Free Salesforce MuleSoft Platform Architect practice questions

Question 1

Cumulus Financial's architect reviews two controls for a new API program. One checks whether API descriptions follow design standards; the other must prevent requests that violate operational access rules. The team proposes treating a successful design review as proof that runtime access is enforced. What should the architect explain?
A. A description that passes design review automatically installs equivalent access policies on its runtime.
B. Design conformance and runtime policy enforcement serve different purposes and must both be addressed.
C. Runtime access control should replace design review because only deployed implementations need standards.
D. Publishing the description removes the need for runtime enforcement once consumers accept its terms.

Accepted Answer

Correct answer: B. Design conformance and runtime policy enforcement serve different purposes and must both be addressed.
API governance and runtime management are distinct parts of the API lifecycle: standards checks and request enforcement address different concerns. A successful design review does not itself install access policies. Runtime protection does not remove the value of consistent API design. Publishing a contract or its terms likewise does not enforce those terms on incoming traffic.

Question 2

A Cloud Kicks residency assessment covers Mule applications on Runtime Fabric in the company's own data center, managed from US Cloud. The applications use persistent object storage, and a reviewer assumes the Object Store connector places stored values in a MuleSoft Object Store v2 region. Which two conclusions should the architect record? Choose 2 answers.
A. Persistent object store values are written to the PostgreSQL database configured for Persistence Gateway.
B. Application payloads pass through Anypoint Management Center so that Runtime Manager can show their metrics.
C. Application data flows are controlled at the installation, with limited metadata and metrics stored in Anypoint.
D. The runtime region selected for each Runtime Fabric application determines where its object store is located.
E. Stored values go to a MuleSoft Object Store v2 region, because the connector calls that service's REST API.

Accepted Answer

Correct answer: A. Persistent object store values are written to the PostgreSQL database configured for Persistence Gateway. | C. Application data flows are controlled at the installation, with limited metadata and metrics stored in Anypoint.
Persistence Gateway writes persistent object storage rows to the PostgreSQL database created for it. The connector uses the Object Store v2 REST API to reach Persistence Gateway, which allows the same app to deploy to CloudHub or Runtime Fabric, but that API use does not place values in a MuleSoft region. The Runtime Fabric security architecture keeps data flows controlled at the installation location, stores limited metadata and metrics in Anypoint Management Center, and states that no customer data traverses Management Center. Runtime Fabric runs in customer infrastructure and does not use MuleSoft-managed runtime regions.

Question 3

An API program requires consumer applications to register dynamically with the company's external OpenID Connect provider and receive tokens from that provider. Which Anypoint capability should the architect configure?
A. Identity Management, because all external identity-provider connections are for employee SSO.
B. Runtime Manager, which stores API consumer credentials alongside each Mule application.
C. Anypoint Exchange asset publishing, which creates OAuth clients when an API is published.
D. Client Management, using an OIDC provider that supports dynamic client registration.

Accepted Answer

Correct answer: D. Client Management, using an OIDC provider that supports dynamic client registration.
OIDC Client Management configures an external provider for client registration, and API portals can dynamically register client applications with that provider. Identity Management is for user SSO, not API consumer registration. Publishing an API asset to Exchange does not itself create external OAuth clients. Runtime Manager manages application deployment and does not serve as the external client registry described.

Question 4

A Cloud Kicks client sends a PUT with If-Match: W/"v18", and the server's current representation has the same weak ETag. What should the server do under HTTP If-Match comparison rules?
A. Return 304 Not Modified because weak tags are used only for cache validation.
B. Accept the request because the weak tag text is identical to the server tag.
C. Treat the precondition as not matching and return 412 Precondition Failed.
D. Process the request only after converting the weak tag to a strong tag automatically.

Accepted Answer

Correct answer: C. Treat the precondition as not matching and return 412 Precondition Failed.
If-Match uses strong comparison, so a weak ETag marked with W/ never matches, even when the text otherwise equals the current validator. When the condition fails, the server returns 412 Precondition Failed and does not process the update. A 304 response is associated with cache revalidation, and the server does not convert a weak tag into a strong validator.

Question 5

A Get Cloudy Consulting team is publishing a RAML API specification that has no version property. It is the first publication of the API. Which initial values should the architect expect Design Center to suggest?
A. Asset version v1 and API version 1.0.0.
B. Asset version 0.1.0 and API version v0.
C. Asset version 1.0.0 and API version v1.
D. Asset version 1.0.0 and API version 1.0.0.

Accepted Answer

Correct answer: C. Asset version 1.0.0 and API version v1.
MuleSoft's Design Center publishing guide says that when the API specification defines no version, the suggested asset version and API version default to 1.0.0 and v1. The other pairs either use different defaults or reverse the distinct roles and formats of those fields. This is an initial-publication default, not a runtime version or an Exchange environment label.

