# Free Salesforce MuleSoft Developer II Practice Questions *Last updated September 2026 ยท https://www.certifyforce.com/salesforce-mulesoft-developer-ii-practice-exam/free-questions* 18 free MuleSoft Developer II practice questions from the Certifyforce bank of 300 reviewed questions, spread across the 5 official exam sections in proportion to their weight. Each has the correct answer, an explanation, and the official documentation it was verified against. ## Expose production-ready Anypoint Platform-managed APIs from Mule applications (13%) ### Question 1 Northern Trail Outfitters' Promotions API returns different offers depending on the `x-region` request header, for example EU or US. After the HTTP Caching policy was applied with its default key, EU shoppers sometimes receive US offers for the same path. What should the Mule developer change? - A. Set the Conditional Request Caching Expression to `#[attributes.headers['x-region'] != null]`. - B. Set `x-region` as the Invalidation Header, so a change of region removes the cached entry for that path. - C. Enable the Distributed option, so that the workers serving each region keep separate cache entries. - D. Set the HTTP Caching Key to `#[attributes.requestPath ++ (attributes.headers['x-region'] default '')]`. **Correct answer:** D. Set the HTTP Caching Key to `#[attributes.requestPath ++ (attributes.headers['x-region'] default '')]`. **Explanation:** The cache works as a dictionary keyed by the HTTP Caching Key, a DataWeave expression whose default is `#[attributes.requestPath]`, so requests for the same path share one entry regardless of region; adding the header to the key stores one entry per path and region. Distributed shares one cache between nodes, which makes cross-region collisions more likely, not less. The invalidation header accepts only the values invalidate and invalidate-all, so it cannot carry a region value. A conditional request expression decides whether to cache, but cached requests would still share the path-only key. **Sources:** [HTTP Caching Policy](https://docs.mulesoft.com/mule-gateway/policies-included-http-caching) ### Question 2 Cloud Kicks' Production environment has a Message Logging automated policy. The Orders API instance on Mule Gateway also has API-level JWT Validation and CORS policies. The security team asks the Mule developer to make JWT Validation run before the automated Message Logging policy. The developer opens Reorder policies for the instance. What can the developer achieve there? - A. Nothing, because Mule Gateway fixes the order by category and runs security policies before logging policies. - B. Only the relative order of API-level policies; they cannot run before automated policies, and CORS always runs first. - C. Move JWT Validation above Message Logging, because reordering covers every policy that affects the API instance. - D. Move CORS below JWT Validation, so that browser preflight requests are authenticated before CORS handles them. **Correct answer:** B. Only the relative order of API-level policies; they cannot run before automated policies, and CORS always runs first. **Explanation:** In Mule Gateway you can reorder included and custom API-level policies through API Manager, but you cannot configure API-level policies to execute before automated policies. The CORS policy's execution order cannot be configured at all: it executes before automated and API-level policies. So JWT Validation cannot be moved ahead of the automated Message Logging policy, and CORS cannot be moved below it. Order is not fixed by policy category; the Reorder policies page exists precisely to change the order of API-level policies. **Sources:** [Reordering Policies](https://docs.mulesoft.com/mule-gateway/policies-reorder), [Policy Types](https://docs.mulesoft.com/mule-gateway/policies-policy-types) ## Implement maintainable and modular Mule applications and their Maven builds (25%) ### Question 3 A Mule module team at AW Computing changes an XML SDK module's `prefix` to `pricing-tools`, then Studio can no longer resolve files in the module's resources directory. What should the team check? - A. Whether the resource folder name was changed to match the custom module prefix - B. Whether the prefix was moved from the module element into the application's `pom.xml` - C. Whether the resource folder was renamed to the module's Maven artifactId instead - D. Whether the prefix was removed because XML SDK modules cannot use custom prefixes **Correct answer:** A. Whether the resource folder name was changed to match the custom module prefix **Explanation:** The XML SDK documentation states that the module prefix correlates with the resource-folder name, so setting a custom prefix requires renaming the resource folder to