Exam AZ-204 topic 1 question 24 discussion

Hmm, there is "Authenticate with Basic policy" for api-management https://docs.microsoft.com/en-us/azure/api-management/api-management-authentication-policies#Basic So maybe Yes is correct answer

Basic client credentials can be defined for HTTP endpoint, not an App Service. My previous answer is incorrect. https://docs.microsoft.com/en-us/azure/api-management/api-management-authentication-policies#Basic

B- No Why this doesn't meet the goal: - Azure API Management supports several more secure and appropriate back-end authentication mechanisms, such as: - Managed identity (preferred for Azure App Service back ends) - Client certificates - OAuth 2.0 - Basic auth is not secure unless used over HTTPS, and is not recommended for authenticating with Azure App Services unless absolutely necessary and well-protected. - It does not integrate directly with Azure Active Directory (AAD) or securely manage credentials like Managed Identity does.

Why this does not meet the goal Basic gateway credentials are primarily used for simple scenarios where the back-end service expects a username and password for authentication. For public-facing APIs, you typically need stronger and more secure authentication mechanisms, such as: OAuth 2.0 JWT (JSON Web Tokens) Managed Identity for Azure resources

they're asking for basic auth with user and password. APIM supports that, whether or not it is secure is another story... this is a yes

good answer is B

Configuring Basic gateway credentials is not recommended for securing a public-facing API because it involves sending credentials (username and password) with each request. This method can expose security vulnerabilities, as credentials are transmitted in an easily readable format. It's better to use more secure methods like API keys, OAuth tokens, or other authentication mechanisms for better protection in a public API scenario

There are two components we're interested in: a. APIM, and b. App Service (resource) The App Service doesn't support basic-auth at all; though APIM does. The tricky part is the word "resource" which is App Service.

https://learn.microsoft.com/en-us/azure/api-management/authentication-basic-policy It clearly states (in the first line), that `authentication-basic` policy can be used to authenticate with a backend service.

The correct answer is YES. Use the authentication-basic policy to authenticate with a backend service using Basic authentication. https://learn.microsoft.com/en-us/azure/api-management/authentication-basic-policy

Yes you can use Basic but it certainly would not be a recommended solution because it's not secure for a public facing API. So using MS think the answer is No.

B. No The solution does not meet the goal of configuring back-end authentication for the API Management service instance. Configuring Basic gateway credentials for the Azure resource does not provide authentication for the API Management service. Basic gateway credentials are used for authentication between the client and the API Management gateway, but it does not provide authentication for the back-end service hosted in the Azure App Service instance. To configure back-end authentication for the API Management service instance, you would typically use authentication mechanisms such as OAuth, API keys, or client certificates to authenticate and secure the communication between the API Management gateway and the back-end service.

B. No. Configuring Basic gateway credentials for the Azure resource would provide authentication for accessing the Azure resource itself, but it does not provide authentication for the API Management service instance. To configure back-end authentication for the API Management service instance, you should use one of the following authentication options: Client Certificate authentication Token-based authentication OAuth 2.0 authentication These options provide secure authentication and access control for the API Management service instance and its associated APIs.

While Basic authentication is a supported option for API Management gateway authentication, it is not recommended for public-facing APIs due to its inherent security weaknesses. Basic authentication transmits user credentials in plain text, which can be easily intercepted and compromised.

B. Would you not instead use Anon and authenticate pass through JWT token to the backend?

B. No Configuring Basic gateway credentials for the Azure resource would not provide a secure solution for back-end authentication for the public facing API. Basic authentication sends the user's credentials in plain text over the network, making it vulnerable to eavesdropping and man-in-the-middle attacks. This is not suitable for public facing APIs. A more secure solution would be to use OAuth2 or OpenID Connect protocol for back-end authentication. This allows the API Management service to securely authenticate the client against an identity provider, such as Azure Active Directory, and obtain an access token for the back-end service. In summary, configuring Basic gateway credentials for the Azure resource does not meet the goal of securing back-end authentication for the public facing API.

ChatGPT: No, the solution of configuring Basic gateway credentials for the Azure resource does not meet the goal of configuring back-end authentication for the API Management service instance. To configure back-end authentication for the API Management service instance, you need to specify the credentials that the API Management service instance should use to authenticate to the API back end. There are several options for back-end authentication, such as using an Azure Active Directory tenant, a certificate, or an API key. The Basic gateway credentials are used to authenticate the API Management service instance to the Azure resource, which is not the same as back-end authentication for the API Management service instance. To properly configure back-end authentication for the API Management service instance, you need to choose the appropriate authentication method and specify the credentials accordingly. You can find more information about configuring back-end authentication in the Azure API Management documentation.