Implement Azure security →mediumMultiple ChoiceObjective-mapped

AZ-204 Implement Azure security Practice Question

You are developing an API that processes sensitive personal data. The API is exposed via Azure API Management (APIM). You need to ensure that only authorized applications can call the API, and you want to validate the token at the APIM gateway without modifying the backend code. What is the most efficient approach?

⚠ Common exam trap

Many exam-takers confuse APIM's OAuth 2.0 authorization server (which issues tokens) with the validate-jwt policy (which validates tokens), leading them to choose Option B instead of D.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Configure a validate-jwt policy in APIM inbound processing

The validate-jwt policy in APIM's inbound processing validates the OAuth 2.0 token at the gateway level, ensuring only authorized applications can call the API without modifying backend code. This is the most efficient approach because it offloads token validation to APIM, reducing backend complexity and centralizing security enforcement.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Implement token validation in the backend API code
Why it's wrong here
Implementing token validation directly in the backend API code, while technically feasible, is not the most efficient or recommended approach when using Azure API Management. This method requires duplicating validation logic across potentially multiple backend services, necessitates code changes, and bypasses APIM's capability to centralize cross-cutting concerns like security. It increases development overhead and makes security policy management more complex, as changes would require redeploying backend services rather than just updating gateway policies.
✗
Use APIM's OAuth 2.0 authorization server
Why it's wrong here
APIM's OAuth 2.0 authorization server configuration is primarily designed to integrate with an identity provider to *issue* access tokens to client applications, typically as part of an OAuth 2.0 authorization code or client credentials flow. This feature facilitates the acquisition of tokens for clients to use when calling APIs. It does not, however, provide a mechanism to *validate* the integrity, authenticity, or claims of an *already received* JWT that a client presents to the API gateway for authorization.
✗
Use subscription keys in APIM
Why it's wrong here
Subscription keys in Azure API Management serve as a basic access control mechanism, primarily used for identifying and metering API consumers and enforcing usage quotas. While they provide a foundational layer of access control, ensuring only authorized applications can call the gateway, they do not offer any capabilities for authenticating an end-user or validating the cryptographic signature, expiration, or claims embedded within a JSON Web Token (JWT). Subscription keys are about client identification, not user authentication or token-based authorization.
✓
Configure a validate-jwt policy in APIM inbound processing
Why this is correct
Configuring a `validate-jwt` policy within APIM's inbound processing is the most effective and recommended approach for validating JSON Web Tokens. This policy allows the API Management gateway to cryptographically verify the token's signature, check its expiration, validate issuer and audience claims, and ensure its overall integrity *before* the request even reaches the backend API. This offloads security responsibilities from the backend, centralizes validation logic, and enhances performance by rejecting invalid requests early in the request pipeline.

Go deeper

AZ-204 Implement Azure security Practice Question

Why each option matters

Option-by-option breakdown

Related to this question