Crucial Exams

Microsoft Azure Developer Associate AZ-204 Practice Question

You manage an Azure API Management instance that exposes several internal REST APIs. A new security requirement states that only requests carrying an Azure AD-issued access token that contains the audience api://orders and the scope Orders.Read may invoke the Orders API. All other requests must be rejected automatically. What is the most appropriate way to enforce this requirement in Azure API Management?

  • Apply a rate-limit-by-key policy that uses the Authorization header as the key to block unauthenticated requests.

  • Add a validate-jwt policy in the API's inbound section and specify the issuer, audience api://orders, and required scope Orders.Read.

  • Enable Require client certificate on the API and upload the certificate chain that Azure AD uses for signing tokens.

  • Disable the Subscription required setting for the API and assign the API to a product that is visible only to authenticated users.

Microsoft Azure Developer Associate AZ-204
Connect to and consume Azure services and third-party services
Your Score:
Settings & Objectives
Random Mixed
Questions are selected randomly from all chosen topics, with a preference for those you haven’t seen before. You may see several questions from the same objective or domain in a row.
Rotate by Objective
Questions cycle through each objective or domain in turn, helping you avoid long streaks of questions from the same area. You may see some repeat questions, but the distribution will be more balanced across topics.

Check or uncheck an objective to set which questions you will receive.

Wipe Score
Bash, the Crucial Exams Chat Bot
AI Bot