Practice Free Mule-Dev-301 Salesforce Certified MuleSoft Developer II Exam Questions Answers With Explanation

A process that can require up to 24 hours is inherently asynchronous. The initiating Mule application should not keep an HTTP connection open until the remote system completes. Instead, Mule should initiate the process, return or continue independently, and expose an HTTP callback endpoint that the external system invokes when processing finishes.

The callback URL is registered with the external system so that completion data can be pushed back to Mule. This separates request initiation from completion notification and avoids tying up network connections or execution resources for an unpredictable duration. Callback-based processing is a standard asynchronous integration mechanism; MuleSoft documentation uses callback endpoints extensively where a remote system must later contact a Mule application.

Polling every minute is inefficient over a possible 24-hour interval and can generate large volumes of unnecessary requests. An Async scope does not transform a fundamentally synchronous HTTP request into a 24-hour callback model; the downstream HTTP connection would still be governed by response and connection timeout behavior. Waiting synchronously is even less appropriate.

Therefore, exposing a Mule HTTP callback API and registering it with the external system provides the most scalable and reliable architecture.

Reference topics: asynchronous integration; callback APIs; HTTP Listener; long-running processes; event-driven completion notification.

Official documentation: https://docs.mulesoft.com/http-connector/latest/http-authentication

===============================================================

API Autodiscovery is what pairs a Mule application with a particular API Manager instance. The apiId in the Autodiscovery configuration identifies the managed API from which the runtime obtains API configuration and policies. Therefore, using an environment-specific configuration for local development prevents the locally running application from binding to the production API instance and consequently prevents those production policies from governing local test traffic.

This is different from setting anypoint.platform.gatekeeper=disabled. Gatekeeper controls whether a managed API is blocked while policy information is unavailable or being synchronized; disabling Gatekeeper is not equivalent to disabling API Manager policies. Policies can still be downloaded and applied when the application remains paired through Autodiscovery.

Running the application unchanged is also incorrect because a locally executed Mule runtime can connect to API Manager when Autodiscovery and platform credentials are configured. MuleSoft explicitly documents local Autodiscovery for policy testing. Deactivating the shared API is likewise inappropriate because it modifies centrally managed configuration rather than isolating the developer's local environment.

Reference topics: API Autodiscovery; API Instance ID; Environment-specific Configuration; Mule Gateway Gatekeeper.

Official documentation: https://docs.mulesoft.com/mule-gateway/mule-gateway-autodiscovery-overview

===============================================================

Mutual TLS requires authentication in both directions. The Mule HTTP Listener acts as the TLS server, so it needs a keystore containing its private key and associated server certificate. This allows the listener to prove its identity to the connecting client.

For mTLS, the server must additionally authenticate the client certificate. Therefore, the TLS context also requires an appropriate truststore containing the certificate authorities or certificates that the application trusts when validating client certificates.

MuleSoft's TLS documentation provides a two-way authentication example for an HTTP Listener containing both < tls:trust-store > and < tls:key-store > inside the TLS context. MuleSoft's HTTP Listener documentation likewise states that HTTPS requires a keystore for the server and a truststore when two-way authentication is required.

Persistent connections affect HTTP connection reuse and performance, not certificate authentication. A reconnection strategy likewise does not provide the cryptographic identity material required for mTLS.

Therefore, an HTTP Listener configured for mutual TLS requires the correct keystore and truststore configuration.

Reference topics: Mule TLS Context; HTTP Listener HTTPS; keystores; truststores; mutual TLS/two-way authentication.

Official documentation: https://docs.mulesoft.com/mule-runtime/4.6/tls-configuration

Official documentation: https://docs.mulesoft.com/http-connector/latest/http-listener-ref

===============================================================

API access requested by a client application is represented through a contract between that application and an API instance or API Group instance. When manual approval is required, the administrator must possess both the relevant contract configuration and sufficient API Manager authority.