match. The prefix is an XML SDK module attribute, not a Maven POM setting. The docs tie the resource folder to the prefix rather than the Maven artifactId. A custom prefix is supported; when absent, the module derives one from its name. **Sources:** [XML SDK](https://docs.mulesoft.com/mule-sdk/latest/xml-sdk) ### Question 4 A Get Cloudy Consulting developer is adding MUnit to a hand-written Mule application POM so that the tests run in the Maven `test` phase. The POM already defines the `munit.version` property but nothing else related to MUnit. Which three additions does the documented setup require? Choose 3 answers. - A. Add the `munit-runner` and `munit-tools` dependencies with the `mule-plugin` classifier and `test` scope. - B. Configure the MuleSoft releases repository under `` and ``. - C. Add the `munit-maven-plugin` with an execution of the `test` goal in the `test` phase. - D. Declare the `maven-surefire-plugin` so that MUnit can produce its test reports in `target/surefire-reports`. - E. Change the project packaging to `munit` so that Maven runs the suites located under `src/test/munit`. **Correct answers:** A. Add the `munit-runner` and `munit-tools` dependencies with the `mule-plugin` classifier and `test` scope.; B. Configure the MuleSoft releases repository under `` and ``.; C. Add the `munit-maven-plugin` with an execution of the `test` goal in the `test` phase. **Explanation:** The documented setup enables the `munit-maven-plugin` with a `test` execution, adds `munit-runner` and `munit-tools` as `mule-plugin` dependencies in `test` scope, and configures the repositories for both the dependencies and the plugin. MUnit has Surefire support built in, so no additional Surefire plugin configuration is needed for the reports in `target/surefire-reports`. The setup does not use a `munit` packaging type, because the project remains a Mule application. **Sources:** [MUnit Maven Plugin](https://docs.mulesoft.com/munit/latest/munit-maven-plugin) ### Question 5 A Northern Trail Outfitters custom policy declares the dependency below to avoid packaging the HTTP Connector twice. The policy now must make its own outbound HTTP requests to a token service from `template.xml`. ```xml com.mulesoft.anypoint mule-http-policy-transform-extension ${httpPolicyTransformVersion} mule-plugin org.mule.connectors mule-http-connector ``` Which two options does the extension's documentation give for this requirement? Choose 2 answers. - A. Set `propagateMessageTransformations="true"` on the source block so that the application's connector is passed to the policy. - B. Add `mule-http-connector` to `exportedPackages` in the application's `mule-artifact.json` so the policy can load it. - C. Remove the exclusion so that the connector is available within the policy's own class loader. - D. Set `mule.enable.policy.isolation=false` so that the policy uses the application-level connector. - E. Move the outbound call into an `http-policy:operation` block, which supplies its own HTTP Requester to the policy. **Correct answers:** C. Remove the exclusion so that the connector is available within the policy's own class loader.; D. Set `mule.enable.policy.isolation=false` so that the policy uses the application-level connector. **Explanation:** The HTTP Policy Transform Extension page says a policy that must perform its own outbound HTTP requests must either remove the exclusion, so the connector is in the policy's class loader, or set `mule.enable.policy.isolation=false`, so the policy uses the application-level connector. Exported packages in the application's descriptor are not one of those options. An operation block only wraps the flow's own HTTP Requester and does not provide a connector to the policy. `propagateMessageTransformations` governs Mule message changes, not connector or class loading. **Sources:** [HTTP Policy Transform Extension](https://docs.mulesoft.com/mule-gateway/policies-custom-http-transform) ### Question 6 Universal Containers runs customer-hosted Mule runtimes registered in Runtime Manager as a server group named `uc-prod-group`. The team wants its Maven pipeline to deploy through Anypoint Platform so the group stays managed in Runtime Manager. How should the developer configure the Mule Maven plugin? - A. Use `armDeployment` with `uc-prod-group` and `serverGroup` - B. Use `cloudhub2Deployment` with `MC` and `` set to `uc-prod-group` - C. Use `agentDeployment` with `` set to the Runtime Manager URL and the group name in `` - D. Use `standaloneDeployment` with `` set to the group's install path on each server in turn **Correct answer:** A. Use `armDeployment` with `uc-prod-group` and `serverGroup` **Explanation:** The Runtime Manager REST API strategy (`armDeployment`) deploys to a server, server group