mule applications?
- A. They must be run in a unit testing environment with dedicated Mule runtimes for the environment
- B. They are typically written using MUnit to run in an embedded Mule runtime that does not require external connectivity
- C. They test the validity of input and output of source and target systems
- D. They must be triggered by an external client tool or event source
Answer: B
Explanation:
Correct Answe r: They are typically written using MUnit to run in an embedded Mule runtime that does not require external connectivity.
*****************************************
Below TWO are characteristics of Integration Tests but NOT unit tests:
>> They test the validity of input and output of source and target systems.
>> They must be triggered by an external client tool or event source.
It is NOT TRUE that Unit Tests must be run in a unit testing environment with dedicated Mule runtimes for the environment.
MuleSoft offers MUnit for writing Unit Tests and they run in an embedded Mule Runtime without needing any separate/ dedicated Runtimes to execute them. They also do NOT need any external connectivity as MUnit supports mocking via stubs.
https://dzone.com/articles/munit-framework
NEW QUESTION # 92
What are 4 important Platform Capabilities offered by Anypoint Platform?
- A. API Versioning, API Runtime Execution and Hosting, API Invocation, API Consumer Engagement
- B. API Design and Development, API Deprecation, API Versioning, API Consumer Engagement
- C. API Design and Development, API Runtime Execution and Hosting, API Operations and Management, API Consumer Engagement
- D. API Design and Development, API Runtime Execution and Hosting, API Versioning, API Deprecation
Answer: C
Explanation:
Correct Answe r: API Design and Development, API Runtime Execution and Hosting, API Operations and Management, API Consumer Engagement
*****************************************
>> API Design and Development - Anypoint Studio, Anypoint Design Center, Anypoint Connectors
>> API Runtime Execution and Hosting - Mule Runtimes, CloudHub, Runtime Services
>> API Operations and Management - Anypoint API Manager, Anypoint Exchange
>> API Consumer Management - API Contracts, Public Portals, Anypoint Exchange, API Notebooks
NEW QUESTION # 93
A customer has an ELA contract with MuleSoft. An API deployed to CloudHub is consistently experiencing performance issues. Based on the root cause analysis, it is determined that autoscaling needs to be applied.
How can this be achieved?
- A. Configure a policy based on CPU usage so that CloudHub auto-adjusts the number of workers/replicas (horizontal scaling)
- B. Configure two separate policies: When CPU and memory reach certain threshold, increase the worker/replica type (vertical sealing) and the number of workers/replicas (horizontal sealing)
- C. Configure a policy so that when the number of HTTP requests reaches a certain threshold the number of workers/replicas increases (horizontal scaling)
- D. Configure a policy so that when the response time reaches a certain threshold the worker/replica type increases (vertical scaling)
Answer: A
Explanation:
In MuleSoft CloudHub, autoscaling is essential to managing application load efficiently. CloudHub supports horizontal scaling based on CPU usage, which is well-suited to applications experiencing variable demand and needing responsive resource allocation.
Autoscaling on CloudHub:
Horizontal scaling increases the number of workers in response to CPU usage thresholds, allowing the application to handle higher loads dynamically. This approach improves performance without downtime or manual intervention.
Why Option C is Correct:
Setting up autoscaling based on CPU usage aligns with MuleSoft's best practices for scalable and responsive applications on CloudHub, particularly in an environment with fluctuating load patterns.
Option C correctly leverages CloudHub's autoscaling features based on resource metrics, which are part of CloudHub's managed scaling solutions.
of Incorrect Options:
Option A (based on HTTP request thresholds) and Option B (separate policies for CPU and memory) do not represent CloudHub's recommended scaling practices.
Option D suggests vertical scaling based on response time, which is not how CloudHub handles autoscaling.
Reference
For more on CloudHub's autoscaling configuration, refer to MuleSoft documentation on CloudHub autoscaling policies.
NEW QUESTION # 94
An API implementation is updated. When must the RAML definition of the API also be updated?
