I85PREP
⌘ K
Boomi API Management study materials
Boomi API Management study resources

Boomi API Management practice questions

One question at a time. Build your Boomi API Management understanding.

First 50 of 199 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1API Management

In Boomi API Management, what is the primary role of an API Gateway component?

  1. It generates the API's documentation portal theme
  2. It compiles JavaScript custom scripts at build time
  3. It stores the API's OpenAPI document for versioning
  4. It enforces policies and routes incoming requests to the appropriate backend service Correct answer.

Explanation

An API Gateway sits between consumers and backend services, applying authentication, rate limiting, transformation, and routing policies before forwarding traffic. It is the runtime enforcement point rather than a documentation or storage tool.

Question 2API Management

Which Boomi component must be created before you can publish an API to a developer portal?

  1. A trading partner agreement
  2. A message queue listener
  3. An API component defining the endpoint and operations Correct answer.
  4. A process reporting schedule

Explanation

The API component holds the endpoint definition, operations, and policies that the gateway will enforce. Publishing to a portal requires an existing API component to expose.

Question 3API Management

A developer wants external consumers to authenticate with an OAuth 2.0 bearer token before reaching a backend operation. Which API Management capability applies?

  1. A process-level try/catch shape
  2. A document cache configured on the gateway
  3. An authentication policy configured on the API operation Correct answer.
  4. A connector operation configured for the backend

Explanation

Authentication policies attached to API operations validate credentials such as OAuth tokens at the gateway before the request is forwarded. This keeps credential enforcement outside the backend logic.

Question 4API Management

What does an API's developer portal primarily provide?

  1. A runtime engine that executes transformation maps
  2. A self-service site where consumers read documentation and request keys Correct answer.
  3. A tool for scheduling batch integrations
  4. A repository for storing process logs

Explanation

The developer portal is the consumer-facing surface that presents API documentation, interactive references, and key or application registration. It does not execute runtime logic itself.

Question 5API Management

Which HTTP method is conventionally used by an API operation that creates a new resource?

  1. GET
  2. HEAD
  3. POST Correct answer.
  4. OPTIONS

Explanation

POST is used to create resources or submit data for processing, with the new resource typically returned or referenced in the response. GET and HEAD are safe read operations, and OPTIONS describes communication options.

Question 6API Management

In Boomi API Management, what is the purpose of defining an API operation?

  1. It schedules a process to run nightly
  2. It defines the color scheme of the portal
  3. It maps a method and path to a backend action with its own policies Correct answer.
  4. It assigns a license to a runtime atom

Explanation

Each operation binds an HTTP method and path to a backend behavior, and policies can be applied per operation for granular control. This lets one API expose multiple endpoints with distinct rules.

Question 7API Management

Which policy would you apply to limit each consumer to 100 requests per minute?

  1. A JSON-to-XML transformation policy
  2. A caching policy
  3. A rate limiting policy Correct answer.
  4. A CORS policy

Explanation

Rate limiting policies cap how many requests a consumer may make within a defined time window. They protect backend capacity and enforce fair usage across clients.

Question 8API Management

What is the main benefit of applying a response caching policy at the API gateway?

  1. It validates the consumer's OAuth scope
  2. It converts JSON responses to XML
  3. It reduces repeated backend calls for identical requests Correct answer.
  4. It encrypts the payload for transport

Explanation

Caching stores responses so that repeated identical requests can be served without hitting the backend, lowering latency and backend load. It does not handle encryption, authorization, or format conversion.

Question 9API Management

A team needs to expose an existing Boomi process as a REST endpoint for external partners. Which sequence best describes the required steps?

  1. Create the process, create an API component referencing it, deploy to a gateway, then publish to the portal Correct answer.
  2. Create the portal, create a queue, deploy the queue, then create the process
  3. Create an API component, create a trading partner, deploy to an atom, then schedule the API
  4. Create a transformation map, create an API component, deploy to a molecule, then publish

Explanation

The process provides the backend logic, the API component defines the endpoint and operations that reference it, deployment pushes the configuration to a gateway, and publication exposes it to consumers. Order matters because each step depends on the prior artifact.

Question 10API Management

Which policy type is used to validate that an incoming JSON request body conforms to a defined schema before reaching the backend?

  1. A CORS policy
  2. A request validation policy using a JSON schema Correct answer.
  3. A response caching policy
  4. A rate limiting policy

Explanation

Request validation policies check payloads against a schema so malformed or non-conforming requests are rejected at the gateway. This shields backend services from invalid input.

Question 11API Management

A consumer receives an HTTP 401 response from a Boomi-managed API. What does this status most directly indicate?

