Examkin

Question

Difficulty: HardDefine API Management Policies

An organization exposes an internal human resources API through Azure API Management (APIM). The API must meet the following security requirements:
1. Restrict access to clients originating from the IP subnet 192.168.100.0/24192.168.100.0/24.
2. Validate a JSON Web Token (JWT) issued by Microsoft Entra ID before routing the request to the backend service.

A developer defines the following APIM policy:

xml
<policies>
<inbound>
<base />
</inbound>
<backend>
<base />
</backend>
<outbound>
<ip-filter action="allow">
<address-subnet>192.168.100.0/24</address-subnet>
</ip-filter>
<jwt-validate header-name="Authorization" failed-validation-httpcode="401" failed-validation-error-message="Unauthorized">
<openid-config url="https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration" />
</jwt-validate>
<base />
</outbound>
<on-error>
<base />
</on-error>
</policies>

Which of the following describes the behavior of this policy configuration?

  1. The backend service will receive and process unauthorized and unfiltered requests because the IP filtering and JWT validation policies are defined in the outbound section, which executes after the backend service responds.Answer
  2. B
    The API Management gateway will block all incoming requests before they reach the backend because security-related policies placed in the outbound section are automatically hoisted and executed during the inbound pipeline.
  3. C
    The policy will fail at runtime because the JWT validation policy requires a system-assigned managed identity to authenticate and fetch the OpenID Connect metadata document from the Microsoft Entra ID endpoint.
  4. D
    The policy will throw a runtime error during JWT validation because APIM requires a Key Vault access policy to retrieve the public keys needed to verify the token's signature.

Answer

The backend service will receive and process unauthorized and unfiltered requests because the IP filtering and JWT validation policies are defined in the outbound section, which executes after the backend service responds.
The correct answer is correct because Azure API Management policy sections are executed in a strict chronological sequence: inbound, backend, outbound, and on-error. Inbound policies execute before the request is routed to the backend service, while outbound policies execute after the backend service has processed the request and returned a response to the gateway. Placing the IP filtering and JWT validation policies in the outbound section means that these validation checks are bypassed before the backend is invoked, exposing the backend service to unauthorized calls.

Step-by-Step Solution

1
Analyze the sections of the APIM policy XML structure.
The XML document defines the `<ip-filter>` and `<jwt-validate>` policies inside the `<outbound>` section, leaving the `<inbound>` section with only the `<base />` policy.
Determining the locations of key policy configurations is the first step in assessing their execution timing.
2
Evaluate the execution sequence of API Management policy pipelines.
APIM executes policies in a strict sequential order: inbound (before backend call) -> backend (during backend call routing/execution) -> outbound (after backend call, before client response).
Understanding the pipeline lifecycle determines when validation checks occur relative to the backend invocation.
3
Determine the impact of placing the security policies in the outbound section.
Since the `<inbound>` section has no filtering or validation, all incoming client requests are immediately forwarded to the backend service. The `<ip-filter>` and `<jwt-validate>` checks are only executed after the backend has fully processed the request, leaving the backend exposed to unauthorized invocations.
Identifying the mismatch between the desired security posture and actual execution order reveals the correct behavior.

Key Concept

Azure API Management policy execution order and section placement rules
Rate this question

Topics

Define API Management Policies

More questions from this topic