Governing web APIs on Anypoint Platform17% of the exam
Security Policy Selection and Enforcement
Match security policies to credential types, provider relationships and enforcement requirements, including token freshness, directory search, trusted network identity and rotating verification keys.
Select appropriate API policies to enforce non-functional security constraints on web API invocations.
~7 min read · 7 practice questions
What the exam expects
- Match token enforcement to the configured identity provider and token representation.
- Separate token freshness, application contracts and downstream metadata exposure.
- Choose directory authentication and the search scope required by the user population.
- Configure network restrictions for the verified client address and intended operations.
- Retrieve rotating JWT verification keys without confusing keys with claims.
An enforcement policy checks requests rather than issuing credentials; introspection obtains token-validation information; JWKS supplies verification keys; an LDAP search scope bounds directory traversal; an IP expression selects the address being evaluated (OIDC enforcement, JWT Validation, LDAP, IP Allowlist).
Key facts
Mule provider policy
- Detail
- Its validation endpoint does not make it compatible with unrelated providers.
OIDC enforcement
- Detail
- Validates tokens; does not issue them.
Cache disabled
- Detail
- Startup cache capacity zero disables token caching.
Metadata exposure
- Detail
- Expose Headers governs forwarding user properties to the backend.
Directory identity
- Detail
- LDAP checks supplied user credentials in the configured directory context.
Search traversal
- Detail
- Subtree includes base and descendants; one level excludes the base and deeper descendants.
Network restriction
- Detail
- IP expression and method/resource conditions configure different dimensions.
Rotating keys
- Detail
- JWKS URL and cache lifetime govern retrieving the published set again.
- When Basic Authentication: Simple rejects credentials on a WSDL SOAP 1.1 API, which status does its reference list?
- When the OIDC policy caches validated OAuth tokens, where are those tokens stored?
- Why does an allowlist not require entering every complete host address separately?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the MuleSoft Platform Architect pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 47 lessons of the MuleSoft Platform Architect guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Practice exams purchase adds inline bank questions and topic practice (7 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Choose guide-only, practice-only, or save $4 with both