Free Salesforce MuleSoft Developer II practice questions

Question 1

Northern Trail Outfitters' Promotions API returns different offers depending on the x-region request header, for example EU or US. After the HTTP Caching policy was applied with its default key, EU shoppers sometimes receive US offers for the same path. What should the Mule developer change?
A. Set the Conditional Request Caching Expression to #[attributes.headers['x-region'] != null].
B. Set x-region as the Invalidation Header, so a change of region removes the cached entry for that path.
C. Enable the Distributed option, so that the workers serving each region keep separate cache entries.
D. Set the HTTP Caching Key to #[attributes.requestPath ++ (attributes.headers['x-region'] default '')].

Accepted Answer

Correct answer: D. Set the HTTP Caching Key to #[attributes.requestPath ++ (attributes.headers['x-region'] default '')].
The cache works as a dictionary keyed by the HTTP Caching Key, a DataWeave expression whose default is #[attributes.requestPath], so requests for the same path share one entry regardless of region; adding the header to the key stores one entry per path and region. Distributed shares one cache between nodes, which makes cross-region collisions more likely, not less. The invalidation header accepts only the values invalidate and invalidate-all, so it cannot carry a region value. A conditional request expression decides whether to cache, but cached requests would still share the path-only key.

Question 2

Cloud Kicks' Production environment has a Message Logging automated policy. The Orders API instance on Mule Gateway also has API-level JWT Validation and CORS policies. The security team asks the Mule developer to make JWT Validation run before the automated Message Logging policy. The developer opens Reorder policies for the instance. What can the developer achieve there?
A. Nothing, because Mule Gateway fixes the order by category and runs security policies before logging policies.
B. Only the relative order of API-level policies; they cannot run before automated policies, and CORS always runs first.
C. Move JWT Validation above Message Logging, because reordering covers every policy that affects the API instance.
D. Move CORS below JWT Validation, so that browser preflight requests are authenticated before CORS handles them.

Accepted Answer

Correct answer: B. Only the relative order of API-level policies; they cannot run before automated policies, and CORS always runs first.
In Mule Gateway you can reorder included and custom API-level policies through API Manager, but you cannot configure API-level policies to execute before automated policies. The CORS policy's execution order cannot be configured at all: it executes before automated and API-level policies. So JWT Validation cannot be moved ahead of the automated Message Logging policy, and CORS cannot be moved below it. Order is not fixed by policy category; the Reorder policies page exists precisely to change the order of API-level policies.

Question 3

A Mule module team at AW Computing changes an XML SDK module's prefix to pricing-tools, then Studio can no longer resolve files in the module's resources directory. What should the team check?
A. Whether the resource folder name was changed to match the custom module prefix
B. Whether the prefix was moved from the module element into the application's pom.xml
C. Whether the resource folder was renamed to the module's Maven artifactId instead
D. Whether the prefix was removed because XML SDK modules cannot use custom prefixes

Accepted Answer

Correct answer: A. Whether the resource folder name was changed to match the custom module prefix
The XML SDK documentation states that the module prefix correlates with the resource-folder name, so setting a custom prefix requires renaming the resource folder to match. The prefix is an XML SDK module attribute, not a Maven POM setting. The docs tie the resource folder to the prefix rather than the Maven artifactId. A custom prefix is supported; when absent, the module derives one from its name.

Question 4

A Get Cloudy Consulting developer is adding MUnit to a hand-written Mule application POM so that the tests run in the Maven test phase. The POM already defines the munit.version property but nothing else related to MUnit. Which three additions does the documented setup require? Choose 3 answers. A. Add the munit-runner and munit-tools dependencies with the mule-plugin classifier and test scope. B. Configure the MuleSoft releases repository under and . C. Add the munit-maven-plugin with an execution of the test goal in the test phase. D. Declare the maven-surefire-plugin so that MUnit can produce its test reports in target/surefire-reports. E. Change the project packaging to munit so that Maven runs the suites located under src/test/munit.

