Exam MCPA - Level 1 topic 1 question 1 discussion

There is no hard and fast rule to apply fix policy to fix layer of API in API-Led connectivity approach. It totally depends on your Organization and the consumer of Experience APIs. But Yes There are couple of recommendation given by MuleSoft team. Let me cite for you. For Exp API IP Whitelisting TLS Mutual (Either through DLB) SLA Based Policy i.e Rate Limiting XML/JSON Threat protection Client Id Enforcement OAuth based Policy JWT based For Process API: SLA Based Rate Limiting to apply Quality of Service for Selected tier IP Whitelisting Rate Limiting Spike Control If you are directly exposing the process API to consumer you can go ahead with the same policy like Experience API

There is no hard and fast rule to apply fix policy to fix layer of API in API-Led connectivity approach. It totally depends on your Organization and the consumer of Experience APIs. But Yes There are couple of recommendation given by MuleSoft team. Let me cite for you. For Exp API IP Whitelisting TLS Mutual (Either through DLB) SLA Based Policy i.e Rate Limiting XML/JSON Threat protection Client Id Enforcement OAuth based Policy JWT based For Process API: SLA Based Rate Limiting to apply Quality of Service for Selected tier IP Whitelisting Rate Limiting Spike Control If you are directly exposing the process API to consumer you can go ahead with the same policy like Experience API Answer D

D. JSON threat protection

And why not C (Rate Limiting)? Since we are talking about a Process API, that can be consumed by several Experience APIs and even other Process APIs, I believe we don't want to reject any request if a certain limit is achieved. In resume, in my point of view a Process API should always be available and not with a limited access to.

D. JSON threat protection

Should be D. JSON threat protection is usually needed for Experience APIs.

Answer: D

Yes Anshwer should be D as JSON threat protection is usually needed on Exp APIs that can least ranked on Process APIs

Ans should be D, option A doesnt even exists in Policy