Examkin

Question

Difficulty: HardSecure API Management Endpoints

You are configuring security for an API hosted on an Azure API Management (APIM) gateway. The business requirement states that all incoming client requests must be authenticated using client certificates (mutual TLS). The allowed certificate thumbprints must be stored securely in an Azure Key Vault rather than hardcoded in the policy. The APIM instance has a system-assigned managed identity enabled.

Which two of the following configuration steps must you perform to meet these requirements?

  1. Create a Named Value in the API Management instance that references the Azure Key Vault secret containing the allowed certificate thumbprint.Answer
  2. In the inbound section of the API policy, add a conditional policy that validates the incoming client certificate's thumbprint against the Named Value.Answer
  3. C
    In the outbound section of the API policy, add a conditional policy that validates the incoming client certificate's thumbprint against the Named Value.
  4. D
    Create a Named Value in the API Management instance that references the Key Vault secret, without granting the system-assigned managed identity any permissions in the Key Vault.
  5. E
    Enable a user-assigned managed identity on the API Management instance to bypass Key Vault access policy requirements for secret retrieval.

Answer

Create a Named Value in the API Management instance that references the Azure Key Vault secret containing the allowed certificate thumbprint, and in the inbound section of the API policy, add a conditional policy that validates the incoming client certificate's thumbprint against the Named Value.
To secure the API Management gateway with client certificates, the APIM instance must validate the certificate incoming in the request. Storing the certificate thumbprints in Azure Key Vault ensures security and maintainability. A Named Value in API Management can be configured to fetch the secret using the system-assigned managed identity. The inbound policy section must then contain a conditional check (such as using the choose policy) to inspect the client certificate thumbprint from the context and ensure it matches the thumbprint retrieved from Key Vault. This blocks unauthorized requests before reaching the backend.

Step-by-Step Solution

1
Enable Managed Identity on the APIM instance and grant it access to the Key Vault.
The APIM instance's system-assigned managed identity is configured with Secret Get permission in the Key Vault access policies.
This allows the APIM instance to authenticate and retrieve secret values from the Key Vault dynamically.
2
Create a Named Value referencing the Key Vault secret.
A Named Value is defined in APIM, linked to the Key Vault secret containing the certificate thumbprint.
This keeps the sensitive thumbprint out of the policy code and centralizes configuration in Key Vault.
3
Add an inbound policy to inspect the client certificate.
An inbound policy check evaluates context.Request.Certificate.Thumbprint and compares it with the Named Value.
Validating the certificate inbound ensures that unauthorized requests are rejected before reaching the backend services.

Key Concept

Securing APIM endpoints with client certificate validation and Key Vault integration
Rate this question

Topics

Secure API Management Endpoints

More questions from this topic