AZ-500 Question 144
Select 2You are a security engineer at an e-commerce company that hosts multiple APIs in Azure API Management, serving both internal microservices and external partners. Some internal APIs handle sensitive customer data and must enforce strong authentication, while partner APIs need a frictionless experience that does not require subscription keys. You want to meet both security and usability requirements with minimal administrative overhead. Which two security configurations should you recommend?
- A
Implement a validate-jwt policy on the internal microservice APIs to enforce Azure AD token checks
- B
Place the partner APIs in a separate product that does not require a subscription key
- C
Keep both internal and partner APIs in a single product with mandatory subscription keys for consistent access
- D
Enable mutual TLS with self-signed certificates for all partner API calls
- E
Configure anonymous (no authentication) access for all APIs to simplify external consumption
Show answer and explanation
Correct answers: A, B
Explanation
In Azure API Management, balancing security and usability often involves combining various configurations. For internal APIs handling sensitive data, enforcing token validation (e.g., with validate-jwt) ensures robust authentication. External partners may need a streamlined path that omits subscription key requirements, placing such APIs in a separate product without subscription enforcement meets that need. References: Microsoft Learn documentation on 'Access restriction policies' (validate-jwt) and 'Products, subscriptions, and groups' for managing API access in Azure API Management.
- A. Correct.
Correct. Using a validate-jwt policy allows you to enforce Azure AD token validation and strongly secure internal APIs that handle sensitive data. This approach ensures only authenticated clients can access these endpoints.
- B. Correct.
Correct. By placing partner APIs in a product that does not require subscription keys, you reduce friction for external partners while maintaining separate security controls from your internal APIs.
- C. Incorrect.
Incorrect. Using a single product with mandatory subscription keys for both internal and external APIs hinders external partner onboarding and does not differentiate security requirements between internal and external consumers.
- D. Incorrect.
Incorrect. While mutual TLS can be used for highly sensitive scenarios, it introduces additional overhead. The scenario specifically requires minimal administrative friction for partner APIs, so mutual TLS may not be the best fit here.
- E. Incorrect.
Incorrect. Allowing anonymous access for all APIs would undermine security, especially for internal APIs that handle sensitive data, and does not align with best practices for protecting customer information.