  1. The server encountered an unexpected internal error
  2. The requested resource does not exist
  3. The client exceeded its rate limit
  4. The request lacked valid authentication credentials Correct answer.

Explanation

HTTP 401 means the request was not successfully authenticated, so valid credentials must be supplied. It differs from 403, which indicates authenticated but unauthorized access.

Question 12API Management

What is the difference between API authentication and API authorization in Boomi API Management?

  1. Authentication encrypts traffic, while authorization compresses it
  2. Authentication verifies identity, while authorization determines which operations that identity may access Correct answer.
  3. Authentication applies to browsers, while authorization applies only to servers
  4. Authentication is configured in the portal, while authorization is configured in reporting

Explanation

Authentication establishes who the caller is, and authorization decides what that caller is permitted to do. Policies such as OAuth validation handle the former, while scope or role checks handle the latter.

Question 13API Management

A team wants browser-based single-page applications on a different origin to call their API. Which policy should they configure?

  1. A JSON schema validation policy
  2. A rate limiting policy
  3. A response caching policy
  4. A CORS policy allowing the trusted origin Correct answer.

Explanation

Cross-Origin Resource Sharing policies declare which origins, methods, and headers browsers may use when calling the API. Without the appropriate CORS headers, browsers block the response.

Question 14API Management

Which artifact in Boomi API Management defines the machine-readable contract that describes an API's paths, operations, and schemas?

  1. A trading partner document
  2. A process property
  3. An OpenAPI specification document Correct answer.
  4. A queue configuration

Explanation

The OpenAPI specification is the standard contract describing endpoints, operations, parameters, and schemas. Portals and tooling consume it to generate documentation and client code.

Question 15API Management

An API must transform an incoming XML payload into JSON before invoking a backend REST service. Where should this transformation be configured?

  1. In a request transformation policy on the API operation Correct answer.
  2. In the developer portal theme settings
  3. In the atom's JVM startup arguments
  4. In the process reporting configuration

Explanation

Request transformation policies modify the payload at the gateway before it is forwarded to the backend. This keeps format adaptation close to the API contract rather than buried in backend code.

Question 16API Management

What does deploying an API to a gateway environment accomplish?

  1. It permanently deletes prior API versions
  2. It converts the API into a batch process
  3. It activates the API configuration on the runtime that will serve requests Correct answer.
  4. It generates the OpenAPI document automatically

Explanation

Deployment pushes the API and its policies to a gateway runtime so that live traffic can be served under that configuration. The API is not callable until it is deployed to an environment.

Question 17API Management

A company wants to stage a new API version for internal testing while production traffic continues on the current version. What is the most appropriate approach?

  1. Disable the gateway until testing finishes
  2. Delete the production API and recreate it after testing
  3. Deploy the new version to a separate environment and keep the current version live in production Correct answer.
  4. Overwrite the production API in place and test with live traffic

Explanation

Environments isolate configurations so a new version can be tested without affecting production consumers. Once validated, the version can be promoted to production.

Question 18API Management

Which mechanism lets you control which consumer applications may call a specific API operation?

  1. Document cache settings
  2. API keys or OAuth scopes bound to applications Correct answer.
  3. Atom memory thresholds
  4. Process schedules

Explanation

Applications are registered and granted keys or scopes that determine which operations they may invoke. The gateway validates these credentials on each request.

Question 19API Management

What is the purpose of API versioning in Boomi API Management?

  1. It replaces the need for authentication policies
  2. It allows breaking changes to be introduced without disrupting existing consumers Correct answer.
  3. It encrypts all traffic to the gateway
  4. It automatically scales the gateway runtime

Explanation

Versioning lets a provider evolve an API while existing consumers continue using a stable contract. New behavior is exposed under a new version, and old versions can be retired on a schedule.

Question 20API Management

Which policy should be applied to strip or mask sensitive fields such as account numbers from a response before it leaves the gateway?

  1. A request validation policy
  2. A CORS policy
  3. A response transformation or masking policy Correct answer.
  4. A rate limiting policy

Explanation

Response transformation policies can remove or mask sensitive data after the backend responds and before the consumer receives it. This limits exposure of confidential fields.

Question 21API Management

A partner reports intermittent HTTP 429 responses during peak hours. What is the most likely cause?

  1. The backend database is offline
  2. The consumer is exceeding the configured rate limit for its application Correct answer.
  3. The API key has expired
  4. The OpenAPI document is missing a schema

Explanation

HTTP 429 means too many requests were sent within the allowed window, so the gateway throttled the caller. The fix is to raise the limit, smooth traffic, or implement retry with backoff.