or cluster registered in Runtime Manager, with `target` naming it and `targetType` set to `server`, `serverGroup` or `cluster`. `agentDeployment` calls the Runtime Manager agent's local API at a server URI rather than going through Anypoint Platform. `standaloneDeployment` copies the app to a local Mule instance and does not involve Runtime Manager. `cloudhub2Deployment` targets CloudHub 2.0 shared or private spaces, not customer-hosted server groups. **Sources:** [Deploy Applications to On-Premises Mule Instances Using the Mule Maven Plugin](https://docs.mulesoft.com/mule-runtime/latest/deploy-on-premises), [Mule Maven Plugin](https://docs.mulesoft.com/mule-runtime/latest/mmp-concept) ## Implement monitorable Mule applications (15%) ### Question 7 Cumulus Financial exposes a custom health endpoint to a partner monitor. A failed dependency operation propagates an error to the HTTP Listener. The monitoring contract requires HTTP 503 and the fixed body `Dependency unavailable`, with no internal error description in the response. Which two listener settings should the developer configure? Choose 2 answers. - A. Set the Error Response status code to 503 for this endpoint rather than relying on the ordinary success response. - B. Set the ordinary Response reason phrase to Service Unavailable while retaining the existing error response settings. - C. Set only the ordinary Response body to the fixed message, leaving the Error Response body unchanged for failures. - D. Set the Error Response body to the required fixed message instead of returning the underlying error description. - E. Add an ERROR Logger containing the fixed message and rely on its severity to replace the listener error response. **Correct answers:** A. Set the Error Response status code to 503 for this endpoint rather than relying on the ordinary success response.; D. Set the Error Response body to the required fixed message instead of returning the underlying error description. **Explanation:** A propagated failure uses the HTTP Listener error response, whose status and body can both be customized. Setting its status to 503 and its body to the safe fixed text satisfies the two independent requirements. Ordinary response settings do not replace the failure response. A reason phrase does not set its status, and logging a message does not make that message the response body. **Sources:** [Configure HTTP Listener Source](https://docs.mulesoft.com/http-connector/latest/http-listener-ref) ### Question 8 AW Computing must send partnerCaseId as the correlation value for one HTTP Request. Other operations should continue using the existing event ID, and Send Correlation Id is already ALWAYS for this request. Which configuration is intended to select that request-specific outgoing value? - A. Set the Request operation Correlation Id value from partnerCaseId rather than replacing the event-wide generator. - B. Set the Request operation Response Timeout from partnerCaseId so the timeout field supplies the correlation value. - C. Set the Request operation Target Variable to partnerCaseId so its name becomes the outgoing correlation ID. - D. Replace the application correlation ID generator with a constant partnerCaseId expression for all new source events. **Correct answer:** A. Set the Request operation Correlation Id value from partnerCaseId rather than replacing the event-wide generator. **Explanation:** The HTTP Request reference provides a Correlation Id field for a custom outgoing value at operation level. With transmission already enabled, that field addresses this request without redesigning IDs for all source events. Target Variable controls where the operation output is stored, while Response Timeout controls how long it waits. Replacing the application generator broadens the change to event generation and does not express the stated one-request override. **Sources:** [HTTP Connector 1.12 Reference](https://docs.mulesoft.com/http-connector/latest/http-documentation), [Correlation ID (Mule Runtime 4.6)](https://docs.mulesoft.com/mule-runtime/4.6/correlation-id) ### Question 9 Bloomington Caregivers packages a tested custom Log4j configuration at a known valid path for one on-premises Mule application. The shared runtime logging configuration must remain unchanged for other applications. The developer needs the application descriptor to select that custom configuration. Which descriptor entry is intended for this purpose? - A. Set minMuleVersion in mule-artifact.json to the custom configuration path for this application. - B. Set secureProperties in mule-artifact.json to the custom configuration path for this application. - C. Set logConfigFile in mule-artifact.json to the custom configuration path for this application. - D. Set requiredProduct