A developer needs to configure security for a specific endpoint in Azure API Management. The endpoint must only accept requests from a partner's office network (subnet ) and must verify that the request contains a valid subscription key.
Which two configuration settings or policy definitions must be applied within Azure API Management to enforce these security controls?
- Define the `ip-filter` policy inside the `<inbound>` element of the API policy.Answer
- Select the 'Require subscription' check box in the settings of the API.Answer
- CDefine the `ip-filter` policy inside the `<outbound>` element of the API policy.
- DConfigure a system-assigned managed identity for the client application to bypass the IP restriction.
- ECreate an Azure Key Vault access policy that allows the API Management gateway to read secrets.
Answer
Defining the `ip-filter` policy inside the `<inbound>` element of the API policy and selecting the 'Require subscription' check box in the settings of the API.
To restrict access by IP address, the `ip-filter` policy must be configured within the `<inbound>` block, which evaluates incoming requests before forwarding them to the backend. To enforce key validation, the 'Require subscription' setting must be enabled on the API, which ensures that Azure API Management validates the presence of a valid subscription key in the request headers or query parameters.
Step-by-Step Solution
Key Concept
Securing API Management endpoints using IP filtering and subscription key enforcement.