Question 22API Management

Why might a team choose OAuth 2.0 client credentials over static API keys for server-to-server API access?

  1. Tokens are short-lived and scoped, reducing the impact of credential leakage Correct answer.
  2. Tokens are visible in URLs for easier debugging
  3. Tokens never expire and require no rotation
  4. Tokens eliminate the need for gateway policies

Explanation

Client credentials flows issue short-lived, scoped access tokens, so a leaked token has limited lifetime and permissions. Static keys, by contrast, remain valid until manually rotated.

Question 23API Management

An architect needs requests to fail fast with a clear error when a downstream service is unavailable, rather than hanging. Which policy combination best achieves this?

  1. A CORS policy paired with a caching policy
  2. A portal theme policy paired with key rotation
  3. A schema validation policy paired with versioning
  4. A timeout policy paired with a fault or error handling policy Correct answer.

Explanation

A timeout bounds how long the gateway waits on the backend, and fault handling returns a controlled error response instead of hanging or exposing internals. Together they improve resilience and consumer experience.

Question 24API Management

A provider must retire an older API version without breaking active consumers. Which approach is most sound?

  1. Redirect all traffic silently to the new version without notice
  2. Remove authentication from the old version to discourage use
  3. Immediately delete the version to force migration
  4. Announce a deprecation timeline, monitor usage, and retire only after consumers migrate Correct answer.

Explanation

Responsible retirement communicates timelines, tracks which applications still call the old version, and confirms migration before removal. Abrupt removal or silent redirection breaks integrations and trust.

Question 25API Management

Which design choice best supports consistent error handling across many API operations in a large program?

  1. Defining a shared error response schema and applying uniform fault policies across operations Correct answer.
  2. Returning HTTP 200 for all failures with a message body
  3. Letting each operation return ad hoc error formats
  4. Embedding stack traces in every error response

Explanation

A shared error schema plus uniform fault policies gives consumers predictable, machine-parseable failures across the whole API surface. Ad hoc formats force consumers to write special-case handling for each endpoint.

Question 26API Management

In Boomi API Management, what does an API component primarily represent?

  1. A logical grouping of operations that share a base path and common policies Correct answer.
  2. A user account that is granted access to the developer portal
  3. A scheduled process that moves records between two systems
  4. A single database connection shared by every integration process

Explanation

An API component is the design-time container that groups related operations under one base path and lets common policies be attached once for all of them. It is a design artifact, not a runtime connection, schedule, or user account.

Question 27API Management

Which gateway component actually hosts and enforces the deployed API at runtime?

  1. The API key record created for a consumer application
  2. The OpenAPI document stored in the design repository
  3. The Atom, Molecule, or Atom Cloud runtime that the API is deployed to Correct answer.
  4. The developer portal where documentation is published

Explanation

Deployment targets a runtime such as an Atom, Molecule, or Atom Cloud, and that runtime executes the gateway behavior and enforces policies on live traffic. Portal, specification, and key records are supporting artifacts that do not process requests.

Question 28API Management

What is the role of an API key in Boomi API Management?

  1. It sets the maximum number of requests allowed per minute
  2. It encrypts the request body so the backend cannot read it
  3. It defines the JSON schema used to validate incoming payloads
  4. It identifies the calling application and is checked by the authentication policy Correct answer.

Explanation

An API key is a shared secret that identifies the consumer application, and the authentication policy verifies it on each request. It is a credential, so it does not perform encryption, schema validation, or rate limiting.

Question 29API Management

Which HTTP status code should a gateway return when a request is rejected because the consumer exceeded its allowed request quota?

  1. 429 Correct answer.
  2. 301
  3. 500
  4. 404

Explanation

HTTP 429 Too Many Requests signals that the client has exceeded an enforced rate or quota limit and should retry later. The other codes describe missing resources, server faults, and redirects, which do not match throttling.

Question 30API Management

What is the purpose of the developer portal in Boomi API Management?

  1. To schedule batch jobs that call the backend systems
  2. To store the runtime logs generated by the gateway
  3. To publish API documentation and let developers register applications and obtain credentials Correct answer.
  4. To compile integration processes into deployable packages

Explanation

The developer portal is the consumer-facing surface where API documentation is published and developers self-register applications to receive credentials. It is not a build, logging, or scheduling tool.

Question 31API Management

Which policy type should be configured to reject requests whose JSON body does not match the declared contract?

  1. A response caching policy
  2. A request validation policy referencing a JSON schema Correct answer.
  3. A rate limiting policy
  4. A CORS policy

Explanation

Request validation compares the incoming payload against a schema and rejects nonconforming bodies before the backend is invoked. Caching, throttling, and CORS policies govern other concerns entirely.

