Pass the Salesforce Salesforce MuleSoft Mule-Dev-301 Questions and answers with CertsForce

PGP uses asymmetric cryptography for establishing confidentiality between a sender and a recipient. When the Mule application sends encrypted information to the backend service, it encrypts the content using the recipient's public key. Only the corresponding private key, retained by the backend recipient, can subsequently be used to decrypt that content.

MuleSoft's Cryptography Module documentation explicitly identifies the two principal PGP scenarios: outgoing encryption uses another party's public key, while incoming decryption uses the receiver's own private key. In a Mule application, the backend's public key is normally imported into a PGP public keyring, and the Cryptography Module's PGP Encrypt operation references the appropriate key or fingerprint.

The sender does not need the backend's private key. In fact, distributing the recipient's private key would defeat the fundamental security model of public-key cryptography. Both keys would be relevant for certain combined operations such as encryption plus signing, but ordinary encryption for confidentiality requires the recipient's public key. HTTPS/TLS may additionally protect transport, but it is separate from PGP payload encryption.

Reference topics: Cryptography Module; PGP Encryption; Public and Private Keyrings; PGP Encrypt Operation.

Official documentation: https://docs.mulesoft.com/cryptography-module/latest/cryptography-module-pgp

===============================================================

The relevant property is the HTTP semantics of PUT. PUT is designed to be idempotent: repeating the same request against the same resource should establish the same intended resource state rather than repeatedly creating additional side effects. This characteristic makes PUT appropriate when an Until Successful scope might retransmit an operation following a transient failure.

For example, the downstream system might process the initial PUT successfully but the Mule application might experience a network error before receiving the response. Until Successful could therefore invoke the same PUT again. Provided the upstream APIs correctly implement standard PUT semantics, repeating the same modification produces the intended final state rather than duplicating the operation.

Changing PUT to POST would generally make the design less suitable because POST is not inherently idempotent. Executing the operations sequentially changes concurrency but does not itself establish idempotency. Compensating transactions address distributed rollback and consistency when independent operations partially succeed; they are a different reliability concern from idempotent retry behavior.

MuleSoft documents Until Successful as retrying the contained processors until they succeed or retries are exhausted.

Therefore, under the REST/HTTP semantics assumed by the question, no additional Mule processing is required.

Reference topics: Until Successful; idempotent operations; HTTP PUT semantics; reliable retries; Scatter-Gather.

Official documentation: https://docs.mulesoft.com/mule-runtime/latest/until-successful-scope

===============================================================

API Autodiscovery pairs a Mule API implementation with an API instance managed in API Manager. The global autodiscovery element requires the API instance identifier and a flowRef that identifies the flow where API Gateway policy enforcement begins.

MuleSoft explicitly states that flowRef must reference a flow containing an HTTP Listener. The referenced flow represents the inbound API entry point receiving the requests against which API Manager policies are enforced. Connectors that merely use HTTP internally are not sufficient for this requirement.

In an APIkit-generated application, the appropriate flow is typically the main API flow that contains the HTTP Listener and APIkit Router. Individual generated resource/operation flows execute later after routing; they are not the primary inbound policy-enforcement point. Similarly, the APIkit Console flow is intended for interactive API documentation/testing and should not be used as the flowRef for production policy enforcement.

The attribute is not simply supplied dynamically at runtime. It is part of the Mule application's Autodiscovery configuration and identifies the exact listener-based flow paired to API Manager.

Therefore, flowRef must identify the flow containing the HTTP Listener that receives the REST API's incoming requests.

Reference topics: API Autodiscovery; api-gateway:autodiscovery; flowRef; HTTP Listener; API Manager policy enforcement.

Official documentation: https://docs.mulesoft.com/mule-gateway/mule-gateway-config-autodiscovery-mule4

===============================================================

Anypoint Monitoring provides connector-level performance metrics without requiring additional application logging or custom instrumentation. For supported connectors, these statistics are accessible from the application's monitoring interface through the Connectors tab.

MuleSoft's documentation specifies that connector monitoring includes Requests, which reports the average number of connector requests over automatically selected intervals, and Response Time, which reports the average response time for connector requests. To access these metrics, the documented procedure is to open Anypoint Monitoring, select the relevant Mule application resource, and open the Connectors view.

Because these metrics are generated by the monitoring platform, examining raw logs is unnecessary. A custom dashboard may be useful when creating specialized operational visualizations, but it is not required simply to obtain standard connector request and response-time measurements. Modifying the Salesforce System API to manually log this information would also duplicate functionality already supplied by Anypoint Monitoring and increase application complexity.

The question additionally identifies Titanium support, which aligns with availability of connector monitoring capabilities described by MuleSoft.

Therefore, the correct procedure is to use the built-in Anypoint Monitoring dashboard and inspect the Connectors tab.