Question 6

Get Cloudy Consulting is defining a customer System API over a backend whose business administrators maintain an editable status picklist. Approved values differ between installations and may be added without changing the field type. The API must preserve these backend-owned codes without publishing a fixed catalog of values in its schema. Which model best fits this requirement?
A. Replace the status codes with numeric API identifiers that every backend must adopt as its picklist.
B. Represent the status as a string so the schema does not freeze the backend-owned value list.
C. Define a closed enumeration containing the status values found in the first backend installation.
D. Omit the status property from the System API whenever an installation adds a new approved value.

Accepted Answer

Correct answer: B. Represent the status as a string so the schema does not freeze the backend-owned value list.
MuleSoft CIM guidance models many coded values as plain strings because lists can differ between organizations or change as editable backend picklists evolve. That approach fits the stated contract, which deliberately avoids a fixed API-level value catalog. A closed enumeration freezes that catalog, while imposing new numeric identifiers changes the backend-owned code convention. Omitting the property loses information instead of representing the approved values.

Question 7

AW Computing has agreed to use an enterprise data model for customer information across several applications. Its largest CRM has the most detailed schema, but that schema contains product-specific structures and terminology. Other systems must remain replaceable without redefining the enterprise contract around a new vendor. Which model should the architect recommend?
A. Use an application-agnostic business model for the enterprise instead of making one vendor’s schema the shared definition.
B. Use the largest CRM’s native schema as the enterprise model because the most detailed model is application-independent.
C. Use each new consuming application’s preferred schema, changing the enterprise contract whenever a consumer is added.
D. Use a union of every backend’s complete schema so the enterprise contract exposes all vendor-specific structures.

Accepted Answer

Correct answer: A. Use an application-agnostic business model for the enterprise instead of making one vendor’s schema the shared definition.
A canonical enterprise model such as CIM is application-agnostic, providing common business definitions across disparate applications. The number of fields in a CRM schema does not make its product-specific structures independent of that product. Combining every backend structure preserves rather than removes vendor coupling. Changing the shared contract for each consumer likewise defeats the agreed enterprise model instead of providing a stable common definition.

Question 8

A developer at Bloomington Caregivers must request another API version for an existing client application owned by a colleague. The developer is neither an owner of that application nor an owner of the target API instance. What is the most focused action that enables the developer to request access for the existing application?
A. Have the developer create another application with the same display name and reuse the original application's contract.
B. Have an administrator add the developer as an owner of the Exchange asset while leaving application ownership unchanged.
C. Have an existing application owner or the API instance owner add the developer to the application's owners list.
D. Have an administrator share the API's Exchange asset with the developer without changing application ownership.

Accepted Answer

Correct answer: C. Have an existing application owner or the API instance owner add the developer to the application's owners list.
The documented request flow permits an API instance owner or an owner of the specific client application to request access for that application. Other users can ask either owner to add their user account to the application's owners list. Sharing or owning the Exchange asset alone does not make the developer an owner of the existing client application. A second application with a matching display name is a different application and does not inherit the original contract.

Question 9

Cumulus Financial has configured an external OIDC dynamic client registration provider for an API. A team proposes enforcing its tokens with OAuth 2.0 Access Token Enforcement Using Mule OAuth Provider and replacing that policy's validation URL with the external IdP URL. What should the architect recommend?
A. Keep the Mule OAuth Provider policy because changing its validation URL makes every OAuth provider compatible.
B. Use Basic Authentication: Simple with the introspection client's credentials as the shared API caller credentials.
C. Use Client ID Enforcement with the external application's ID and secret as the only gateway check.
D. Use the OpenID Connect OAuth 2.0 Token Enforcement policy with this API's configured external OIDC client provider.

Accepted Answer

Correct answer: D. Use the OpenID Connect OAuth 2.0 Token Enforcement policy with this API's configured external OIDC client provider.
The Mule OAuth Provider enforcement policy is designed exclusively for an OAuth provider implemented with the Mule OAuth provider module. Changing its validation URL does not turn it into the external OIDC provider policy. OpenID Connect OAuth 2.0 Token Enforcement is the matching policy for the configured OIDC client-management solution. Client ID Enforcement and shared Basic authentication do not substitute for validation of the external provider's bearer tokens.

Question 10

Cloud Kicks' browser client successfully reads a cross-origin API response body. Mule Gateway already returns X-RateLimit-Remaining, but JavaScript cannot read that response header. The CORS origin and method are already accepted. What should the architect change?
A. Enable CORS credential support so every response header becomes readable.
B. Increase the CORS group's preflight cache duration for the accepted origin.
C. Add X-RateLimit-Remaining to the CORS group's exposed response headers.
D. Add X-RateLimit-Remaining to the CORS group's allowed request headers.

