HOTSPOT - You need to configure API Management for authentication. Which policy values should you use? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:
The second box should be Inbound instead of Outbound.
https://docs.microsoft.com/en-us/azure/api-management/api-management-access-restriction-policies
Quoting:
This policy can be used in the following policy sections and scopes.
Policy sections: inbound
Policy scopes: all scopes
you are correct. it should be INBOUND for Validate JWT
https://docs.microsoft.com/en-us/azure/api-management/api-management-access-restriction-policies#ValidateJWT
Box 1: Validate JWT
The validate-jwt policy enforces existence and validity of a JWT extracted from either a specified HTTP Header or a specified query parameter.
Box 2: Inbound
Authentication should be done on Incoming Request and that should be done in Inbound section of the policy of course.
This policy can be used in the following policy sections and scopes.
Policy sections: inbound
Policy scopes: all scopes
Reference:
https://docs.microsoft.com/en-us/azure/api-management/api-management-access-restriction-policies
https://docs.microsoft.com/en-us/azure/api-management/api-management-access-restriction-policies#ValidateJWT
https://docs.microsoft.com/en-us/azure/api-management/api-management-access-restriction-policies
Scenario, section 'Authentication':
5. The web application calls an API and includes the access token in the authentication header. The application ID is sent as the audience (`˜aud') claim in the access token.
6. The back-end API validates the access token.
So, shouldn't the first box be "Check HTTP header"?
Yeap, it could be done that way also... there is a small performance hit when using JWT validation. There is no need to have the validation on both places except in the case one has a "great" number of invalid JWT tokens and you want to remove the burden from the backend server.
So I think that deciding between checking the existence of the header vs validation JWT in this exams boils down to "lucky guess".
Use the Validate JWT policy to pre-authorize requests in API Management, by validating the access tokens of each incoming request. If a request does not have a valid token, API Management blocks it. Validate JWT policy is part of <inbound> policy section of the the API. It checks the audience claim in an access token, and returns an error message if the token is not valid.
https://docs.microsoft.com/en-us/azure/api-management/api-management-access-restriction-policies#ValidateJWT
A very good point, but I hope Microsoft guys do not understand the difference between Authentication and Authorization and go with the most-voted answer. Majority wins (does it?). All of these questions are substandard
It should be Inbound. Authentication should be done on Incoming Request and that should be done in Inbound section of the policy ofcourse.
upvoted 4 times
...
This section is not available anymore. Please use the main Exam Page.AZ-204 Exam Questions
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
ZiadAZ
Highly Voted 3 years, 3 months agosurprise0011
1 year, 2 months agowarchoon
1 year, 2 months agosam365
3 years, 3 months agoDani_ac7
1 year, 11 months agomlantonis
Highly Voted 3 years agoCiupaz
Most Recent 8 months agoOlivierPaudex
1 year, 10 months agoEltooth
1 year, 11 months agoSivajiTheBoss
2 years, 3 months agoleonidn
2 years, 4 months agofr369
2 years, 5 months agolugospod
2 years, 5 months agoMrXBasit
2 years, 10 months agoMrXBasit
2 years, 10 months agoanandhprakash
3 years, 1 month agopavan555manjunath
3 years, 1 month agofaizalzain
3 years, 1 month agoSnakePlissken
3 years, 1 month agokwaazaar
3 years, 2 months agogmishra88
1 year, 8 months agoSubhoG
3 years, 2 months ago