Question 32API Management

Which deployment artifact must exist before an API can be exposed to consumers on a gateway?

  1. A published integration pack
  2. A configured trading partner profile
  3. A completed process test case
  4. A deployed API component bound to a runtime environment Correct answer.

Explanation

The API must be deployed to a runtime environment so the gateway can route and enforce policies for it. Test cases, integration packs, and partner profiles are unrelated artifacts that do not expose an endpoint.

Question 33API Management

What does the base path of an API component determine?

  1. The number of runtime nodes that will host the API
  2. The credential type required for authentication
  3. The maximum request size the gateway will accept
  4. The common URL prefix under which all of its operations are addressed Correct answer.

Explanation

The base path forms the shared URL prefix, and each operation appends its own path and method to it. Request size, credential type, and node count are governed by separate settings and policies.

Question 34API Management

A gateway policy must add a header containing a correlation identifier to every request before it reaches the backend. Which policy category fits best?

  1. A caching policy
  2. A response-side transformation policy
  3. An authentication policy
  4. A request-side mediation policy that sets a header Correct answer.

Explanation

Mediation policies on the request path can add or modify headers before forwarding to the backend. Response policies act after the backend replies, while authentication and caching address different concerns.

Question 35API Management

How does an API operation relate to an HTTP method and path?

  1. Each operation may bind any method to any path at runtime
  2. Operations are defined only by method and ignore the path
  3. Each operation binds one method and path pattern to a backend action Correct answer.
  4. Operations apply to the whole API and cannot be individually addressed

Explanation

An operation is the unit that pairs a specific HTTP method and path pattern with the backend behavior it invokes. This granularity allows policies and access control to target individual operations.

Question 36API Management

A team wants the gateway to return a stored copy of a backend response for repeated identical GET requests. Which policy accomplishes this?

  1. A JSON-to-XML transformation policy
  2. A request validation policy
  3. A response caching policy with a defined time to live Correct answer.
  4. A basic authentication policy

Explanation

Response caching stores the backend reply for a configured duration so repeated identical requests are served without calling the backend again. Validation, transformation, and authentication policies do not store responses.

Question 37API Management

Which policy should be applied when a provider needs to expose an API only to requests originating from approved web domains in a browser?

  1. A CORS policy listing the allowed origins Correct answer.
  2. A schema validation policy
  3. A rate limiting policy
  4. A message logging policy

Explanation

CORS policies tell browsers which origins may call the API by returning the appropriate access control headers. Throttling, validation, and logging policies do not govern cross-origin browser permissions.

Question 38API Management

What is the effect of applying a rate limiting policy at the operation level rather than the API level?

  1. The quota applies only to unauthenticated callers
  2. The quota is enforced separately for each operation's traffic Correct answer.
  3. The quota is shared across every operation in the API
  4. The quota is disabled once the API is versioned

Explanation

Scope determines what the counter covers, so an operation-level policy tracks and enforces limits per operation independently. API-level scope would pool the traffic across all operations instead.

Question 39API Management

A backend service occasionally takes far longer than expected to respond. Which policy configuration prevents client requests from waiting indefinitely?

  1. A CORS policy allowing all origins
  2. A response caching policy with a long time to live
  3. A schema validation policy on the response
  4. A timeout setting on the API operation that aborts slow calls Correct answer.

Explanation

A timeout bound on the operation causes the gateway to stop waiting and return an error once the limit is exceeded. Caching, CORS, and validation do not bound how long a backend call may take.

Question 40API Management

Which approach best isolates production consumers from a breaking change while a new API version is being validated?

  1. Overwrite the existing operations in place and test with production traffic
  2. Deploy the new version to a separate environment and keep the current version live in production Correct answer.
  3. Disable authentication on the new version until testing finishes
  4. Remove the old version immediately so consumers migrate faster

Explanation

Running the new version in a separate environment lets it be validated without affecting live consumers, and the current version stays available until the migration is complete. In-place overwrites, forced removal, and disabled security all create avoidable risk.

Question 41API Management

What is the main reason to centralize common policies at the API level rather than repeating them on every operation?

  1. Higher throughput because policies are executed only once per day
  2. Consistent enforcement with less duplication and easier maintenance Correct answer.
  3. Automatic generation of the OpenAPI document
  4. Removal of the need to deploy the API to a runtime

Explanation

Attaching shared policies at the API level enforces them uniformly and avoids duplicating configuration across operations, which simplifies maintenance. It does not change execution frequency, generate documentation, or eliminate deployment.

Question 42API Management

A consumer application authenticates successfully but receives HTTP 403 when calling one specific operation. What is the most likely explanation?