- A. When the API implementation changes the structure of the request or response messages
- B. When the API implementation is optimized to improve its average response time
- C. When the API implementation changes from interacting with a legacy backend system deployed on-premises to a modern, cloud-based (SaaS) system
- D. When the API implementation is migrated from an older to a newer version of the Mule runtime
Answer: A
Explanation:
Correct Answe r: When the API implementation changes the structure of the request or response messages
*****************************************
>> RAML definition usually needs to be touched only when there are changes in the request/response schemas or in any traits on API.
>> It need not be modified for any internal changes in API implementation like performance tuning, backend system migrations etc..
NEW QUESTION # 95
A Rate Limiting policy is applied to an API implementation to protect the back-end system. Recently, there have been surges in demand that cause some API client POST requests to the API implementation to be rejected with policy-related errors, causing delays and complications to the API clients.
How should the API policies that are applied to the API implementation be changed to reduce the frequency of errors returned to API clients, while still protecting the back-end system?
- A. Remove the Rate Limiting policy and add an HTTP Caching policy
- B. Keep the Rate Limiting policy and add an SLA-based Spike Control policy
- C. Keep the Rate Limiting policy and add 9 Client ID Enforcement policy
- D. Remove the Rate Limiting policy and add a Spike Control policy
Answer: B
Explanation:
When managing high traffic to an API, especially with POST requests, it is crucial to ensure the API's policies both protect the back-end systems and provide a smooth client experience. Here's the approach to reducing errors:
Rate Limiting Policy: This policy enforces a limit on the number of requests within a defined time period. However, rate limiting alone may cause clients to hit limits during demand surges, leading to errors.
Adding an SLA-based Spike Control Policy:
Spike Control is designed to handle sudden increases in traffic by smoothing out bursts of requests, which is particularly useful during high-demand periods.
By configuring SLA-based Spike Control, you can define thresholds for specific client tiers. For instance, premium clients might have higher limits or more flexibility in traffic bursts than standard clients.
Why Option D is Correct:
Keeping the Rate Limiting policy continues to provide baseline protection for the back-end.
Adding the SLA-based Spike Control policy allows for differentiated control, where requests are queued or delayed during bursts rather than outright rejected. This approach significantly reduces error responses to clients while still controlling overall traffic.
of Incorrect Options:
Option A (adding Client ID Enforcement) would not reduce errors related to traffic surges.
Option B (HTTP Caching) is not applicable as caching is generally ineffective for non-idempotent requests like POST.
Option C (only Spike Control without Rate Limiting) may leave the back-end system vulnerable to sustained high traffic levels, reducing protection.
Reference
For more information on configuring Rate Limiting and SLA-based Spike Control policies, refer to MuleSoft documentation on API Policies and Rate Limiting.
NEW QUESTION # 96
What Anypoint Connectors support transactions?
- A. Database, 3MS, HTTP
- B. Database, JMS, VM, SFTP
- C. Database, VM, File
- D. Database, JMS, VM
Answer: D
NEW QUESTION # 97
An established communications company is beginning its API-led connectivity journey, The company has been using a successful Enterprise Data Model for many years. The company has identified a self-service account management app as the first effort for API-led, and it has identified the following APIs.
Experience layer: Mobile Account Management EAPI, Browser Account Management EAPI Process layer: Customer Lookup PAPI, Service Lookup PAPI, Account Lookup PAPI System layer: Customer SAPI, Account SAPI, Product SAPI, Service SAPI According to MuleSoft's API-led connectivity approach, which API would not be served by the Enterprise Data Model?
- A. Customer Lookup PAPI
- B. Customer SAPI
- C. Service SAPI
- D. Mobile Account Management EAPI
Answer: D
Explanation:
In the API-led connectivity approach, APIs are categorized into Experience, Process, and System layers:
Enterprise Data Model Scope:
The Enterprise Data Model (EDM) generally supports System APIs and some Process APIs by defining standard data structures used across the organization. Experience APIs, however, are tailored to specific applications or interfaces and are less likely to be served directly by the EDM, as they may require customized data representations to meet the unique needs of each user interface.
Why Option C is Correct:
The Mobile Account Management EAPI serves mobile-specific needs and often requires data formatted differently from the standardized data models. Thus, it would be outside the direct scope of the EDM and might employ custom mappings to fit mobile application requirements.
of Incorrect Options:
Option A (Customer SAPI), Option B (Customer Lookup PAPI), and Option D (Service SAPI) would typically align with the EDM as they are closer to the core data and services the EDM supports.