Accepted Answer

Correct answer: C. Add X-RateLimit-Remaining to the CORS group's exposed response headers.
CORS exposed headers identify response headers that browser JavaScript may access. The quota header is already present, so it must be exposed through that CORS configuration. Allowed headers describe headers the client may send in its actual request, while preflight cache duration controls how long the browser can reuse a preflight result. Credential support concerns credential-bearing requests and does not expose every response header.

Question 11

A hybrid Mule application was deployed through Runtime Manager. During maintenance, Cloud Kicks stops the Mule runtime, deletes the application's local folder, and restarts Mule. The application is deployed again. Which removal procedure should the architect put in the runbook?
A. Delete the managed application through Runtime Manager or its REST API so it is permanently removed.
B. Delete the local folder on every server-group node while leaving the managed application in Runtime Manager.
C. Stop the application's flows in Runtime Manager before deleting the local folder during maintenance.
D. Repeat the folder deletion while Mule is stopped and wait longer before the next restart.

Accepted Answer

Correct answer: A. Delete the managed application through Runtime Manager or its REST API so it is permanently removed.
A Mule restart triggers resynchronization, and Runtime Manager redeploys managed applications missing from the local runtime. Permanent removal therefore uses Runtime Manager's delete action or the Runtime Manager REST API. Waiting longer after a stopped-runtime folder deletion does not remove that managed deployment. Stopping flows or deleting folders on additional nodes likewise leaves the application record that drives resynchronization.

Question 12

Cloud Kicks will run two CloudHub 1.0 integration estates in the same region. The security design requires separate virtual network boundaries for the estates, while each estate needs several application environments. Which topology should the architect recommend?
A. One Anypoint VPC with a separate dedicated load balancer for each estate.
B. One Anypoint VPC with each estate assigned to a different availability zone.
C. One Anypoint VPC with a separate environment name and application naming prefix for each estate.
D. Separate Anypoint VPCs for the estates, with their respective environments associated to them.

Accepted Answer

Correct answer: D. Separate Anypoint VPCs for the estates, with their respective environments associated to them.
An Anypoint VPC provides the isolated virtual network, and multiple environments can be associated with that network. Separate VPCs therefore establish the requested network boundaries. Environment names and application prefixes do not subdivide one VPC into separate virtual networks. Dedicated load balancers and availability zones serve other purposes within the deployment topology; neither replaces the separate VPC boundaries in this design.

Question 13

Cumulus Financial has equivalent CloudHub 1.0 applications and traffic failover in a backup region. The remaining design assumes the primary region's Object Store v2 and Anypoint VPC automatically fail over with them. Which two responsibilities must the platform architect add? Choose 2 answers.
A. Design replication or backup of required external application state because Object Store v2 has no cross-region failover.
B. Provision an Anypoint VPC in each region where the recovery applications need private network connectivity.
C. Keep the primary region's VPC and object store as the only instances, treating backup-region application deployment as sufficient recovery.
D. Configure DNS failover for the application endpoints and rely on that switch to restore private network connectivity in the backup region.
E. Treat a regionally persistent object store as a globally replicated store requiring no recovery design.

Accepted Answer

Correct answer: A. Design replication or backup of required external application state because Object Store v2 has no cross-region failover. | B. Provision an Anypoint VPC in each region where the recovery applications need private network connectivity.
The CloudHub HA/DR guide assigns customers responsibility for cross-region external state recovery and VPC deployment in each region requiring connectivity. Object Store v2 is regional and does not provide cross-region failover, while an Anypoint VPC also applies at region level. Deploying equivalent applications elsewhere does not make those dependencies regional replicas. DNS-based traffic failover does not provision the backup region's private network, and persistence within a region is not global replication.

Question 14

Bloomington Caregivers enables CloudHub 1.0 persistent queues to protect queued work during worker failures. A design review now claims the setting also guarantees each message can be delivered only once. Which assessment should the platform architect make?
A. Accept it because every persistent-queue consumer shares a transaction with the application's HTTP client.
B. Accept it because persistent storage removes all possibilities of a queue redelivering a message.
C. Reject it because persistent queues can deliver duplicates and do not guarantee one-time-only delivery.
D. Accept it when only one worker consumes the queue, because duplicates require concurrent consumption by multiple workers.

Accepted Answer

Correct answer: C. Reject it because persistent queues can deliver duplicates and do not guarantee one-time-only delivery.
CloudHub persistent queues protect queued work, but the documentation explicitly warns that duplicate messages can be sent and one-time-only delivery is not guaranteed. Persistence therefore does not establish exactly-once delivery. Enabling the setting does not create a transaction spanning arbitrary HTTP clients. Limiting consumption to one worker does not turn the documented persistent-queue delivery behavior into an exactly-once guarantee; the limitation is not restricted to simultaneous consumers.

