Examkin

Question

Difficulty: MediumSecure API Management Endpoints

You are securing an API hosted in Azure API Management (APIM). The security requirements specify that:
1. The API must only accept requests from a partner's public IP address: 203.0.113.50.
2. The APIM gateway must retrieve a shared secret stored in Azure Key Vault to authenticate the request against a legacy backend service.

You configure a system-assigned managed identity for the APIM instance. Which of the following actions must you perform to successfully implement this configuration? Select two.

  1. Configure the <ip-filter> policy within the <inbound> section of the API policy to allow the IP address 203.0.113.50.Answer
  2. Grant the APIM system-assigned managed identity Get secret permission in the Azure Key Vault access policy.Answer
  3. C
    Configure the <ip-filter> policy within the <outbound> section of the API policy to restrict access to the IP address 203.0.113.50.
  4. D
    Create a user-assigned managed identity for APIM and grant access to the Key Vault, but configure APIM settings to use the system-assigned identity to retrieve the secret.

Answer

Configure the <ip-filter> policy within the <inbound> section of the API policy to allow the IP address 203.0.113.50, and grant the APIM system-assigned managed identity Get secret permission in the Azure Key Vault access policy.
Securing APIM inbound traffic requires applying the IP filter in the inbound policy processing phase, and retrieving secrets from Azure Key Vault requires granting the system-assigned managed identity permission to retrieve those secrets.

Step-by-Step Solution

1
Determine the correct policy section for client IP address restriction.
Identify that incoming client requests must be evaluated before forwarding to the backend, which requires using the inbound policy section.
Placing ip-filter in inbound ensures unauthorized IPs are blocked immediately.
2
Configure the ip-filter policy details.
Write the policy configuration to allow 203.0.113.50 in the inbound section.
This implements the requirement to restrict access to the partner's IP address.
3
Configure the authorization access to retrieve the backend secret from Azure Key Vault.
Grant the Get secret permission specifically to the system-assigned managed identity of the APIM instance.
APIM requires access to Key Vault secrets to authenticate requests to the legacy backend service.

Key Concept

Securing API Management endpoints by applying inbound policies (ip-filter) and securely accessing backend credentials using Azure Key Vault and Managed Identities.
Estimated Time:1m 30s
Rate this question

Topics

Secure API Management Endpoints

More questions from this topic