MCPA-LEVEL-1-MAINTENANCE Exam Questions and Answers

QUESTION: 11

What is a key requirement when using an external Identity Provider for Client Management in Anypoint Platform?

Single sign-on is required to sign in to Anypoint Platform
The application network must include System APIs that interact with the Identity Provider
To invoke OAuth 2.0-protected APIs managed by Anypoint Platform, API clients must submit access tokens issued by that same Identity Provider
APIs managed by Anypoint Platform must be protected by SAML 2.0 policies

Answer(s): C

Explanation:

https://www.folkstalk.com/2019/11/mulesoft-integration-and-platform.html

Correct Answer: To invoke OAuth 2.0-protected APIs managed by Anypoint Platform, API clients must submit access tokens issued by that same Identity Provider *****************************************
>> It is NOT necessary that single sign-on is required to sign in to Anypoint Platform because we are using an external Identity Provider for Client Management >> It is NOT necessary that all APIs managed by Anypoint Platform must be protected by SAML 2.0 policies because we are using an external Identity Provider for Client Management >> Not TRUE that the application network must include System APIs that interact with the Identity Provider because we are using an external Identity Provider for Client Management Only TRUE statement in the given options is - "To invoke OAuth 2.0-protected APIs managed by Anypoint Platform, API clients must submit access tokens issued by that same Identity Provider"

Reference:

https://docs.mulesoft.com/api-manager/2.x/external-oauth-2.0-token-validation-policy https://blogs.mulesoft.com/dev/api-dev/api-security-ways-to-authenticate-and-authorize/

Reveal Solution Next Question

QUESTION: 12

The responses to some HTTP requests can be cached depending on the HTTP verb used in the request. According to the HTTP specification, for what HTTP verbs is this safe to do?

PUT, POST, DELETE
GET, HEAD, POST
GET, PUT, OPTIONS
GET, OPTIONS, HEAD

Answer(s): D

Explanation:

Correct Answer: GET, OPTIONS, HEAD

Reference:

http://restcookbook.com/HTTP%20Methods/idempotency/

Reveal Solution Next Question

QUESTION: 13

What is the most performant out-of-the-box solution in Anypoint Platform to track transaction state in an asynchronously executing long-running process implemented as a Mule application deployed to multiple CloudHub workers?

Redis distributed cache
java.util.WeakHashMap
Persistent Object Store
File-based storage

Answer(s): C

Explanation:

Correct Answer: Persistent Object Store
*****************************************
>> Redis distributed cache is performant but NOT out-of-the-box solution in Anypoint Platform >> File-storage is neither performant nor out-of-the-box solution in Anypoint Platform >> java.util.WeakHashMap needs a completely custom implementation of cache from scratch using Java code and is limited to the JVM where it is running. Which means the state in the cache is not worker aware when running on multiple workers. This type of cache is local to the worker. So, this is neither out-of-the-box nor worker-aware among multiple workers on cloudhub.
https://www.baeldung.com/java-weakhashmap
>> Persistent Object Store is an out-of-the-box solution provided by Anypoint Platform which is performant as well as worker aware among multiple workers running on CloudHub.
https://docs.mulesoft.com/object-store/
So, Persistent Object Store is the right answer.

Reveal Solution Next Question

QUESTION: 14

How can the application of a rate limiting API policy be accurately reflected in the RAML definition of an API?

By refining the resource definitions by adding a description of the rate limiting policy behavior
By refining the request definitions by adding a remaining Requests query parameter with description, type, and example
By refining the response definitions by adding the out-of-the-box Anypoint Platform rate-limit- enforcement securityScheme with description, type, and example
By refining the response definitions by adding the x-ratelimit-* response headers with description, type, and example

Answer(s): D

Explanation:

Correct Answer: By refining the response definitions by adding the x-ratelimit-* response headers with description, type, and example
*****************************************

Reference:

https://docs.mulesoft.com/api-manager/2.x/rate-limiting-and-throttling#response-headers https://docs.mulesoft.com/api-manager/2.x/rate-limiting-and-throttling-sla-based- policies#response-headers

Reveal Solution Next Question

QUESTION: 15

An organization has several APIs that accept JSON data over HTTP POST. The APIs are all publicly available and are associated with several mobile applications and web applications. The organization does NOT want to use any authentication or compliance policies for these APIs, but at the same time, is worried that some bad actor could send payloads that could somehow compromise the applications or servers running the API implementations.
What out-of-the-box Anypoint Platform policy can address exposure to this threat?

Shut out bad actors by using HTTPS mutual authentication for all API invocations
Apply an IP blacklist policy to all APIs; the blacklist will Include all bad actors
Apply a Header injection and removal policy that detects the malicious data before it is used
Apply a JSON threat protection policy to all APIs to detect potential threat vectors

Answer(s): D

Explanation:

Correct Answer: Apply a JSON threat protection policy to all APIs to detect potential threat vectors
*****************************************
>> Usually, if the APIs are designed and developed for specific consumers (known consumers/customers) then we would IP Whitelist the same to ensure that traffic only comes from them.
>> However, as this scenario states that the APIs are publicly available and being used by so many mobile and web applications, it is NOT possible to identify and blacklist all possible bad actors.

>> So, JSON threat protection policy is the best chance to prevent any bad JSON payloads from such bad actors.

Reveal Solution Next Question

MuleSoft MCPA-LEVEL-1-MAINTENANCE Exam (page: 3) MuleSoft Certified Platform Architect - Level 1 MAINTENANCE Updated on: 12-Feb-2026

QUESTION: 11

Explanation:

Reference:

QUESTION: 12

Explanation:

Reference:

QUESTION: 13

Explanation:

QUESTION: 14

Explanation:

Reference:

QUESTION: 15

Explanation:

MuleSoft MCPA-LEVEL-1-MAINTENANCE Exam (page: 3)
MuleSoft Certified Platform Architect - Level 1 MAINTENANCE
Updated on: 12-Feb-2026