Reference
For additional guidance, review MuleSoft's best practices on API-led connectivity and data modeling.
NEW QUESTION # 98
A System API is designed to retrieve data from a backend system that has scalability challenges. What API policy can best safeguard the backend system?
- A. Client ID enforcement
- B. Auth 2 token enforcement
- C. SLA-based rate limiting
- D. IPwhitelist
Answer: C
Explanation:
Correct Answe r: SLA-based rate limiting
*****************************************
>> Client Id enforement policy is a "Compliance" related NFR and does not help in maintaining the "Quality of Service (QoS)". It CANNOT and NOT meant for protecting the backend systems from scalability challenges.
>> IP Whitelisting and OAuth 2.0 token enforcement are "Security" related NFRs and again does not help in maintaining the "Quality of Service (QoS)". They CANNOT and are NOT meant for protecting the backend systems from scalability challenges.
Rate Limiting, Rate Limiting-SLA, Throttling, Spike Control are the policies that are "Quality of Service (QOS)" related NFRs and are meant to help in protecting the backend systems from getting overloaded.
https://dzone.com/articles/how-to-secure-apis
NEW QUESTION # 99
In an organization, the InfoSec team is investigating Anypoint Platform related data traffic.
From where does most of the data available to Anypoint Platform for monitoring and alerting originate?
- A. From the Mule runtime or the API Manager, depending on the type of data
- B. From various components of Anypoint Platform, such as the Shared Load Balancer, VPC, and Mule runtimes
- C. From the Mule runtime or the API implementation, depending on the deployment model
- D. From the Mule runtime irrespective of the deployment model
Answer: D
Explanation:
Correct Answe r: From the Mule runtime irrespective of the deployment model
*****************************************
>> Monitoring and Alerting metrics are always originated from Mule Runtimes irrespective of the deployment model.
>> It may seems that some metrics (Runtime Manager) are originated from Mule Runtime and some are (API Invocations/ API Analytics) from API Manager. However, this is realistically NOT TRUE. The reason is, API manager is just a management tool for API instances but all policies upon applying on APIs eventually gets executed on Mule Runtimes only (Either Embedded or API Proxy).
>> Similarly all API Implementations also run on Mule Runtimes.
So, most of the day required for monitoring and alerts are originated fron Mule Runtimes only irrespective of whether the deployment model is MuleSoft-hosted or Customer-hosted or Hybrid.
NEW QUESTION # 100
What is true about API implementations when dealing with legal regulations that require all data processing to be performed within a certain jurisdiction (such as in the USA or the EU)?
- A. They must te deployed to Anypoint Platform runtime planes that are managed by Anypoint Platform control planes, with both planes in the same Jurisdiction
- B. They must ensure ALL data is encrypted both in transit and at rest
- C. They must avoid using the Object Store as it depends on services deployed ONLY to the US East region
- D. They must use a Jurisdiction-local external messaging system such as Active MQ rather than Anypoint MQ
Answer: A
Explanation:
Correct Answe r: They must be deployed to Anypoint Platform runtime planes that are managed by Anypoint Platform control planes, with both planes in the same Jurisdiction.
*****************************************
>> As per legal regulations, all data processing to be performed within a certain jurisdiction. Meaning, the data in USA should reside within USA and should not go out. Same way, the data in EU should reside within EU and should not go out.
>> So, just encrypting the data in transit and at rest does not help to be compliant with the rules. We need to make sure that data does not go out too.
>> The data that we are talking here is not just about the messages that are published to Anypoint MQ. It includes the apps running, transaction states, application logs, events, metric info and any other metadata. So, just replacing Anypoint MQ with a locally hosted ActiveMQ does NOT help.
>> The data that we are talking here is not just about the key/value pairs that are stored in Object Store. It includes the messages published, apps running, transaction states, application logs, events, metric info and any other metadata. So, just avoiding using Object Store does NOT help.
>> The only option left and also the right option in the given choices is to deploy application on runtime and control planes that are both within the jurisdiction.