Question 15

Cumulus Financial's API client uses an RFC 9111-compliant cache. A stored response has Cache-Control: max-age=60, must-revalidate and a current age of 80 seconds. The origin cannot be contacted, and no other error status is more applicable. Which response should the architect expect from the cache?
A. Return an error, normally 504, rather than reuse the expired representation.
B. Return the stored body with 203 so its status makes revalidation optional.
C. Return the stored body with 200 because disconnection permits stale reuse.
D. Reset the age to zero and reuse the body for another 60-second interval.

Accepted Answer

Correct answer: A. Return an error, normally 504, rather than reuse the expired representation.
Once this response is stale, must-revalidate prohibits reuse until successful origin validation. A disconnected cache must generate an error, normally 504 when no other error status applies. Disconnection can permit stale reuse in other circumstances, but it does not override this directive. Changing the status to 203 does not validate the representation, and resetting Age would misrepresent its origin-relative age.

Question 16

A Cumulus Financial HTTP client receives 421 Misdirected Request from an origin while using a reused connection. Its request is a non-idempotent POST, and the architect is reviewing the recovery specifically permitted by RFC 9110 for this status. Which recovery may the client attempt?
A. Resend the request on the same connection because 421 certifies that its origin binding is correct.
B. Change POST to GET on the same URI because 421 requires a safe replacement method.
C. Retry over a different connection suitable for the target origin, even for this method.
D. Change the target URI to the connection host because 421 is a permanent resource redirect.

Accepted Answer

Correct answer: C. Retry over a different connection suitable for the target origin, even for this method.
RFC 9110 explicitly permits retrying a 421 response over a different connection, whether or not the method is idempotent. The status identifies a request directed to a server that cannot or will not give an authoritative response in that origin or connection context. Reusing the same unsuitable connection does not address that issue, and changing POST to GET would change the operation. A 421 is not a permanent redirect authorizing a different resource URI.

Question 17

AW Computing has access to Mule API Analytics reports. A successful response is a non-String DataWeave stream with no Content-Length header, and the event report shows Response Size as -1. An analyst interprets that value as a negative or empty payload. What should the architect explain?
A. The value is a negative byte adjustment that must be subtracted from the previous event's measured size.
B. The field reports the request's size instead, so the response body type and headers have no effect.
C. The analytics service could not determine the response size under those header and payload conditions.
D. The value proves the application sent an empty response body despite returning a success code.

Accepted Answer

Correct answer: C. The analytics service could not determine the response size under those header and payload conditions.
The Analytics Event report uses Content-Length when present and otherwise calculates length when the payload is a String. With no Content-Length and a non-String payload, it reports -1 instead of a measured response size. That sentinel does not prove the body was empty or represent a negative-byte adjustment. The field describes the response rather than substituting the incoming request size.

Question 18

Get Cloudy Consulting is setting a Server Thread count alert for a local Mule server. Its capacity spreadsheet contains operating-system thread totals, Java thread counts, and a configured executor-pool maximum. Which quantity should the architect match to this Runtime Manager condition?
A. The combined thread count of every process on the operating-system host.
B. The configured maximum size of one Mule executor pool, even if that many threads have not been created.
C. Only threads currently executing a Mule flow processor, excluding other JVM threads.
D. The thread count on the JVM, compared with the chosen level for the specified period.

Accepted Answer

Correct answer: D. The thread count on the JVM, compared with the chosen level for the specified period.
Runtime Manager defines Server Thread count as the thread count on the JVM above or below a configured level for a period. A configured pool maximum is a capacity setting, not the JVM's measured thread count. Host-wide threads include other processes outside that JVM. Restricting the count to threads actively executing Mule flow processors would also narrow the documented scope.

Free Salesforce MuleSoft Platform Architect
Practice Questions

What is the MuleSoft Platform Architect exam like?

Questions by exam section

Explaining application network basics

Question 1 · Medium

Establishing organizational and platform foundations

Question 2 · Harder · Choose 2

Question 3 · Medium

Designing APIs using System, Process, and Experience Layers

Question 6 · Easier

Question 7 · Medium

Governing web APIs on Anypoint Platform

Question 8 · Medium

Question 9 · Medium

Question 10 · Medium

Architecting and deploying API implementations

Question 11 · Medium

Question 12 · Medium

Deploying API implementations to CloudHub

Question 13 · Medium · Choose 2

Question 14 · Easier

Meeting API quality goals

Question 15 · Easier

Question 16 · Medium

Monitoring and analyzing application networks

Question 17 · Medium

Question 18 · Easier

Where to go after these 18 questions

Get MuleSoft Platform Architect exam updates by email

Ready for a full MuleSoft Platform Architect practice exam?

Free Salesforce MuleSoft Platform ArchitectPractice Questions