AZ-500 Question 142
Single answerYour company hosts an internal API behind Azure API Management. Due to strict compliance requirements, only calls from a specific internal IP address range are allowed, and every incoming request must present a valid client certificate. Which configuration approach should you recommend in Azure API Management to enforce these rules?
- A
Configure inbound policies in Azure API Management that validate the client certificate and restrict incoming traffic to the approved IP range
- B
Enable subscription key authentication only and rely on Azure Active Directory to restrict outbound traffic to the API
- C
Deploy a custom hostname with a self-signed certificate and rely on OAuth 2.0 authentication for validating client credentials
- D
Use outbound policies in Azure API Management to validate IP addresses and enforce client certificate checks on the backend service
Show answer and explanation
Correct answer: A
Explanation
To meet compliance and security requirements, Azure API Management allows you to configure inbound policies that restrict caller IP ranges and enforce client certificate authentication (mTLS). By doing so, you can ensure that every request originates from a trusted IP address range and presents a valid client certificate before being forwarded to the backend. For more details, refer to Microsoft’s Azure API Management documentation on inbound policies and client certificate validation.
- A. Correct.
Option 1 is correct. Azure API Management supports inbound policies for client certificate validation and IP filtering. By configuring a mutual TLS (mTLS) policy, you can ensure that each incoming call presents a valid client certificate, and an IP restriction policy can be set to only allow calls from designated IP ranges.
- B. Incorrect.
Option 2 is incorrect. While subscription keys offer a layer of protection, they do not provide client-certificate-level security or IP-based access restriction on their own. Azure Active Directory can manage identities, but it does not directly restrict the source IP addresses in Azure API Management.
- C. Incorrect.
Option 3 is incorrect. Using a custom hostname and a self-signed certificate for TLS encryption only secures the communication channel. It does not verify the client’s certificate, nor does it prohibit calls from unapproved IPs. OAuth 2.0 handles token-based authentication but does not inherently enforce IP restrictions or client certificate checks.
- D. Incorrect.
Option 4 is incorrect. Enforcing IP restrictions and SSL client certificate checks on the backend (outbound policies) applies to traffic leaving Azure API Management and going to the backend. This does not address controlling which clients can call the API Management endpoint itself.