Accepted Answer

Correct answer: A. Add the munit-runner and munit-tools dependencies with the mule-plugin classifier and test scope. | B. Configure the MuleSoft releases repository under and . | C. Add the munit-maven-plugin with an execution of the test goal in the test phase. The documented setup enables the munit-maven-plugin with a test execution, adds munit-runner and munit-tools as mule-plugin dependencies in test scope, and configures the repositories for both the dependencies and the plugin. MUnit has Surefire support built in, so no additional Surefire plugin configuration is needed for the reports in target/surefire-reports. The setup does not use a munit packaging type, because the project remains a Mule application.

Question 5

A Northern Trail Outfitters custom policy declares the dependency below to avoid packaging the HTTP Connector twice. The policy now must make its own outbound HTTP requests to a token service from template.xml. com.mulesoft.anypoint mule-http-policy-transform-extension ${httpPolicyTransformVersion} mule-plugin org.mule.connectors mule-http-connector Which two options does the extension's documentation give for this requirement? Choose 2 answers. A. Set propagateMessageTransformations="true" on the source block so that the application's connector is passed to the policy. B. Add mule-http-connector to exportedPackages in the application's mule-artifact.json so the policy can load it. C. Remove the exclusion so that the connector is available within the policy's own class loader. D. Set mule.enable.policy.isolation=false so that the policy uses the application-level connector. E. Move the outbound call into an http-policy:operation block, which supplies its own HTTP Requester to the policy.

Accepted Answer

Correct answer: C. Remove the exclusion so that the connector is available within the policy's own class loader. | D. Set mule.enable.policy.isolation=false so that the policy uses the application-level connector.
The HTTP Policy Transform Extension page says a policy that must perform its own outbound HTTP requests must either remove the exclusion, so the connector is in the policy's class loader, or set mule.enable.policy.isolation=false, so the policy uses the application-level connector. Exported packages in the application's descriptor are not one of those options. An operation block only wraps the flow's own HTTP Requester and does not provide a connector to the policy. propagateMessageTransformations governs Mule message changes, not connector or class loading.

Question 6

Universal Containers runs customer-hosted Mule runtimes registered in Runtime Manager as a server group named uc-prod-group. The team wants its Maven pipeline to deploy through Anypoint Platform so the group stays managed in Runtime Manager. How should the developer configure the Mule Maven plugin? A. Use armDeployment with uc-prod-group and serverGroup B. Use cloudhub2Deployment with MC and set to uc-prod-group C. Use agentDeployment with set to the Runtime Manager URL and the group name in D. Use standaloneDeployment with set to the group's install path on each server in turn

Accepted Answer

Correct answer: A. Use armDeployment with uc-prod-group and serverGroup The Runtime Manager REST API strategy (armDeployment) deploys to a server, server group or cluster registered in Runtime Manager, with target naming it and targetType set to server, serverGroup or cluster. agentDeployment calls the Runtime Manager agent's local API at a server URI rather than going through Anypoint Platform. standaloneDeployment copies the app to a local Mule instance and does not involve Runtime Manager. cloudhub2Deployment targets CloudHub 2.0 shared or private spaces, not customer-hosted server groups.

Question 7

Cumulus Financial exposes a custom health endpoint to a partner monitor. A failed dependency operation propagates an error to the HTTP Listener. The monitoring contract requires HTTP 503 and the fixed body Dependency unavailable, with no internal error description in the response. Which two listener settings should the developer configure? Choose 2 answers.
A. Set the Error Response status code to 503 for this endpoint rather than relying on the ordinary success response.
B. Set the ordinary Response reason phrase to Service Unavailable while retaining the existing error response settings.
C. Set only the ordinary Response body to the fixed message, leaving the Error Response body unchanged for failures.
D. Set the Error Response body to the required fixed message instead of returning the underlying error description.
E. Add an ERROR Logger containing the fixed message and rely on its severity to replace the listener error response.

Accepted Answer

Correct answer: A. Set the Error Response status code to 503 for this endpoint rather than relying on the ordinary success response. | D. Set the Error Response body to the required fixed message instead of returning the underlying error description.
A propagated failure uses the HTTP Listener error response, whose status and body can both be customized. Setting its status to 503 and its body to the safe fixed text satisfies the two independent requirements. Ordinary response settings do not replace the failure response. A reason phrase does not set its status, and logging a message does not make that message the response body.

