Examkin

Question

Difficulty: EasySecure API Management Endpoints

You are securing an API hosted in Azure API Management (APIM). The API must validate a JSON Web Token (JWT) sent by clients in the Authorization header. Additionally, APIM must use its own system-assigned managed identity to authenticate against the secure backend service. You need to configure the APIM policy definition.

Which two actions should you perform? (Select two.)

  1. Add the `validate-jwt` policy to the `<inbound>` section of the policy definition.Answer
  2. Add the `authentication-managed-identity` policy to the `<inbound>` section of the policy definition.Answer
  3. C
    Add the `validate-jwt` policy to the `<outbound>` section of the policy definition.
  4. D
    Add the `authentication-managed-identity` policy to the `<outbound>` section of the policy definition.
  5. E
    Add the `authentication-managed-identity` policy to the `<inbound>` section and specify a user-assigned client ID.

Answer

Add the `validate-jwt` policy to the `<inbound>` section of the policy definition, and add the `authentication-managed-identity` policy to the `<inbound>` section of the policy definition.
To secure the API endpoints, the incoming token must be validated, and credentials for the backend must be attached before forwarding the request. The `validate-jwt` policy and the `authentication-managed-identity` policy must both be defined in the `<inbound>` section of the APIM policy. The system-assigned identity is used directly without specifying any client ID parameters.

Step-by-Step Solution

1
Determine where client request token validation should take place.
The token must be validated before forwarding the request to the backend. This requires the `validate-jwt` policy in the `<inbound>` section.
Inbound policies process the incoming client request before it is sent to the backend.
2
Determine how to configure backend authentication.
APIM must authenticate to the backend using its system-assigned managed identity, which is done using the `authentication-managed-identity` policy in the `<inbound>` section.
The backend authentication policy modifies the outbound request headers/context before it leaves the APIM gateway for the backend, which must be configured within the `<inbound>` section.

Key Concept

Azure API Management inbound policies for JWT validation and backend authentication using managed identities
Estimated Time:1m 0s
Rate this question

Topics

Secure API Management Endpoints

More questions from this topic