Examkin

Question

Difficulty: MediumDefine API Management Policies

You are configuring policies in Azure API Management (APIM) for a weather forecasting API. The API must satisfy the following requirements:
1. Strip a sensitive query parameter named `internal-token` from the request before it is forwarded to the backend.
2. Authenticate to the backend service using the APIM instance's system-assigned managed identity.

Which two of the following XML policy configurations should you apply to meet these requirements? (Select two)

  1. xml
    <inbound>
    <base />
    <set-query-parameter name="internal-token" action="delete" />
    </inbound>
    Answer
  2. xml
    <inbound>
    <base />
    <authentication-managed-identity resource="https://management.azure.com/" />
    </inbound>
    Answer
  3. C
    xml
    <outbound>
    <base />
    <set-query-parameter name="internal-token" action="delete" />
    </outbound>
  4. D
    xml
    <inbound>
    <base />
    <authentication-managed-identity resource="https://management.azure.com/" client-id="system" />
    </inbound>

Answer

Apply the inbound policy to delete the query parameter and the inbound policy using the authentication-managed-identity tag without a client-id attribute.
The inbound policy block executes before the request is forwarded to the backend. Deleting query parameters must be performed here using the set-query-parameter policy. Additionally, acquiring an access token using the system-assigned managed identity is configured in the inbound block via the authentication-managed-identity policy, which must omit the client-id attribute to indicate system-assigned identity utilization.

Step-by-Step Solution

1
Determine the correct policy section for stripping query parameters.
The inbound section is selected because modifications to the request must occur before it is sent to the backend.
Placing request modifications in the outbound section would execute them after the backend has already processed the request.
2
Select the correct XML policy to remove the query parameter.
The set-query-parameter policy with action="delete" is configured inside the inbound block.
This removes the specified parameter from the query string of the incoming request.
3
Determine the correct policy configuration for system-assigned managed identity authentication.
The authentication-managed-identity policy is placed in the inbound block with the resource attribute, omitting the client-id attribute.
Omitting client-id instructs APIM to use the system-assigned identity. Specifying client-id is reserved for user-assigned managed identities.

Key Concept

Azure API Management policies are executed sequentially within specific blocks (inbound, backend, outbound, on-error). Inbound policies modify requests before forwarding, including credential acquisition and parameter sanitization.
Rate this question

Topics

Define API Management Policies

More questions from this topic