Examkin

Question

Difficulty: MediumSecure API Management Endpoints

You are securing an Azure API Management (APIM) gateway endpoint. The security requirements specify that all client applications must authenticate using client certificates, and the APIM gateway must validate that the certificate is not expired and is issued by a specific Certificate Authority (CA).

Which configuration and policy implementation should you use to meet these requirements?

  1. Enable client certificate negotiation in the APIM gateway settings, and configure an inbound policy that validates the certificate using context.Request.Certificate properties.Answer
  2. B
    Enable client certificate negotiation in the APIM gateway settings, and configure an outbound policy that validates the certificate using context.Request.Certificate properties.
  3. C
    Enable a system-assigned managed identity on the APIM instance, and configure an authentication-managed-identity policy in the inbound section of the API.
  4. D
    Upload the trusted CA certificate to Azure Key Vault, configure a validate-jwt inbound policy to validate the certificate, and grant the client application Get permissions in the Key Vault access policies.

Answer

Enable client certificate negotiation in the APIM gateway settings, and configure an inbound policy that validates the certificate using context.Request.Certificate properties.
To secure an APIM gateway using client certificates, you must first configure the gateway to negotiate client certificates. Once negotiated, the certificate is accessible in the policy context. The validation logic must reside in the inbound section so that requests are verified before reaching the backend. The context.Request.Certificate object exposes the necessary properties to verify issuer and expiration details.

Step-by-Step Solution

1
Enable client certificate negotiation on the APIM custom domain or gateway configurations.
The APIM gateway will request and negotiate client certificates during the TLS handshake.
By default, APIM does not request client certificates. This configuration ensures the certificate is available in the request context.
2
Configure the inbound policy section of the target API or product.
A policy rule is added to the inbound processing pipeline.
Security checks and request validation must be executed in the inbound section before requests are dispatched to the backend service.
3
Use the context.Request.Certificate expression within a conditional policy (e.g., choose or check-header) to validate the certificate's issuer and expiration date.
APIM checks the properties of the certificate and returns a 401 Unauthorized status if validation fails.
Using context.Request.Certificate properties ensures that only valid, non-expired certificates from the trusted CA are permitted to pass.

Key Concept

Securing APIM endpoints via client certificate authentication (Mutual TLS) and policy expressions
Rate this question

Topics

Secure API Management Endpoints

More questions from this topic