in mule-artifact.json to the custom configuration path for this application. **Correct answer:** C. Set logConfigFile in mule-artifact.json to the custom configuration path for this application. **Explanation:** The logging guide documents logConfigFile in mule-artifact.json as an application-level override of logging configuration. This selects the stipulated valid configuration without editing the shared runtime file. secureProperties identifies values treated as secrets, while requiredProduct identifies the runtime product edition. minMuleVersion declares a runtime-version requirement rather than a logging configuration path. **Sources:** [Configuring Logging (Mule Runtime 4.6)](https://docs.mulesoft.com/mule-runtime/4.6/logging-in-mule), [Package a Mule Application](https://docs.mulesoft.com/mule-runtime/latest/package-a-mule-application) ## Implement performant and reliable Mule applications (27%) ### Question 10 A Cumulus Financial VM listener should stop retrying a repeatedly failing message after a configured threshold and then trigger process-failed handling. Which redelivery-policy field sets that threshold? - A. Enable `Use Secure Hash` to control message redelivery identification. - B. Set `Max Redelivery Count` to define the unsuccessful redelivery limit. - C. Increase `Number Of Consumers` to control concurrent consumption. - D. Raise `Timeout` to control how long a queue operation waits. **Correct answer:** B. Set `Max Redelivery Count` to define the unsuccessful redelivery limit. **Explanation:** Max Redelivery Count sets the maximum unsuccessful redeliveries before process-failed handling is triggered. Number Of Consumers controls concurrent queue consumers and the rate at which the source feeds its flow, not the redelivery threshold. Use Secure Hash controls identification of redelivered messages. Timeout controls how long a queue operation waits, rather than how many failed redeliveries are allowed. **Sources:** [VM Connector Reference](https://docs.mulesoft.com/vm-connector/latest/vm-reference) ### Question 11 A Bloomington Caregivers integration accepts collapsed IPv6 literals. The team passes an endpoint string such as [2001:db8::7]:443 to Validation Is IP and wants the address-format check to pass without losing the transport port. What should the developer do? - A. Separate the address from the port, then validate the IPv6 literal without the port suffix. - B. Expand IPv6 but keep the port attached; only collapsed literals reject ports. - C. Keep the endpoint unchanged and allowlist it, because an allowlist turns a port into address syntax. - D. Replace Is IP with Is Email, because the colon-separated endpoint is treated as a mailbox address. **Correct answer:** A. Separate the address from the port, then validate the IPv6 literal without the port suffix. **Explanation:** Is IP supports full and collapsed IPv6 addresses but explicitly excludes addresses containing ports. Separating the endpoint components lets the flow validate the address while retaining the port elsewhere. Expanding the address does not remove the excluded port, and allowlisting does not change the syntax being validated. Is Email validates a different kind of identifier. **Sources:** [Validation Module Examples 2.0](https://docs.mulesoft.com/validation-connector/latest/validation-examples) ### Question 12 Northern Trail Outfitters uses an on-premises custom Object Store, not Object Store v2, with entry TTL, maxEntries, and a positive expiration interval. Between cleanup runs, monitoring finds expired records and a count above the limit. Which two statements explain the cleanup behavior? Choose 2 answers. - A. An interval starts the thread even when both entry TTL and maxEntries are absent. - B. Entries exceeding maxEntries are removed when the expiration thread runs. - C. Crossing maxEntries guarantees that subsequent Store operations reject new keys. - D. The expiration interval schedules cleanup checks rather than checking on every write. - E. The expiration interval replaces entry TTL as the lifetime assigned to each entry. **Correct answers:** B. Entries exceeding maxEntries are removed when the expiration thread runs.; D. The expiration interval schedules cleanup checks rather than checking on every write. **Explanation:** The expiration interval determines how frequently the expiration thread runs, while entry TTL defines the time boundary. Entries exceeding maxEntries are removed when that thread runs, so the limit is not a guarantee of immediate write-time eviction or rejection. The interval does not replace the TTL. If neither entryTtl nor maxEntries is configured, the interval has no effect and the expiration thread does not run. **Sources:** [Object Store Connector