Reference topics: Anypoint Monitoring; connector performance metrics; built-in dashboards; request count; response time; Salesforce Connector.

Official documentation: https://docs.mulesoft.com/monitoring/monitor-connectors

===============================================================

The HTTP Request connector is operating as a TLS client when it connects to the target HTTPS API. During the TLS handshake, the server presents its certificate chain. The client must be able to establish a chain of trust from that certificate to a trusted certificate authority.

When no custom Mule truststore is configured, Mule relies on the default Java/JRE truststore. MuleSoft explicitly states that if a tls:trust-store is not specified, Mule uses Java's default truststore, which normally contains certificates for major public certificate authorities.

Therefore, the target API connection succeeds when the issuing CA can be validated through that JRE truststore, assuming the remainder of the TLS negotiation is valid. A keystore serves a different purpose: it normally contains a private key and certificate used to establish the local party's own identity. It is not the default repository used to establish trust in remote HTTPS servers.

The connection also does not automatically trust every CA. Certificate validation still occurs unless validation is explicitly disabled.

Therefore, B correctly describes Mule's behavior when the HTTP Request configuration has no custom TLS truststore configured.

Reference topics: HTTP Request Connector; TLS client validation; Java default truststore; CA certificate chains; keystore versus truststore.

Official documentation: https://docs.mulesoft.com/mule-runtime/4.4/tls-configuration

===============================================================

Object Store v2 is suitable for distributed key/value state that must be available across CloudHub executions and replicas, but it should not be used to hold the complete contents of files larger than its per-value limit. MuleSoft documents that an Object Store v2 value is limited to 10 MB, while the overall store does not have a fixed aggregate size limit.

The appropriate architecture is therefore to persist the binary file itself in storage designed for large objects—for example, a durable external object/blob storage service—and store only lightweight metadata in Object Store v2. That metadata can include the object's storage key, URI/location, status, or other lookup information. Subsequent flow executions can query Object Store v2 to determine whether the object exists and then retrieve the actual file from the external storage system.

An in-memory Object Store is inappropriate because application replicas do not provide a durable shared in-memory persistence model for this requirement. Storing the entire file directly in Object Store violates the 10 MB value constraint. Local file-based storage is also unsuitable as a cross-replica CloudHub persistence mechanism.

Reference topics: Object Store v2 limits; CloudHub replicas; distributed persistence; external object storage; key/location metadata.

Official documentation: https://docs.mulesoft.com/object-store/osv2-faq

===============================================================

API access requested by a client application is represented through a contract between that application and an API instance or API Group instance. When manual approval is required, the administrator must possess both the relevant contract configuration and sufficient API Manager authority.

MuleSoft's API Manager documentation identifies two prerequisites for manually approving or rejecting an access request. First, an SLA tier must be configured for the application. Second, the user performing the approval must be an Organization Administrator, an API Manager Environment Administrator, or possess the Manage Contracts permission.

The Manage Contracts permission specifically grants the ability to manage contracts and their associated tiers within the API Manager environment. Exchange Administrator permissions alone do not satisfy this API Manager contract-management requirement.

The SLA component is also significant. API Manager contracts can govern access based on an SLA tier, allowing the API owner to determine permitted consumption levels and whether approval is automatic or manual.

Option C therefore contains the complete combination required by the platform: the application's SLA tier configuration plus appropriate administrative or contract-management authority.

Reference topics: API Manager Contracts; Client Applications; SLA Tiers; Manage Contracts permission; API access approval.

Official documentation: https://docs.mulesoft.com/api-manager/latest/manage-client-apps-latest-task

Official documentation: https://docs.mulesoft.com/api-manager/latest/environment-permission-task

===============================================================

API Autodiscovery is what pairs a Mule application with a particular API Manager instance. The apiId in the Autodiscovery configuration identifies the managed API from which the runtime obtains API configuration and policies. Therefore, using an environment-specific configuration for local development prevents the locally running application from binding to the production API instance and consequently prevents those production policies from governing local test traffic.

This is different from setting anypoint.platform.gatekeeper=disabled. Gatekeeper controls whether a managed API is blocked while policy information is unavailable or being synchronized; disabling Gatekeeper is not equivalent to disabling API Manager policies. Policies can still be downloaded and applied when the application remains paired through Autodiscovery.

Running the application unchanged is also incorrect because a locally executed Mule runtime can connect to API Manager when Autodiscovery and platform credentials are configured. MuleSoft explicitly documents local Autodiscovery for policy testing. Deactivating the shared API is likewise inappropriate because it modifies centrally managed configuration rather than isolating the developer's local environment.

Reference topics: API Autodiscovery; API Instance ID; Environment-specific Configuration; Mule Gateway Gatekeeper.

Official documentation: https://docs.mulesoft.com/mule-gateway/mule-gateway-autodiscovery-overview

===============================================================