Exam AZ-204 topic 1 question 25 discussion

This is scenario questions. If backend is accepts HTTP(S) Then Basic AUTH or Certificate will work. so Client Certificate + HTTP(s) YES

yes? https://docs.microsoft.com/en-us/azure/api-management/api-management-howto-mutual-certificates

The API back end is hosted in an Azure App Service instance. It is an Azure resource and not an HTTP(s) endpoint.

The solution you’ve described does not meet the goal. While configuring client certificate gateway credentials for the HTTP(s) endpoint is a valid approach for securing the API, it doesn’t directly address the requirement to configure back-end authentication for the API Management service instance. To meet the goal, consider using Azure API Management policies to enforce authentication and authorization. Specifically, you can use policies like authentication-certificate or authentication-oauth2 to secure the API endpoints. These policies allow you to validate client certificates or use OAuth2 tokens for authentication. Remember to configure the API Management service to validate incoming requests against the back-end API’s certificate or OAuth2 token. This way, you’ll ensure that only authorized clients can access your API.

Yes, the solution meets the goal. By configuring Client cert gateway credentials for the HTTP(s) endpoint, you are implementing back-end authentication for the API Management service instance. This means that the API Management service will only allow access to the back-end hosted in the Azure App Service instance if the appropriate client certificate is presented. This provides a secure means of authenticating and authorizing requests from the API Management service to the back-end API.

OAUTH 2.0 or API Key is needed to secure public facing API as per API Management Service. This was also the answer from COPILOT so answer is B

Authentication policies Authenticate with Basic - Authenticate with a backend service using Basic authentication. Authenticate with client certificate - Authenticate with a backend service using client certificates. Authenticate with managed identity - Authenticate with a backend service using a managed identity.

The solution mentioned, which is configuring Client cert gateway credentials for the HTTP(s) endpoint, does not meet the goal of configuring back-end authentication for the API Management service instance. Client certificate authentication is used for authenticating clients accessing the API Management service, not for authenticating the back-end service itself. To configure back-end authentication for the API Management service instance hosted in an Azure App Service, you have several options, such as: API key authentication: Generate an API key and configure it in the API Management service to authenticate requests sent to the back-end service. OAuth 2.0 authentication: Configure OAuth 2.0 authentication between the API Management service and the back-end service, allowing clients to authenticate using OAuth 2.0 tokens. Certificate-based authentication: If your back-end service supports certificate-based authentication, you can configure the API Management service to authenticate requests using client certificates. Therefore, the correct answer is: B. No

https://learn.microsoft.com/en-us/azure/api-management/api-management-howto-mutual-certificates

A. Yes

I would say "YES". Secure backend services using client certificate authentication in Azure API Management: https://learn.microsoft.com/en-us/azure/api-management/api-management-howto-mutual-certificates

B. No Configuring client cert gateway credentials for the HTTP(s) endpoint would not provide a suitable solution for back-end authentication for the public facing API. Client certificate authentication is based on the possession of a certificate and private key, which can be installed on the client device. However, this approach is not suitable for public facing APIs, as it requires the client to have a unique certificate, which is not easy to manage, and it's not a scalable solution for public facing APIs.

chatGPT: This solution does not meet the goal of configuring back-end authentication for the API Management service instance. Client certificate gateway credentials are used for client-side authentication, which is not the same as back-end authentication. Back-end authentication is used to authenticate the API Management service instance with the back-end service hosted in the Azure App Service instance. For back-end authentication, you can use Azure Active Directory (AAD) authentication, Azure AD B2C, or OAuth 2.0 authentication to authenticate the API Management service instance with the back-end service.

A (Yes) is correct. https://learn.microsoft.com/en-us/azure/api-management/api-management-howto-mutual-certificates "API Management allows you to secure access to the backend service of an API using client certificates." ... "You should have your backend service configured for client certificate authentication. To configure certificate authentication in the Azure App Service, refer to this article." Then see: https://learn.microsoft.com/en-us/azure/app-service/app-service-web-configure-tls-mutual-auth?tabs=azurecli#enable-client-certificates

Client certificate is supported. Even if I select an App service while creating the API it shows the back-end authentication option as Https endpoint and not as Azure resource.

Answer is Yes, its obvious if you check it yourself Design Tab->Backend panel->HTTP(s) endpoint->And you have None, Basic and Certificate

I think the key phrase in this question is "App Service". I am voting No since the API is hosted in an app service and not APIM. https://docs.microsoft.com/en-us/azure/app-service/overview-authentication-authorization