Question 8

AW Computing must send partnerCaseId as the correlation value for one HTTP Request. Other operations should continue using the existing event ID, and Send Correlation Id is already ALWAYS for this request. Which configuration is intended to select that request-specific outgoing value?
A. Set the Request operation Correlation Id value from partnerCaseId rather than replacing the event-wide generator.
B. Set the Request operation Response Timeout from partnerCaseId so the timeout field supplies the correlation value.
C. Set the Request operation Target Variable to partnerCaseId so its name becomes the outgoing correlation ID.
D. Replace the application correlation ID generator with a constant partnerCaseId expression for all new source events.

Accepted Answer

Correct answer: A. Set the Request operation Correlation Id value from partnerCaseId rather than replacing the event-wide generator.
The HTTP Request reference provides a Correlation Id field for a custom outgoing value at operation level. With transmission already enabled, that field addresses this request without redesigning IDs for all source events. Target Variable controls where the operation output is stored, while Response Timeout controls how long it waits. Replacing the application generator broadens the change to event generation and does not express the stated one-request override.

Question 9

Bloomington Caregivers packages a tested custom Log4j configuration at a known valid path for one on-premises Mule application. The shared runtime logging configuration must remain unchanged for other applications. The developer needs the application descriptor to select that custom configuration. Which descriptor entry is intended for this purpose?
A. Set minMuleVersion in mule-artifact.json to the custom configuration path for this application.
B. Set secureProperties in mule-artifact.json to the custom configuration path for this application.
C. Set logConfigFile in mule-artifact.json to the custom configuration path for this application.
D. Set requiredProduct in mule-artifact.json to the custom configuration path for this application.

Accepted Answer

Correct answer: C. Set logConfigFile in mule-artifact.json to the custom configuration path for this application.
The logging guide documents logConfigFile in mule-artifact.json as an application-level override of logging configuration. This selects the stipulated valid configuration without editing the shared runtime file. secureProperties identifies values treated as secrets, while requiredProduct identifies the runtime product edition. minMuleVersion declares a runtime-version requirement rather than a logging configuration path.

Question 10

A Cumulus Financial VM listener should stop retrying a repeatedly failing message after a configured threshold and then trigger process-failed handling. Which redelivery-policy field sets that threshold?
A. Enable Use Secure Hash to control message redelivery identification.
B. Set Max Redelivery Count to define the unsuccessful redelivery limit.
C. Increase Number Of Consumers to control concurrent consumption.
D. Raise Timeout to control how long a queue operation waits.

Accepted Answer

Correct answer: B. Set Max Redelivery Count to define the unsuccessful redelivery limit.
Max Redelivery Count sets the maximum unsuccessful redeliveries before process-failed handling is triggered. Number Of Consumers controls concurrent queue consumers and the rate at which the source feeds its flow, not the redelivery threshold. Use Secure Hash controls identification of redelivered messages. Timeout controls how long a queue operation waits, rather than how many failed redeliveries are allowed.

Question 11

A Bloomington Caregivers integration accepts collapsed IPv6 literals. The team passes an endpoint string such as [2001:db8::7]:443 to Validation Is IP and wants the address-format check to pass without losing the transport port. What should the developer do?
A. Separate the address from the port, then validate the IPv6 literal without the port suffix.
B. Expand IPv6 but keep the port attached; only collapsed literals reject ports.
C. Keep the endpoint unchanged and allowlist it, because an allowlist turns a port into address syntax.
D. Replace Is IP with Is Email, because the colon-separated endpoint is treated as a mailbox address.

Accepted Answer

Correct answer: A. Separate the address from the port, then validate the IPv6 literal without the port suffix.
Is IP supports full and collapsed IPv6 addresses but explicitly excludes addresses containing ports. Separating the endpoint components lets the flow validate the address while retaining the port elsewhere. Expanding the address does not remove the excluded port, and allowlisting does not change the syntax being validated. Is Email validates a different kind of identifier.

Question 12

Northern Trail Outfitters uses an on-premises custom Object Store, not Object Store v2, with entry TTL, maxEntries, and a positive expiration interval. Between cleanup runs, monitoring finds expired records and a count above the limit. Which two statements explain the cleanup behavior? Choose 2 answers.
A. An interval starts the thread even when both entry TTL and maxEntries are absent.
B. Entries exceeding maxEntries are removed when the expiration thread runs.
C. Crossing maxEntries guarantees that subsequent Store operations reject new keys.
D. The expiration interval schedules cleanup checks rather than checking on every write.
E. The expiration interval replaces entry TTL as the lifetime assigned to each entry.

