Examkin

Question

Difficulty: MediumSecure API Management Endpoints

An organization hosts a backend service that mandates mutual TLS (mTLS) authentication. You register the backend service in Azure API Management (APIM). You upload the client certificate to the APIM instance and want to configure the APIM gateway to present this certificate to the backend service when routing requests. Which policy configuration must you apply to meet this requirement?

  1. A
    Place the `authentication-certificate` policy inside the `<outbound>` policy block, referencing the certificate's thumbprint or ID.
  2. Place the `authentication-certificate` policy inside the `<inbound>` policy block, referencing the certificate's thumbprint or ID.Answer
  3. C
    Configure the APIM instance to use a system-assigned managed identity and add the `authentication-managed-identity` policy in the `<inbound>` block.
  4. D
    Create a named value referencing the certificate in Azure Key Vault without configuring a Key Vault access policy for the APIM identity, and reference the named value in the `<inbound>` block.

Answer

Place the `authentication-certificate` policy inside the `<inbound>` policy block, referencing the certificate's thumbprint or ID.
The correct answer configuration correctly places the `authentication-certificate` policy in the inbound section. This policy configures Azure API Management to present the specified client certificate (referenced by its thumbprint or ID) to the backend service during the TLS handshake, satisfying the mutual TLS requirements of the backend API.

Step-by-Step Solution

1
Analyze the authentication requirements of the backend service.
The backend service requires mutual TLS (mTLS), meaning a client certificate must be provided during the handshake.
This determines that identity-based authentication or header injections are not appropriate for this TLS-level connection.
2
Select the correct Azure API Management policy for certificate-based backend authentication.
The `authentication-certificate` policy is selected.
This policy explicitly instructs the gateway to use a client certificate from the certificate store when establishing a connection to the backend.
3
Determine the proper policy section to apply the selected configuration.
The policy must be applied in the `<inbound>` section.
Inbound policies process the request and configure credentials before the gateway makes the HTTP call to the backend service.

Key Concept

Securing backend connectivity from Azure API Management (APIM) using client certificates (mutual TLS).
Estimated Time:1m 30s
Rate this question

Topics

Secure API Management Endpoints

More questions from this topic