Examkin

Soru

Zorluk: OrtaDefine API Management Policies

You are configuring policies for an Azure API Management (APIM) gateway that routes requests to a backend microservice. You must meet the following requirements:
1. Authenticate the gateway to the backend microservice by using the APIM instance's system-assigned managed identity to acquire a Microsoft Entra ID token.
2. Strip the X-Powered-By header from the response returned by the backend microservice before the response is sent back to the clients.

Which policy configuration should you use?

  1. <policies>
    <inbound>
    <base />
    <authentication-managed-identity resource="https://graph.microsoft.com" />
    </inbound>
    <backend>
    <base />
    </backend>
    <outbound>
    <base />
    <set-header name="X-Powered-By" exists-action="delete" />
    </outbound>
    <on-error>
    <base />
    </on-error>
    </policies>    Cevap
  2. B
    <policies>
    <inbound>
    <base />
    <authentication-managed-identity resource="https://graph.microsoft.com" />
    <set-header name="X-Powered-By" exists-action="delete" />
    </inbound>
    <backend>
    <base />
    </backend>
    <outbound>
    <base />
    </outbound>
    <on-error>
    <base />
    </on-error>
    </policies>
  3. C
    <policies>
    <inbound>
    <base />
    <authentication-managed-identity resource="https://graph.microsoft.com" client-id="87654321-4321-4321-4321-210987654321" />
    </inbound>
    <backend>
    <base />
    </backend>
    <outbound>
    <base />
    <set-header name="X-Powered-By" exists-action="delete" />
    </outbound>
    <on-error>
    <base />
    </on-error>
    </policies>
  4. D
    <policies>
    <inbound>
    <base />
    <set-header name="Authorization" exists-action="override">
    <value>@("Bearer " + {{vault-token}})</value>
    </set-header>
    </inbound>
    <backend>
    <base />
    </backend>
    <outbound>
    <base />
    <set-header name="X-Powered-By" exists-action="delete" />
    </outbound>
    <on-error>
    <base />
    </on-error>
    </policies>

Cevap

The configuration that places the authentication-managed-identity policy without a client-id inside the inbound section, and the set-header policy with exists-action="delete" inside the outbound section.
The correct configuration places the authentication-managed-identity policy (with only the resource attribute specified) in the inbound section. This correctly triggers authentication using the system-assigned managed identity before routing. It also places the set-header policy in the outbound section with exists-action="delete" to successfully strip the X-Powered-By header from the backend response before returning it to the client.

Adım Adım Çözüm

1
Determine the proper placement of the authentication policy.
The authentication-managed-identity policy must be placed in the inbound section to acquire the Microsoft Entra ID token before the request is forwarded to the backend microservice.
Inbound policies process the request before it reaches the backend.
2
Configure the managed identity parameters for system-assigned managed identity.
Omit both the client-id and identity-resource-id attributes from the authentication-managed-identity tag.
By default, omitting these attributes causes Azure API Management to use the system-assigned managed identity.
3
Determine the proper placement and action of the header removal policy.
Place a set-header policy inside the outbound section with the header name set to 'X-Powered-By' and exists-action set to 'delete'.
Response headers returned by the backend microservice are modified in the outbound section before being returned to the client.

Anahtar Kavram

Azure API Management policy sections and identity configuration
Bu soruyu puanla

Konular

Define API Management Policies

Bu konudan daha fazla soru