AZ-204 Implement Azure security Practice Question
You are using Azure API Management (APIM) to expose a REST API. The backend API requires mutual TLS (client certificate) for authentication. The client certificate is stored in Azure Key Vault. You need to configure APIM to use this certificate when calling the backend, without exposing the certificate contents in the policy files. Which APIM feature and policy should you use?
⚠ Common exam trap
It's easy for candidates to confuse the `authentication-managed-identity` policy with certificate-based authentication, or assume that uploading the certificate directly to APIM is equivalent to using Key Vault, but the question explicitly requires avoiding exposure of certificate contents in policy files, which only the named value approach with Key Vault reference achieves.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the authentication-certificate policy with a named value that references the Key Vault certificate.
The `authentication-certificate` policy in Azure API Management can reference a client certificate stored in Azure Key Vault via a named value. Named values securely store secrets and can point to Key Vault certificates without exposing the certificate contents in policy files. This allows APIM to present the certificate during mutual TLS authentication to the backend API.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use the authentication-certificate policy with a named value that references the Key Vault certificate.
Why this is correct
This is the correct approach. The authentication-certificate policy is specifically designed to present a client certificate to a backend service for mutual TLS authentication. By using a named value configured to reference a Key Vault secret of type 'certificate', APIM securely retrieves the certificate's private key at runtime without exposing it in configuration. This method ensures secure storage, automatic rotation capabilities, and simplified management of client certificates.
- ✗
Use the authentication-managed-identity policy to authenticate to the backend.
Why it's wrong here
The authentication-managed-identity policy is used for authenticating APIM to a backend service that supports Microsoft Entra ID token-based authentication. It issues an OAuth 2.0 access token using APIM's managed identity. However, this policy does not provide or attach a client certificate to the request, which is a distinct requirement for mutual TLS authentication with the backend. Therefore, it cannot fulfill the need for a client certificate.
- ✗
Upload the client certificate directly to APIM's Certificate store and reference it in the policy.
Why it's wrong here
While APIM allows uploading client certificates directly to its certificate store, this method is not recommended for production environments, especially when Key Vault is available. Direct upload requires manual handling of the certificate's private key, potentially exposing it during the upload process or in APIM's configuration. Furthermore, it necessitates manual updates and re-uploads upon certificate expiration, which is prone to errors and operational overhead, failing to leverage Key Vault's secure and automated management capabilities.
- ✗
Use a JavaScript policy to fetch the certificate from Key Vault and attach it.
Why it's wrong here
Using a JavaScript policy to programmatically fetch a certificate from Key Vault and attach it is an insecure and overly complex approach. JavaScript policies execute within the APIM gateway and are not designed for secure secret retrieval or manipulation of sensitive cryptographic materials like private keys. Such an implementation could inadvertently expose credentials or the certificate itself, and it bypasses the robust, built-in Key Vault integration specifically designed for secure certificate management via named values.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
API Management
API Management is a service that acts as a front door for application programming interfaces, controlling access, monitoring usage, and enforcing security policies.
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.