AZ-204 Implement Azure security Practice Question
A healthcare organization uses Azure API Management (APIM) to expose FHIR APIs to external partners. The FHIR backend is an Azure API for FHIR that requires OAuth 2.0 tokens from Microsoft Entra ID. APIM must validate tokens before forwarding requests to the backend. The organization also needs to rate-limit requests per subscription key and log all requests to Azure Monitor for audit. Which combination of APIM policies should be implemented?
⚠ Common exam trap
Test-takers frequently confuse rate-limit (sliding window throttling per key) with quota (fixed total limit over a period), and assuming check-header can validate JWT tokens when it only checks for header existence, not cryptographic validity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use validate-jwt to validate the token, rate-limit to throttle requests per subscription key, and log-to-event-hub to send logs.
Validate-jwt is the appropriate policy to validate OAuth 2.0 tokens from Microsoft Entra ID before forwarding requests to the FHIR backend. The rate-limit policy enforces throttling per subscription key, which is the standard way to rate-limit based on API Management subscription keys. The log-to-event-hub policy sends logs to Azure Monitor via Event Hubs for audit purposes, meeting all requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use validate-jwt, set-header to add the subscription key, and log-to-event-hub.
Why it's wrong here
The `set-header` policy is designed to add or modify HTTP headers in a request or response. While `validate-jwt` correctly handles token validation and `log-to-event-hub` addresses logging, `set-header` does not provide any functionality for enforcing rate limits or throttling requests. Therefore, this option fails to meet the crucial requirement of rate limiting per subscription key, as it merely manipulates header values without imposing usage constraints.
- ✗
Use check-header to verify the token, rate-limit to throttle requests, and log-to-event-hub to send logs.
Why it's wrong here
The `check-header` policy is used to verify the existence or specific value of an HTTP header. However, it is fundamentally incapable of performing cryptographic validation of a JSON Web Token (JWT), which involves verifying the signature, checking claims like expiration and issuer, and ensuring the token's integrity. While `rate-limit` and `log-to-event-hub` address other requirements, the lack of proper JWT validation makes this option insecure and incomplete for authenticating requests.
- ✓
Use validate-jwt to validate the token, rate-limit to throttle requests per subscription key, and log-to-event-hub to send logs.
Why this is correct
This option correctly combines policies to meet all specified requirements. The `validate-jwt` policy is essential for securely verifying the authenticity, integrity, and claims of the incoming JWT, ensuring only legitimate requests proceed. The `rate-limit` policy effectively throttles requests on a per-subscription-key basis, preventing abuse and ensuring fair resource allocation. Finally, `log-to-event-hub` provides a robust mechanism for asynchronously sending detailed logs to Azure Event Hubs for monitoring, auditing, and analytics.
- ✗
Use validate-jwt to validate the token, quota to limit total requests, and log-to-event-hub.
Why it's wrong here
While `validate-jwt` correctly handles token validation and `log-to-event-hub` addresses logging, the `quota` policy is designed for limiting the *total* number of calls or bandwidth over a longer period (e.g., daily, monthly) for a specific scope like a product or API. It does not provide the real-time, short-term throttling *per subscription key* that the `rate-limit` policy offers. Consequently, this option fails to implement the specific requirement for rate limiting on a per-subscription-key basis.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.