Examkin

Soru

Zorluk: OrtaDefine API Management Policies

You are configuring policies in Azure API Management (APIM) for a secure backend API. You must configure the policy to meet the following requirements:

1. Obtain an Entra ID token using the APIM instance's system-assigned managed identity for the database resource https://database.windows.net/ and use it to authenticate to the backend.
2. Retrieve an API key from Azure Key Vault using an APIM named value named kv-backend-key and send it to the backend in an HTTP header named X-API-Key.

Which two of the following XML snippets represent correct policy configurations that must be placed in the policy file to meet these requirements?

  1. <authentication-managed-identity resource="https://database.windows.net/" /> placed in the <inbound> sectionCevap
  2. B
    <authentication-managed-identity resource="https://database.windows.net/" /> placed in the <outbound> section
  3. <set-header name="X-API-Key" exists-action="override">
    <value>{{kv-backend-key}}</value>
    </set-header> placed in the <inbound> section    Cevap
  4. D
    <authentication-managed-identity client-id="36c3a1b0-1234-4bc9-881a-7b3e9a0c1234" resource="https://database.windows.net/" /> placed in the <inbound> section

Cevap

The correct policy configurations require placing the authentication-managed-identity policy without a client ID inside the inbound section, and placing the set-header policy referencing the kv-backend-key named value in double curly braces inside the inbound section.
To authenticate with a system-assigned managed identity, the client-id attribute must be omitted from the authentication-managed-identity policy, and it must be placed in the inbound block so that it runs before the request reaches the backend. The custom header containing the secret is set in the inbound block using set-header and naming the target header, referencing the named value with double curly braces.

Adım Adım Çözüm

1
Determine the authentication mechanism.
Use <authentication-managed-identity resource="https://database.windows.net/" /> since omitting the client-id defaults to the system-assigned managed identity.
The system-assigned managed identity is requested, so no specific client ID should be declared.
2
Determine the proper placement for authentication.
Place the authentication-managed-identity snippet in the <inbound> section.
Authentication must occur before the gateway forwards the request to the backend service.
3
Determine how to reference the Named Value in the header.
Use the <set-header> policy with value referencing {{kv-backend-key}} inside the <inbound> section.
Named values in API Management are referenced using double curly braces to fetch the key vault secret dynamically.

Anahtar Kavram

API Management policies are configured in specific pipeline stages (inbound, backend, outbound, on-error) and can leverage system-assigned managed identities and named values to secure backend communication.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Define API Management Policies

Bu konudan daha fazla soru