Examkin

Question

Difficulty: Very hardProvision and Configure Azure API Management

You are provisioning and configuring a production Azure API Management (APIM) instance that must connect to both internal and external APIs. You must meet the following requirements:
- The APIM instance must run within a private subnet of an Azure Virtual Network (VNet) in internal mode so that it is not exposed directly to the public internet.
- The API gateway must be deployed across two distinct Azure regions to ensure high availability and minimize latency for global clients.
- All custom domain TLS/SSL certificates must be securely stored in Azure Key Vault and automatically updated when a new version is uploaded.

Which of the following configuration steps must you perform to meet these requirements? (Select THREE.)

  1. Provision the APIM instance using the Premium tier and configure the Virtual Network setting to Internal.Answer
  2. Enable a system-assigned managed identity for the APIM instance and grant it the Key Vault Secrets User role on the Azure Key Vault.Answer
  3. Add the secondary geographic region under the Locations settings of the APIM instance to scale out the gateway.Answer
  4. D
    Provision the APIM instance using the Developer tier to support internal VNet integration and multi-region deployment while keeping costs low.
  5. E
    Create a Shared Access Signature (SAS) token with secret read permissions on the Key Vault and configure it in the APIM Custom Domains settings.
  6. F
    Grant the APIM system-assigned managed identity the Key Vault Administrator role to ensure it can update DNS zones and certificates.

Answer

To meet the requirements, you must provision the APIM instance using the Premium tier and configure the Virtual Network setting to Internal, enable a system-assigned managed identity for the APIM instance and grant it the Key Vault Secrets User role on the Azure Key Vault, and add the secondary geographic region under the Locations settings of the APIM instance to scale out the gateway.
The solution requires the Premium tier of Azure API Management, as it is the only production tier that supports both virtual network integration and multi-region scale-out. A system-assigned managed identity is enabled on the APIM instance, and it is granted the Key Vault Secrets User role on the Key Vault, which allows the gateway to retrieve the TLS certificates for custom domains securely under least privilege. Finally, the secondary region is added under the Locations settings of the APIM instance in the Azure portal or deployment template.

Step-by-Step Solution

1
Determine the required Azure API Management tier.
Premium tier must be selected.
VNet integration and multi-region deployment are only supported in the Premium (and Developer, which is non-production) tiers.
2
Configure the network isolation.
Virtual Network connectivity is configured to 'Internal' mode.
This ensures the gateway is only reachable from within the VNet or via VPN/ExpressRoute.
3
Configure Key Vault certificate access.
Enable system-assigned managed identity on APIM and assign the 'Key Vault Secrets User' role.
APIM needs to fetch certificates from Key Vault using its managed identity under least privilege.
4
Set up global distribution.
Add a secondary location under the Locations settings of APIM.
This scales the gateway to a second region for global latency reduction and high availability.

Key Concept

Azure API Management provisioning tiers, virtual network integration, multi-region scaling, and Key Vault integration using managed identities.
Rate this question

Topics

Provision and Configure Azure API Management