AZ-204 Practice Question: Connect to and consume Azure services and third-party services

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Add a set-backend-service policy with the authentication-managed-identity attribute

  Why this is correct

  The `set-backend-service` policy with the `authentication-managed-identity` attribute is the correct approach for API Management to securely authenticate to an Azure AD-protected backend. This policy instructs APIM to use its assigned managed identity to automatically acquire an OAuth 2.0 access token from Azure Active Directory. The obtained token is then seamlessly added as a `Bearer` token in the `Authorization` header of the request forwarded to the backend API, eliminating the need for manual credential management.

• ✗

  Configure the backend API's subscription key in policy

  Why it's wrong here

  Configuring a backend API's subscription key in a policy is incorrect because subscription keys serve a different purpose than OAuth tokens. Subscription keys are primarily used by API Management to identify calling clients, enforce rate limits, and control access to the APIM gateway itself. They are not designed to authenticate APIM to a backend API that specifically expects a dynamically issued OAuth `Bearer` token for secure authorization.

• ✗

  Use a validate-jwt policy to check incoming token

  Why it's wrong here

  The `validate-jwt` policy is designed to validate JSON Web Tokens (JWTs) presented by the *client* to the API Management gateway, ensuring the client's identity and authorization. This policy performs checks like signature validation, audience, issuer, and expiry on *inbound* tokens. It does not, however, facilitate the acquisition or generation of a new token for API Management to authenticate itself to a *backend* service.

• ✗

  Create a named value with the token and reference it in policy

  Why it's wrong here

  Creating a named value to store an authentication token and referencing it in a policy is an unsuitable solution for dynamic OAuth tokens. Named values are static configuration elements, ideal for storing unchanging strings, secrets, or policy expressions. OAuth access tokens are inherently short-lived and require frequent refreshing, a dynamic process that cannot be managed by a static named value, which would quickly become stale and invalid.

Go deeper

Related to this question