NEW QUESTION # 101
Which scenario is suited for MUnit tests instead of integration tests?
- A. When testing does not require knowledge of implementation details
- B. For tests that are implemented using SoapUI
- C. When no mocking is permissible
- D. For read-only interactions to any dependencies (such as other web APIs)
Answer: D
Explanation:
MUnit is MuleSoft's testing framework for creating and running automated tests within Anypoint Studio. It is specifically designed for unit testing Mule applications and is best suited when testing doesn't require understanding the inner workings or implementation details of the components being tested.
Ideal Use Cases for MUnit:
MUnit is optimal when testing individual flows, functions, or components in isolation. This type of testing focuses on verifying the behavior of each unit without needing to understand the complete system.
Since unit tests do not require external integrations or dependencies to be live, mocking is commonly used in MUnit to simulate the behavior of external services and APIs.
Why Option B is Correct:
Option B aligns with the concept of unit testing, where the emphasis is on testing functionality rather than system integration. Integration tests, on the other hand, would require implementation knowledge and live endpoints, making them unsuitable for MUnit's scope.
of Incorrect Options:
Option A (read-only interactions) and Option C (no mocking) do not suit MUnit's typical testing environment as MUnit is designed with mocking capabilities to simulate dependencies.
Option D (SoapUI-based tests) suggests an external testing tool, while MUnit is specific to MuleSoft.
Reference
For more on MUnit best practices, refer to MuleSoft's MUnit documentation.
NEW QUESTION # 102
An organization requires several APIs to be secured with OAuth 2.0, and PingFederate has been identified as the identity provider for API client authorization, The PingFederate Client Provider is configured in access management, and the PingFederate OAuth 2.0 Token Enforcement policy is configured for the API instances required by the organization. The API instances reside in two business groups (Group A and Group B) within the Master Organization (Master Org).
What should be done to allow API consumers to access the API instances?
- A. The APT consumer should create a client application and request access to the API in Ping Identity, and the organization's Ping Identity workflow will grant access
- B. The APL consumer should create a client application and request access to the APT in Anypoint Exchange, and the API administrator should approve the request
- C. The API administrator should configure the correct client discovery URL in both child business groups, and the API consumer should request access to the API in Ping Identity
- D. The API administrator should grant access to the API consumers by creating contracts in the relevant API instances in API Manager
Answer: B
Explanation:
OAuth 2.0 and PingFederate Setup:
The organization uses PingFederate as the identity provider, integrated with Anypoint Platform for OAuth 2.0 authentication and authorization.
The PingFederate OAuth 2.0 Token Enforcement policy is applied to the API instances, requiring clients to be registered and authenticated via PingFederate.
Accessing Secured APIs:
API consumers need to register their client applications in Anypoint Exchange to request access to the secured APIs.
The API administrator then reviews and approves the access request in API Manager. This grants the client application a contract, allowing it to access the API using OAuth 2.0 tokens issued by PingFederate.
Evaluating the Options:
Option A: Configuring the client discovery URL in child business groups is not relevant to granting access; this is part of setting up PingFederate, not managing consumer access.
Option B: While creating contracts in API Manager is necessary, this option lacks the detail about the process in Anypoint Exchange, where consumers request access.
Option C (Correct Answer): API consumers must create a client application in Anypoint Exchange to request access to the API, and the API administrator then approves the request in API Manager.
Option D: The access request and approval process happens within Anypoint Platform (Exchange and API Manager), not directly in Ping Identity.
Conclusion:
Option C is the correct answer as it accurately describes the process within Anypoint Platform where API consumers request access through Exchange, and the API administrator approves it.
Refer to MuleSoft's documentation on OAuth 2.0 setup with PingFederate and managing API client access in Exchange and API Manager.
NEW QUESTION # 103
......
Salesforce Exam 2026 Mule-Arch-201 Dumps Updated Questions: https://www.examsreviews.com/Mule-Arch-201-pass4sure-exam-review.html
Free UPDATED Salesforce Mule-Arch-201 Certification Exam Dumps is Online: https://drive.google.com/open?id=18yHTdjmzV2w5gvwDA0wNpb8DdHj0ESHT