Accepted Answer

Correct answer: B. Entries exceeding maxEntries are removed when the expiration thread runs. | D. The expiration interval schedules cleanup checks rather than checking on every write.
The expiration interval determines how frequently the expiration thread runs, while entry TTL defines the time boundary. Entries exceeding maxEntries are removed when that thread runs, so the limit is not a guarantee of immediate write-time eviction or rejection. The interval does not replace the TTL. If neither entryTtl nor maxEntries is configured, the interval has no effect and the expiration thread does not run.

Question 13

Cloud Kicks uses Mule 4.6. fetchCatalog performs a read-only API invocation, and normalizeCatalog deterministically transforms its result. The application wants to reuse the fully normalized response for equivalent requests. A custom strategy and repeatable input/output are already configured:

Which two statements describe this scope design? Choose 2 answers. A. The API invocation must move before the scope because a Cache scope can contain only transformation processors. B. The scope must split into one cache per processor because each scope is restricted to one message processor. C. The cached value is necessarily the original request payload, because output from enclosed processors cannot be cached. D. The scope can contain both processors and cache the response produced by their combined processing. E. On a cache miss the enclosed processing produces the response; a later hit can reuse that output instead of invoking it again.

Accepted Answer

Correct answer: D. The scope can contain both processors and cache the response produced by their combined processing. | E. On a cache miss the enclosed processing produces the response; a later hit can reuse that output instead of invoking it again.
Cache Scope permits any number of enclosed message processors and stores the response produced by their processing. This allows the invocation and normalization to form one cached computation: a miss runs that computation and a later hit can reuse its output. Moving the invocation outside would leave it executing before cache lookup rather than eliminating repeated API work. The scope is neither restricted to one processor nor required to cache the original request instead of the generated response.

Question 14

Cumulus Financial runs Mule Enterprise Edition and feeds a large binary stream to independent Scatter-Gather routes. A custom repeatable in-memory strategy reaches its maximum buffer and fails. Disk buffering is allowed, and the team needs concurrent reads without an unbounded heap buffer. Which two recommendations fit? Choose 2 answers.
A. Tune the file-store in-memory buffer with the trade-off that a smaller buffer saves memory but increases disk access.
B. Use a repeatable file-store strategy that can spill buffered content to a temporary file.
C. Increase Scatter-Gather maxConcurrency, which changes the stream buffer into persistent disk storage.
D. Use a non-repeatable stream so every Scatter-Gather route receives its own full readable copy.
E. Keep the in-memory strategy and remove its practical size bound so the heap can hold every large input.

Accepted Answer

Correct answer: A. Tune the file-store in-memory buffer with the trade-off that a smaller buffer saves memory but increases disk access. | B. Use a repeatable file-store strategy that can spill buffered content to a temporary file.
Repeatable streams support parallel readers, and the EE file-store strategy buffers in memory before using disk for larger content. Its memory-buffer size trades memory against disk activity, while the in-memory strategy can fail when its configured maximum is exceeded. A non-repeatable stream cannot supply the router's required repeatable access. Removing the practical heap bound violates the constraint, and maxConcurrency controls routes rather than the streaming storage strategy.

Question 15

Cumulus Financial converts one private-key entry into a new JKS package using Java 8 importkeystore. Its source entry password differs from the new destination store password. The job supplies both store passwords and the source key password, but omits destkeypass. The conversion succeeds. Which password protects the imported destination entry?
A. The source entry password, because it is retained when destkeypass is omitted.
B. No password, because successfully importing an entry removes its private-key protection.
C. The destination store password, because conversion always makes both passwords identical.
D. The destination alias, because a renamed entry uses its alias as the key password.

Accepted Answer

Correct answer: A. The source entry password, because it is retained when destkeypass is omitted.
Java 8 importkeystore specifies that if destkeypass is omitted, the destination entry is protected with the source entry password. Choosing a different destination store password does not automatically replace that entry password. Successful conversion neither removes key protection nor turns an alias into a password. This question explicitly uses JKS, rather than assuming identical store/key-password behavior for every destination format.

