Examkin

Question

Difficulty: MediumSecure API Management Endpoints

A developer needs to secure an API hosted in Azure API Management (APIM) by validating JSON Web Tokens (JWT) issued by Microsoft Entra ID. The validation process must ensure that the token signature is verified against Microsoft Entra ID's keys, and that expired or unauthorized requests are rejected before reaching the backend. Which two configuration steps should the developer perform? (Select TWO.)

  1. Place the <validate-jwt> policy in the <inbound> section of the API policy configuration.Answer
  2. Define the openid-config endpoint URL pointing to the Microsoft Entra ID metadata endpoint in the <validate-jwt> policy.Answer
  3. C
    Place the <validate-jwt> policy in the <outbound> section of the API policy configuration.
  4. D
    Enable a system-assigned managed identity on the APIM instance to sign the incoming client tokens.
  5. E
    Configure the <validate-jwt> policy to reference a signature key in Azure Key Vault without setting a Key Vault access policy for the APIM identity.

Answer

To secure the API endpoints, place the <validate-jwt> policy within the <inbound> processing block and configure the policy to use the Microsoft Entra ID OpenID Connect metadata endpoint for key validation.
The correct options state that the <validate-jwt> policy must be placed in the <inbound> section and configured with the Microsoft Entra ID OpenID Connect metadata endpoint. Inbound policies filter requests before they reach the backend service, which is required for security. The OpenID Connect metadata endpoint configuration ensures that the gateway can fetch and verify the signing keys of the tokens dynamically.

Step-by-Step Solution

1
Locate the target API configuration in Azure API Management and open the policy editor.
Access to the API policy XML document.
Policies in APIM are defined using XML blocks at different scopes (global, product, API, or operation).
2
Add the <validate-jwt> policy inside the <inbound> section of the policy XML.
Token validation is configured to occur before forwarding requests to the backend.
Token checks must happen on inbound requests to prevent unauthorized requests from consuming backend resources.
3
Set the openid-config attribute of the <validate-jwt> element to the Microsoft Entra ID tenant endpoint.
APIM is configured to fetch and cache the signing keys needed to verify token signatures.
Dynamic key retrieval via OpenID Connect ensures validation remains functional when Microsoft Entra ID rotates signing keys.

Key Concept

Securing API Management endpoints using inbound JWT validation and OpenID Connect configuration.
Rate this question

Topics

Secure API Management Endpoints

More questions from this topic