Exam AZ-203 topic 4 question 7 discussion

Actual exam question from Microsoft's AZ-203

Question #: 7
Topic #: 4

You provide an Azure API Management managed web service to clients. The back-end web service implements HTTP Strict Transport Security (HSTS).
Every request to the backend service must include a valid HTTP authorization header.
You need to configure the Azure API Management instance with an authentication policy.
Which two policies can you use? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.

A. OAuth Client Credential Grant
B. Basic Authentication
C. Certificate Authentication
D. Digest Authentication

Show Suggested Answer

Suggested Answer: AC 🗳️

by stefanat at Feb. 5, 2020, 6:12 p.m.

Comments

Submit Cancel

stefanat

Highly Voted 5 years, 4 months ago

Should be BC https://docs.microsoft.com/en-us/azure/api-management/api-management-authentication-policies

upvoted 47 times

lau13

5 years ago

For those who are asking is it AC or BC The requirement is asking for the backend service to include a valid HTTP authorization header, B is the minimum that we can do to achieve the goal; you can do A, but it is overkill and it will require more steps to achieve, not the best option for this requirement.

upvoted 2 times

...

Juanlu

4 years, 6 months ago

Agree. As @lq said, option A is not a policy Microsoft offers

upvoted 1 times

...

shuakwe

Highly Voted 5 years ago

It should be AB. Certification authentication does not use the Authorization header so it doesn't match the requirements. Example of implementing OAuth Client Credential Grant in API Management: https://platform.deloitte.com.au/articles/oauth2-client-credentials-flow-on-azure-api-management

upvoted 13 times

dailak

4 years, 8 months ago

I think AB is correct because Basic and OAuth are using Authorization Header

upvoted 2 times

...

altafpatel1984

3 years, 6 months ago

I agree

upvoted 1 times

...

hems4all

Most Recent 4 years ago

Authentication policies Authenticate with Basic - Authenticate with a backend service using Basic authentication. Authenticate with client certificate - Authenticate with a backend service using client certificates. Authenticate with managed identity - Authenticate with the managed identity for the API Management service. https://docs.microsoft.com/en-us/azure/api-management/api-management-authentication-policies

upvoted 1 times

...

SidSadhu

4 years, 9 months ago

B, C Reference: https://docs.microsoft.com/en-us/azure/api-management/api-management-authentication-policies

upvoted 2 times

bugimachi

4 years, 5 months ago

This is true! For all who make the same mistake as I did (because it did not read carefully enough): The question is about authentication between APIM and backend (and has nothing to do with the user authentication!)

upvoted 2 times

...