MuleSoft's API Manager documentation identifies two prerequisites for manually approving or rejecting an access request. First, an SLA tier must be configured for the application. Second, the user performing the approval must be an Organization Administrator, an API Manager Environment Administrator, or possess the Manage Contracts permission.

The Manage Contracts permission specifically grants the ability to manage contracts and their associated tiers within the API Manager environment. Exchange Administrator permissions alone do not satisfy this API Manager contract-management requirement.

The SLA component is also significant. API Manager contracts can govern access based on an SLA tier, allowing the API owner to determine permitted consumption levels and whether approval is automatic or manual.

Option C therefore contains the complete combination required by the platform: the application's SLA tier configuration plus appropriate administrative or contract-management authority.

Reference topics: API Manager Contracts; Client Applications; SLA Tiers; Manage Contracts permission; API access approval.

Official documentation: https://docs.mulesoft.com/api-manager/latest/manage-client-apps-latest-task

Official documentation: https://docs.mulesoft.com/api-manager/latest/environment-permission-task

===============================================================

MuleSoft provides the JSON Module specifically for operations such as JSON validation. The application should include the JSON Module as a Mule dependency and place its Validate schema operation before the connector or operation that posts the data to the target system.

The Validate schema operation receives the JSON document and evaluates it against the configured JSON Schema. When validation succeeds, processing continues to the next processor. If the payload does not conform, Mule raises JSON:SCHEMA_NOT_HONOURED, allowing the flow's error-handling strategy to reject or transform the invalid request before the target system is modified.

MuleSoft also documents that modules/connectors added manually to an application are declared in pom.xml as dependencies with the mule-plugin classifier; the JSON Module follows this standard pattern.

DataWeave conditional validation would unnecessarily reimplement schema semantics and would not automatically interpret a JSON Schema. API Manager does not provide the application-level JSON Module operation described by this requirement, and import json-module is not a valid mechanism for invoking the Mule JSON Module from DataWeave.

Reference topics: JSON Module; Validate Schema; JSON Schema; JSON:SCHEMA_NOT_HONOURED; Maven module dependency.

Official documentation: https://docs.mulesoft.com/json-module/latest/json-schema-validation

Official documentation: https://docs.mulesoft.com/json-module/latest/json-xml-maven

===============================================================

Secure property management should isolate development, test, staging, and production environments rather than allowing secrets from one environment to provide access to another. MuleSoft's Secure Configuration Properties model supports this by using environment-specific property files—for example dev.secure.yaml, sandbox.secure.yaml, and prod.secure.yaml—and resolving the appropriate file through an environment property.

Sensitive values such as passwords, API credentials, and private service configuration should therefore be environment-specific. Production credentials should not normally be reused in development or testing. The encryption key used to protect those values should likewise be independently managed rather than shared broadly across security boundaries. This limits the impact if a non-production key or properties file is exposed.

The Secure Properties Tool encrypts the sensitive values using a supplied key, while the Mule runtime receives the corresponding decryption key separately at deployment/runtime. MuleSoft also emphasizes protecting that key rather than embedding it directly in application configuration.

Accordingly, the Developer II security model represented by this question expects both different sensitive property values and different encryption keys across environments.

Reference topics: Secure Configuration Properties; environment-specific secure files; encryption keys; secret isolation; deployment security.

Official documentation: https://docs.mulesoft.com/anypoint-code-builder/int-create-secure-configs

===============================================================

Mule's Cache scope is backed by a caching strategy, commonly using an Object Store. The caching strategy can directly configure expiration characteristics, including entry time to live (TTL). Once the TTL expires and the corresponding expiration processing occurs, cached entries are removed according to the configured Object Store policy without requiring application-specific invalidation logic.

MuleSoft's cache strategy documentation shows that the Object Store used by a caching strategy can define values such as entryTtl, expirationInterval, and maximum entries. A Cache component can then reference that strategy and automatically use those expiration settings.