Reference](https://docs.mulesoft.com/object-store-connector/latest/object-store-connector-reference) ### Question 13 Cloud Kicks uses Mule 4.6. fetchCatalog performs a read-only API invocation, and normalizeCatalog deterministically transforms its result. The application wants to reuse the fully normalized response for equivalent requests. A custom strategy and repeatable input/output are already configured: ```xml ``` Which two statements describe this scope design? Choose 2 answers. - A. The API invocation must move before the scope because a Cache scope can contain only transformation processors. - B. The scope must split into one cache per processor because each scope is restricted to one message processor. - C. The cached value is necessarily the original request payload, because output from enclosed processors cannot be cached. - D. The scope can contain both processors and cache the response produced by their combined processing. - E. On a cache miss the enclosed processing produces the response; a later hit can reuse that output instead of invoking it again. **Correct answers:** D. The scope can contain both processors and cache the response produced by their combined processing.; E. On a cache miss the enclosed processing produces the response; a later hit can reuse that output instead of invoking it again. **Explanation:** Cache Scope permits any number of enclosed message processors and stores the response produced by their processing. This allows the invocation and normalization to form one cached computation: a miss runs that computation and a later hit can reuse its output. Moving the invocation outside would leave it executing before cache lookup rather than eliminating repeated API work. The scope is neither restricted to one processor nor required to cache the original request instead of the generated response. **Sources:** [Cache Scope](https://docs.mulesoft.com/mule-runtime/4.6/cache-scope) ### Question 14 Cumulus Financial runs Mule Enterprise Edition and feeds a large binary stream to independent Scatter-Gather routes. A custom repeatable in-memory strategy reaches its maximum buffer and fails. Disk buffering is allowed, and the team needs concurrent reads without an unbounded heap buffer. Which two recommendations fit? Choose 2 answers. - A. Tune the file-store in-memory buffer with the trade-off that a smaller buffer saves memory but increases disk access. - B. Use a repeatable file-store strategy that can spill buffered content to a temporary file. - C. Increase Scatter-Gather maxConcurrency, which changes the stream buffer into persistent disk storage. - D. Use a non-repeatable stream so every Scatter-Gather route receives its own full readable copy. - E. Keep the in-memory strategy and remove its practical size bound so the heap can hold every large input. **Correct answers:** A. Tune the file-store in-memory buffer with the trade-off that a smaller buffer saves memory but increases disk access.; B. Use a repeatable file-store strategy that can spill buffered content to a temporary file. **Explanation:** Repeatable streams support parallel readers, and the EE file-store strategy buffers in memory before using disk for larger content. Its memory-buffer size trades memory against disk activity, while the in-memory strategy can fail when its configured maximum is exceeded. A non-repeatable stream cannot supply the router's required repeatable access. Removing the practical heap bound violates the constraint, and maxConcurrency controls routes rather than the streaming storage strategy. **Sources:** [Scatter-Gather Router](https://docs.mulesoft.com/mule-runtime/4.6/scatter-gather-concept), [Streaming in Mule Apps](https://docs.mulesoft.com/mule-runtime/4.6/streaming-about) ## Secure data at rest and in transit (20%) ### Question 15 Cumulus Financial converts one private-key entry into a new JKS package using Java 8 importkeystore. Its source entry password differs from the new destination store password. The job supplies both store passwords and the source key password, but omits destkeypass. The conversion succeeds. Which password protects the imported destination entry? - A. The source entry password, because it is retained when destkeypass is omitted. - B. No password, because successfully importing an entry removes its private-key protection. - C. The destination store password, because conversion always makes both passwords identical. - D. The destination alias, because a renamed entry uses its alias as the key password. **Correct answer:** A. The source entry password, because it is retained when destkeypass is omitted. **Explanation:** Java 8 importkeystore specifies that if destkeypass is omitted, the destination entry is protected with the source entry password. Choosing a different destination