Broadcom API Management Technical Specialist (250-573) Certification Sample Questions

01. A node was taken out of a three-node Gateway cluster overnight. Since then a share of calls fail, while an immediate retry of the same call often succeeds. No policy has been edited.
What is the most likely cause?
a) The cluster cannot serve traffic until a new primary node is nominated in place of the old one
b) The surviving nodes are running a policy revision saved before the node was removed
c) The load balancer is still offering traffic to the node that was removed
d) The cluster-wide properties must be re-applied by hand to each of the surviving nodes

02. An energy supplier's Gateway accepts client certificates from partner systems. One partner reports that a server holding the private key for its certificate was stolen, and the issuing authority has withdrawn that certificate. Its validity period still has a long way to run.
What has to be in the policy for the Gateway to start refusing it?
a) An expiry check on the presented certificate, which is still inside its stated validity period
b) A revocation check with the issuing authority
c) A check that the certificate chains to an authority the Gateway trusts, which this one still does
d) A stronger cipher on the listener that the partner connects to, so that the stolen key is of no further use

03. A build of a customer application shipped with a flaw that exposed the credentials the application had obtained, and that build is on an unknown number of handsets. The credentials have to stop being usable while a corrected build is prepared and distributed.
What contains the exposure?
a) Revoke the tokens issued to that client in the OAuth Manager
b) Unregister each affected handset individually as its owner contacts support about the corrected build
c) Shorten the lifetime of newly issued tokens and wait for the exposed ones to run out
d) Block the application's traffic at the load balancer

04. A payments application is registered with a scope covering transfers, and the tokens it receives carry that scope. During testing, a transfer submitted with a token that lacks the scope still succeeds.
What has been missed?
a) The scope was granted to the application rather than to the customer who signs in to it
b) The application asks for the scope at sign-in rather than on each call, so the Gateway sees it only once
c) The token's lifetime outlasts the period for which the scope was granted
d) The policy never reads the scope, and nothing else enforces it

05. An insurer's claims API, published on the Gateway, shows a sharp rise in error responses on its service metrics over the last hour. The team now needs to know what those failing requests actually contained.
Why do the metrics not settle that question?
a) They are calculated for the cluster as a whole, so a failure on any single node is never represented in a figure the team can read
b) They count outcomes across many requests, so no individual message survives in them
c) They are refreshed continuously, so a count from an hour ago has already been overwritten by the current one
d) They report only failed calls and not successful ones

06. A courier application shows its drivers the same brief apology whatever the reason a call failed, and the team wants the Gateway's error responses to let the application react instead.
Which properties should the mobile app service policy give those responses?
(Choose three.)
a) A stable code the application can branch on without reading the message text
b) The back end's own error identifier and its own status text, so support staff can trace the incident in the back-end logs
c) Wording tailored to the driver's language, which the application displays exactly as it arrives
d) Nothing that exposes the back end, such as a stack trace or an internal host name
e) A clear separation between a failure the driver must re-authenticate to clear and one worth retrying later

07. A team has built one encapsulated assertion for the credential check its services share. Two of those services need the same check made against different identity providers, and the team does not want a second copy of the logic.
Which property of an encapsulated assertion makes that possible?
a) Each calling policy holds its own copy of the assertion, which it can edit independently
b) A cluster-wide property can override the values the encapsulated assertion was built with
c) It declares input parameters, and each calling policy supplies its own values
d) The assertion reads which identity provider to use from the service's resolution path

08. Employees inside an enterprise network call an internal reporting API through the Gateway from applications running on their domain-joined desktops. The business has said they must not be asked for a second set of credentials at the Gateway.
What does Windows integrated authentication contribute here?
a) It issues every employee a separate API key, which the reporting application then stores on their behalf
b) It accepts the desktop identity that the caller already holds
c) It prompts the employee for their domain password once, then caches it for the remainder of the session
d) It converts the employee's domain credential into an OAuth access token before the request is routed

09. A handset that was unregistered when it went missing has been recovered and is going back into service. It is registered again, and the SDK on it still holds what it obtained before.
What is true of that handset once re-registration completes?
a) It carries a new device identity and newly issued credentials, so what the handset held before its removal is not brought back into force
b) It is registered, but it cannot be issued anything until the credentials it already holds reach the end of their lifetime
c) It takes up the identity it had before, because registration records the handset rather than the moment it was registered
d) It keeps its previous identity and receives fresh credentials, so policies written for that handset go on applying

10. Two applications from the same publisher are installed on one handset, and both use the storage and messaging services the Mobile API Gateway offers them through the SDK.
What does the app service policy determine about those services?
a) How much of the handset's own storage each application may occupy, and what the Gateway does when an application exceeds the share it was allowed
b) That the two applications share one store, because the same organization published them
c) Which application owns each stored item and each message, so that one cannot read what the other holds
d) Whether the traffic between the handset and the Gateway is encrypted