Write-through and write-behind describe cache/database synchronization strategies in which cache updates are coordinated with writes to an underlying persistent data source. Mule's standard Cache scope does not automatically implement those patterns as an invalidation mode. Notification-based invalidation would similarly require external notification logic or explicit Mule processing to identify and invalidate affected keys.

TTL requires no such custom invalidation workflow. The developer establishes the lifetime when configuring the caching Object Store, after which Mule manages expiration automatically.

Therefore, Time to live is the cache invalidation mechanism directly available through standard Cache scope configuration.

Reference topics: Cache Scope; Object Store Caching Strategy; entryTtl; expirationInterval; automatic cache expiration.

Official documentation: https://docs.mulesoft.com/mule-runtime/latest/cache-scope-strategy

===============================================================

Java keytool -importkeystore converts a keystore by explicitly defining both the source keystore and its format and the destination keystore and its required format. To convert JKS ? PKCS12, the source must therefore be the JKS file with -srcstoretype JKS, while the destination must be the .p12 file with -deststoretype PKCS12.

MuleSoft provides the same conversion pattern in its TLS-related documentation. Its example for converting a JKS client keystore to P12 uses -srckeystore ...jks, -srcstoretype JKS, followed by -destkeystore ...p12 and -deststoretype PKCS12.

Mule supports JKS, PKCS12, and other keystore types for TLS configurations, but the configured file type must correspond correctly to the actual keystore encoding.

Option A reverses the declared store types even though the filenames suggest JKS-to-P12 conversion. Option C performs the opposite conversion, PKCS12 to JKS. Option D incorrectly identifies a .p12 source as JKS and does not correctly express the required source/destination relationship.

Thus, option B contains the correct source and destination formats.

Reference topics: TLS configuration; Java Keytool; JKS; PKCS12; keystore conversion.

Official documentation: https://docs.mulesoft.com/runtime-manager/rtm-agent-REST-connections

Official documentation: https://docs.mulesoft.com/mule-runtime/4.9/tls-configuration

===============================================================

The Mule Maven Plugin's CloudHub 2.0 deployment configuration supports a top-level < secureProperties > element. Properties supplied through this element are treated differently from ordinary deployment properties: CloudHub 2.0 encrypts their values before storing them.

MuleSoft's deployment documentation explicitly states that < secureProperties > is used to set application properties and instruct CloudHub 2.0 to encrypt the values before storing them. This is particularly appropriate for TLS credentials such as keystore passwords because these values should not be persisted as ordinary clear-text application configuration.

The important distinction is between encryption and UI masking. A masked field merely hides its visual representation; it does not by itself establish protected storage. In CloudHub 2.0, protected property values are stored securely and are not retrievable as plain values through Runtime Manager. Anypoint Studio is also not the component responsible for protecting a value supplied through the CloudHub deployment configuration, nor is this deferred to the Mule application's runtime flow.

Therefore, with the property placed under the Mule Maven Plugin's < secureProperties > configuration, CloudHub encrypts the value.

Reference topics: CloudHub 2.0 deployment; Mule Maven Plugin; secure properties; protected application configuration.

Official documentation: https://docs.mulesoft.com/mule-runtime/4.6/deploy-to-cloudhub-2

Official documentation: https://docs.mulesoft.com/cloudhub-2/ch2-protect-app-props

===============================================================

Anypoint MQ implements publish/subscribe fan-out by publishing a message to a message exchange and binding multiple queues to that exchange. Each subscribing application consumes from its own queue. As a result, a single gate-change event published by the Flight Management System can be copied to the Baggage Handler, Inflight Catering, and Passenger Notification queues independently.

MuleSoft documents that messages sent to an exchange are delivered to its bound queues and specifically describes exchanges as the mechanism for distributing one published message to multiple applications. A consumer does not directly consume from the exchange; consumption occurs from a queue. In fact, MuleSoft states that attempts to consume from a message exchange are rejected because the destination for consumption must be a queue.

Having all systems consume from one queue would instead create competing consumers: individual messages would normally be processed by one consumer rather than independently delivered to every subscribing system.

