AZ-204 Implement Azure security Practice Question
Your company uses Azure API Management to expose APIs to external partners. You need to validate that each incoming request includes a valid JSON Web Token (JWT) issued by your Microsoft Entra ID tenant, and reject requests without valid tokens. What should you configure?
⚠ Common exam trap
Candidates often confuse configuring an OAuth 2.0 authorization server (which handles token issuance) with applying a policy to validate tokens on each request, leading them to pick Option A instead of the correct validate-jwt policy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a validate-jwt policy in the inbound processing policy
The validate-jwt policy is the correct choice because it allows API Management to inspect the JWT token in the inbound request, verify its signature against the Microsoft Entra ID tenant’s keys, and enforce claims such as issuer and audience. This policy rejects requests with missing, expired, or invalid tokens, meeting the requirement to validate each incoming request.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure an OAuth 2.0 authorization server in API Management
Why it's wrong here
Configuring an OAuth 2.0 authorization server in Azure API Management primarily registers the identity provider with APIM, enabling features like the developer portal to acquire tokens for testing purposes. This configuration defines the authorization server's metadata but does not automatically enforce token validation on every incoming API request. To actually validate JWT tokens presented by clients, a specific policy must be explicitly applied within the API's inbound processing pipeline.
- ✗
Require a subscription key for each API
Why it's wrong here
Requiring a subscription key for each API provides a layer of access control and usage metering managed directly by Azure API Management. These keys identify the caller's subscription to an API product within APIM's ecosystem, but they are distinct from JWT tokens. Subscription keys do not contain cryptographic signatures or claims about a user's identity from an external identity provider, and therefore cannot validate the authenticity, integrity, or expiration of a JWT.
- ✗
Use an IP access restriction policy
Why it's wrong here
Using an IP access restriction policy in Azure API Management filters incoming requests based solely on their source IP address, allowing or denying access from specific network ranges. While useful for network-level security, this policy operates at a different layer and has no capability to inspect, parse, or validate the contents of an HTTP header, including a JSON Web Token. Consequently, it cannot verify the authenticity, integrity, or validity of a JWT token.
- ✓
Add a validate-jwt policy in the inbound processing policy
Why this is correct
Adding a `validate-jwt` policy in the inbound processing policy is the correct and most effective method for enforcing JWT validation within Azure API Management. This policy is specifically designed to inspect the incoming request for a JWT, verify its signature against a configured public key or OpenID Connect discovery endpoint, and validate claims such as issuer, audience, and expiration. It ensures that only requests with valid, unexpired, and untampered tokens proceed to the backend API, rejecting invalid or missing tokens at the gateway.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.