Online Access Free MCIA-Level-1 Exam Questions

An organization has several APIs that accept JSON data over HTTP POST. The APIs are all publicly available and are associated with several mobile applications and web applications. The organization does NOT want to use any authentication or compliance policies for these APIs, but at the same time, is worried that some bad actor could send payloads that could somehow compromise the applications or servers running the API implementations. What out-of-the-box Anypoint Platform policy can address exposure to this threat?

• A.Apply an IP blacklist policy to all APIs; the blacklist will Include all bad actors
• B.Shut out bad actors by using HTTPS mutual authentication for all API invocations
• C.Apply a JSON threat protection policy to all APIs to detect potential threat vectors
• D.Apply a Header injection and removal policy that detects the malicious data before it is used

When using Anypoint Platform across various lines of business with their own Anypoint Platform business groups, what configuration of Anypoint Platform is always performed at the organization level as opposed to at the business group level?

• A.Role and permission setup
• B.Identity management setup
• C.Dedicated Load Balancer setup
• D.Environment setup

What is an advantage of using OAuth 2.0 client credentials and access tokens over only API keys for API authentication?

• A.If the access token is compromised, I can be exchanged for an API key.
• B.If the access token is compromised, the client credentials do not to be reissued.
• C.If the client secret is compromised, the client credentials do not have to be reissued.
• D.If the client ID is compromised, it can be exchanged for an API key

According to MuleSoft, which major benefit does a Center for Enablement (C4E) provide for an enterprise and its lines of business?

• A.Enabling Edge security between the lines of business and public devices
• B.Accelerating self-service by the lines of business
• C.Centralizing project management across the lines of business
• D.Centrally managing return on investment (ROI) reporting from lines of business to leadership

A leading eCommerce giant will use MuleSoft APIs on Runtime Fabric (RTF) to process customer orders.
Some customer-sensitive information, such as credit card information, is required in request payloads or is included in response payloads in some of the APIs. Other API requests and responses are not authorized to access some of this customer-sensitive information but have been implemented to validate and transform based on the structure and format of this customer-sensitive information (such as account IDs, phone numbers, and postal codes).
What approach configures an API gateway to hide sensitive data exchanged between API consumers and API implementations, but can convert tokenized fields back to their original value for other API requests or responses, without having to recode the API implementations?
Later, the project team requires all API specifications to be augmented with an additional non-functional requirement (NFR) to protect the backend services from a high rate of requests, according to defined service-level agreements (SLAs). The NFR's SLAs are based on a new tiered subscription level "Gold", "Silver", or
"Platinum" that must be tied to a new parameter that is being added to the Accounts object in their enterprise data model.
Following MuleSoft's recommended best practices, how should the project team now convey the necessary non-functional requirement to stakeholders?

• A.Update each API specification with a shared RAML fragment required to implement the NFR and publish the RAML fragment and each modified API specification to Exchange
• B.Create and deploy API proxies in API Manager for the NFR, change the baseurl in each API specification to the corresponding API proxy implementation endpoint, and publish each modified API specification to Exchange
• C.Create a shared RAML fragment required to implement the NFR, list each API implementation endpoint in the RAML fragment, and publish the RAML fragment to Exchange
• D.Update each API specification with comments about the NFR's SLAs and publish each modified API specification to Exchange