Connect to and consume Azure services and third-party services →mediumMultiple ChoiceObjective-mapped
AZ-204 Practice Question: Connect to and consume Azure services and third-party services
You manage a set of APIs using Azure API Management (APIM). One backend API requires an API key passed in the 'X-API-Key' header. The API key is stored securely in a named value in APIM. You need to configure APIM to add this header to all requests to that backend without exposing the key to API consumers. Which policy should you add to the inbound processing for that API?
⚠ Common exam trap
A common mix-up: candidates confuse 'set-header' with 'authentication-basic' because both deal with adding authentication-related headers, but 'authentication-basic' specifically encodes credentials in Base64 and is intended for HTTP Basic Auth, not for arbitrary API key headers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
set-header
The 'set-header' policy in Azure API Management allows you to add, modify, or remove HTTP headers on requests or responses. By placing this policy in the inbound processing section, you can inject the 'X-API-Key' header with the value retrieved from a named value (using the '{{NamedValue}}' syntax) without exposing the key to API consumers, as the policy executes on the gateway side.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
set-backend-service
Why it's wrong here
The set-backend-service policy is exclusively designed to dynamically alter the target URL of the backend service for the current request. It operates at the routing layer, enabling conditional redirection or service discovery based on request parameters. However, this policy lacks any functionality to inject or modify HTTP headers within the request itself before it reaches the backend, making it unsuitable for adding an X-API-Key header.
- ✓
set-header
Why this is correct
The set-header policy is the precise solution for this requirement, as it explicitly allows for the addition, modification, or deletion of HTTP headers in either the request or response. It can be configured to add a custom header, such as X-API-Key, with its value securely retrieved from a Named Value within APIM. This approach ensures the API key remains confidential, preventing its exposure in policy definitions or to API consumers, while successfully passing it to the backend.
- ✗
authentication-basic
Why it's wrong here
The authentication-basic policy is specifically engineered to add an Authorization header using the Basic scheme, encoding a username and password pair for backend authentication. It is intended for scenarios where the backend service expects HTTP Basic Authentication credentials. This policy does not support adding arbitrary custom headers like X-API-Key, nor is it designed to handle API keys as its primary form of credential, rendering it inappropriate for this specific task.
- ✗
validate-jwt
Why it's wrong here
The validate-jwt policy serves the critical function of verifying the authenticity and integrity of a JSON Web Token (JWT) presented by the client, typically found within the Authorization header. Its primary role involves validating the token against specified issuers, audiences, and signing keys. While essential for securing API access, this policy solely performs validation operations and does not possess any capability to inject new headers or modify existing ones for the request being forwarded to the backend service.
Go deeper
Related to this question
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.