store password does not automatically replace that entry password. Successful conversion neither removes key protection nor turns an alias into a password. This question explicitly uses JKS, rather than assuming identical store/key-password behavior for every destination format. **Sources:** [Java Platform, Standard Edition 8 Tools Reference: keytool](https://docs.oracle.com/javase/8/docs/technotes/tools/unix/keytool.html) ### Question 16 Cloud Kicks generates a Mule 4.6 TLS context whose single revocation-check wrapper contains both standard-revocation-check and custom-ocsp-responder children. The developer expects the children to define an ordered fallback chain. All their individual attributes are valid. What does the TLS schema require? - A. Keep both children and rename the wrapper so each mechanism has a unique name. - B. Keep both children and reorder them so that the custom responder appears first. - C. Choose one mechanism child; the wrapper is a single-choice configuration. - D. Keep both children and add a CRL File child so the fallback chain is complete. **Correct answer:** C. Choose one mechanism child; the wrapper is a single-choice configuration. **Explanation:** The revocation wrapper schema uses a choice with exactly one mechanism child: standard checking, CRL file, or custom OCSP responder. It does not define an ordered chain of sibling mechanisms. Reordering or renaming therefore cannot make the two-child structure valid, and adding a third child increases the violation. Fallback within standard checking is configured through that mechanism's own options. **Sources:** [Mule 4.6 TLS module schema](https://github.com/mulesoft/mule/blob/f686c2d3f2ed5f3153e2ffa0a9702eab51082a14/runtime-extension-model/src/main/resources/META-INF/mule-tls.xsd) ### Question 17 Get Cloudy Consulting's Mule 4.6 OAuth integration already extracts a custom token-response parameter named account_zone and stores it in PartnerTokens. After a protected API call, the payload is now the returned business document, which has no account_zone field. The next step needs the stored non-secret zone in vars.zone. Which operation should the developer use? - A. ``, to obtain the stored zone as the renewal credential. - B. ``, to return the zone instead of the issued access token. - C. ``. - D. ``, to read the stored OAuth state. **Correct answer:** C. ``. **Explanation:** Retrieve Custom Token Response Param reads a previously extracted token-response value by its key from the selected token manager. Its target stores that result in vars.zone, so the flow does not have to find the field in the later business payload. Retrieve State returns OAuth state rather than an arbitrary custom parameter. Retrieve Access Token and Retrieve Refresh Token return their respective credentials, neither of which is the stipulated account_zone value. **Sources:** [OAuth Module Reference](https://docs.mulesoft.com/oauth-module/latest/oauth-module-reference), [OAuth1.1 reference source, July2022](https://raw.githubusercontent.com/mulesoft/docs-connectors/e670e4fa926b805cff09b3a6d377a92bc4a6bb12/oauth/1.1/modules/ROOT/pages/oauth-module-reference.adoc) ### Question 18 A Cloud Kicks Mule 4.6 API call fails during TLS negotiation, before an HTTP response is available. The developer needs handshake and cipher-negotiation diagnostics rather than only raw HTTP messages. Which diagnostic setting should the developer enable? - A. Supply the JVM system property `-Djavax.net.debug=ssl` for the TLS diagnostic run. - B. Enable the HttpMessageLogger at DEBUG to obtain the complete TLS negotiation trace. - C. Enable HTTP wire logging so its request headers include the negotiated key exchange. - D. Set the HTTP Request response timeout to capture certificate-negotiation details. **Correct answer:** A. Supply the JVM system property `-Djavax.net.debug=ssl` for the TLS diagnostic run. **Explanation:** The HTTP troubleshooting guide prescribes javax.net.debug=ssl for connection attempts, TLS handshakes, and negotiations. HttpMessageLogger wire logging captures raw HTTP requests and responses rather than supplying that TLS trace. A response timeout controls waiting for an HTTP response and does not enable negotiation logging. Wire-logged request headers likewise do not replace the documented TLS debugging facility. **Sources:** [Troubleshooting HTTP Connector](https://docs.mulesoft.com/http-connector/latest/http-troubleshooting) ## Related pages - [Salesforce MuleSoft Developer II practice exam](https://www.certifyforce.com/salesforce-mulesoft-developer-ii-practice-exam) - [Practice exam packs](https://www.certifyforce.com/practice-exams) - [Official MuleSoft Developer II exam guide](https://help.salesforce.com/s/articleView?id=005298955&language=en_US&type=1)