Your company is developing an Azure API.You need to implement authentication for the Azure API. You have the following requirements:All API calls must be secure.-Callers to the API must not send credentials to the API.Which authentication mechanism should you use?
Answer(s): C
Use the authentication-managed-identity policy to authenticate with a backend service using the managed identity of the API Management service. This policy essentially uses the managed identity to obtain an access token from Azure Active Directory for accessing the specified resource. After successfully obtaining the token, the policy will set the value of the token in the Authorization header using the Bearer scheme.
https://docs.microsoft.com/bs-cyrl-ba/azure/api-management/api-management-authentication-policies
You are a developer for a SaaS company that offers many web services.All web services for the company must meet the following requirements:-Use API Management to access the services-Use OpenID Connect for authentication-Prevent anonymous usageA recent security audit found that several web services can be called without any authentication.Which API Management policy should you implement?
Answer(s): D
Add the validate-jwt policy to validate the OAuth token for every incoming request.Incorrect Answers:A: The jsonp policy adds JSON with padding (JSONP) support to an operation or an API to allow cross-domain calls from JavaScript browser-based clients.JSONP is a method used in JavaScript programs to request data from a server in a different domain. JSONP bypasses the limitation enforced by most web browsers where access to web pages must be in the same domain.JSONP - Adds JSON with padding (JSONP) support to an operation or an API to allow cross-domain calls from JavaScript browser-based clients.
https://docs.microsoft.com/en-us/azure/api-management/api-management-howto-protect-backend-with-aad
DRAG DROP (Drag and Drop is not supported) Contoso, Ltd. provides an API to customers by using Azure API Management (APIM). The API authorizes users with a JWT token.You must implement response caching for the APIM gateway. The caching mechanism must detect the user ID of the client that accesses data for a given location and cache the response for that user ID.You need to add the following policies to the policies file:-a set-variable policy to store the detected user identity-a cache-lookup-value policy-a cache-store-value policy-a find-and-replace policy to update the response body with the user profile informationTo which policy section should you add the policies? To answer, drag the appropriate sections to the correct policies. Each section may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.NOTE: Each correct selection is worth one point.Select and Place:
Answer(s): A
Box 1: Inbound.A set-variable policy to store the detected user identity.Example:<policies><inbound><!-- How you determine user identity is application dependent --><set-variablename="enduserid"value="@(context.Request.Headers.GetValueOrDefault("Authorization","").Split(' ')[1].AsJwt()?.Subject)" />Box 2: Inbound A cache-lookup-value policy Example:<inbound><base /><cache-lookup vary-by-developer="true | false" vary-by-developer-groups="true | false" downstream-caching-type="none | private | public" must- revalidate="true | false"><vary-by-query-parameter>parameter name</vary-by-query-parameter> <!-- optional, can repeated several times --></cache-lookup></inbound>Box 3: Outbound A cache-store-value policy.Example:<outbound><base /><cache-store duration="3600" /></outbound>Box 4: Outbound A find-and-replace policy to update the response body with the user profile information.Example:<outbound><!-- Update response body with user profile--><find-and-replacefrom='"$userprofile$"'to="@((string)context.Variables["userprofile"])" /><base /></outbound>
https://docs.microsoft.com/en-us/azure/api-management/api-management-caching-policies https://docs.microsoft.com/en-us/azure/api-management/api-management-sample-cache-by-key
DRAG DROP (Drag and Drop is not supported) You are developing an Azure solution.You need to develop code to access a secret stored in Azure Key Vault.How should you complete the code segment? To answer, drag the appropriate code segments to the correct location. Each code segment may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.NOTE: Each correct selection is worth one point.Select and Place:
Box 1: SecretClient Box 2: DefaultAzureCredential In below example, the name of your key vault is expanded to the key vault URI, in the format "https://<your-key-vault-name>.vault.azure.net". This example is using 'DefaultAzureCredential()' class from Azure Identity Library, which allows to use the same code across different environments with different options to provide identity. string keyVaultName = Environment.GetEnvironmentVariable("KEY_VAULT_NAME"); var kvUri = "https://" + keyVaultName + ".vault.azure.net"; var client = new SecretClient(new Uri(kvUri), new DefaultAzureCredential());
https://docs.microsoft.com/en-us/azure/key-vault/secrets/quick-create-net
You are developing an Azure App Service REST API.The API must be called by an Azure App Service web app. The API must retrieve and update user profile information stored in Azure Active Directory (Azure AD).You need to configure the API to make the updates.Which two tools should you use? Each correct answer presents part of the solution.NOTE: Each correct selection is worth one point.
Answer(s): A,B
A: You can use the Azure AD REST APIs in Microsoft Graph to create unique workflows between Azure AD resources and third-party services.Enterprise developers use Microsoft Graph to integrate Azure AD identity management and other services to automate administrative workflows, such as employee onboarding (and termination), profile maintenance, license deployment, and more.C: API Management (APIM) is a way to create consistent and modern API gateways for existing back-end services.API Management helps organizations publish APIs to external, partner, and internal developers to unlock the potential of their data and services.
https://docs.microsoft.com/en-us/graph/azuread-identity-access-management-concept-overview
Post your Comments and Discuss Microsoft AZ-204 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AZ-204 content, but please register or login to continue.