AZ-204 Practice Question: Connect to and consume Azure services and third-party services
You have an Azure API Management instance that exposes a REST API. You need to secure the API using OAuth 2.0 with Microsoft Entra ID. The API should accept tokens from multiple client applications. Which policy should you add to the inbound processing section?
⚠ Common exam trap
Candidates often confuse authentication (validating who the user is) with authorization (what the user can do), and may incorrectly choose a policy like <rate-limit> or <cache-lookup> thinking they provide security, but only <validate-jwt> actually validates the OAuth 2.0 token's authenticity and integrity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
<validate-jwt header-name="Authorization" failed-validation-httpcode="401" />
The <validate-jwt> policy is the correct choice because it validates the OAuth 2.0 token presented in the Authorization header, ensuring that only requests with valid tokens from Microsoft Entra ID are processed. This policy checks the token's signature, issuer, audience, and expiration, and returns a 401 status code if validation fails, which is essential for securing the API against unauthorized access from multiple client applications.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
<validate-jwt header-name="Authorization" failed-validation-httpcode="401" />
Why this is correct
The <validate-jwt> policy is specifically designed to validate JSON Web Tokens (JWTs) presented in an HTTP header, typically the 'Authorization' header using the 'Bearer' scheme. It verifies the token's signature, expiration, audience, issuer, and other claims against configured validation parameters, ensuring the request originates from an authenticated and authorized source. If validation fails, it immediately terminates the request processing and returns the specified HTTP status code, such as 401 Unauthorized, preventing access to the backend API.
- ✗
<xml-to-json>
Why it's wrong here
The <xml-to-json> policy is a transformation policy used to convert the XML body of an HTTP request or response into a JSON format. Its sole purpose is data format conversion, typically applied in the outbound processing section to standardize API responses or in the inbound section for requests. It has no functionality related to security, authentication, or validating any form of access token, making it entirely unsuitable for securing an API endpoint.
- ✗
<rate-limit>
Why it's wrong here
The <rate-limit> policy is employed to control the number of API calls a consumer can make within a specified time period, preventing abuse and ensuring fair usage. This policy focuses on throttling requests based on a defined key, such as IP address or user ID, to protect backend services from overload. While crucial for API stability, it does not perform any authentication or authorization checks, nor does it validate the integrity or authenticity of a JWT token.
- ✗
<cache-lookup>
Why it's wrong here
The <cache-lookup> policy is used to retrieve a response from the Azure API Management built-in cache or an external cache, significantly improving API performance and reducing the load on backend services. It operates by checking if a previous response for an identical request is available in the cache. This policy is purely for performance optimization through response caching and has no mechanism or capability to validate security tokens like JWTs or enforce access control.
Go deeper
Related to this question
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.