Examkin

Question

Difficulty: MediumSecure API Management Endpoints

An enterprise client communicates with an API hosted in Azure API Management (APIM). You must implement two security requirements:
1. Validate that the client presents a client certificate containing an authorized thumbprint.
2. Accept the subscription key in a custom HTTP header named `X-API-Signature` instead of the default header.

Which two configuration actions should you perform to meet these requirements?

  1. Configure the `validate-client-certificate` policy in the `inbound` section of the API policy configuration, specifying the allowed client certificate thumbprints.Answer
  2. Configure the API settings in the Azure portal or ARM template to use the custom HTTP header named `X-API-Signature` for subscription key validation.Answer
  3. C
    Add the `validate-client-certificate` policy to the `outbound` section of the API policy configuration.
  4. D
    Configure the `authentication-certificate` policy in the inbound section, referencing a certificate stored in Azure Key Vault without configuring Key Vault access policies to grant the APIM instance GET permissions.

Answer

Configure the validate-client-certificate policy in the inbound section of the API policy configuration, and configure the API settings to use the custom HTTP header for subscription key validation.
To secure the APIM endpoint with the client certificate, you must configure the validate-client-certificate policy within the inbound section of the policy file. Additionally, to change the header name where APIM expects the subscription key, you must modify the Subscription key header name setting in the API settings configuration.

Step-by-Step Solution

1
Place client certificate validation in the inbound request flow.
The APIM gateway will inspect the TLS handshake, extract the client certificate, and validate it against the configured thumbprint before forwarding requests to the backend.
Request validation policies must run in the inbound section to filter unauthorized client requests early.
2
Modify the API configuration settings to use a custom subscription header.
APIM will look for the subscription key in the custom `X-API-Signature` header instead of the default `Ocp-Apim-Subscription-Key` header.
Updating the header name in the API settings updates the metadata configuration telling APIM where to look for subscription keys.

Key Concept

Securing APIM gateway endpoints using client certificates and customizing subscription key validation headers.
Estimated Time:2m 0s
Rate this question

Topics

Secure API Management Endpoints

More questions from this topic