  1. The request body failed schema validation
  2. The API key presented is invalid or expired
  3. The gateway cannot reach the backend service
  4. The application is authenticated but not authorized for that operation Correct answer.

Explanation

A 403 Forbidden means the caller's identity was recognized but lacks permission for the requested resource, which points to authorization scoping on that operation. Invalid credentials yield 401, unreachable backends yield 5xx, and validation failures typically yield 400.

Question 43API Management

Which OAuth 2.0 grant type is most appropriate for a background service that calls an API with no human present?

  1. Resource owner password
  2. Client credentials Correct answer.
  3. Authorization code with PKCE
  4. Implicit

Explanation

The client credentials grant lets a confidential machine client obtain a token using its own credentials without any user interaction. The other grants are designed around a human user's involvement or are deprecated for that purpose.

Question 44API Management

Why should an API key be transmitted only over TLS-secured connections?

  1. TLS compresses the key so it consumes less bandwidth
  2. TLS rotates the key automatically on every request
  3. The key is a bearer secret, so interception would let an attacker impersonate the client Correct answer.
  4. TLS converts the key into an OAuth access token

Explanation

An API key functions as a bearer credential, so anyone who captures it can replay it and act as the legitimate client. TLS protects the key in transit; it does not compress, convert, or rotate credentials.

Question 45API Management

A provider wants to return a friendly error payload instead of a raw backend fault when a downstream system fails. Which capability should be used?

  1. A fault-handling policy that maps backend errors to a defined response Correct answer.
  2. A response caching policy with a short time to live
  3. A CORS policy that allows all origins
  4. A request validation policy on the incoming body

Explanation

Fault-handling policies intercept errors raised during processing and let the provider substitute a controlled status and payload. Validation, caching, and CORS policies address other stages and cannot reshape backend faults.

Question 46API Management

An architect must ensure that a retired API version stops serving traffic on a known date while consumers migrate. Which plan is most sound?

  1. Keep both versions deployed indefinitely with no deprecation notice
  2. Undeploy the old version immediately and let consumers discover the change
  3. Redirect all old-version calls to the new version without validating compatibility
  4. Announce a deprecation schedule, monitor remaining usage, then undeploy the old version after migration Correct answer.

Explanation

A managed retirement combines advance notice, usage monitoring, and a defined cutover so consumers can migrate before the old version is undeployed. Abrupt removal, indefinite coexistence, and unvalidated redirects each create operational or compatibility risk.

Question 47API Management

A gateway must reject requests that omit a required header before any backend call is attempted, and the rejection must be consistent across all operations. Which design is best?

  1. Add the header check inside each backend process after the request is routed
  2. Rely on the backend to reject requests that lack the header
  3. Document the header requirement in the portal and trust consumers to comply
  4. Attach a validation policy at the API level that checks the header and returns a defined error Correct answer.

Explanation

Enforcing the check at the API level stops invalid requests at the gateway, avoids backend load, and guarantees uniform behavior across operations. Backend checks, documentation, and per-process logic are inconsistent and allow bad traffic through.

Question 48API Management

Which combination best protects a public API from credential stuffing and volumetric abuse at the same time?

  1. Schema validation plus message logging
  2. API versioning plus a developer portal
  3. Authentication with short-lived tokens plus per-consumer rate limiting Correct answer.
  4. Response caching plus a permissive CORS policy

Explanation

Short-lived tokens limit the value of stolen credentials, while per-consumer rate limiting caps abusive volume from any single client. Caching, CORS, validation, logging, versioning, and the portal do not jointly address both threats.

Question 49API Management

A provider needs per-consumer quotas that differ by subscription tier. Which design achieves this with the least duplication?

  1. Hard-code the quota inside each backend process
  2. Disable rate limiting and monitor usage manually
  3. Create a separate API component for every individual consumer
  4. Define tier-specific rate limiting policies and assign consumers to the matching tier Correct answer.

Explanation

Tier-based policies apply the appropriate limit based on the consumer's assigned tier, so one API definition serves all consumers without duplication. Per-consumer APIs, backend hard-coding, and manual monitoring all scale poorly and invite inconsistency.

Question 50API Management

Why is it risky to expose internal backend hostnames and stack traces in gateway error responses?

  1. They prevent the gateway from applying authentication policies
  2. They reveal implementation details that help attackers plan targeted attacks Correct answer.
  3. They cause the OpenAPI document to become invalid
  4. They increase the TLS handshake time for each request

Explanation

Error details can disclose internal topology, software versions, and code paths that aid reconnaissance and exploitation. Leaking them has no bearing on handshake timing, authentication enforcement, or specification validity.