Connect to and consume Azure services and third-party services →mediumMultiple ChoiceObjective-mapped
AZ-204 Practice Question: Connect to and consume Azure services and third-party services
Wide World Importers has an Azure API Management (APIM) instance that exposes several APIs. One API is a custom REST API hosted on an Azure App Service. The API requires authentication via a subscription key. APIM is configured to require subscription keys for all APIs. The team wants to offload authentication to APIM so that backend services do not need to validate keys. However, the backend API also needs to know the identity of the calling application for logging. The team decides to use APIM's OAuth 2.0 authorization with Microsoft Entra ID. The backend API should receive the JWT token from APIM. How should the team configure APIM to pass the token to the backend?
⚠ Common exam trap
It's easy for candidates to think removing the subscription key or using IP filtering is sufficient for authentication offloading, but they miss that the backend specifically needs the JWT token for identity logging, which only the 'validate-jwt' and 'set-header' combination provides.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
In the inbound processing policy, add a 'validate-jwt' policy to validate the token. Then add a 'set-header' policy to copy the token from the Authorization header (or from the context) and forward it to the backend.
APIM can use the 'validate-jwt' policy to verify the OAuth 2.0 token from Microsoft Entra ID, and then a 'set-header' policy to forward the original JWT token (e.g., from the Authorization header or context variable) to the backend. This offloads authentication from the backend while preserving the caller's identity for logging, as the backend receives the token without needing to validate it again.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
In the inbound processing policy, add a 'validate-jwt' policy to validate the token. Then add a 'set-header' policy to copy the token from the Authorization header (or from the context) and forward it to the backend.
Why this is correct
The 'validate-jwt' policy in APIM's inbound processing is essential for verifying the authenticity and integrity of the incoming JSON Web Token, ensuring its signature, issuer, audience, and expiration are valid. Following successful validation, a 'set-header' policy must be used to explicitly copy the validated token from the Authorization header or context variables and forward it to the backend service. This ensures the backend receives the user's identity and can perform granular authorization based on the token's claims.
- ✗
Use the 'ip-filter' policy to restrict access to known IPs. The backend trusts requests from APIM's IP.
Why it's wrong here
The 'ip-filter' policy restricts access to the API Management instance based on source IP addresses, providing network-level security. While the backend could be configured to trust requests originating from APIM's IP address, this approach only verifies the source of the request, not the identity of the end-user. It completely bypasses the need to validate and forward the JWT, failing to provide the backend with the necessary user identity for authorization.
- ✗
Remove the subscription key requirement for that API. APIM will not pass any authentication information to the backend.
Why it's wrong here
Removing the subscription key requirement only affects the initial access control layer for the API Management gateway itself, allowing clients to call the API without providing a subscription key. This action does not configure APIM to process or forward any authentication information, such as a JWT, to the backend service. Consequently, the backend would receive requests without any user identity context, making it impossible to perform user-specific authorization.
- ✗
Configure APIM to use client certificate authentication for the backend. The certificate is presented to the backend, which extracts the identity from the certificate.
Why it's wrong here
Configuring APIM to use client certificate authentication for the backend establishes a secure, mutually authenticated connection between APIM and the backend service, identifying APIM itself. However, this method does not facilitate the propagation of the original client's JWT token or its embedded identity claims to the backend. The backend would only receive APIM's identity via the certificate, not the end-user's identity from the JWT, which is crucial for user-specific authorization.
Go deeper
Related to this question
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.