Question 16

Cloud Kicks generates a Mule 4.6 TLS context whose single revocation-check wrapper contains both standard-revocation-check and custom-ocsp-responder children. The developer expects the children to define an ordered fallback chain. All their individual attributes are valid. What does the TLS schema require?
A. Keep both children and rename the wrapper so each mechanism has a unique name.
B. Keep both children and reorder them so that the custom responder appears first.
C. Choose one mechanism child; the wrapper is a single-choice configuration.
D. Keep both children and add a CRL File child so the fallback chain is complete.

Accepted Answer

Correct answer: C. Choose one mechanism child; the wrapper is a single-choice configuration.
The revocation wrapper schema uses a choice with exactly one mechanism child: standard checking, CRL file, or custom OCSP responder. It does not define an ordered chain of sibling mechanisms. Reordering or renaming therefore cannot make the two-child structure valid, and adding a third child increases the violation. Fallback within standard checking is configured through that mechanism's own options.

Question 17

Get Cloudy Consulting's Mule 4.6 OAuth integration already extracts a custom token-response parameter named account_zone and stores it in PartnerTokens. After a protected API call, the payload is now the returned business document, which has no account_zone field. The next step needs the stored non-secret zone in vars.zone. Which operation should the developer use? A. , to obtain the stored zone as the renewal credential. B. , to return the zone instead of the issued access token. C. . D. , to read the stored OAuth state.

Accepted Answer

Correct answer: C. <oauth:retrieve-custom-token-response-param tokenManager="PartnerTokens" key="account_zone" target="zone"/>.
Retrieve Custom Token Response Param reads a previously extracted token-response value by its key from the selected token manager. Its target stores that result in vars.zone, so the flow does not have to find the field in the later business payload. Retrieve State returns OAuth state rather than an arbitrary custom parameter. Retrieve Access Token and Retrieve Refresh Token return their respective credentials, neither of which is the stipulated account_zone value.

Question 18

A Cloud Kicks Mule 4.6 API call fails during TLS negotiation, before an HTTP response is available. The developer needs handshake and cipher-negotiation diagnostics rather than only raw HTTP messages. Which diagnostic setting should the developer enable?
A. Supply the JVM system property -Djavax.net.debug=ssl for the TLS diagnostic run.
B. Enable the HttpMessageLogger at DEBUG to obtain the complete TLS negotiation trace.
C. Enable HTTP wire logging so its request headers include the negotiated key exchange.
D. Set the HTTP Request response timeout to capture certificate-negotiation details.

Accepted Answer

Correct answer: A. Supply the JVM system property -Djavax.net.debug=ssl for the TLS diagnostic run.
The HTTP troubleshooting guide prescribes javax.net.debug=ssl for connection attempts, TLS handshakes, and negotiations. HttpMessageLogger wire logging captures raw HTTP requests and responses rather than supplying that TLS trace. A response timeout controls waiting for an HTTP response and does not enable negotiation logging. Wire-logged request headers likewise do not replace the documented TLS debugging facility.

Free Salesforce MuleSoft Developer II
Practice Questions

What is the MuleSoft Developer II exam like?

Questions by exam section

Expose production-ready Anypoint Platform-managed APIs from Mule applications

Question 1 · Medium

Question 2 · Harder

Implement maintainable and modular Mule applications and their Maven builds

Question 3 · Medium

Question 4 · Medium · Choose 3

Question 5 · Harder · Choose 2

Question 6 · Medium

Implement monitorable Mule applications

Question 7 · Harder · Choose 2

Question 8 · Medium

Question 9 · Harder

Implement performant and reliable Mule applications

Question 10 · Medium

Question 11 · Easier

Question 12 · Medium · Choose 2

Question 13 · Medium · Choose 2

Question 14 · Medium · Choose 2

Secure data at rest and in transit

Question 15 · Harder

Question 16 · Harder

Question 17 · Medium

Question 18 · Easier

Where to go after these 18 questions

Get MuleSoft Developer II exam updates by email

Ready for a full MuleSoft Developer II practice exam?

Free Salesforce MuleSoft Developer IIPractice Questions