The required architecture is therefore: publisher ? exchange ? multiple bound queues ? independent subscribers. This supplies asynchronous fan-out while preserving subscriber isolation and independent consumption.

Reference topics: Anypoint MQ exchanges; queue bindings; publish/subscribe; asynchronous event distribution.

Official documentation: https://docs.mulesoft.com/mq/

Official documentation: https://docs.mulesoft.com/mq/mq-exchanges

===============================================================

A TLS cipher suite defines the cryptographic algorithms that the communicating parties use to protect the connection. During TLS negotiation, the client advertises cipher suites that it supports and the server selects a mutually supported suite according to the protocol version and its security configuration.

In TLS 1.2 and earlier, a cipher-suite name can identify several cryptographic components, including key-exchange/authentication mechanisms, the symmetric encryption algorithm, and integrity protection. TLS 1.3 expresses cipher suites differently, but the negotiated suite still determines the authenticated-encryption algorithm used to protect application traffic. MuleSoft's TLS documentation exposes cipher-suite configuration directly, including suites based on AES-GCM and ChaCha20-Poly1305.

The TLS protocol version is negotiated as part of the broader handshake but is conceptually distinct from choosing a cipher suite. Likewise, a public-key format is not what the cipher-suite exchange fundamentally selects, and "a protocol" is too general.

Among the provided choices, an encryption algorithm is therefore the technically correct description of what the cipher-suite negotiation establishes for protecting the session.

Reference topics: TLS handshake; cipher suites; symmetric encryption; AES-GCM; mTLS cryptographic negotiation.

Official documentation: https://docs.mulesoft.com/anypoint-security/cipher-suites

===============================================================

Option C is directly supported by the MuleSoft XML SDK documentation. MuleSoft defines an XML SDK property as a field supplied by an end user of the component that operates at the module configuration level. Unlike an operation parameter, which applies to one operation invocation, properties configure the XML SDK component across the Mule project in which that configuration is used.

The other choices conflict with documented XML SDK behavior. XML SDK operations do not support recursive calls, so A is false. XML SDK provides outbound operations but does not provide inbound message sources such as schedulers, making B false.

Option D also requires correction. Current XML SDK versions support a visibility setting with values including PUBLIC and PRIVATE; the default is public, but operations are not universally required to remain public. MuleSoft's current XML SDK reference explicitly documents private operation visibility.

Therefore, C is the technically correct and directly documented statement. This is one question where the option selected in the supplied source should not be accepted without verification.

Reference topics: XML SDK Properties; Operations; module configuration; operation visibility; XML SDK limitations.

Official documentation: https://docs.mulesoft.com/mule-sdk/latest/xml-sdk

Official documentation: https://docs.mulesoft.com/mule-sdk/latest/

===============================================================

PGP uses asymmetric cryptography for establishing confidentiality between a sender and a recipient. When the Mule application sends encrypted information to the backend service, it encrypts the content using the recipient's public key. Only the corresponding private key, retained by the backend recipient, can subsequently be used to decrypt that content.

MuleSoft's Cryptography Module documentation explicitly identifies the two principal PGP scenarios: outgoing encryption uses another party's public key, while incoming decryption uses the receiver's own private key. In a Mule application, the backend's public key is normally imported into a PGP public keyring, and the Cryptography Module's PGP Encrypt operation references the appropriate key or fingerprint.

The sender does not need the backend's private key. In fact, distributing the recipient's private key would defeat the fundamental security model of public-key cryptography. Both keys would be relevant for certain combined operations such as encryption plus signing, but ordinary encryption for confidentiality requires the recipient's public key. HTTPS/TLS may additionally protect transport, but it is separate from PGP payload encryption.

Reference topics: Cryptography Module; PGP Encryption; Public and Private Keyrings; PGP Encrypt Operation.

Official documentation: https://docs.mulesoft.com/cryptography-module/latest/cryptography-module-pgp

===============================================================