Google Cloud - Apigee Certified API Engineer - Apigee-API-Engineer Exam Questions [2026]

QUESTION NO: 1
Which is true about PostClientFlow?

A. PostClientFlow can only include MessageLogging policies. B. The response is blocked until! the PostClientFlow policies are executed. C. PostClientFlow will only be executed if a payload is returned. D. PostClientFlow can include any supported policy.

Correct Answer: A

QUESTION NO: 2
Your API generates tokens to authenticate users. You have the following requirements
1. Limited token lifetime.
2. Managed key rotation.
3. Self-verifiable content.
4 Compact data representation
5. Refresh without new challenge.
You plan to use SAML2 Which two of the above-listed requirements are satisfied by using SAML2? Choose 2 answers

A. Compact data representation B. Refresh without a new challenge C. Self-verifiable content D. Limited token lifetime. E. Managed key rotation

Correct Answer: D

QUESTION NO: 3
What is the purpose of a refresh token?

A. To notify the application that a new access token is required. B. To request that Apigee re-issue a new access token to replace an expired access token. C. To reset an application to its default configuration. D. To extend the amount of time an existing access token can be used by resetting the token's expiration time

Correct Answer: B

QUESTION NO: 4
Which is a benefit of 2-way TLS (mutual TLS) for target endpoint connections?

A. End users can use the name of the system to verify that they are connecting to a trusted system. B. Sensitive data presented to end users will be encrypted C. All of the above D. Certificates can be used to verify the identity of both Apigee Edge and the target endpoint

Correct Answer: D

QUESTION NO: 5
How many times can an authorization code be used to obtain an access token?

A. Unlimited until it expires B. 1 C. Unlimited as long as requests come within specified time of authorization code creation D. 5 E. 2

Correct Answer: B

QUESTION NO: 6
You have created an OpenAPl specification and begun a sample implementation of the API Proxy in Apigee Edge Another team is asking for early access for interactive documentation What should you do1?

A. Create a sample web app that uses your API, and publish the source code. B. Publish using SwaggerUI C. Generate web documents using SmartDocs D. Send the requesting team the OpenAPl spec.

Correct Answer: A

QUESTION NO: 7
Your team has the following requirements in building an API:
* Adhere to Pragmatic REST.
* Model the API to the consumption use case.
* Require API Key authentication
* Implement CORS
* Validate inputs.
You have begun migrating a SOAP-based web service to a REST API by using the SOAP to REST function in Apigee Edge Which two of the above-listed requirements could be satisfied by this action?
Choose 2 answers

A. Adhere to Pragmatic REST B. Model the API to the consumption use case C. Validate inputs. D. Implement CORS. E. Require API Key authentication

Correct Answer: B,E

QUESTION NO: 8
As an API Engineer your team has had issues with security vulnerabilities and poor coding practices in the past. You would like to improve your team's reputation within the organization. What step could take to improve your process?

A. Add code quality analysis into your CI/CD process. B. Ask the developers to run unit tests prior to code check-in. C. Add smoke tests to your CI/CD process D. Ask the developers to run anti-virus against the code prior to check in.

Correct Answer: D

QUESTION NO: 9
You have a requirement to expose functions and data from an existing back-end system Using Apigee recommended practices, which step should you take first*?

A. Write business and functional requirements documents. B. Implement ad-hoc microservices using a managed container system. C. Catalog the data model of the backing data store or API into a data dictionary D. Work with the existing or targeted application consumers to build an Open API Specification model

Correct Answer: D

QUESTION NO: 10
Where in the proxy should you place a policy that modifies the flow variable target, url?

A. proxy response flow B. proxy request flow C. target request flow D. target response flow E. any flow

Correct Answer: D