Examkin

Soru

Zorluk: OrtaProvision and Configure Azure API Management

You are configuring an Azure API Management (APIM) instance to route traffic to a backend service that requires mutual TLS (mTLS) authentication. You upload the client certificate to the APIM instance. You need to ensure that APIM presents this client certificate when sending requests to the backend service. Which configuration should you apply to meet this requirement?

  1. Add the authentication-certificate policy with the certificate thumbprint or ID to the inbound section of the API policy.Cevap
  2. B
    Add the authentication-certificate policy with the certificate thumbprint or ID to the outbound section of the API policy.
  3. C
    Add the authentication-certificate policy with the certificate thumbprint or ID to the on-error section of the API policy.
  4. D
    Grant the APIM system-assigned managed identity GET permissions in the Azure Key Vault access policy for secrets and certificates, and rely on default credential forwarding.

Cevap

Add the authentication-certificate policy with the certificate thumbprint or ID to the inbound section of the API policy.
The correct option is to apply the authentication-certificate policy in the inbound section. This instructs the gateway to use the specified client certificate when executing the outbound request to the backend service. Because the backend connection is initiated during or immediately after the inbound processing phase, policies affecting authentication to the backend must be declared in the inbound block.

Adım Adım Çözüm

1
Upload the client certificate to the Certificates store of the Azure API Management instance.
The certificate is registered with APIM and assigned an identifier or thumbprint.
APIM must have the certificate in its store to present it during the TLS handshake.
2
Determine the correct policy to attach the client certificate to outbound backend calls.
The authentication-certificate policy is identified as the correct tool.
This policy explicitly configures client certificate credentials for backend authentication.
3
Insert the authentication-certificate policy into the inbound section of the policy XML configuration.
The certificate is attached to the request before it is sent to the backend.
Inbound policies run before the request is sent to the backend, enabling the gateway to establish the mTLS connection.

Anahtar Kavram

Configuring client certificate authentication for backends in Azure API Management
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Provision and Configure Azure API Management